Comment by hk__2

9 hours ago

> The only other notable setback was an accidental use of the word "revert" which Codex took literally, and ran git revert on a file where 1-2 hours of progress had been accumulating.

Amazing that these tools don't maintain a replayable log of everything they've done.

Although git revert is not a destructive operation, so it's surprising that it caused any loss of data. Maybe they meant git reset --hard or something like that. Wild if Codec would run that.

Does Codex not let you set command permissions?

  • Yea, it does so this would likely have been to be a `--yolo` (I don't care, let me `rm -rf /`). I've found even with the "workspace write" mode and no additional writable directories I can't do git operations without approval so it seems to exclude `.git` by default.

Yet another reason to use Jujutsu. And put a `jj status` wrapper in your PS1. ;-)

  • > Yet another reason to use Jujutsu

    And what would that reason be? You can git revert a git revert.

    • You're correct for an actual git revert, but it seems pretty clear that the original authors have mangled the story and it was actually either a "git checkout" or "git reset". The "file where 1-2 hours of progress had been accumulating" phrasing only makes sense if those were uncommitted changes.

      And the reason jj helps in that case is that for jj there is no such thing as an uncommitted change.

      4 replies →

    • Probably it actually ran git checkout or reset. As you say git revert only operates on committed snapshots so it will all be in the reflog

      2 replies →

  • Start with env args like AGENT_ID for indicating which Merkle hash of which model(s) generated which code with which agent(s) and add those attributes to signed (-S) commit messages. For traceability; to find other faulty code generated by the same model and determine whether an agent or a human introduced the fault.

    Then, `git notes` is better for signature metadata because it doesn't change the commit hash to add signatures for the commit.

    And then, you'd need to run a local Rekor log to use Sigstore attestations on every commit.

    Sigstore.dev is SLSA.dev compliant.

    Sigstore grants short-lived release attestation signing keys for CI builds on a build farm to sign artifacts with.

    So, when jujutsu autocommits agent-generated code, what causes there to be an {{AGENT_ID}} in the commit message or git notes? And what stops a user from forging such attestations?

  • It's not going to happen...

    Stop spamming

    • This is funny. I tried it once and didn't see what the benefit was. Then, when I tried to reset it back to normal git, I realized that the devs had not (at the time) made any clean way to revert it back, just a one-way conversion to jj. I haven't tried it since.

      1 reply →