pdurlej/platform

Fork 0

docs(strategy): platform security & maturity roadmap v1 (audit-grounded) #674

Merged

pdurlej merged 2 commits from claude/maturity-roadmap-wip into main

2026-06-02 12:02:53 +02:00

claude commented

2026-06-01 17:19:15 +02:00

Collaborator

WIP — do not merge yet.

Security/maturity roadmap from the 2026-06-01 audit + claude's tooling brief + a GPT-5.5 Pro adversarial red-team. The lens for the upcoming Phase-0 audit, which grounds it with evidence and produces the first round of fixes.

Ties: #667 #669 #668 #646 #673 #76.

**WIP — do not merge yet.** Security/maturity roadmap from the 2026-06-01 audit + claude's tooling brief + a GPT-5.5 Pro adversarial red-team. The lens for the upcoming Phase-0 audit, which grounds it with evidence and produces the first round of fixes. Ties: #667 #669 #668 #646 #673 #76.

claude added 1 commit

2026-06-01 17:19:15 +02:00

docs(strategy): platform security & maturity roadmap (WIP, Oracle-red-teamed)

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 3s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 1m47s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 2m43s

Details

67502e4c3f

claude referenced this pull request

2026-06-01 17:22:48 +02:00

ops(ci-security): harden forgejo-runner — Docker socket + Infisical token + persistent = host-compromise surface #675

codex commented

2026-06-01 17:23:59 +02:00

Collaborator

Patchwarden PR sanity

Status: advisory_findings
PR: 674
Commit: eb7cea7a3c896b9d039b7600b0b46ed892e81132
Security-sensitive label: missing
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: NOT_OK
blocker PR explicitly marked WIP — do not merge yet
- Evidence: PR description states: 'WIP — do not merge yet.' Merging contradicts author intent and process guard.
- Next: Honor the WIP flag. Do not merge until author removes the 'do not merge yet' designation and confirms readiness.
medium Future-dated timestamps may cause timeline confusion
- Evidence: Document references '2026-06-01' and '2026-06-02' dates (lines 4, 5, 8, 14, 23). If current year is 2024/2025, these future dates could mislead readers about when audit occurred or create filing inconsistencies.
- Next: Verify date intent. If typo, correct to actual audit date. If intentional future-dating, add a brief explanatory note so readers understand the convention.
medium Reference to non-existent technology undermines document credibility
- Evidence: Line 8 references 'GPT-5.5 Pro adversarial red-team'. As of current knowledge, GPT-5.5 does not exist. This could be placeholder text, a typo, or speculative fiction that made it into the final document.
- Next: Clarify or correct the model reference. If placeholder, replace with actual tool used. If intentional, add context explaining the reference.

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: NOT_OK
medium PR explicitly marked as WIP and not ready for merge
- Evidence: PR description states 'WIP — do not merge yet.'
- Next: Do not merge until the author removes the WIP label and confirms the document is final.
high Document contains sensitive security findings that could aid an attacker if the repository is public
- Evidence: The roadmap details a host-compromise surface (Docker socket mount, Infisical token bind-mount) and enumerates high-capability MCP servers (email, browser, WordPress write).
- Next: Verify the repository visibility; if public, redact or abstract the specific vulnerability details before merging.

`redteam` / `kimi-k2.6:cloud`

Status: error
Verdict: -
Note: Ollama response had no message.content.
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `674` - Commit: `eb7cea7a3c896b9d039b7600b0b46ed892e81132` - Security-sensitive label: `missing` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`blocker`** PR explicitly marked WIP — do not merge yet - Evidence: `PR description states: 'WIP — do not merge yet.' Merging contradicts author intent and process guard.` - Next: Honor the WIP flag. Do not merge until author removes the 'do not merge yet' designation and confirms readiness. - **`medium`** Future-dated timestamps may cause timeline confusion - Evidence: `Document references '2026-06-01' and '2026-06-02' dates (lines 4, 5, 8, 14, 23). If current year is 2024/2025, these future dates could mislead readers about when audit occurred or create filing inconsistencies.` - Next: Verify date intent. If typo, correct to actual audit date. If intentional future-dating, add a brief explanatory note so readers understand the convention. - **`medium`** Reference to non-existent technology undermines document credibility - Evidence: `Line 8 references 'GPT-5.5 Pro adversarial red-team'. As of current knowledge, GPT-5.5 does not exist. This could be placeholder text, a typo, or speculative fiction that made it into the final document.` - Next: Clarify or correct the model reference. If placeholder, replace with actual tool used. If intentional, add context explaining the reference. ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`medium`** PR explicitly marked as WIP and not ready for merge - Evidence: `PR description states 'WIP — do not merge yet.'` - Next: Do not merge until the author removes the WIP label and confirms the document is final. - **`high`** Document contains sensitive security findings that could aid an attacker if the repository is public - Evidence: `The roadmap details a host-compromise surface (Docker socket mount, Infisical token bind-mount) and enumerates high-capability MCP servers (email, browser, WordPress write).` - Next: Verify the repository visibility; if public, redact or abstract the specific vulnerability details before merging. ### `redteam` / `kimi-k2.6:cloud` - Status: `error` - Verdict: `-` - Note: Ollama response had no message.content. - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.

claude changed title from ~~WIP: docs(strategy): platform security & maturity roadmap (Oracle-red-teamed)~~ to docs(strategy): platform security & maturity roadmap v1 (audit-grounded)

2026-06-02 11:33:44 +02:00

claude commented

2026-06-02 11:33:44 +02:00

Author

Collaborator

Finalized → v1 (claude). Folded in the Phase-0 audit (pass 1) + Codex's shipped progress; removed the WIP framing.

Key updates:

Correction: backups are NOT missing — M02/DR already built restore-drills. The real gap is continuity + new-state coverage, not absence.
Standout finding: runner = host-compromise surface (docker-socket + Infisical token + persistent) → #675.
Progress: #667 ✅, #668 prepared, #669 partial, #662 ✅, #673 design → PR #686, M06 closed.
MCP surface: 10 servers, no capability tags; email-MCP is the priority.

Phase-0 audit continues (secret-scan, MCP-tagging, apply-pipeline threat-model) → each pass updates this doc + spawns fixes. Ready for review/merge as the canonical roadmap.

**Finalized → v1 (claude).** Folded in the Phase-0 audit (pass 1) + Codex's shipped progress; removed the WIP framing. Key updates: - **Correction:** backups are NOT missing — M02/DR already built restore-drills. The real gap is *continuity + new-state coverage*, not absence. - **Standout finding:** runner = host-compromise surface (docker-socket + Infisical token + persistent) → **#675**. - **Progress:** #667 ✅, #668 prepared, #669 partial, #662 ✅, #673 design → PR #686, M06 closed. - **MCP surface:** 10 servers, no capability tags; email-MCP is the priority. Phase-0 audit continues (secret-scan, MCP-tagging, apply-pipeline threat-model) → each pass updates this doc + spawns fixes. Ready for review/merge as the canonical roadmap.

claude added 1 commit

2026-06-02 11:33:44 +02:00

docs(strategy): finalize maturity roadmap v1 — fold Phase-0 audit findings + Codex progress

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 3s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-client-dry-run / dry-run (pull_request) Failing after 19s