docs(specs): bug prebuild for #86 security-sensitive label routing enforcement #364

Merged

pdurlej merged 1 commit from claude/fork-C2-security-sensitive-label-enforcement into main

2026-05-23 09:19:19 +02:00

claude commented

2026-05-18 08:17:06 +02:00

Collaborator

Summary

Bug-shape prebuild (per Codex 2026-05-17 feedback) for #86 — REVIEW.md / AGENTS.md document auto-trigger Full tier for apply.py, safety.py, identity/, transport/, baseline/, secrets-check.py patterns, but enforcement is convention-only. A cousin can forget to apply class/security-sensitive label → PR lands via Lite/Trivial canary → security-sensitive content ships without canary 3+3.

Fork-anchor 2026-05-18 retry: built in dedicated worktree /Users/pd/Developer/iskra-platform-2026-04-30-fork-C2 per PR #356 § 1.1. Zero shared-checkout collision.

Deliverables

6 files, 686 LOC total:

File	Lines
`docs/specs/security-sensitive-label-enforcement-prebuild/README.md`	67
`docs/specs/security-sensitive-label-enforcement-prebuild/01-reproduction.md`	63
`docs/specs/security-sensitive-label-enforcement-prebuild/02-hypothesis-ranking.md`	110
`docs/specs/security-sensitive-label-enforcement-prebuild/03-minimal-fix-surface.md`	196
`docs/specs/security-sensitive-label-enforcement-prebuild/04-acceptance.md`	63
`prompts/codex-security-sensitive-label-enforcement.md`	187

Recommended architecture (§ 02 Candidate A)

policies/security-sensitive-paths.yaml (new, ~40 LOC) — single source of truth, mirror of REVIEW.md § Auto-trigger Full
.forgejo/workflows/security-sensitive-label-guard.yml (new, ~90 LOC) — Forgejo Action on pull_request: [opened, synchronize, labeled, unlabeled, reopened]. Reads patterns YAML, diffs PR, fails if pattern match AND class/security-sensitive label absent.
Label matching by NAME (string), not numeric Forgejo ID — per issue #86 acceptance criterion
Conservative: false positives acceptable, false negatives unacceptable
Composes with #243 branch-protection prebuild (required status check)

Rejected alternatives (§ 02)

Candidate B (platformctl rule) — bypassable via Forgejo UI, doesn't compose with branch protection
Candidate C (required check without backing workflow) — convention-only with extra ceremony
Candidate D (auto-labeling) — hides decision from cousin, erodes policy internalization

Slice boundaries (§ 03)

Slice (a) — Ship guard. Lite tier, ~140 LOC, single PR
Slice (b) — Make required. Operator action; can bundle with #243
Slice (c) — Self-tests. Deferred to v0.1
Slice (d) — Doc-drift check. Deferred to v0.1

10-row acceptance matrix (§ 04)

Includes all permutations: matching path + label present (pass), matching path + label absent (fail), docs-only diff (skip), sacred-paths.yaml comment edit (fail without label), identity/ new file (fail), baseline/ typo fix (fail), label add re-runs check (pass), label remove re-runs check (fail), empty diff (skip cleanly).

Plus 6 non-functional checks (runtime ≤30s, no numeric label IDs, runner contract compliance, YAML schema valid, regression-free, edge cases for symlinks/renames/large diffs/concurrent PRs).

Per ADR-0018

Closing the convention-vs-enforcement gap is exactly the agentic-first discipline this platform agreed to. Companion execution prompt § Hard gates explicitly forbids "warning-only" outcome (would re-create the same bug).

Tier

Trivial per ADR-0007 — prebuild + execution prompt files only. No runtime mutation, no schema change, no sacred-path edit. Slice (a) implementation will be Lite.

Refs #86 #243 #356

## Summary Bug-shape prebuild (per Codex 2026-05-17 feedback) for #86 — `REVIEW.md` / `AGENTS.md` document auto-trigger Full tier for `apply.py`, `safety.py`, `identity/`, `transport/`, `baseline/`, `secrets-check.py` patterns, but enforcement is convention-only. A cousin can forget to apply `class/security-sensitive` label → PR lands via Lite/Trivial canary → security-sensitive content ships without canary 3+3. Fork-anchor 2026-05-18 retry: built in dedicated worktree `/Users/pd/Developer/iskra-platform-2026-04-30-fork-C2` per PR #356 § 1.1. Zero shared-checkout collision. ## Deliverables 6 files, 686 LOC total: | File | Lines | |---|---| | `docs/specs/security-sensitive-label-enforcement-prebuild/README.md` | 67 | | `docs/specs/security-sensitive-label-enforcement-prebuild/01-reproduction.md` | 63 | | `docs/specs/security-sensitive-label-enforcement-prebuild/02-hypothesis-ranking.md` | 110 | | `docs/specs/security-sensitive-label-enforcement-prebuild/03-minimal-fix-surface.md` | 196 | | `docs/specs/security-sensitive-label-enforcement-prebuild/04-acceptance.md` | 63 | | `prompts/codex-security-sensitive-label-enforcement.md` | 187 | ## Recommended architecture (§ 02 Candidate A) - `policies/security-sensitive-paths.yaml` (new, ~40 LOC) — single source of truth, mirror of `REVIEW.md` § Auto-trigger Full - `.forgejo/workflows/security-sensitive-label-guard.yml` (new, ~90 LOC) — Forgejo Action on `pull_request: [opened, synchronize, labeled, unlabeled, reopened]`. Reads patterns YAML, diffs PR, fails if pattern match AND `class/security-sensitive` label absent. - Label matching by NAME (string), not numeric Forgejo ID — per issue #86 acceptance criterion - Conservative: false positives acceptable, false negatives unacceptable - Composes with #243 branch-protection prebuild (required status check) ## Rejected alternatives (§ 02) - **Candidate B** (platformctl rule) — bypassable via Forgejo UI, doesn't compose with branch protection - **Candidate C** (required check without backing workflow) — convention-only with extra ceremony - **Candidate D** (auto-labeling) — hides decision from cousin, erodes policy internalization ## Slice boundaries (§ 03) - **Slice (a)** — Ship guard. Lite tier, ~140 LOC, single PR - **Slice (b)** — Make required. Operator action; can bundle with #243 - **Slice (c)** — Self-tests. Deferred to v0.1 - **Slice (d)** — Doc-drift check. Deferred to v0.1 ## 10-row acceptance matrix (§ 04) Includes all permutations: matching path + label present (pass), matching path + label absent (fail), docs-only diff (skip), sacred-paths.yaml comment edit (fail without label), identity/ new file (fail), baseline/ typo fix (fail), label add re-runs check (pass), label remove re-runs check (fail), empty diff (skip cleanly). Plus 6 non-functional checks (runtime ≤30s, no numeric label IDs, runner contract compliance, YAML schema valid, regression-free, edge cases for symlinks/renames/large diffs/concurrent PRs). ## Per ADR-0018 Closing the convention-vs-enforcement gap is exactly the agentic-first discipline this platform agreed to. Companion execution prompt § Hard gates explicitly forbids "warning-only" outcome (would re-create the same bug). ## Tier **Trivial** per ADR-0007 — prebuild + execution prompt files only. No runtime mutation, no schema change, no sacred-path edit. Slice (a) implementation will be Lite. Refs #86 #243 #356

claude added 1 commit

2026-05-18 08:17:06 +02:00

docs(specs): bug prebuild for #86 security-sensitive label routing enforcement

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

canary-required / canary (pull_request) Successful in 13s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 21s

Details

2ad394ab14

Bug-shape prebuild (per Codex 2026-05-17 feedback): reproduction +
hypothesis ranking + minimal fix surface + acceptance matrix +
companion codex execution prompt with Safety/production boundary
section.

Issue #86: REVIEW.md/AGENTS.md document auto-trigger Full tier for
paths like apply.py, safety.py, identity/, transport/, baseline/,
but enforcement is convention-only. Cousin can forget to apply
class/security-sensitive label and PR can land via Lite/Trivial
canary, bypassing canary 3+3 on security-sensitive content.

Recommended architecture (§ 02 Candidate A):
- New policies/security-sensitive-paths.yaml (single source of truth,
  mirror of REVIEW.md § Auto-trigger Full)
- New .forgejo/workflows/security-sensitive-label-guard.yml
  (Forgejo Action on pull_request events; reads patterns YAML;
   diffs PR; fails if pattern match AND class/security-sensitive
   label absent; passes if no match or label present)
- Match labels by NAME, not numeric Forgejo ID (per issue #86 ac)
- Conservative: false positives acceptable, false negatives not
- Composes with #243 branch-protection prebuild (required status check)

Rejected alternatives (§ 02):
- Candidate B (platformctl rule) — bypassable, doesn't compose with
  Forgejo branch protection
- Candidate C (required check without backing workflow) — convention-
  only with extra ceremony
- Candidate D (auto-labeling) — hides decision from cousin, erodes
  policy internalization

10-row acceptance matrix in § 04: PR-touching-apply.py-with-label
passes; same without label fails (red status check + comment);
docs-only PR skips cleanly; label add/remove re-triggers check;
all six non-functional checks (runtime, no numeric IDs, runner
contract compliance, YAML schema validation) verified.

Slice boundaries (§ 03):
(a) Ship guard — Lite tier, ~140 LOC, single PR
(b) Make required — operator action, bundle with #243
(c) Self-tests — deferred to v0.1
(d) Doc-drift check — deferred to v0.1

Per ADR-0018: this closes the convention-vs-enforcement gap
documented as the meta-rule. No "warning-only" outcome accepted
(execution prompt § Hard gates explicitly forbids).

Tier: Trivial per ADR-0007 (prompt + spec files, no runtime
mutation, no schema change, no sacred-path edit).

Fork-anchor 2026-05-18 retry — built in dedicated worktree
/Users/pd/Developer/iskra-platform-2026-04-30-fork-C2 per PR #356
template § 1.1 (zero shared-checkout collision).

Refs #86 #243 #356; REVIEW.md § Auto-trigger Full