adam/open-swe
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/open-swe.git synced 2026-09-30 04:33:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

docs: repoint plan-review gate to security-review cross_review.py (orchestrator archived) (#184)
Some checks are pending
CI / Lint (push) Waiting to run
Details
CI / Format check (push) Waiting to run
Details
CI / Typecheck (push) Waiting to run
Details
CI / Unit tests (push) Waiting to run
Details
CI / Playwright E2E (push) Waiting to run
Details
CI / Docker build smoke (push) Waiting to run
Details
CI / Triage ledger up to date (push) Waiting to run
Details
CI / ui bun.lock in sync (push) Waiting to run
Details

Browse source
This commit is contained in:
Adam Moussa 2026-07-14 19:28:30 -04:00 • committed by GitHub
parent a2ceb9feaf
commit 800c44f21b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
deploy/MIGRATION.md
View file

@ -394,7 +394,7 @@ Compare to the retired AWS stack: 2× EC2 (t4g.large prod + t4g.medium/large dev
## 9. Sea Haven Gates & Obligations ## 9. Sea Haven Gates & Obligations
- [ ] **`/sh-plan-review`** (GPT-4.1 `cross_reviewer`) on THIS plan **BEFORE prod cutover** (Phase C gate). ⚠️ `run.py` misroutes reviewer-framed prompts to the no-op `done` route — call `models.get_cross_reviewer()` directly (load orchestrator `.env`, `ChatOpenAI("gpt-4.1")`) per `feedback_orchestrator_usage`. - [ ] **`/sh-plan-review`** (GPT-4.1) on THIS plan **BEFORE prod cutover** (Phase C gate). Runs via `python3 ~/Documents/repositories/seahaven/security-review/cross_review.py "<task>"` (the orchestrator repo was archived 2026-07-14; the CLI has no router, so the old misroute workaround is obsolete).
- [ ] **`/sh-security-review`** on the sensitive surface: this migration touches **auth/webhook signature verification** (the custom `http.app` is now publicly reachable on `*.langgraph.app` with no platform gate in front) and **secrets handling** (secrets move from Secrets Manager to the Deployment/Vercel env). Required, not opt-in — resolve confirmed critical/high before cutover. - [ ] **`/sh-security-review`** on the sensitive surface: this migration touches **auth/webhook signature verification** (the custom `http.app` is now publicly reachable on `*.langgraph.app` with no platform gate in front) and **secrets handling** (secrets move from Secrets Manager to the Deployment/Vercel env). Required, not opt-in — resolve confirmed critical/high before cutover.
- [ ] **GPT-4.1 cross-family review** if the Bedrock-auth fix changes IAM (new Bedrock-scoped IAM user + policy = IAM change → mandatory cross-review). - [ ] **GPT-4.1 cross-family review** if the Bedrock-auth fix changes IAM (new Bedrock-scoped IAM user + policy = IAM change → mandatory cross-review).
- [ ] **Confluence** — rework "AWS Architecture Map" (**1540098**) + open-swe child page (**26116098**): replace the RDS/EC2/ALB subgraph with an external-services view (LangGraph Cloud + Vercel + retained GitHub App + LangSmith sandbox). Do it in the same conversation as the cutover, not as a follow-up. - [ ] **Confluence** — rework "AWS Architecture Map" (**1540098**) + open-swe child page (**26116098**): replace the RDS/EC2/ALB subgraph with an external-services view (LangGraph Cloud + Vercel + retained GitHub App + LangSmith sandbox). Do it in the same conversation as the cutover, not as a follow-up.