CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-16 01:45:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

v1.87.0.0 feat: add verified CSO audits and replayable repair bundles (#2852)

Browse Source 
* feat(cso): add verified audits and replayable repair bundles

* fix(cso): harden qualification and setup boundaries

* fix(cso): assemble security canaries at runtime

* fix(cso): bound release proof and maintenance work

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): require complete evaluation reports

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): replay expired snapshots from supplied source

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): synchronize DNS cancellation assertion

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore(ship): exempt repository owner from liveness proof

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): make recheck retention overlap deterministic

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: bump version and changelog (v1.85.0.0)

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass native release gates

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.86.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): resolve rechecks by finding

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.87.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass macOS and Windows release gates

Normalize BSD wc output, compare Windows paths by filesystem identity, preserve portable snapshot race coverage, and narrow POSIX-only Windows fixtures.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): harden native verification gates

* fix(cso): refine Windows native diagnostics

* test(cso): isolate Windows Git startup failure

* test(cso): stabilize Windows native diagnostics

* fix(cso): support hardened Git on Windows

* fix(cso): close final verification gaps

* test(cso): bound cold Docker fixture setup

* fix(cso): restore cross-platform free-suite gates

---------

Co-authored-by: OpenAI Codex <noreply@openai.com>
This commit is contained in:
Garry Tan
2026-09-14 15:14:58 -07:00
committed by GitHub
co-authored by OpenAI Codex
parent 9f81911136
commit 4a3c6a8a3c
160 changed files with 24697 additions and 2288 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/skill-validation.test.ts
+31 -5
View File
@@ -49,6 +49,28 @@ function readShipUnion(): string {
return readSkillUnion('ship');
}
describe('CSO host permission boundary', () => {
test('grants no raw source, mutation, search, question, or Agent tools', () => {
const content = fs.readFileSync(path.join(ROOT, 'cso', 'SKILL.md'), 'utf-8');
const fmEnd = content.indexOf('\n---', 4);
const frontmatter = Bun.YAML.parse(content.slice(4, fmEnd)) as Record<string, unknown>;
const allowed = frontmatter['allowed-tools'];
expect(allowed).toEqual([
'Bash(~/.claude/skills/gstack/bin/gstack-cso-launcher *)',
'Bash(~/.claude/skills/gstack/bin/gstack-cso-launcher.exe *)',
]);
for (const broad of ['Bash', 'Read', 'Grep', 'Glob', 'Write', 'Agent', 'WebSearch', 'AskUserQuestion']) expect(allowed).not.toContain(broad);
});
test('retains helper-only source access, sequential challenge, and honest host containment', () => {
const content = readSkillUnion('cso');
expect(content).toContain('Never use host `Read`/`Glob`/`Grep`');
expect(content).toContain('sequential challenge; independent agent unavailable');
expect(content).toContain('Do not request broader tool access solely to obtain an independent reviewer.');
expect(content).toContain('Containment does not sandbox the host agent or kernel.');
});
});
function readCodexSkillUnion(skill: string): string {
const dir = path.join(CODEX_OUT, '.agents', 'skills', `gstack-${skill}`);
const sections = path.join(dir, 'sections');
@@ -58,7 +80,6 @@ function readCodexSkillUnion(skill: string): string {
.map(file => '\n' + fs.readFileSync(path.join(sections, file), 'utf-8')).join('') : '');
}
describe('SKILL.md command validation', () => {
// P2 (v1.2.0): the top-level gstack skill is a pure ROUTER, not the browse
// skill. The browse body lives only in browse/SKILL.md now. This regression
@@ -333,7 +354,8 @@ describe('Update check preamble', () => {
'benchmark/SKILL.md',
'land-and-deploy/SKILL.md',
'setup-deploy/SKILL.md',
'cso/SKILL.md',
// CSO intentionally uses a private startup instead of the shared update,
// session, learning, checkpoint, and telemetry PREAMBLE.
];
for (const skill of skillsWithUpdateCheck) {
@@ -698,7 +720,8 @@ describe('v0.4.1 preamble features', () => {
'canary/SKILL.md',
'land-and-deploy/SKILL.md',
'setup-deploy/SKILL.md',
'cso/SKILL.md',
// CSO's private startup intentionally omits the generic AUQ/session/
// escalation PREAMBLE; its helper owns readiness and terminal state.
];
const skillsWithPreamble = [...tier1Skills, ...tier2PlusSkills];
@@ -964,7 +987,9 @@ describe('Completeness Principle in generated SKILL.md files', () => {
'design-review/SKILL.md',
'design-consultation/SKILL.md',
'document-release/SKILL.md',
'cso/SKILL.md', ];
// CSO reports complete/partial/not-assessed from its own evidence contract
// and must not inherit the shared numerical completeness rubric.
];
for (const skill of skillsWithPreamble) {
test(`${skill} contains Completeness Principle section`, () => {
@@ -975,7 +1000,8 @@ describe('Completeness Principle in generated SKILL.md files', () => {
}
test('Completeness Principle keeps compact scoring guidance in tier 2+ skills', () => {
const content = fs.readFileSync(path.join(ROOT, 'cso', 'SKILL.md'), 'utf-8');
// CSO is intentionally exempt; use a regular tier 2+ PREAMBLE consumer.
const content = fs.readFileSync(path.join(ROOT, 'review', 'SKILL.md'), 'utf-8');
expect(content).toContain('Completeness: X/10');
expect(content).toContain('10 = all edge cases');
expect(content).toContain('Note: options differ in kind, not coverage');