Files
gstack/lib
Garry Tanandcapy-ai[bot] 2bf6bd7942 feat(review): fetch rule in every reader brief, base-read readers policy (GST-1322 A) (#4007)
* feat(review): a fetch rule in every reader brief and a base-read readers policy (GST-1322 PR A)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test(review-fetch): type the empty policy fixture for the test typecheck ratchet

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test(review-fetch): register the #362 fixture as a free fixture

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix: pre-landing review fixes

Head forbid_paths are ignored (base only), directory-form forbid_paths cover files under them in the scanner and the keep filter, an explicit --base that resolves nowhere refuses, and audit-fetch gains a CLI test.

Review-Finding: p1/specialist-batched#1 reader=security
Review-Finding: p1/red-team#1 reader=red-team
Review-Finding: p1/red-team#2 reader=red-team
Review-Finding: p1/red-team#3 reader=red-team
Review-Finding: p1/specialist-batched#2 reader=testing
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix: pre-landing review fixes

forbid_paths also excludes <pattern>/** so git's diff exclusion covers nested files the way forbiddenPath does; the readersAt refusal no longer names a network command.

Review-Finding: p2/red-team#1 reader=red-team
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix: pre-landing review fixes

forbiddenPath matches a pattern against the path and its parent directories only, the set forbidSpecs makes git exclude; the probe of a made-up child also forbade siblings (lib/x forbade lib/).

Review-Finding: p2/outside-voice#1 reader=outside-voice
Review-Finding: p2/adversarial-native#1 reader=adversarial-native
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* docs(changelog): name the PR A fragment for its branch; forbid_paths and the note come from the base

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* docs: fix the readers and review-scope anchors; key versions live in lib/ship-policy-keys.ts (Step 14.5 audit)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
2026-11-04 23:46:23 +00:00
..