CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-11 07:29:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: red-team review fixes (9 findings, 2 critical)

Browse Source 
Red team reviewed what four specialists missed — cross-cutting and
self-contradiction class:

CRITICAL: the release-body banner tripwire failed OPEN on the exact leak it
guards (grep -c prints 0 AND exits 1 on no-match, so a fallback echo
double-emitted "0" twice and the -gt comparison fell into the clean branch) —
counts now default via parameter expansion, and a functional drift test
executes the rendered tripwire block against a 0->1 banner delta to prove the
ABORT branch fires. CRITICAL: evidence fingerprints were captured AFTER the
child exited, so a working-tree edit made DURING a long suite was certified as
tested content — wtree is now captured before spawn and re-checked after;
mid-run drift omits the fingerprint (grades STALE) with a warning.

Also: the review-grading rule dropped its dirty-gates (they nullified the
keystone dirty-record->commit->CURRENT property that evidence checks already
honor — wtree equality alone proves identical content); careful's HIGH
force-push tier falls back to probing origin/main|master when the origin/HEAD
symbolic ref is absent (Conductor worktrees — the tier was silently inert in
the primary deploy environment); quoted tokens (rm -rf "/", push "main") no
longer dodge the deny; freeze fails CLOSED when its own helper file is missing
(bash makes a missing source target fatal non-interactively, so an existence
pre-check guards it); spec dedupe distinguishes pipeline failure from zero
matches instead of silently skipping dedupe on gh/jq breakage; land 3.5b sets
the cross-session --expect-cmd mismatch expectation; hook analytics JSON
fields are encoder-built per this wave's own rule.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-16 08:35:56 -07:00
co-authored by Claude Fable 5
parent a171029e6b
commit 5d6804cb61
23 changed files with 212 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
document-release/sections/release-body.md
+8 -2
View File
@@ -284,8 +284,14 @@ reach the live PR/MR. If the composed section leaked it, ABORT the update:
# (A hostile body that already contained the literal banner string must not
# permanently DoS every future doc update — pre-existing occurrences pass
# through unchanged; only markup WE would be adding trips the wire.)
_ORIG_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-orig-$$.md 2>/dev/null || echo 0)
_NEW_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-$$.md 2>/dev/null || echo 0)
# grep -c already prints 0 on no-match (exit 1) — appending a fallback echo
# to it would DOUBLE-EMIT ("0" twice) and break the -gt comparison into the
# clean branch, failing open on the exact leak this guards. Default only the
# missing-file case via parameter expansion.
_ORIG_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-orig-$$.md 2>/dev/null)
_ORIG_BANNERS=${_ORIG_BANNERS:-0}
_NEW_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-$$.md 2>/dev/null)
_NEW_BANNERS=${_NEW_BANNERS:-0}
if [ "$_NEW_BANNERS" -gt "$_ORIG_BANNERS" ]; then
echo "ABORT: envelope banner leaked into the outgoing PR/MR body — recompose the Documentation section from your own outputs, not from the enveloped rendering." >&2
else
document-release/sections/release-body.md.tmpl
+8 -2
View File
@@ -282,8 +282,14 @@ reach the live PR/MR. If the composed section leaked it, ABORT the update:
# (A hostile body that already contained the literal banner string must not
# permanently DoS every future doc update — pre-existing occurrences pass
# through unchanged; only markup WE would be adding trips the wire.)
_ORIG_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-orig-$$.md 2>/dev/null || echo 0)
_NEW_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-$$.md 2>/dev/null || echo 0)
# grep -c already prints 0 on no-match (exit 1) — appending a fallback echo
# to it would DOUBLE-EMIT ("0" twice) and break the -gt comparison into the
# clean branch, failing open on the exact leak this guards. Default only the
# missing-file case via parameter expansion.
_ORIG_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-orig-$$.md 2>/dev/null)
_ORIG_BANNERS=${_ORIG_BANNERS:-0}
_NEW_BANNERS=$(grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-$$.md 2>/dev/null)
_NEW_BANNERS=${_NEW_BANNERS:-0}
if [ "$_NEW_BANNERS" -gt "$_ORIG_BANNERS" ]; then
echo "ABORT: envelope banner leaked into the outgoing PR/MR body — recompose the Documentation section from your own outputs, not from the enveloped rendering." >&2
else