Adam Moussa
8f28fbe6a5
Resolves the GPT-4.1 cross-review FIX items on the §3.3.2 CI apply/verify guard: - Symlink-escape (Medium-High): reject any candidate diff that introduces a symlink (git mode 120000). A symlink can redirect a later in-diff write into a denied path that textual canonicalization cannot see; auto-built diffs have no legitimate symlinks, so this fails closed (exit 7). - Diff-parse robustness (Medium): decode the diff as strict UTF-8 and fail closed (exit 8) instead of errors='replace', closing homoglyph/encoding evasion. - Declared-scope canonicalization (Medium): drop parent-escaping scope globs so a malformed scope can only shrink coverage, never widen it past repo root. - Egress allowlist (Low-Med): explicit DEPLOY marker to parameterize the build-test registries per target repo before enabling. Backs the gate's correctness claim with a committed, runnable suite (tests/test_ci_gate_workflow.py) that extracts the inline guard from the YAML and exercises good + adversarial diffs (clean, hash mismatch, workflow delete, copy-into-denied, symlink, non-UTF-8, out-of-scope, unscoped, escaping scope). Corrects the README "Tests" section that claimed coverage that did not exist. Full suite: 557 passed, 1 skipped; ruff clean. |
||
|---|---|---|
| .. | ||
| sim | ||
| __init__.py | ||
| conftest.py | ||
| test_billing.py | ||
| test_builders.py | ||
| test_ci_gate.py | ||
| test_ci_gate_workflow.py | ||
| test_clarifier.py | ||
| test_claude_code_adapter.py | ||
| test_deadline_timer.py | ||
| test_github_adapter.py | ||
| test_graph.py | ||
| test_ledger.py | ||
| test_operator_cli.py | ||
| test_planner.py | ||
| test_recovery.py | ||
| test_responder.py | ||
| test_resume_worker.py | ||
| test_review_loop.py | ||
| test_run_team.py | ||
| test_schema.py | ||
| test_slack_adapter.py | ||
| test_state_store.py | ||
| test_task_model.py | ||
| test_transport_base.py | ||
| test_verifier.py | ||