CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-16 09:55:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(release): digest regen is an explicit --regen-digest opt-in, not presence-sniffed code exec

Browse Source 
Review (security) caught the cycle-1 fix executing any repo's
scripts/gen-agents-digest.ts on plain 'write' — arbitrary code exec from a
hostile clone on a routine bump, contradicting the binary's own containment
posture. The regen still runs the TARGET repo's generator (a 'trusted' copy
beside the binary would false-red the freshness gate on version drift), but
only under the flag: /ship passes it deliberately, in a repo whose code the
operator already executes (its test suite). Plain write is side-effect-free
again. Also: uniform output shape (agentsDigest: null on the JSON-manifest
branch), a REAL generator round-trip test replacing the misnamed lockstep
check, and land-and-deploy's evidence gate gets the same digest allow-path
as ship so the two grading surfaces agree.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-29 05:42:57 +00:00
co-authored by Claude Fable 5
parent b8970a2862
commit a101bf4093
9 changed files with 111 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
land-and-deploy/sections/readiness-gate.md
+1 -1
View File
@@ -97,7 +97,7 @@ and tell the user: "I found and fixed a few issues during the review. The fixes
Check the evidence ledger first:
```bash
~/.claude/skills/gstack/bin/gstack-evidence check --label tests --expect-cmd '<the project test command>' --max-age 24 --allow-paths CHANGELOG.md,VERSION,package.json
~/.claude/skills/gstack/bin/gstack-evidence check --label tests --expect-cmd '<the project test command>' --max-age 24 --allow-paths CHANGELOG.md,VERSION,package.json,agents-digest/gstack-AGENTS.md
```
(The `--expect-cmd` string must be the exact command the recorded run used —
land-and-deploy/sections/readiness-gate.md.tmpl
+1 -1
View File
@@ -95,7 +95,7 @@ and tell the user: "I found and fixed a few issues during the review. The fixes
Check the evidence ledger first:
```bash
~/.claude/skills/gstack/bin/gstack-evidence check --label tests --expect-cmd '<the project test command>' --max-age 24 --allow-paths CHANGELOG.md,VERSION,package.json
~/.claude/skills/gstack/bin/gstack-evidence check --label tests --expect-cmd '<the project test command>' --max-age 24 --allow-paths CHANGELOG.md,VERSION,package.json,agents-digest/gstack-AGENTS.md
```
(The `--expect-cmd` string must be the exact command the recorded run used —