CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-21 04:10:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(gstack2): port 6 judgment overlays (#1102 #1049 #592 #696 #1523 #1053)

Browse Source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude
2026-07-21 19:19:23 -07:00
parent 268e9ed10b
commit d72133e18e
30 changed files with 503 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
evals/parity/transcripts/deterministic/security-review.json
+14
View File
@@ -93,6 +93,20 @@
"reproduced_defect": "Record only signal-bearing learnings",
"regression_fixture": "evals/parity/regressions/pr-2030.json",
"explanation": "### Signal-gated learning\n\nPersist a learning only when the interaction contains a useful, reusable signal such as an explicit preference, correction, accepted recommendation, or rejected direction. Track helpful and harmful outcomes separately. Do not manufacture a learning merely because a workflow completed."
},
{
"classification": "INTENTIONAL_IMPROVEMENT",
"issue_or_pr": "https://github.com/garrytan/gstack/pull/1523",
"reproduced_defect": "Detect the shai-hulud campaign in comprehensive mode only",
"regression_fixture": "evals/parity/regressions/pr-1523.json",
"explanation": "### Known-campaign IOC tier\n\nAdd Tier 3 rules that detect the mini-shai-hulud supply-chain campaign: `/proc/*/mem` reads from Claude Code settings hooks, auto-run persistence bridges (folderOpen tasks or settings hooks invoking payloads), packed droppers that decrypt or decompress an embedded blob at load, and the getsession.org C2 IOCs. Every rule matches a deterministic primary-source indicator, surfaces only under comprehensive mode, and carries a TENTATIVE marking. Daily mode's zero-noise contract stays unchanged: none of these rules add findings there."
},
{
"classification": "INTENTIONAL_IMPROVEMENT",
"issue_or_pr": "https://github.com/garrytan/gstack/pull/1053",
"reproduced_defect": "Keep the audit report-only unless --fix is passed",
"regression_fixture": "evals/parity/regressions/pr-1053.json",
"explanation": "### Opt-in auto-fix boundary\n\nThe default audit is strictly report-only and mutates nothing. Auto-fixes apply only under an explicit `--fix` flag, and only for provably safe patterns where the correct change is deterministic and the breakage risk is near-zero (additive gitignore hardening, TLS-verification flips, non-breaking dependency patches). No business logic and no guessing. Without `--fix`, produce findings and remediation plans and change no files."
}
]
}