fix(process): enforce security-sensitive PR routing #453

Merged

pdurlej merged 1 commit from codex/w6c-security-sensitive-routing into main

2026-05-24 22:20:35 +02:00

codex commented

2026-05-24 21:36:03 +02:00

Collaborator

Canary status: missing — rely on required Forgejo checks before merge

Canary Context Pack

Product story

Security-sensitive routing is only useful if agents cannot forget it silently. This PR makes the Patchwarden sanity check fail closed when obvious security/access/workflow paths are changed without class/security-sensitive.

What changed

Captures PR labels from the Forgejo pull request event payload in patchwarden-pr-sanity.yml.
Re-runs Patchwarden on labeled / unlabeled events so adding the label can clear the guard.
Adds deterministic security-sensitive-label-missing blocker for obvious security-sensitive path changes without class/security-sensitive.
Records PR labels and securitySensitiveLabelPresent in the Patchwarden JSON report.
Adds tests for missing-label blocking and labeled pass-through.

Why it changed

Issue #86 asks for mechanical enforcement so secret/auth/SSH/CI/exposure work cannot accidentally travel through the wrong review lane.

Files touched

.forgejo/workflows/patchwarden-pr-sanity.yml
control-plane/platformctl/ci/pr_sanity.py
control-plane/platformctl/tests/test_pr_sanity.py

Relevant context

AGENTS.md § Security-Sensitive Class Of Service
Issue #86
W6c reviewer/process safety

Runtime evidence

No runtime mutation. Repo-only CI/tooling change.

Known constraints

The guard is intentionally conservative. False positives cost one label/full-route; false negatives around secret/access work are more expensive.

Explicit out-of-scope

No branch-protection mutation.
No autonomous merge policy.
No Forgejo runtime/API deployment.
No numeric label IDs persisted in repo files.

Requested decision

Merge if required checks are green. This PR itself should carry class/security-sensitive because it changes workflow/reviewer trust boundaries.

Merge blockers

Patchwarden label capture does not work on Forgejo pull request events.
Unit tests or workflow lint fail.

Spec sources read

AGENTS.md § Security-Sensitive Class Of Service
.forgejo/workflows/patchwarden-pr-sanity.yml
control-plane/platformctl/ci/pr_sanity.py
control-plane/platformctl/tests/test_pr_sanity.py
Issue #86 via Forgejo API

Test plan

PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_pr_sanity.py → 13 passed
python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --markdown /tmp/w6c-workflow-lint.md --json /tmp/w6c-workflow-lint.json → passed with 0 findings
git diff --check → clean

Closes #86

Canary status: missing — rely on required Forgejo checks before merge ## Canary Context Pack ### Product story Security-sensitive routing is only useful if agents cannot forget it silently. This PR makes the Patchwarden sanity check fail closed when obvious security/access/workflow paths are changed without `class/security-sensitive`. ### What changed - Captures PR labels from the Forgejo pull request event payload in `patchwarden-pr-sanity.yml`. - Re-runs Patchwarden on `labeled` / `unlabeled` events so adding the label can clear the guard. - Adds deterministic `security-sensitive-label-missing` blocker for obvious security-sensitive path changes without `class/security-sensitive`. - Records PR labels and `securitySensitiveLabelPresent` in the Patchwarden JSON report. - Adds tests for missing-label blocking and labeled pass-through. ### Why it changed Issue #86 asks for mechanical enforcement so secret/auth/SSH/CI/exposure work cannot accidentally travel through the wrong review lane. ### Files touched - `.forgejo/workflows/patchwarden-pr-sanity.yml` - `control-plane/platformctl/ci/pr_sanity.py` - `control-plane/platformctl/tests/test_pr_sanity.py` ### Relevant context - AGENTS.md § Security-Sensitive Class Of Service - Issue #86 - W6c reviewer/process safety ### Runtime evidence No runtime mutation. Repo-only CI/tooling change. ### Known constraints The guard is intentionally conservative. False positives cost one label/full-route; false negatives around secret/access work are more expensive. ### Explicit out-of-scope - No branch-protection mutation. - No autonomous merge policy. - No Forgejo runtime/API deployment. - No numeric label IDs persisted in repo files. ### Requested decision Merge if required checks are green. This PR itself should carry `class/security-sensitive` because it changes workflow/reviewer trust boundaries. ### Merge blockers - Patchwarden label capture does not work on Forgejo pull request events. - Unit tests or workflow lint fail. ## Spec sources read - `AGENTS.md` § Security-Sensitive Class Of Service - `.forgejo/workflows/patchwarden-pr-sanity.yml` - `control-plane/platformctl/ci/pr_sanity.py` - `control-plane/platformctl/tests/test_pr_sanity.py` - Issue #86 via Forgejo API ## Test plan - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_pr_sanity.py` → 13 passed - `python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --markdown /tmp/w6c-workflow-lint.md --json /tmp/w6c-workflow-lint.json` → passed with 0 findings - `git diff --check` → clean Closes #86

codex added 1 commit

2026-05-24 21:36:03 +02:00

fix(process): enforce security-sensitive PR routing

canary-required / collect-diff (pull_request) Successful in 3s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

python-ci / Python 3.13 (pull_request) Successful in 41s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 21s