|
|
da304aa9d7
|
docs(agent-team): fold GPT-4.1 plan-review findings into the P3-live-flip plan
REQUEST CHANGES from the cross-family plan-review (2026-06-22), dispositioned:
- expanded denylist (§4.2): submodules/.gitmodules, git hooks, .gitattributes filters,
lockfile postinstall, generated artifacts
- runner-trust assertion (privileged jobs GitHub-hosted only)
- concrete diff-transport spec + threat model (signed artifact / branch-only token, nonce anti-replay)
- gate-weakening detection (noqa/skip/excludes/--no-verify)
- PR-metadata secret sanitization; ledger diff-hash anti-tamper
- Phase 1b: recovery for an accidentally-merged/applied privileged change + draft-PR rate
monitoring + stale-PR cleanup
- required-check-name discovery; deploy-before-merge enforcement; no-write-token audit
Notes which BLOCK items are already implemented in PR #17's CI (Phase 1 verifies, not rebuilds).
|
2026-06-22 16:19:09 -04:00 |
|
