pdurlej/platform

Fork 0

fix(platformctl): redact apply remote commands #635

Merged

pdurlej merged 1 commit from codex/m06-redact-remote-command into main

2026-05-30 13:56:45 +02:00

codex commented

2026-05-30 13:36:28 +02:00

Collaborator

Summary

Closes #199.

Redacts the command field emitted in apply preflight/remote results. The raw compose commands are still used internally for transport.run, but emitted result/status JSON now carries a stable redacted marker instead of the shell command.

Why

The current commands are safe today, but future apply commands may include sensitive env/path material. This makes command redaction the default before result/status artifact emission.

Validation

PYTHONPATH=control-plane control-plane/.venv/bin/python -m pytest control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_apply_env_file.py → 61 passed
PYTHONPATH=control-plane control-plane/.venv/bin/python -m platformctl.cli validate all --json → passed

Notes

No runtime mutation.
No secret values printed or persisted.
This intentionally covers #199 only; #200/#206 continue the redaction train.

## Summary Closes #199. Redacts the `command` field emitted in apply preflight/remote results. The raw compose commands are still used internally for `transport.run`, but emitted result/status JSON now carries a stable redacted marker instead of the shell command. ## Why The current commands are safe today, but future apply commands may include sensitive env/path material. This makes command redaction the default before result/status artifact emission. ## Validation - `PYTHONPATH=control-plane control-plane/.venv/bin/python -m pytest control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_apply_env_file.py` → 61 passed - `PYTHONPATH=control-plane control-plane/.venv/bin/python -m platformctl.cli validate all --json` → passed ## Notes - No runtime mutation. - No secret values printed or persisted. - This intentionally covers #199 only; #200/#206 continue the redaction train.

codex added 1 commit

2026-05-30 13:36:28 +02:00

fix(platformctl): redact apply remote commands

canary-required / collect-diff (pull_request) Successful in 6s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 5s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 1m10s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 34s

Details

python-ci / Python 3.12 (pull_request) Successful in 1m11s

Details

canary-required / canary (pull_request) Successful in 18s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 31s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 1m43s

Details

python-ci / Python 3.11 (pull_request) Successful in 52s

Details

python-ci / Python 3.13 (pull_request) Successful in 49s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 6s

Details

a91224741d

codex commented

2026-05-30 13:44:45 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 635
Commit: a91224741d74b4f102145014fdc9776941742c85
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

info sensitive-path-touched Sensitive path touched — control-plane/platformctl/apply.py
- Evidence: control-plane/platformctl/apply.py
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: OK
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `635` - Commit: `a91224741d74b4f102145014fdc9776941742c85` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings - **`info` `sensitive-path-touched`** Sensitive path touched — `control-plane/platformctl/apply.py` - Evidence: `control-plane/platformctl/apply.py` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.

codex added the

class/security-sensitive

label

2026-05-30 13:48:53 +02:00

pdurlej approved these changes

2026-05-30 13:56:44 +02:00

pdurlej left a comment

Owner-authorized admin approval after green checks. Scope: #199 redacts platformctl apply remote commands; no runtime mutation and no secrets printed.