weichen
fed87ad14b
Consolidate approved policies and add local lease, document CAS, commit, candidate and environment gates. Preserve conservative recovery and cleanup limits.
532 lines
32 KiB
JSON
532 lines
32 KiB
JSON
{
|
|
"status": "complete",
|
|
"verdict": "Ready with fixes",
|
|
"verdict_reason": "Four P1 defects remain in managed integration, child lifetime and candidate-build behavior, plus a P2 completion-approval bypass. Resolve admission (#1), supervision (#2), build-source choice and nightly compatibility (#3-#4), then approval parsing (#5). No bounded requirement is wholly omitted; partial items map to these findings.",
|
|
"scope": {
|
|
"base": "a241e838150f218f3a09d3523f93291b847d45fd",
|
|
"branch": "feature/agent-governance-implementation",
|
|
"head_sha": "eb4dbdca5baae8dd5f3ddefc0f5510ac2978dcd3",
|
|
"pr_url": null,
|
|
"files_changed": 41,
|
|
"includes_working_tree_diff": true
|
|
},
|
|
"intent": "Implement approved R01-R10 governance and minimal L1 managed operations: isolated worktrees, canonical SQLite coordination, scoped leases, process identity and conservative recovery, docs CAS/receipts, exact candidate integration and safe service/build guards. Preserve history and existing product behavior; L2 OS isolation and cross-host operations are outside this unit.",
|
|
"intent_confidence": "explicit",
|
|
"reviewers": [
|
|
"correctness",
|
|
"security",
|
|
"testing",
|
|
"maintainability",
|
|
"reliability",
|
|
"adversarial",
|
|
"project-standards",
|
|
"agent-native"
|
|
],
|
|
"reviewer_selection": [
|
|
{
|
|
"reviewer": "correctness",
|
|
"tier": "session",
|
|
"reason": "always-on"
|
|
},
|
|
{
|
|
"reviewer": "security",
|
|
"tier": "session",
|
|
"reason": "Managed-operation permissions and path/capability boundaries"
|
|
},
|
|
{
|
|
"reviewer": "testing",
|
|
"tier": "mid",
|
|
"reason": "Real temporary Git/SQLite subprocess test harnesses changed"
|
|
},
|
|
{
|
|
"reviewer": "maintainability",
|
|
"tier": "mid",
|
|
"reason": "Substantial new coordinator abstractions and 2343 executable changed lines"
|
|
},
|
|
{
|
|
"reviewer": "reliability",
|
|
"tier": "mid",
|
|
"reason": "Lease expiry, process identity, signal handling and recovery"
|
|
},
|
|
{
|
|
"reviewer": "adversarial",
|
|
"tier": "session",
|
|
"reason": "Concurrency, persistence and silent-pass guard risks; external transport prohibited"
|
|
},
|
|
{
|
|
"reviewer": "project-standards",
|
|
"tier": "mid",
|
|
"reason": "Root AGENTS.md and CLAUDE.md govern all changed paths"
|
|
},
|
|
{
|
|
"reviewer": "agent-native",
|
|
"tier": "mid",
|
|
"reason": "New agent-facing governance commands and instructions"
|
|
}
|
|
],
|
|
"findings": [
|
|
{
|
|
"#": 1,
|
|
"autofix_class": "manual",
|
|
"confidence": 100,
|
|
"evidence": [
|
|
"scripts/agentctl.py:802-805 checks ancestry and SELECT sha FROM validations WHERE sha=?; integrate:874-879 additionally checks task, two parents and frozen first parent.",
|
|
"Real temporary Git reproduction with production hooks: integrate rejected the linear SHA; agentctl with --resource git:dev --cwd MAIN -- git merge --ff-only SHA succeeded and advanced dev. No hook disabling or unleased writes."
|
|
],
|
|
"file": "scripts/agentctl.py",
|
|
"first_evidence": "scripts/agentctl.py:802 -- if git(repo.main, 'merge-base', '--is-ancestor', old, new, check=False).returncode:",
|
|
"independent_reviewers": [
|
|
"adversarial",
|
|
"security"
|
|
],
|
|
"line": 802,
|
|
"owner": "downstream-resolver",
|
|
"pre_existing": false,
|
|
"requires_verification": true,
|
|
"reviewers": [
|
|
"adversarial",
|
|
"security"
|
|
],
|
|
"severity": "P1",
|
|
"suggested_fix": "Share candidate admission between integrate and hook_ref: require two parents, first parent equal to old dev, and validation bound to candidate/task. Alternatively require an integration receipt binding old dev, candidate and owning run. Test rejection through the alternate managed git merge path.",
|
|
"title": "Managed fast-forward bypasses the validated merge-candidate invariant",
|
|
"why_it_matters": "A registered git:dev operator can promote a validated linear commit through agentctl with and git merge, although integrate rejects that commit as INVALID_CANDIDATE. The reference hook checks ancestry and any SHA receipt but omits the required two-parent, frozen-baseline and task-bound checks.",
|
|
"validation_status": "confirmed",
|
|
"validation_reason": "With a registered git:dev task and a validated linear descendant, the new execute path permits main-worktree git merge (scripts/agentctl.py:509-527) while hook_ref checks only ancestry and any SHA receipt (802-807), bypassing integrate's two-parent and frozen-first-parent checks (874-879); the supplied real-Git reproduction supports reachability, which was independently verified in source rather than rerun.",
|
|
"protected_subject": "authorization-authentication"
|
|
},
|
|
{
|
|
"#": 2,
|
|
"autofix_class": "gated_auto",
|
|
"confidence": 100,
|
|
"evidence": [
|
|
"scripts/agentctl.py:848-853 and 890-894 start new-session children then wait; Lease.__exit__:468-477 finalizes failure and unlocks without child termination.",
|
|
"execute:531-558 already forwards signals, escalates, reaps and marks recovery. Interruption finding confirmed from source; incidence was not measured."
|
|
],
|
|
"file": "scripts/agentctl.py",
|
|
"first_evidence": "scripts/agentctl.py:848-853 -- child = subprocess.Popen(command, cwd=repo.current, start_new_session=True) ... code = child.wait()",
|
|
"independent_reviewers": [
|
|
"correctness",
|
|
"reliability"
|
|
],
|
|
"line": 848,
|
|
"owner": "downstream-resolver",
|
|
"pre_existing": false,
|
|
"requires_verification": true,
|
|
"reviewers": [
|
|
"correctness",
|
|
"reliability"
|
|
],
|
|
"severity": "P1",
|
|
"suggested_fix": "Reuse execute child supervision in validate and integrate: forward SIGINT/SIGTERM, escalate with bounded SIGKILL, reap the process group and retain recovery_required until safe resolution. Test interruption of both commands.",
|
|
"title": "Interrupted validation leaves its child running",
|
|
"why_it_matters": "SIGINT during validate or integrate can leave a separately sessioned child running after the lease is marked failed and unlocked. A later operation can overlap validation writes, or detached git merge can advance dev after reported failure.",
|
|
"validation_status": "confirmed",
|
|
"validation_reason": "If SIGINT interrupts validate or integrate after its new-session child starts, scripts/agentctl.py:848-853 and 890-894 have no signal forwarding or exception cleanup and Lease.__exit__:468-477 marks the non-document run failed and unlocks without terminating the child, allowing conflicting admission at 429-439; confirmation is source-based and interruption incidence was not measured.",
|
|
"protected_subject": "concurrency"
|
|
},
|
|
{
|
|
"#": 3,
|
|
"autofix_class": "manual",
|
|
"confidence": 75,
|
|
"evidence": [
|
|
"scripts/agentctl.py:692-696 checks HEAD/cleanliness without retaining a lease; candidate-images-build.sh:48-53 builds from the mutable checkout and publishes COMMIT at 84.",
|
|
"Real Git/SQLite controlled reproduction paused a fake Docker boundary: managed source edit succeeded, then build/manifest succeeded with the original SHA and dirty source. Actual image contents were not built or examined."
|
|
],
|
|
"file": "scripts/candidate-images-build.sh",
|
|
"first_evidence": "scripts/candidate-images-build.sh:30 -- python3 \"${ROOT}/scripts/agentctl.py\" guard build --commit \"${COMMIT}\"",
|
|
"independent_reviewers": [
|
|
"adversarial"
|
|
],
|
|
"line": 30,
|
|
"owner": "downstream-resolver",
|
|
"pre_existing": false,
|
|
"requires_verification": true,
|
|
"reviewers": [
|
|
"adversarial"
|
|
],
|
|
"severity": "P1",
|
|
"suggested_fix": "Choose an immutable checkout pinned to COMMIT, or retain source/index leases that conflict with every managed writer through both builds and manifest publication. Recheck provenance before publishing and add a synchronized concurrent-writer regression.",
|
|
"title": "Concurrent managed edits invalidate successful candidate image provenance",
|
|
"why_it_matters": "After the one-shot build guard exits, managed writers can change the checkout while Docker reads it. A successful manifest can therefore name the original commit despite build inputs changing.",
|
|
"validation_status": "confirmed",
|
|
"validation_reason": "If a managed writer changes build-relevant source after the newly added guard returns, scripts/agentctl.py:692-696 retains no lease and candidate-images-build.sh:48-53 reads the mutable checkout before publishing the original COMMIT at 84, so the new managed-build admission does not preserve its exact-source guarantee; supplied fake-Docker boundary evidence establishes writer admission and receipt behavior, not actual image contents or production incidence.",
|
|
"protected_subject": "concurrency"
|
|
},
|
|
{
|
|
"#": 4,
|
|
"autofix_class": "gated_auto",
|
|
"confidence": 75,
|
|
"evidence": [
|
|
"run-nightly-real-pi.sh:33,115,174,193 writes evidence under the checkout before ensure_candidate_images at 198; agentctl.py:158-160 rejects untracked files.",
|
|
"git check-ignore found no ignores for the default evidence paths. Complete nightly execution was not rerun."
|
|
],
|
|
"file": "scripts/candidate-images-build.sh",
|
|
"first_evidence": "scripts/candidate-images-build.sh:30 -- python3 \"${ROOT}/scripts/agentctl.py\" guard build --commit \"${COMMIT}\"",
|
|
"independent_reviewers": [
|
|
"correctness"
|
|
],
|
|
"line": 30,
|
|
"owner": "downstream-resolver",
|
|
"pre_existing": false,
|
|
"requires_verification": true,
|
|
"reviewers": [
|
|
"correctness"
|
|
],
|
|
"severity": "P1",
|
|
"suggested_fix": "Keep nightly evidence outside the build checkout until image creation finishes, then persist it at the documented path; alternatively build from a separate clean pinned checkout. Preserve dirty-source rejection and test the default fresh-manifest flow.",
|
|
"title": "New build guard rejects nightly's own evidence files",
|
|
"why_it_matters": "With default paths and no existing image manifest, nightly creates untracked health/test evidence before calling the builder. The new clean_source guard rejects those files, turning otherwise passing tests into infra_fail before image creation.",
|
|
"validation_status": "confirmed",
|
|
"validation_reason": "With default nightly evidence paths, passing required tests and no existing image manifest, run-nightly-real-pi.sh:33,115,174,193 creates untracked evidence before invoking the builder at 198, whose new guard calls clean_source and rejects all untracked files at scripts/agentctl.py:158-160; independent git check-ignore found no matching ignores, while a complete nightly execution was not rerun.",
|
|
"protected_subject": "public-contract"
|
|
},
|
|
{
|
|
"#": 5,
|
|
"autofix_class": "gated_auto",
|
|
"confidence": 100,
|
|
"evidence": [
|
|
"scripts/agentctl.py:645 matches only '| done |'; row checks at 651-660 trim cells and require docs:approve plus evidence.",
|
|
"The exact predicates evaluated on '| core |done|' give whole_document_detects_done=False and row_detects_done=True. Receipts at 682-685 satisfy hook_check:781-787 without transition rechecking; live incidence was not measured."
|
|
],
|
|
"file": "scripts/agentctl.py",
|
|
"first_evidence": "scripts/agentctl.py:645 -- if any('| done |' in line and line not in old_done for line in replacement.splitlines()):",
|
|
"independent_reviewers": [
|
|
"security"
|
|
],
|
|
"line": 645,
|
|
"owner": "downstream-resolver",
|
|
"pre_existing": false,
|
|
"requires_verification": true,
|
|
"reviewers": [
|
|
"security"
|
|
],
|
|
"severity": "P2",
|
|
"suggested_fix": "Parse trimmed table cells with a shared helper and compare status transitions by record id. Reject newly done rows in @document regardless of spacing; retain approval/evidence transitions on the row path. Test docs:admin without docs:approve using | core |done|.",
|
|
"title": "CWE-863: Whole-document edits bypass completion approval",
|
|
"why_it_matters": "A docs:admin and docs:publish task without docs:approve can introduce a done row through @document using valid Markdown such as | core |done|. The exact-space predicate misses it, publishes a receipt and allows the commit hook to accept completion without approval or evidence.",
|
|
"validation_status": "confirmed",
|
|
"validation_reason": "For a docs:admin and docs:publish task lacking docs:approve, a whole-document replacement containing a newly completed row such as '| core |done|' passes the exact '| done |' predicate at scripts/agentctl.py:643-648, receives a receipt at 682-683 and satisfies the receipt-only hook at 781-787 despite the row-path approval requirement at 654-660; confirmation is source-based and live incidence was not measured.",
|
|
"protected_subject": "authorization-authentication"
|
|
}
|
|
],
|
|
"actionable_findings": [
|
|
{
|
|
"#": 1,
|
|
"autofix_class": "manual",
|
|
"confidence": 100,
|
|
"evidence": [
|
|
"scripts/agentctl.py:802-805 checks ancestry and SELECT sha FROM validations WHERE sha=?; integrate:874-879 additionally checks task, two parents and frozen first parent.",
|
|
"Real temporary Git reproduction with production hooks: integrate rejected the linear SHA; agentctl with --resource git:dev --cwd MAIN -- git merge --ff-only SHA succeeded and advanced dev. No hook disabling or unleased writes."
|
|
],
|
|
"file": "scripts/agentctl.py",
|
|
"first_evidence": "scripts/agentctl.py:802 -- if git(repo.main, 'merge-base', '--is-ancestor', old, new, check=False).returncode:",
|
|
"independent_reviewers": [
|
|
"adversarial",
|
|
"security"
|
|
],
|
|
"line": 802,
|
|
"owner": "downstream-resolver",
|
|
"pre_existing": false,
|
|
"requires_verification": true,
|
|
"reviewers": [
|
|
"adversarial",
|
|
"security"
|
|
],
|
|
"severity": "P1",
|
|
"suggested_fix": "Share candidate admission between integrate and hook_ref: require two parents, first parent equal to old dev, and validation bound to candidate/task. Alternatively require an integration receipt binding old dev, candidate and owning run. Test rejection through the alternate managed git merge path.",
|
|
"title": "Managed fast-forward bypasses the validated merge-candidate invariant",
|
|
"why_it_matters": "A registered git:dev operator can promote a validated linear commit through agentctl with and git merge, although integrate rejects that commit as INVALID_CANDIDATE. The reference hook checks ancestry and any SHA receipt but omits the required two-parent, frozen-baseline and task-bound checks.",
|
|
"validation_status": "confirmed",
|
|
"validation_reason": "With a registered git:dev task and a validated linear descendant, the new execute path permits main-worktree git merge (scripts/agentctl.py:509-527) while hook_ref checks only ancestry and any SHA receipt (802-807), bypassing integrate's two-parent and frozen-first-parent checks (874-879); the supplied real-Git reproduction supports reachability, which was independently verified in source rather than rerun.",
|
|
"protected_subject": "authorization-authentication"
|
|
},
|
|
{
|
|
"#": 2,
|
|
"autofix_class": "gated_auto",
|
|
"confidence": 100,
|
|
"evidence": [
|
|
"scripts/agentctl.py:848-853 and 890-894 start new-session children then wait; Lease.__exit__:468-477 finalizes failure and unlocks without child termination.",
|
|
"execute:531-558 already forwards signals, escalates, reaps and marks recovery. Interruption finding confirmed from source; incidence was not measured."
|
|
],
|
|
"file": "scripts/agentctl.py",
|
|
"first_evidence": "scripts/agentctl.py:848-853 -- child = subprocess.Popen(command, cwd=repo.current, start_new_session=True) ... code = child.wait()",
|
|
"independent_reviewers": [
|
|
"correctness",
|
|
"reliability"
|
|
],
|
|
"line": 848,
|
|
"owner": "downstream-resolver",
|
|
"pre_existing": false,
|
|
"requires_verification": true,
|
|
"reviewers": [
|
|
"correctness",
|
|
"reliability"
|
|
],
|
|
"severity": "P1",
|
|
"suggested_fix": "Reuse execute child supervision in validate and integrate: forward SIGINT/SIGTERM, escalate with bounded SIGKILL, reap the process group and retain recovery_required until safe resolution. Test interruption of both commands.",
|
|
"title": "Interrupted validation leaves its child running",
|
|
"why_it_matters": "SIGINT during validate or integrate can leave a separately sessioned child running after the lease is marked failed and unlocked. A later operation can overlap validation writes, or detached git merge can advance dev after reported failure.",
|
|
"validation_status": "confirmed",
|
|
"validation_reason": "If SIGINT interrupts validate or integrate after its new-session child starts, scripts/agentctl.py:848-853 and 890-894 have no signal forwarding or exception cleanup and Lease.__exit__:468-477 marks the non-document run failed and unlocks without terminating the child, allowing conflicting admission at 429-439; confirmation is source-based and interruption incidence was not measured.",
|
|
"protected_subject": "concurrency"
|
|
},
|
|
{
|
|
"#": 3,
|
|
"autofix_class": "manual",
|
|
"confidence": 75,
|
|
"evidence": [
|
|
"scripts/agentctl.py:692-696 checks HEAD/cleanliness without retaining a lease; candidate-images-build.sh:48-53 builds from the mutable checkout and publishes COMMIT at 84.",
|
|
"Real Git/SQLite controlled reproduction paused a fake Docker boundary: managed source edit succeeded, then build/manifest succeeded with the original SHA and dirty source. Actual image contents were not built or examined."
|
|
],
|
|
"file": "scripts/candidate-images-build.sh",
|
|
"first_evidence": "scripts/candidate-images-build.sh:30 -- python3 \"${ROOT}/scripts/agentctl.py\" guard build --commit \"${COMMIT}\"",
|
|
"independent_reviewers": [
|
|
"adversarial"
|
|
],
|
|
"line": 30,
|
|
"owner": "downstream-resolver",
|
|
"pre_existing": false,
|
|
"requires_verification": true,
|
|
"reviewers": [
|
|
"adversarial"
|
|
],
|
|
"severity": "P1",
|
|
"suggested_fix": "Choose an immutable checkout pinned to COMMIT, or retain source/index leases that conflict with every managed writer through both builds and manifest publication. Recheck provenance before publishing and add a synchronized concurrent-writer regression.",
|
|
"title": "Concurrent managed edits invalidate successful candidate image provenance",
|
|
"why_it_matters": "After the one-shot build guard exits, managed writers can change the checkout while Docker reads it. A successful manifest can therefore name the original commit despite build inputs changing.",
|
|
"validation_status": "confirmed",
|
|
"validation_reason": "If a managed writer changes build-relevant source after the newly added guard returns, scripts/agentctl.py:692-696 retains no lease and candidate-images-build.sh:48-53 reads the mutable checkout before publishing the original COMMIT at 84, so the new managed-build admission does not preserve its exact-source guarantee; supplied fake-Docker boundary evidence establishes writer admission and receipt behavior, not actual image contents or production incidence.",
|
|
"protected_subject": "concurrency"
|
|
},
|
|
{
|
|
"#": 4,
|
|
"autofix_class": "gated_auto",
|
|
"confidence": 75,
|
|
"evidence": [
|
|
"run-nightly-real-pi.sh:33,115,174,193 writes evidence under the checkout before ensure_candidate_images at 198; agentctl.py:158-160 rejects untracked files.",
|
|
"git check-ignore found no ignores for the default evidence paths. Complete nightly execution was not rerun."
|
|
],
|
|
"file": "scripts/candidate-images-build.sh",
|
|
"first_evidence": "scripts/candidate-images-build.sh:30 -- python3 \"${ROOT}/scripts/agentctl.py\" guard build --commit \"${COMMIT}\"",
|
|
"independent_reviewers": [
|
|
"correctness"
|
|
],
|
|
"line": 30,
|
|
"owner": "downstream-resolver",
|
|
"pre_existing": false,
|
|
"requires_verification": true,
|
|
"reviewers": [
|
|
"correctness"
|
|
],
|
|
"severity": "P1",
|
|
"suggested_fix": "Keep nightly evidence outside the build checkout until image creation finishes, then persist it at the documented path; alternatively build from a separate clean pinned checkout. Preserve dirty-source rejection and test the default fresh-manifest flow.",
|
|
"title": "New build guard rejects nightly's own evidence files",
|
|
"why_it_matters": "With default paths and no existing image manifest, nightly creates untracked health/test evidence before calling the builder. The new clean_source guard rejects those files, turning otherwise passing tests into infra_fail before image creation.",
|
|
"validation_status": "confirmed",
|
|
"validation_reason": "With default nightly evidence paths, passing required tests and no existing image manifest, run-nightly-real-pi.sh:33,115,174,193 creates untracked evidence before invoking the builder at 198, whose new guard calls clean_source and rejects all untracked files at scripts/agentctl.py:158-160; independent git check-ignore found no matching ignores, while a complete nightly execution was not rerun.",
|
|
"protected_subject": "public-contract"
|
|
},
|
|
{
|
|
"#": 5,
|
|
"autofix_class": "gated_auto",
|
|
"confidence": 100,
|
|
"evidence": [
|
|
"scripts/agentctl.py:645 matches only '| done |'; row checks at 651-660 trim cells and require docs:approve plus evidence.",
|
|
"The exact predicates evaluated on '| core |done|' give whole_document_detects_done=False and row_detects_done=True. Receipts at 682-685 satisfy hook_check:781-787 without transition rechecking; live incidence was not measured."
|
|
],
|
|
"file": "scripts/agentctl.py",
|
|
"first_evidence": "scripts/agentctl.py:645 -- if any('| done |' in line and line not in old_done for line in replacement.splitlines()):",
|
|
"independent_reviewers": [
|
|
"security"
|
|
],
|
|
"line": 645,
|
|
"owner": "downstream-resolver",
|
|
"pre_existing": false,
|
|
"requires_verification": true,
|
|
"reviewers": [
|
|
"security"
|
|
],
|
|
"severity": "P2",
|
|
"suggested_fix": "Parse trimmed table cells with a shared helper and compare status transitions by record id. Reject newly done rows in @document regardless of spacing; retain approval/evidence transitions on the row path. Test docs:admin without docs:approve using | core |done|.",
|
|
"title": "CWE-863: Whole-document edits bypass completion approval",
|
|
"why_it_matters": "A docs:admin and docs:publish task without docs:approve can introduce a done row through @document using valid Markdown such as | core |done|. The exact-space predicate misses it, publishes a receipt and allows the commit hook to accept completion without approval or evidence.",
|
|
"validation_status": "confirmed",
|
|
"validation_reason": "For a docs:admin and docs:publish task lacking docs:approve, a whole-document replacement containing a newly completed row such as '| core |done|' passes the exact '| done |' predicate at scripts/agentctl.py:643-648, receives a receipt at 682-683 and satisfies the receipt-only hook at 781-787 despite the row-path approval requirement at 654-660; confirmation is source-based and live incidence was not measured.",
|
|
"protected_subject": "authorization-authentication"
|
|
}
|
|
],
|
|
"triage_groups": [
|
|
{
|
|
"title": "Managed integration admission and child lifetime",
|
|
"findings": [
|
|
1,
|
|
2
|
|
],
|
|
"context": "Managed integration must enforce the same exact candidate and retain coordination while child processes can still act.",
|
|
"preferred_resolution": "Decision gate: choose shared admission or an integration receipt for #1, then reuse child supervision for #2. Verify alternate-entrypoint and interruption cases.",
|
|
"why": "The two independent defects can admit invalid or overlapping protected-ref operations; fixing either alone leaves the other reachable."
|
|
},
|
|
{
|
|
"title": "Candidate build source and nightly evidence",
|
|
"findings": [
|
|
3,
|
|
4
|
|
],
|
|
"context": "The builder reads a mutable checkout and the nightly caller creates evidence there before invoking its clean-source guard.",
|
|
"preferred_resolution": "Decision gate: choose immutable build input or retained source leases for #3, then keep nightly evidence outside that input for #4. Verify concurrency and the default fresh-manifest flow.",
|
|
"why": "A pinned clean checkout can address both concerns, but concurrency and self-generated dirty state remain separate acceptance cases."
|
|
}
|
|
],
|
|
"pre_existing_findings": [],
|
|
"requirements_completeness": {
|
|
"plan": "/home/weichen/projects/Agent-System/.worktrees/agent-governance-implementation/.doc/audit/2026-09-21-agent-policy-review.md",
|
|
"source": "explicit",
|
|
"requirements": [
|
|
{
|
|
"id": "R01",
|
|
"requirement": "Scope tests and model evidence to changes",
|
|
"status": "met",
|
|
"note": "Scoped validation contract and temporary Git/SQLite/subprocess tests are present; no shared product-runtime claim."
|
|
},
|
|
{
|
|
"id": "R02",
|
|
"requirement": "Exact real-PI selection and no-skip evidence",
|
|
"status": "partially addressed",
|
|
"note": "Exact test selection and no-skip evidence checks are present; default nightly completion is blocked by #4."
|
|
},
|
|
{
|
|
"id": "R03",
|
|
"requirement": "Task levels and single durable record for small work",
|
|
"status": "met",
|
|
"note": "Task-level and single-record conventions are present in AGENTS.md and task templates."
|
|
},
|
|
{
|
|
"id": "R04",
|
|
"requirement": "CURRENT active coordination and preserved history",
|
|
"status": "met",
|
|
"note": "CURRENT coordination changes and archived history are present."
|
|
},
|
|
{
|
|
"id": "R05",
|
|
"requirement": "Separate session, task, integration, deployment, cleanup statuses",
|
|
"status": "met",
|
|
"note": "Separate lifecycle status conventions are present in the task and close templates."
|
|
},
|
|
{
|
|
"id": "R06",
|
|
"requirement": "Atomic logical commits without fixed layer order",
|
|
"status": "met",
|
|
"note": "Atomic logical commit guidance is present; this review does not attest future caller commits."
|
|
},
|
|
{
|
|
"id": "R07",
|
|
"requirement": "Normative SSOT lifecycle and thin client entries",
|
|
"status": "met",
|
|
"note": "Policy registry, lifecycle guidance and thin client entrypoints are present."
|
|
},
|
|
{
|
|
"id": "R08",
|
|
"requirement": "Task authorization and exception boundaries",
|
|
"status": "partially addressed",
|
|
"note": "Scoped capabilities and exception boundaries are implemented, with alternate-entrypoint gaps #1 and #5."
|
|
},
|
|
{
|
|
"id": "R09",
|
|
"requirement": "Minimal L1 worktree, env, docs CAS, commit and integration gates",
|
|
"status": "partially addressed",
|
|
"note": "Minimal L1 gates are implemented, with integration, child-lifetime and build defects #1-#4."
|
|
},
|
|
{
|
|
"id": "R10",
|
|
"requirement": "Cleanup owner, retention reason, revisit trigger",
|
|
"status": "met",
|
|
"note": "Cleanup ownership, retention and revisit guidance are present; inaccessible processes fail closed."
|
|
}
|
|
],
|
|
"implementation_units": [],
|
|
"note": "Coverage describes the bounded two-document/dev L1 unit. L2, cross-host and full product-image delivery are deferred."
|
|
},
|
|
"learnings": [],
|
|
"agent_native_gaps": [],
|
|
"deployment_notes": [],
|
|
"residual_risks": [
|
|
"Interruption and completion-approval incidence were not measured; validator confirmation is source-based.",
|
|
"The controlled build probe establishes managed-writer admission and receipt behavior, not actual Docker image contents.",
|
|
"Default nightly and shared product runtime were not executed in this review."
|
|
],
|
|
"testing_gaps": [
|
|
{
|
|
"title": "Test admin capability denial",
|
|
"file": "scripts/agentctl.py",
|
|
"line": 611,
|
|
"autofix_class": "advisory",
|
|
"owner": "human",
|
|
"suggested_fix": "Add a docs:publish-only whole-document request to test_admin_document_cas_preserves_slot_and_needs_capability (or a separate test), assert CAPABILITY_REQUIRED, and compare the document bytes before and after."
|
|
},
|
|
{
|
|
"title": "Exercise failed validation outcomes",
|
|
"file": "scripts/agentctl.py",
|
|
"line": 855,
|
|
"autofix_class": "advisory",
|
|
"owner": "human",
|
|
"suggested_fix": "Extend test_validated_merge_candidate_is_exactly_promoted_to_dev (or add focused tests) with a nonzero validation command and a command that creates an untracked file; for each, assert validate fails and a subsequent integrate for that candidate is rejected with VALIDATION_REQUIRED."
|
|
}
|
|
],
|
|
"coverage": {
|
|
"notes": [
|
|
"Standalone current-tree review against explicit base; staged and unstaged intent-to-add files included.",
|
|
"Standards fall back to root AGENTS.md and CLAUDE.md; no CODING_STANDARDS.md exists.",
|
|
"No Compound Packs or matching docs/solutions corpus.",
|
|
"Tool-only change: shared product services, Go/React/database runtime and L2 OS isolation excluded; tests are temporary Git/SQLite/process scenarios.",
|
|
"Run artifacts use skill-sanctioned temporary directory; no repository artifacts written by reviewers.",
|
|
"All eight local reviewer returns collected. Testing and standards reviewers independently ran real temporary Git/SQLite/subprocess suite: 67 tests passed. Parent additionally reports 20-contender probe PASS, one writer/19 busy; raw parent evidence outside this review run.",
|
|
"Cross-model transport is outside the caller-authorized boundary; no peer launched. Adversarial lens uses in-session reviewer; no different-model corroboration claimed.",
|
|
"Two testing-only findings are report-only gaps: nonzero/dirty validation receipt denial and docs:admin denial. No defect is inferred from their absence. The line-count-only split proposal failed the concrete-consequence/applicable-standard admission check; the specific duplicate supervision bug remains primary.",
|
|
"Three positive cleanup tests mock only /proc enumeration; inaccessible-process and live-cwd negatives remain real. Production cleanup fails closed."
|
|
],
|
|
"first_evidence_backfilled": 10,
|
|
"quote_gate_demoted": 0,
|
|
"suppressed_by_confidence": {
|
|
"50": 0,
|
|
"25": 0
|
|
},
|
|
"malformed_findings": 0,
|
|
"malformed_returns": 0,
|
|
"semantic_duplicates_merged": 2,
|
|
"mode_aware_demotions": 2,
|
|
"admission_rejected": 1,
|
|
"settlement_suppressed": 0,
|
|
"validator_shortcut_skipped": 0,
|
|
"validator_shortcut_evidence_basis": "No independently verified cross-model peer; in-session persona agreement never licenses shortcut or confidence promotion.",
|
|
"failed_reviewers": [],
|
|
"bound_exceeded": [],
|
|
"compound_packs": {
|
|
"roots": [],
|
|
"errors": [],
|
|
"warnings": []
|
|
},
|
|
"independence_note": "independent_reviewers retains helper-derived persona provenance; these identities do not represent different serving models.",
|
|
"mode": "agent report-only",
|
|
"lite": false,
|
|
"cross_model_outcome": "in-process-fallback",
|
|
"cross_model_coverage": "Cross-model transport is outside the caller-authorized boundary; no peer launched. Adversarial lens uses in-session reviewer; no different-model corroboration claimed.",
|
|
"validator": {
|
|
"outcome": "verdicts",
|
|
"batches": 1,
|
|
"confirmed": 5,
|
|
"rejected": 0,
|
|
"unresolved": 0,
|
|
"malformed": 0,
|
|
"failed": 0,
|
|
"shortcut_skipped": 0,
|
|
"bound_exceeded": false,
|
|
"protected_subject_reclassifications": [],
|
|
"degraded_blockers": [],
|
|
"reason": "All five matched verdicts landed; severity, confidence and routes preserved. Reasons and evidence limits accompany each finding."
|
|
}
|
|
},
|
|
"artifact_path": "/tmp/compound-engineering-1000/ce-code-review/20260921-133611-5e4781e6",
|
|
"run_id": "20260921-133611-5e4781e6"
|
|
}
|