CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-16 18:05:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

v1.87.0.0 feat: add verified CSO audits and replayable repair bundles (#2852)

Browse Source 
* feat(cso): add verified audits and replayable repair bundles

* fix(cso): harden qualification and setup boundaries

* fix(cso): assemble security canaries at runtime

* fix(cso): bound release proof and maintenance work

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): require complete evaluation reports

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): replay expired snapshots from supplied source

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): synchronize DNS cancellation assertion

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore(ship): exempt repository owner from liveness proof

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): make recheck retention overlap deterministic

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: bump version and changelog (v1.85.0.0)

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass native release gates

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.86.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): resolve rechecks by finding

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.87.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass macOS and Windows release gates

Normalize BSD wc output, compare Windows paths by filesystem identity, preserve portable snapshot race coverage, and narrow POSIX-only Windows fixtures.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): harden native verification gates

* fix(cso): refine Windows native diagnostics

* test(cso): isolate Windows Git startup failure

* test(cso): stabilize Windows native diagnostics

* fix(cso): support hardened Git on Windows

* fix(cso): close final verification gaps

* test(cso): bound cold Docker fixture setup

* fix(cso): restore cross-platform free-suite gates

---------

Co-authored-by: OpenAI Codex <noreply@openai.com>
This commit is contained in:
Garry Tan
2026-09-14 15:14:58 -07:00
committed by GitHub
co-authored by OpenAI Codex
parent 9f81911136
commit 4a3c6a8a3c
160 changed files with 24697 additions and 2288 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/gen-skill-docs.test.ts
+29 -3
View File
@@ -430,9 +430,10 @@ describe('gen-skill-docs', () => {
});
test('tier 2+ skills contain ELI10 simplification rules (AskUserQuestion format)', () => {
// Root SKILL.md is tier 1 (no AskUserQuestion format). Check a tier 2+ skill instead.
// Root SKILL.md is tier 1 and CSO intentionally uses a private startup with
// no shared PREAMBLE. Check a regular tier 2+ PREAMBLE consumer instead.
// v1.7.0.0 Pros/Cons format uses "ELI10 (ALWAYS)" rather than "Simplify (ELI10".
const content = fs.readFileSync(path.join(ROOT, 'cso', 'SKILL.md'), 'utf-8');
const content = fs.readFileSync(path.join(ROOT, 'review', 'SKILL.md'), 'utf-8');
expect(content).toContain('ELI10');
expect(content).toContain('plain English');
expect(content).toContain('not function names');
@@ -3616,7 +3617,9 @@ describe('LEARNINGS_LOG resolver', () => {
});
describe('CONFIDENCE_CALIBRATION resolver', () => {
const CONFIDENCE_SKILLS = ['review', 'ship', 'plan-eng-review', 'cso'];
// CSO owns a distinct evidence rubric; the shared numerical confidence
// resolver would conflict with that contract and its private startup.
const CONFIDENCE_SKILLS = ['review', 'ship', 'plan-eng-review'];
for (const skill of CONFIDENCE_SKILLS) {
test(`${skill} generated SKILL.md contains confidence calibration`, () => {
@@ -3759,6 +3762,29 @@ describe('voice-triggers processing', () => {
expect(frontmatter).not.toContain('voice-triggers:');
});
test('generated Claude CSO skill preauthorizes only the trusted launcher', () => {
const expected = [
'Bash(~/.claude/skills/gstack/bin/gstack-cso-launcher *)',
'Bash(~/.claude/skills/gstack/bin/gstack-cso-launcher.exe *)',
];
for (const file of ['cso/SKILL.md.tmpl', 'cso/SKILL.md']) {
const content = fs.readFileSync(path.join(ROOT, file), 'utf-8');
const fmEnd = content.indexOf('\n---', 4);
const frontmatter = Bun.YAML.parse(content.slice(4, fmEnd)) as Record<string, unknown>;
expect(frontmatter['allowed-tools'], file).toEqual(expected);
}
});
test('generated CSO host variants retain challenge fallback and host-containment disclosure', () => {
const claude = fs.readFileSync(path.join(ROOT, 'cso', 'SKILL.md'), 'utf-8');
const codex = fs.readFileSync(path.join(EXTERNAL_OUT, '.agents', 'skills', 'gstack-cso', 'SKILL.md'), 'utf-8');
for (const content of [claude, codex]) {
expect(content).toContain('sequential challenge; independent agent unavailable');
expect(content).toContain('Containment does not sandbox the host agent or kernel.');
expect(content).toContain('Do not request broader tool access solely to obtain an independent reviewer.');
}
});
// Gen-time-only keys: interactive + benefits-from are read from the .tmpl by
// buildContext; the generated copy has no reader (the host reads name/
// description/allowed-tools/hooks; gbrain: is runtime-read and NOT stripped).