pdurlej/platform

Fork 0

fix(process): enforce security-sensitive label routing #86

New issue

Closed

opened 2026-05-05 09:32:07 +02:00 by codex · 1 comment

codex commented

2026-05-05 09:32:07 +02:00

Collaborator

Product story

The security-sensitive lane now exists as policy and Forgejo label routing, but agents can still forget to apply the label. Mechanical enforcement should reduce false negatives for secrets/auth/SSH/CI/exposure work.

Scope

Add a lightweight CI/check or platformctl rule that detects obvious security-sensitive path/pattern changes and verifies class/security-sensitive is present, or emits a blocking/owner-visible warning.
Keep the check conservative: false positives are acceptable; false negatives around secret/access work are not.

Acceptance criteria

A PR touching known secret/auth/SSH/CI token/exposure paths without class/security-sensitive is flagged.
Numeric Forgejo label IDs are not persisted.
Existing docs in AGENTS.md / PLATFORM_CHARTER.md remain the policy source.

Risk class

risk/process
risk/exposure

Class of service

class/security-sensitive

Refs #82

## Product story The security-sensitive lane now exists as policy and Forgejo label routing, but agents can still forget to apply the label. Mechanical enforcement should reduce false negatives for secrets/auth/SSH/CI/exposure work. ## Scope - Add a lightweight CI/check or platformctl rule that detects obvious security-sensitive path/pattern changes and verifies `class/security-sensitive` is present, or emits a blocking/owner-visible warning. - Keep the check conservative: false positives are acceptable; false negatives around secret/access work are not. ## Acceptance criteria - A PR touching known secret/auth/SSH/CI token/exposure paths without `class/security-sensitive` is flagged. - Numeric Forgejo label IDs are not persisted. - Existing docs in AGENTS.md / PLATFORM_CHARTER.md remain the policy source. ## Risk class - [x] `risk/process` - [x] `risk/exposure` ## Class of service - [x] `class/security-sensitive` Refs #82

codex referenced this issue

2026-05-05 09:32:37 +02:00

docs(process): add security-sensitive work lane #82

codex referenced this issue

2026-05-05 09:32:37 +02:00

docs(process): add security-sensitive work lane #82

claude referenced this issue

2026-05-17 17:23:10 +02:00

docs(specs): prebuild for #243 branch protection main with base-is-main guard #327

claude referenced this issue

2026-05-17 17:27:24 +02:00

docs(specs): prebuild for #243 branch protection main with base-is-main guard #330

claude referenced this issue from a commit

2026-05-17 21:28:58 +02:00

docs(specs): bug prebuild for #86 security-sensitive label routing enforcement

claude referenced this issue

2026-05-17 21:29:20 +02:00

docs(specs): secrets-pipeline-foundation-v0 prebuild (#237) #349

claude referenced this issue

2026-05-17 22:30:03 +02:00

docs(specs): ops prebuild for #49 ADR-0002 CI enforcement rollout #353

claude referenced this issue

2026-05-17 22:30:24 +02:00

docs(specs): bug-shaped prebuild for ADR-0018 mechanical enforcement guard (DeepSeek #11) #354

claude referenced this issue

2026-05-17 22:30:50 +02:00

docs(state): cross-ref agent-souls + practices in ANY-COUSIN-WAKEUP.md #355

claude referenced this issue

2026-05-17 22:43:36 +02:00

docs(specs): secrets-pipeline-foundation-v0 prebuild (#237) #335

claude referenced this issue

2026-05-17 22:43:47 +02:00

docs(specs): secrets-pipeline-foundation-v0 prebuild (#237) #349

claude referenced this issue from a commit

2026-05-17 23:02:43 +02:00

prompts(forks): v0.1 dispatch template with worktree isolation (8 retry prebuilds)

claude referenced this issue

2026-05-17 23:03:11 +02:00

prompts(forks): v0.1 dispatch template with worktree isolation (8 retry prebuilds) #356

claude referenced this issue from a commit

2026-05-18 08:16:41 +02:00

docs(specs): bug prebuild for #86 security-sensitive label routing enforcement

claude referenced this issue

2026-05-18 08:17:06 +02:00

docs(specs): bug prebuild for #86 security-sensitive label routing enforcement #364

pdurlej commented

2026-05-18 16:59:10 +02:00

Owner

Codex live audit note — 2026-05-18 16:56 CEST

Do not treat current green canary-required checks as proof that security-sensitive label routing is enforced by reviewers.

Current live state:

branch protection and base-is-main / guard are live;
patchwarden-pr-sanity exists and is running;
but canary-required.yml is still scaffold/readiness-only;
Infisical canary env is missing, so the full trusted 3+3 reviewer path does not run.

Acceptance for this issue should include both mechanical routing evidence and one live PR smoke showing a class/security-sensitive PR enters the intended full/tiered path, not just the scaffold canary path.

## Codex live audit note — 2026-05-18 16:56 CEST Do not treat current green `canary-required` checks as proof that security-sensitive label routing is enforced by reviewers. Current live state: - branch protection and `base-is-main / guard` are live; - `patchwarden-pr-sanity` exists and is running; - but `canary-required.yml` is still scaffold/readiness-only; - Infisical canary env is missing, so the full trusted 3+3 reviewer path does not run. Acceptance for this issue should include both mechanical routing evidence and one live PR smoke showing a `class/security-sensitive` PR enters the intended full/tiered path, not just the scaffold canary path.

codex added this to the 06 - Agent execution and CI governance milestone

2026-05-19 08:36:24 +02:00

pdurlej referenced this issue from a commit

2026-05-23 09:19:19 +02:00

Merge pull request 'docs(specs): bug prebuild for #86 security-sensitive label routing enforcement' (#364) from claude/fork-C2-security-sensitive-label-enforcement into main

codex referenced this issue from a pull request that will close it,

2026-05-24 21:36:03 +02:00

fix(process): enforce security-sensitive PR routing #453

pdurlej closed this issue

2026-05-24 22:20:35 +02:00