From 8f9bf13d520cd4eb5a0645a124c0cccde17a443d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 21:07:48 +0900 Subject: [PATCH 001/192] docs: record product and technical gaps --- docs/product-technical-gap-baseline.md | 147 +++++++++++++++++++++++++ 1 file changed, 147 insertions(+) create mode 100644 docs/product-technical-gap-baseline.md diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md new file mode 100644 index 00000000..663f3b80 --- /dev/null +++ b/docs/product-technical-gap-baseline.md @@ -0,0 +1,147 @@ +# AppGuardrail product and technical gap baseline + +**Snapshot:** 2026-08-20 +**Authority:** protected `develop` documentation plus live GitHub PR/issue state +**Status:** working baseline; it is not a release or certification claim + +## Decision summary + +AppGuardrail already has a useful standalone scanner, normalized findings/SARIF, +safe remediation guidance, an optional tenant control plane, external-engine +provenance, and a PR-first security-development loop. The largest buyer gap is +not another detector pattern: it is proving that one detector acquired +source-authoritative evidence, bound it to the control obligation, and produced +an independently verifiable result. + +The delivery order is therefore: + +1. ship one source-authoritative detector vertical slice; +2. make `Clean Scan` an evidence-qualified state; +3. make remediation evidence safely portable into an agent workflow; +4. harden retention, audit, release provenance, and cross-repository evidence + as the preceding contracts become production truth. + +An open or green PR is not protected-branch behavior. A claim becomes current +only after the exact unchanged head passes its required Checks, review-thread +resolution, applicable independent review, and ordinary protected merge. + +## Current product contract + +The accepted product and technical baselines define four separable planes: + +```text +scan built-in detectors + optional external engines +remediate deterministic safe transforms + reviewable fix/verification guidance +control tenant-isolated scan history, drift, API keys, and webhooks +assurance SARIF, reports, SBOM, provenance, and CI/release evidence +``` + +The contract requires executable detector evidence, realistic positive/negative/ +inconclusive tests, preserved external provenance, explicit tenant and egress +boundaries, and a `Clean Scan` result only after the selected evidence sources +complete successfully. `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, +`docs/TRACEABILITY.md`, `docs/THREAT_MODEL.md`, `docs/TEST_STRATEGY.md`, and +`docs/OPERABILITY.md` are the current source documents. A standalone +`docs/ARCHITECTURE.md` is still absent; its boundary is currently distributed +across those documents and ADRs. + +## Live PR and issue evidence + +This table records the high-signal work visible during the 2026-08-20 audit. +It intentionally does not promote a PR's proposal, review, or queued Check to +protected-branch truth. + +| Work | Live state | Product meaning | Required next proof | +| --- | --- | --- | --- | +| PR #998, Python shell AST detector, head `e2b0637` | open, `develop` target; detector coverage passed; other Checks queued at snapshot | High-value detector precision for aliases, nesting, shadowing, and malformed Python | exact-head terminal Checks, current review evidence, protected merge | +| PR #997, browser XSS evidence, head `079b335` | open, `develop` target; teardown review thread addressed; browser Check in progress at snapshot | Browser-level proof that hostile dashboard content remains inert | terminal browser/security Checks and protected merge | +| PR #996, reference-dedupe performance | draft | performance proposal, not current product behavior | remove draft status only after reproducible claim and exact coverage | +| PR #972, evidence-qualified clean scans | draft/open product line | candidate implementation for the assurance-state gap below | prove all incomplete, stale, unavailable, failed, and wrong-commit states fail closed | +| Issue #938 | open product gap | source-authoritative detector vertical slice | one real source fixture, independent oracle, persisted evidence, and black-box production path | +| Issue #927 | open product gap | buyer cannot distinguish zero findings from completed trusted coverage | evidence-qualified outcome model and accessible dashboard/report parity | +| Issue #928 | open product gap | remediation evidence cannot yet move safely through CSP-compatible agent handoff | CSP-safe listeners, exact text copy, fallback, provenance schema, and UX tests | + +The live queue contains additional open PRs and security-failure coordination +issues. The hourly loop must re-read them from GitHub before selecting work; +this snapshot is not a substitute for that query. + +## Buyer-facing gap register + +| ID | Buyer-visible gap | Current evidence | Smallest valuable slice | Exit evidence | +| --- | --- | --- | --- | --- | +| G-01 | A buyer cannot verify that AppGuardrail itself observed the authoritative source condition rather than receiving a caller assertion. | PRD-FR-002/TRD §3 require the boundary; Issue #938 states the missing vertical slice. | Implement one detector family through `atomic cause → obligation → probe/acquirer → source identity → typed assessment → independent oracle → persisted evidence → API`. | Positive, negative, malformed, unavailable, stale, duplicate, adversarial fixtures; mutation tests; production black-box test; exact source/artifact digest. | +| G-02 | `0 findings` can overstate assurance when detectors, external tools, scope, or provenance are incomplete. | PRD invariant 10 and TRD §7 state the rule; Issue #927 and PR #972 remain active. | Add `clean`, `findings_present`, `incomplete`, `failed`, and `untrusted` outcomes with scope, detector completion, freshness, commit, schema, and provenance fields. | Only fully completed/trusted fixtures render clean; dashboard, JSON, SARIF, reports, and deploy gate agree. | +| G-03 | A developer cannot transfer remediation and evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928; current dashboard is static and must retain its CSP contract. | Add listener-based copy actions and a versioned deterministic evidence bundle; keep raw suppressed secrets out of the bundle. | hostile text remains inert; success/rejection/fallback are accessible; no duplicate listeners; schema and digest are verified. | +| G-04 | Enterprise buyers need defensible retention, deletion, audit, and recovery semantics for scan evidence. | PRD §7, Issue #871, `docs/controlplane-schema-migration.md`, and current control-plane docs. | Integrate the reviewed retention/audit policy into the live control-plane store/API with tenant ownership and migration rollback. | real migration rehearsal, backup/restore evidence, tenant authorization tests, immutable audit verification, and current-head release proof. | +| G-05 | Acquisition reviewers cannot yet consume one compact, exact-head evidence package spanning source, checks, provenance, and residual gaps. | `docs/OPERABILITY.md` and assurance-plane requirements exist; open PRs remain distributed evidence. | Produce a deterministic buyer evidence bundle that separates observed, unavailable, and inferred facts and binds every claim to SHA/run/artifact identifiers. | independently recomputable digest, no raw secrets, failed/unavailable distinction, protected-head and post-publish smoke evidence. | + +## Technical and architecture gaps + +- The scanner, control plane, remediation, and assurance planes are described + separately, but the source-authoritative evidence contract is not yet proven + end to end by one production detector. +- `docs/ARCHITECTURE.md` should become the concise navigation document for the + existing PRD/TRD/UML/ERD/threat/test/operability contracts; do not duplicate + those documents until a boundary changes. +- External tools remain capability-dependent. Missing, queued, failed, and + unavailable evidence must remain typed states rather than becoming a clean + result or a built-in AppGuardrail finding. +- The current repository is Python/stdlib security tooling, not mathematical + or psychometrics software. No Rust/GPU rewrite is justified by this baseline; + introduce a native component only for a measured security, isolation, or + throughput boundary with a stable standalone/MSA contract. +- No database object is added by this baseline. Future schema work must use + descriptive two-word-or-longer `snake_case` names, normalized relations, + tenant ownership, migration rollback, and a hot-partition strategy grounded + in measured workload. +- Authorized PII-bearing work must use tenant isolation, least privilege, + encryption, immutable audit, purpose binding, retention, and field-level + authorization. Indiscriminate masking is not an acceptable substitute for + access control, and this document contains no customer identifiers. +- No Figma file is needed for this documentation-only slice. Any material UI + change for G-02 or G-03 must first record its Figma File ID in an ADR and + maintain a reusable design-token/Storybook inventory where the project uses + a component UI. The current static dashboard is not evidence that Storybook + coverage exists. + +## Governance loop + +The scheduler remains PR-first and single-flight: + +```text +read live PRs → inspect current-head review/Checks → fix valid findings +→ rerun focused/full evidence → merge only under protection +→ re-read queue → select one reviewed gap → implement → repeat +``` + +Checks waiting is not a reason to bypass the gate. During a wait, only +non-conflicting diagnostic, documentation, or test work may proceed. Never use +admin merge, force-push, review dismissal, required-check removal, fabricated +runtime evidence, or a model's output as merge/release authority. + +## Standards and acceptance basis + +This baseline maps its delivery evidence to the following current primary +sources. These references guide controls; they do not constitute CSAP, SOC 2, +or any other certification claim. + +### References (APA 7th) + +National Institute of Standards and Technology. (2022). *Secure software +development framework (SSDF) version 1.1: Recommendations for mitigating the +risk of software vulnerabilities* (NIST Special Publication 800-218). +https://doi.org/10.6028/NIST.SP.800-218 + +OWASP Foundation. (2025). *OWASP Application Security Verification Standard +(ASVS) 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/ + +SLSA. (n.d.). *SLSA specification version 1.2*. Retrieved August 20, 2026, +from https://slsa.dev/spec/v1.2/ + +## Next action + +After the current exact-head PR loop reaches a protected merge, start with +G-01/Issue #938 on `develop`. Keep G-02 and G-03 as separately reviewable +successors unless a live dependency proves stacking is safe. Do not call this +baseline complete until the gap register is re-audited against current PR, +issue, source, and protected-branch evidence. From 2c23b02292630296232de1febefd6abb5a87aaab Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 21:35:23 +0900 Subject: [PATCH 002/192] docs: refresh live PR evidence in gap baseline --- docs/product-technical-gap-baseline.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 663f3b80..fea1dc54 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -55,6 +55,10 @@ protected-branch truth. | --- | --- | --- | --- | | PR #998, Python shell AST detector, head `e2b0637` | open, `develop` target; detector coverage passed; other Checks queued at snapshot | High-value detector precision for aliases, nesting, shadowing, and malformed Python | exact-head terminal Checks, current review evidence, protected merge | | PR #997, browser XSS evidence, head `079b335` | open, `develop` target; teardown review thread addressed; browser Check in progress at snapshot | Browser-level proof that hostile dashboard content remains inert | terminal browser/security Checks and protected merge | +| PR #999, product/technical gap baseline, head `8f9bf13` | open, `develop` target; required Checks queued; review required | Buyer-facing evidence register and a bounded product-development contract | terminal Checks, current review evidence, and protected merge | +| PR #973, GitHub Actions workflow-input injection detector, head `89deac8` | open, `develop` target; required Checks queued; no live review finding observed in the current review API read | Trust-boundary detection for untrusted workflow inputs reaching commands | exact-head SAST, coverage, security, and protected-merge evidence | +| PR #971, Java mutable MultipartFile detector, head `565917c` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; old OpenCode request remains while current-head rerun is queued | Detect unsafe mutable byte-array exposure across Java syntax variants | current-head OpenCode approval, terminal Checks, and protected merge | +| PR #968, fail-open authentication-secret detector, head `4d030ff` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; current OpenCode approval absent | Prevent authentication findings from losing their declared CWE contract | current-head OpenCode approval, terminal Checks, and protected merge | | PR #996, reference-dedupe performance | draft | performance proposal, not current product behavior | remove draft status only after reproducible claim and exact coverage | | PR #972, evidence-qualified clean scans | draft/open product line | candidate implementation for the assurance-state gap below | prove all incomplete, stale, unavailable, failed, and wrong-commit states fail closed | | Issue #938 | open product gap | source-authoritative detector vertical slice | one real source fixture, independent oracle, persisted evidence, and black-box production path | From 7af3cc6ce07ca882d983e94c8b3695e3066762b6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 22:05:07 +0900 Subject: [PATCH 003/192] docs: refresh current PR evidence in gap baseline --- docs/product-technical-gap-baseline.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index fea1dc54..a7d7e8d5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -55,7 +55,10 @@ protected-branch truth. | --- | --- | --- | --- | | PR #998, Python shell AST detector, head `e2b0637` | open, `develop` target; detector coverage passed; other Checks queued at snapshot | High-value detector precision for aliases, nesting, shadowing, and malformed Python | exact-head terminal Checks, current review evidence, protected merge | | PR #997, browser XSS evidence, head `079b335` | open, `develop` target; teardown review thread addressed; browser Check in progress at snapshot | Browser-level proof that hostile dashboard content remains inert | terminal browser/security Checks and protected merge | -| PR #999, product/technical gap baseline, head `8f9bf13` | open, `develop` target; required Checks queued; review required | Buyer-facing evidence register and a bounded product-development contract | terminal Checks, current review evidence, and protected merge | +| PR #999, product/technical gap baseline, head `2c23b02` | open, `develop` target; required Checks queued; review required | Buyer-facing evidence register and a bounded product-development contract | terminal Checks, current review evidence, and protected merge | +| PR #983, Python shell-spawning detector, head `952fa20` | open, `develop` target; current tree has passed local focused/full tests; required Checks and current review queued | Distinguish implicit `os.system`/`os.popen` shells from `subprocess(..., shell=True)` and cover nested arguments | exact-head terminal Checks, current review evidence, protected merge | +| PR #969, dashboard upload proxy, head `bef1ac5` | open, `develop` target; accessibility regression fixed on current head; required Checks and current review queued | Preserve one accessible upload action while keeping native file selection behavior | terminal browser/accessibility/security Checks, current review evidence, protected merge | +| PR #963, Java tenant authorization detector, head `9cbba72` | open, `develop` target; source-backed fixture and local full tests pass; required Checks and current review queued | Detect discarded tenant authorization context at Spring admin read/mutation sinks | exact-head terminal Checks, current review evidence, protected merge | | PR #973, GitHub Actions workflow-input injection detector, head `89deac8` | open, `develop` target; required Checks queued; no live review finding observed in the current review API read | Trust-boundary detection for untrusted workflow inputs reaching commands | exact-head SAST, coverage, security, and protected-merge evidence | | PR #971, Java mutable MultipartFile detector, head `565917c` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; old OpenCode request remains while current-head rerun is queued | Detect unsafe mutable byte-array exposure across Java syntax variants | current-head OpenCode approval, terminal Checks, and protected merge | | PR #968, fail-open authentication-secret detector, head `4d030ff` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; current OpenCode approval absent | Prevent authentication findings from losing their declared CWE contract | current-head OpenCode approval, terminal Checks, and protected merge | From c13e6e02f86a2119e5f41444d6de0e73eb788e54 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 22:05:32 +0900 Subject: [PATCH 004/192] docs: avoid stale self-head in gap baseline --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a7d7e8d5..33f14b04 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -55,7 +55,7 @@ protected-branch truth. | --- | --- | --- | --- | | PR #998, Python shell AST detector, head `e2b0637` | open, `develop` target; detector coverage passed; other Checks queued at snapshot | High-value detector precision for aliases, nesting, shadowing, and malformed Python | exact-head terminal Checks, current review evidence, protected merge | | PR #997, browser XSS evidence, head `079b335` | open, `develop` target; teardown review thread addressed; browser Check in progress at snapshot | Browser-level proof that hostile dashboard content remains inert | terminal browser/security Checks and protected merge | -| PR #999, product/technical gap baseline, head `2c23b02` | open, `develop` target; required Checks queued; review required | Buyer-facing evidence register and a bounded product-development contract | terminal Checks, current review evidence, and protected merge | +| PR #999, product/technical gap baseline, this documentation head | open, `develop` target; required Checks queued; review required | Buyer-facing evidence register and a bounded product-development contract | terminal Checks, current review evidence, and protected merge | | PR #983, Python shell-spawning detector, head `952fa20` | open, `develop` target; current tree has passed local focused/full tests; required Checks and current review queued | Distinguish implicit `os.system`/`os.popen` shells from `subprocess(..., shell=True)` and cover nested arguments | exact-head terminal Checks, current review evidence, protected merge | | PR #969, dashboard upload proxy, head `bef1ac5` | open, `develop` target; accessibility regression fixed on current head; required Checks and current review queued | Preserve one accessible upload action while keeping native file selection behavior | terminal browser/accessibility/security Checks, current review evidence, protected merge | | PR #963, Java tenant authorization detector, head `9cbba72` | open, `develop` target; source-backed fixture and local full tests pass; required Checks and current review queued | Detect discarded tenant authorization context at Spring admin read/mutation sinks | exact-head terminal Checks, current review evidence, protected merge | From 086b86410bff85126d9eb1bbddfa32f086093c78 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 22:21:08 +0900 Subject: [PATCH 005/192] docs: refresh dashboard PR head in gap baseline --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 33f14b04..3b3f6bba 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -57,7 +57,7 @@ protected-branch truth. | PR #997, browser XSS evidence, head `079b335` | open, `develop` target; teardown review thread addressed; browser Check in progress at snapshot | Browser-level proof that hostile dashboard content remains inert | terminal browser/security Checks and protected merge | | PR #999, product/technical gap baseline, this documentation head | open, `develop` target; required Checks queued; review required | Buyer-facing evidence register and a bounded product-development contract | terminal Checks, current review evidence, and protected merge | | PR #983, Python shell-spawning detector, head `952fa20` | open, `develop` target; current tree has passed local focused/full tests; required Checks and current review queued | Distinguish implicit `os.system`/`os.popen` shells from `subprocess(..., shell=True)` and cover nested arguments | exact-head terminal Checks, current review evidence, protected merge | -| PR #969, dashboard upload proxy, head `bef1ac5` | open, `develop` target; accessibility regression fixed on current head; required Checks and current review queued | Preserve one accessible upload action while keeping native file selection behavior | terminal browser/accessibility/security Checks, current review evidence, protected merge | +| PR #969, dashboard upload proxy, head `de745be3` | open, `develop` target; accessibility regression fixed on current head; required Checks and current review queued | Preserve one accessible upload action while keeping native file selection behavior | terminal browser/accessibility/security Checks, current review evidence, protected merge | | PR #963, Java tenant authorization detector, head `9cbba72` | open, `develop` target; source-backed fixture and local full tests pass; required Checks and current review queued | Detect discarded tenant authorization context at Spring admin read/mutation sinks | exact-head terminal Checks, current review evidence, protected merge | | PR #973, GitHub Actions workflow-input injection detector, head `89deac8` | open, `develop` target; required Checks queued; no live review finding observed in the current review API read | Trust-boundary detection for untrusted workflow inputs reaching commands | exact-head SAST, coverage, security, and protected-merge evidence | | PR #971, Java mutable MultipartFile detector, head `565917c` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; old OpenCode request remains while current-head rerun is queued | Detect unsafe mutable byte-array exposure across Java syntax variants | current-head OpenCode approval, terminal Checks, and protected merge | From f6db14ce4f01c5b2b7ed04effb5b3af89e3fcf80 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 22:24:07 +0900 Subject: [PATCH 006/192] docs: refresh live PR evidence states --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3b3f6bba..828a58af 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -53,10 +53,10 @@ protected-branch truth. | Work | Live state | Product meaning | Required next proof | | --- | --- | --- | --- | -| PR #998, Python shell AST detector, head `e2b0637` | open, `develop` target; detector coverage passed; other Checks queued at snapshot | High-value detector precision for aliases, nesting, shadowing, and malformed Python | exact-head terminal Checks, current review evidence, protected merge | -| PR #997, browser XSS evidence, head `079b335` | open, `develop` target; teardown review thread addressed; browser Check in progress at snapshot | Browser-level proof that hostile dashboard content remains inert | terminal browser/security Checks and protected merge | +| PR #998, Python shell AST detector, head `e2b0637` | open, `develop` target; all repository and dedicated detector Checks terminal-success; current CodeRabbit threads resolved; independent approval absent | High-value detector precision for aliases, nesting, shadowing, and malformed Python | exact-head qualifying approval, protected merge | +| PR #997, browser XSS evidence, head `079b335` | open, `develop` target; repository and browser Checks terminal-success; visible review thread resolved; independent approval absent | Browser-level proof that hostile dashboard content remains inert | exact-head qualifying approval, protected merge | | PR #999, product/technical gap baseline, this documentation head | open, `develop` target; required Checks queued; review required | Buyer-facing evidence register and a bounded product-development contract | terminal Checks, current review evidence, and protected merge | -| PR #983, Python shell-spawning detector, head `952fa20` | open, `develop` target; current tree has passed local focused/full tests; required Checks and current review queued | Distinguish implicit `os.system`/`os.popen` shells from `subprocess(..., shell=True)` and cover nested arguments | exact-head terminal Checks, current review evidence, protected merge | +| PR #983, Python shell-spawning detector, head `40c4d24` | open, `develop` target; current tree has passed local focused/full tests; required Checks queued after a same-tree follow-up commit; current review evidence is predecessor-bound | Distinguish implicit `os.system`/`os.popen` shells from `subprocess(..., shell=True)` and cover nested arguments | exact-head terminal Checks, current review evidence, protected merge | | PR #969, dashboard upload proxy, head `de745be3` | open, `develop` target; accessibility regression fixed on current head; required Checks and current review queued | Preserve one accessible upload action while keeping native file selection behavior | terminal browser/accessibility/security Checks, current review evidence, protected merge | | PR #963, Java tenant authorization detector, head `9cbba72` | open, `develop` target; source-backed fixture and local full tests pass; required Checks and current review queued | Detect discarded tenant authorization context at Spring admin read/mutation sinks | exact-head terminal Checks, current review evidence, protected merge | | PR #973, GitHub Actions workflow-input injection detector, head `89deac8` | open, `develop` target; required Checks queued; no live review finding observed in the current review API read | Trust-boundary detection for untrusted workflow inputs reaching commands | exact-head SAST, coverage, security, and protected-merge evidence | From 44d30cd856e9b72d1a25c7287725cb4ef5de431e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 22:25:50 +0900 Subject: [PATCH 007/192] docs: include current high-signal PR evidence --- docs/product-technical-gap-baseline.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 828a58af..e516656f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -62,6 +62,8 @@ protected-branch truth. | PR #973, GitHub Actions workflow-input injection detector, head `89deac8` | open, `develop` target; required Checks queued; no live review finding observed in the current review API read | Trust-boundary detection for untrusted workflow inputs reaching commands | exact-head SAST, coverage, security, and protected-merge evidence | | PR #971, Java mutable MultipartFile detector, head `565917c` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; old OpenCode request remains while current-head rerun is queued | Detect unsafe mutable byte-array exposure across Java syntax variants | current-head OpenCode approval, terminal Checks, and protected merge | | PR #968, fail-open authentication-secret detector, head `4d030ff` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; current OpenCode approval absent | Prevent authentication findings from losing their declared CWE contract | current-head OpenCode approval, terminal Checks, and protected merge | +| PR #966, orphaned workflow registry detector, head `b3f10ad` | open, `develop` target; all repository Checks terminal-success; visible threads resolved; OpenCode request remains; qualifying approval absent | Detect stale workflow registrations before assurance evidence is trusted | exact-head qualifying approval and protected merge | +| PR #954, hostname-unbound loopback SSRF detector, head `f1e2ce5` | open, `develop` target; all repository Checks terminal-success; visible threads resolved; repeated OpenCode requests remain; qualifying approval absent | Prevent hostname-bound SSRF exceptions from accepting loopback targets | exact-head qualifying approval and protected merge | | PR #996, reference-dedupe performance | draft | performance proposal, not current product behavior | remove draft status only after reproducible claim and exact coverage | | PR #972, evidence-qualified clean scans | draft/open product line | candidate implementation for the assurance-state gap below | prove all incomplete, stale, unavailable, failed, and wrong-commit states fail closed | | Issue #938 | open product gap | source-authoritative detector vertical slice | one real source fixture, independent oracle, persisted evidence, and black-box production path | From 070b9712d416c530dc4ea15c741bd94f693209fe Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 22:30:53 +0900 Subject: [PATCH 008/192] docs: track latest dashboard PR head --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e516656f..12fa55a0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -57,7 +57,7 @@ protected-branch truth. | PR #997, browser XSS evidence, head `079b335` | open, `develop` target; repository and browser Checks terminal-success; visible review thread resolved; independent approval absent | Browser-level proof that hostile dashboard content remains inert | exact-head qualifying approval, protected merge | | PR #999, product/technical gap baseline, this documentation head | open, `develop` target; required Checks queued; review required | Buyer-facing evidence register and a bounded product-development contract | terminal Checks, current review evidence, and protected merge | | PR #983, Python shell-spawning detector, head `40c4d24` | open, `develop` target; current tree has passed local focused/full tests; required Checks queued after a same-tree follow-up commit; current review evidence is predecessor-bound | Distinguish implicit `os.system`/`os.popen` shells from `subprocess(..., shell=True)` and cover nested arguments | exact-head terminal Checks, current review evidence, protected merge | -| PR #969, dashboard upload proxy, head `de745be3` | open, `develop` target; accessibility regression fixed on current head; required Checks and current review queued | Preserve one accessible upload action while keeping native file selection behavior | terminal browser/accessibility/security Checks, current review evidence, protected merge | +| PR #969, dashboard upload proxy, head `9997f00` | open, `develop` target; current head restores HTML `hidden` tree exclusion after an external regression; required Checks and current review queued | Preserve one accessible upload action while keeping native file selection behavior | exact-head terminal Checks, current review evidence, protected merge | | PR #963, Java tenant authorization detector, head `9cbba72` | open, `develop` target; source-backed fixture and local full tests pass; required Checks and current review queued | Detect discarded tenant authorization context at Spring admin read/mutation sinks | exact-head terminal Checks, current review evidence, protected merge | | PR #973, GitHub Actions workflow-input injection detector, head `89deac8` | open, `develop` target; required Checks queued; no live review finding observed in the current review API read | Trust-boundary detection for untrusted workflow inputs reaching commands | exact-head SAST, coverage, security, and protected-merge evidence | | PR #971, Java mutable MultipartFile detector, head `565917c` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; old OpenCode request remains while current-head rerun is queued | Detect unsafe mutable byte-array exposure across Java syntax variants | current-head OpenCode approval, terminal Checks, and protected merge | From 73eaf4cc14f8b10420c552eb20172d67f3b4e7ef Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 22:31:28 +0900 Subject: [PATCH 009/192] docs: record assurance gap PR evidence --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 12fa55a0..0b754688 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -65,7 +65,7 @@ protected-branch truth. | PR #966, orphaned workflow registry detector, head `b3f10ad` | open, `develop` target; all repository Checks terminal-success; visible threads resolved; OpenCode request remains; qualifying approval absent | Detect stale workflow registrations before assurance evidence is trusted | exact-head qualifying approval and protected merge | | PR #954, hostname-unbound loopback SSRF detector, head `f1e2ce5` | open, `develop` target; all repository Checks terminal-success; visible threads resolved; repeated OpenCode requests remain; qualifying approval absent | Prevent hostname-bound SSRF exceptions from accepting loopback targets | exact-head qualifying approval and protected merge | | PR #996, reference-dedupe performance | draft | performance proposal, not current product behavior | remove draft status only after reproducible claim and exact coverage | -| PR #972, evidence-qualified clean scans | draft/open product line | candidate implementation for the assurance-state gap below | prove all incomplete, stale, unavailable, failed, and wrong-commit states fail closed | +| PR #972, evidence-qualified clean scans, head `4ba738a` | draft, `develop` target; repository and dedicated assurance Checks terminal-success; visible thread resolved; formal review COMMENTED; independent approval absent | Candidate implementation for the assurance-state gap below | leave Draft only after current-head review policy and qualifying approval; then integrate dashboard/report consumers | | Issue #938 | open product gap | source-authoritative detector vertical slice | one real source fixture, independent oracle, persisted evidence, and black-box production path | | Issue #927 | open product gap | buyer cannot distinguish zero findings from completed trusted coverage | evidence-qualified outcome model and accessible dashboard/report parity | | Issue #928 | open product gap | remediation evidence cannot yet move safely through CSP-compatible agent handoff | CSP-safe listeners, exact text copy, fallback, provenance schema, and UX tests | From 01ba6169cb269a38d82307c6b818fdac8b0d806b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 22:32:21 +0900 Subject: [PATCH 010/192] docs: expand buyer-critical PR evidence --- docs/product-technical-gap-baseline.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0b754688..0a7ec551 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -64,7 +64,10 @@ protected-branch truth. | PR #968, fail-open authentication-secret detector, head `4d030ff` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; current OpenCode approval absent | Prevent authentication findings from losing their declared CWE contract | current-head OpenCode approval, terminal Checks, and protected merge | | PR #966, orphaned workflow registry detector, head `b3f10ad` | open, `develop` target; all repository Checks terminal-success; visible threads resolved; OpenCode request remains; qualifying approval absent | Detect stale workflow registrations before assurance evidence is trusted | exact-head qualifying approval and protected merge | | PR #954, hostname-unbound loopback SSRF detector, head `f1e2ce5` | open, `develop` target; all repository Checks terminal-success; visible threads resolved; repeated OpenCode requests remain; qualifying approval absent | Prevent hostname-bound SSRF exceptions from accepting loopback targets | exact-head qualifying approval and protected merge | -| PR #996, reference-dedupe performance | draft | performance proposal, not current product behavior | remove draft status only after reproducible claim and exact coverage | +| PR #930, dashboard state and focus, head `2e96553` | draft, `develop` target; repository Checks terminal-success; visible threads resolved; extensive predecessor OpenCode requests remain; qualifying approval absent | Make scan state, detail focus, external-reference behavior, and read-only console exposure perceivable | current-head review reconciliation, qualifying approval, and protected merge | +| PR #996, reference-dedupe performance, head `51dd28a` | draft, `develop` target; repository Checks terminal-success; review absent; qualifying approval absent | Remove generator-frame allocation without changing reference normalization semantics | reproducible benchmark evidence, current review, and protected merge | +| PR #970, retention-audit diligence posture, head `db06f5e` | open, `develop` target; repository Checks terminal-success; visible threads resolved; OpenCode request remains; qualifying approval absent | Give buyers a non-secret, fail-closed retention and audit posture | exact-head qualifying approval and protected merge | +| PR #967, protected PyPI publication, head `5a48b74` | open, `develop` target; repository Checks terminal-success; OpenCode requests remain; qualifying approval absent | Bind release publication to protected source and installable artifact evidence | exact-head qualifying approval and protected merge | | PR #972, evidence-qualified clean scans, head `4ba738a` | draft, `develop` target; repository and dedicated assurance Checks terminal-success; visible thread resolved; formal review COMMENTED; independent approval absent | Candidate implementation for the assurance-state gap below | leave Draft only after current-head review policy and qualifying approval; then integrate dashboard/report consumers | | Issue #938 | open product gap | source-authoritative detector vertical slice | one real source fixture, independent oracle, persisted evidence, and black-box production path | | Issue #927 | open product gap | buyer cannot distinguish zero findings from completed trusted coverage | evidence-qualified outcome model and accessible dashboard/report parity | From 3c2c7a85a15905a332a733e1161936c231b6a51e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 22:36:54 +0900 Subject: [PATCH 011/192] docs: align architecture gap with repository baseline --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0a7ec551..1739992d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -92,9 +92,9 @@ this snapshot is not a substitute for that query. - The scanner, control plane, remediation, and assurance planes are described separately, but the source-authoritative evidence contract is not yet proven end to end by one production detector. -- `docs/ARCHITECTURE.md` should become the concise navigation document for the - existing PRD/TRD/UML/ERD/threat/test/operability contracts; do not duplicate - those documents until a boundary changes. +- `ARCHITECTURE.md` is the concise navigation document for the existing + PRD/TRD/UML/ERD/threat/test/operability contracts; keep it synchronized when + a boundary changes and do not duplicate those documents. - External tools remain capability-dependent. Missing, queued, failed, and unavailable evidence must remain typed states rather than becoming a clean result or a built-in AppGuardrail finding. From 8c7e1aa9d30aaa0c30d4ba459bacc1acc23d3bd4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 20 Aug 2026 23:09:43 +0900 Subject: [PATCH 012/192] docs: correct architecture baseline location --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1739992d..b827a45a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -41,9 +41,9 @@ inconclusive tests, preserved external provenance, explicit tenant and egress boundaries, and a `Clean Scan` result only after the selected evidence sources complete successfully. `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, `docs/TRACEABILITY.md`, `docs/THREAT_MODEL.md`, `docs/TEST_STRATEGY.md`, and -`docs/OPERABILITY.md` are the current source documents. A standalone -`docs/ARCHITECTURE.md` is still absent; its boundary is currently distributed -across those documents and ADRs. +`docs/OPERABILITY.md` are the current source documents. The root +`ARCHITECTURE.md` is the concise navigation document for these contracts; do +not create a duplicate `docs/ARCHITECTURE.md`. ## Live PR and issue evidence From cdcf4d11bbbbd80aa9a187626621e7abbe459602 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 02:13:30 +0900 Subject: [PATCH 013/192] docs: refresh current PR gap evidence --- docs/product-technical-gap-baseline.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b827a45a..10829a53 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -73,6 +73,22 @@ protected-branch truth. | Issue #927 | open product gap | buyer cannot distinguish zero findings from completed trusted coverage | evidence-qualified outcome model and accessible dashboard/report parity | | Issue #928 | open product gap | remediation evidence cannot yet move safely through CSP-compatible agent handoff | CSP-safe listeners, exact text copy, fallback, provenance schema, and UX tests | +### Current queue refresh (2026-08-21) + +The following exact-head refresh supplements the historical 2026-08-20 +snapshot above. It records observed queue state only; `queued`, `in progress`, +and robot `COMMENTED`/`CHANGES_REQUESTED` states are not approvals or protected +merge evidence. + +| Work | Exact-head observed state | Product meaning | Required next proof | +| --- | --- | --- | --- | +| PR #1000, source-bound workflow evidence, head `b1ec29b` | open, `develop` target; no failed Checks observed; `coverage-source-tree` queued; review required; qualifying approval absent | Bind GitHub workflow failure evidence to source, revision, artifact, freshness, and typed assessment | terminal exact-head Checks, current qualifying approval, protected merge | +| PR #1002, dashboard DOM-XSS hardening, head `9932510` | open, `develop` target; required repository/security Checks queued; no failed Check observed; review required; qualifying approval absent | Escape untrusted numeric and identifier properties before dashboard `innerHTML` rendering | terminal SAST/security/browser evidence, current qualifying approval, protected merge | +| PR #1001, console busy-state styling, head `71c4251` | open, `develop` target; required Checks queued; no failed Check observed; review required; qualifying approval absent | Keep disabled and `aria-busy` button state perceivable to visual and assistive users | terminal accessibility Checks, current qualifying approval, protected merge | +| PR #983, Python shell-spawning detector, head `3f9db72` | open, `develop` target; same-tree follow-up head; required Checks queued; predecessor-bound review state remains; qualifying approval absent | Distinguish implicit `os.system`/`os.popen` shell execution from `subprocess(..., shell=True)` | exact-head terminal Checks and current review evidence, qualifying approval, protected merge | +| PR #973, workflow-input command-injection detector, head `89deac8` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; current review decision not yet recorded | Detect caller-controlled string workflow inputs interpolated into shell run blocks | terminal SAST/coverage/security evidence, current qualifying approval, protected merge | +| PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | + The live queue contains additional open PRs and security-failure coordination issues. The hourly loop must re-read them from GitHub before selecting work; this snapshot is not a substitute for that query. From 1b5fe81326e7c46a4eb81a48eabb37cf64a1b447 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 10:04:38 +0900 Subject: [PATCH 014/192] docs: record cryptography security gap --- docs/product-technical-gap-baseline.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 10829a53..1e792079 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -88,6 +88,7 @@ merge evidence. | PR #983, Python shell-spawning detector, head `3f9db72` | open, `develop` target; same-tree follow-up head; required Checks queued; predecessor-bound review state remains; qualifying approval absent | Distinguish implicit `os.system`/`os.popen` shell execution from `subprocess(..., shell=True)` | exact-head terminal Checks and current review evidence, qualifying approval, protected merge | | PR #973, workflow-input command-injection detector, head `89deac8` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; current review decision not yet recorded | Detect caller-controlled string workflow inputs interpolated into shell run blocks | terminal SAST/coverage/security evidence, current qualifying approval, protected merge | | PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | +| PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | The live queue contains additional open PRs and security-failure coordination issues. The hourly loop must re-read them from GitHub before selecting work; From d0b97f8e1b09b427d2cf06cbcfb417ffa550e1f5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 10:06:07 +0900 Subject: [PATCH 015/192] docs: record assurance report consumer --- docs/product-technical-gap-baseline.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1e792079..36afbfe6 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-08-20 +**Snapshot:** 2026-08-21 **Authority:** protected `develop` documentation plus live GitHub PR/issue state **Status:** working baseline; it is not a release or certification claim @@ -68,7 +68,7 @@ protected-branch truth. | PR #996, reference-dedupe performance, head `51dd28a` | draft, `develop` target; repository Checks terminal-success; review absent; qualifying approval absent | Remove generator-frame allocation without changing reference normalization semantics | reproducible benchmark evidence, current review, and protected merge | | PR #970, retention-audit diligence posture, head `db06f5e` | open, `develop` target; repository Checks terminal-success; visible threads resolved; OpenCode request remains; qualifying approval absent | Give buyers a non-secret, fail-closed retention and audit posture | exact-head qualifying approval and protected merge | | PR #967, protected PyPI publication, head `5a48b74` | open, `develop` target; repository Checks terminal-success; OpenCode requests remain; qualifying approval absent | Bind release publication to protected source and installable artifact evidence | exact-head qualifying approval and protected merge | -| PR #972, evidence-qualified clean scans, head `4ba738a` | draft, `develop` target; repository and dedicated assurance Checks terminal-success; visible thread resolved; formal review COMMENTED; independent approval absent | Candidate implementation for the assurance-state gap below | leave Draft only after current-head review policy and qualifying approval; then integrate dashboard/report consumers | +| PR #972, evidence-qualified clean scans, head `4ba738a` | draft, `develop` target; repository and dedicated assurance Checks terminal-success; visible thread resolved; formal review COMMENTED; independent approval absent | Core assurance contract for the state gap below | leave Draft only after current-head review policy and qualifying approval; keep consumer follow-ups separately reviewable | | Issue #938 | open product gap | source-authoritative detector vertical slice | one real source fixture, independent oracle, persisted evidence, and black-box production path | | Issue #927 | open product gap | buyer cannot distinguish zero findings from completed trusted coverage | evidence-qualified outcome model and accessible dashboard/report parity | | Issue #928 | open product gap | remediation evidence cannot yet move safely through CSP-compatible agent handoff | CSP-safe listeners, exact text copy, fallback, provenance schema, and UX tests | @@ -89,6 +89,7 @@ merge evidence. | PR #973, workflow-input command-injection detector, head `89deac8` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; current review decision not yet recorded | Detect caller-controlled string workflow inputs interpolated into shell run blocks | terminal SAST/coverage/security evidence, current qualifying approval, protected merge | | PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | +| PR #1005, scan-assurance report consumer, head `58565d8` | open, `feat/scan-assurance-927` target; local 1,046-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | The live queue contains additional open PRs and security-failure coordination issues. The hourly loop must re-read them from GitHub before selecting work; @@ -99,7 +100,7 @@ this snapshot is not a substitute for that query. | ID | Buyer-visible gap | Current evidence | Smallest valuable slice | Exit evidence | | --- | --- | --- | --- | --- | | G-01 | A buyer cannot verify that AppGuardrail itself observed the authoritative source condition rather than receiving a caller assertion. | PRD-FR-002/TRD §3 require the boundary; Issue #938 states the missing vertical slice. | Implement one detector family through `atomic cause → obligation → probe/acquirer → source identity → typed assessment → independent oracle → persisted evidence → API`. | Positive, negative, malformed, unavailable, stale, duplicate, adversarial fixtures; mutation tests; production black-box test; exact source/artifact digest. | -| G-02 | `0 findings` can overstate assurance when detectors, external tools, scope, or provenance are incomplete. | PRD invariant 10 and TRD §7 state the rule; Issue #927 and PR #972 remain active. | Add `clean`, `findings_present`, `incomplete`, `failed`, and `untrusted` outcomes with scope, detector completion, freshness, commit, schema, and provenance fields. | Only fully completed/trusted fixtures render clean; dashboard, JSON, SARIF, reports, and deploy gate agree. | +| G-02 | `0 findings` can overstate assurance when detectors, external tools, scope, or provenance are incomplete. | PRD invariant 10 and TRD §7 state the rule; Issue #927 and PR #972 remain active; PR #1005 stages the report consumer. | Add `clean`, `findings_present`, `incomplete`, `failed`, and `untrusted` outcomes with scope, detector completion, freshness, commit, schema, and provenance fields; carry the state into reports without allowing cross-artifact digest reuse. | Only fully completed/trusted fixtures render clean; dashboard, JSON, SARIF, reports, and deploy gate agree. | | G-03 | A developer cannot transfer remediation and evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928; current dashboard is static and must retain its CSP contract. | Add listener-based copy actions and a versioned deterministic evidence bundle; keep raw suppressed secrets out of the bundle. | hostile text remains inert; success/rejection/fallback are accessible; no duplicate listeners; schema and digest are verified. | | G-04 | Enterprise buyers need defensible retention, deletion, audit, and recovery semantics for scan evidence. | PRD §7, Issue #871, `docs/controlplane-schema-migration.md`, and current control-plane docs. | Integrate the reviewed retention/audit policy into the live control-plane store/API with tenant ownership and migration rollback. | real migration rehearsal, backup/restore evidence, tenant authorization tests, immutable audit verification, and current-head release proof. | | G-05 | Acquisition reviewers cannot yet consume one compact, exact-head evidence package spanning source, checks, provenance, and residual gaps. | `docs/OPERABILITY.md` and assurance-plane requirements exist; open PRs remain distributed evidence. | Produce a deterministic buyer evidence bundle that separates observed, unavailable, and inferred facts and binds every claim to SHA/run/artifact identifiers. | independently recomputable digest, no raw secrets, failed/unavailable distinction, protected-head and post-publish smoke evidence. | From 3a66056412af93bf6bce1bc4b47a811385f232c3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 10:18:05 +0900 Subject: [PATCH 016/192] docs: refresh assurance consumer head --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 36afbfe6..d763502d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -89,7 +89,7 @@ merge evidence. | PR #973, workflow-input command-injection detector, head `89deac8` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; current review decision not yet recorded | Detect caller-controlled string workflow inputs interpolated into shell run blocks | terminal SAST/coverage/security evidence, current qualifying approval, protected merge | | PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | -| PR #1005, scan-assurance report consumer, head `58565d8` | open, `feat/scan-assurance-927` target; local 1,046-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | +| PR #1005, scan-assurance report consumer, head `d968a0e` | open, `feat/scan-assurance-927` target; local 1,047-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | The live queue contains additional open PRs and security-failure coordination issues. The hourly loop must re-read them from GitHub before selecting work; From f7147f9c913c695c7f00e44ec652ae72db12a306 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 10:25:43 +0900 Subject: [PATCH 017/192] docs(gaps): record remediation handoff contract PR --- docs/product-technical-gap-baseline.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d763502d..59bf4b59 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -71,7 +71,7 @@ protected-branch truth. | PR #972, evidence-qualified clean scans, head `4ba738a` | draft, `develop` target; repository and dedicated assurance Checks terminal-success; visible thread resolved; formal review COMMENTED; independent approval absent | Core assurance contract for the state gap below | leave Draft only after current-head review policy and qualifying approval; keep consumer follow-ups separately reviewable | | Issue #938 | open product gap | source-authoritative detector vertical slice | one real source fixture, independent oracle, persisted evidence, and black-box production path | | Issue #927 | open product gap | buyer cannot distinguish zero findings from completed trusted coverage | evidence-qualified outcome model and accessible dashboard/report parity | -| Issue #928 | open product gap | remediation evidence cannot yet move safely through CSP-compatible agent handoff | CSP-safe listeners, exact text copy, fallback, provenance schema, and UX tests | +| Issue #928 | open product gap; PR #1006 adds the standalone non-UI handoff contract | remediation evidence still cannot yet move through the CSP-compatible dashboard workflow; the current branch provides bounded redacted JSON, while clipboard/UI behavior remains unimplemented | CSP-safe listeners, exact text copy, fallback, provenance schema, and UX tests | ### Current queue refresh (2026-08-21) @@ -90,6 +90,7 @@ merge evidence. | PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | | PR #1005, scan-assurance report consumer, head `d968a0e` | open, `feat/scan-assurance-927` target; local 1,047-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | +| PR #1006, remediation evidence handoff contract, head `20f0dfd` | open, `develop` target; exact local 1,013-test suite, focused 100% statement/branch coverage, and CodeGraph scan pass; required Checks queued; review required; qualifying approval absent | Provide a bounded, redacted, deterministic handoff artifact for standalone/naruon/contextual-orchestrator consumers | exact-head terminal Checks and qualifying review; dashboard clipboard actions, fallback, announcements, focus, and browser E2E remain open | The live queue contains additional open PRs and security-failure coordination issues. The hourly loop must re-read them from GitHub before selecting work; @@ -101,7 +102,7 @@ this snapshot is not a substitute for that query. | --- | --- | --- | --- | --- | | G-01 | A buyer cannot verify that AppGuardrail itself observed the authoritative source condition rather than receiving a caller assertion. | PRD-FR-002/TRD §3 require the boundary; Issue #938 states the missing vertical slice. | Implement one detector family through `atomic cause → obligation → probe/acquirer → source identity → typed assessment → independent oracle → persisted evidence → API`. | Positive, negative, malformed, unavailable, stale, duplicate, adversarial fixtures; mutation tests; production black-box test; exact source/artifact digest. | | G-02 | `0 findings` can overstate assurance when detectors, external tools, scope, or provenance are incomplete. | PRD invariant 10 and TRD §7 state the rule; Issue #927 and PR #972 remain active; PR #1005 stages the report consumer. | Add `clean`, `findings_present`, `incomplete`, `failed`, and `untrusted` outcomes with scope, detector completion, freshness, commit, schema, and provenance fields; carry the state into reports without allowing cross-artifact digest reuse. | Only fully completed/trusted fixtures render clean; dashboard, JSON, SARIF, reports, and deploy gate agree. | -| G-03 | A developer cannot transfer remediation and evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928; current dashboard is static and must retain its CSP contract. | Add listener-based copy actions and a versioned deterministic evidence bundle; keep raw suppressed secrets out of the bundle. | hostile text remains inert; success/rejection/fallback are accessible; no duplicate listeners; schema and digest are verified. | +| G-03 | A developer cannot transfer remediation and evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928 and PR #1006; the standalone versioned/redacted/digest-verified JSON contract is active-PR evidence only, while the current dashboard is static and must retain its CSP contract. | Keep PR #1006 as the transport-neutral bundle boundary; then add listener-based copy actions and a versioned deterministic UI evidence bundle after the design/Storybook gate. | hostile text remains inert; success/rejection/fallback are accessible; no duplicate listeners; schema and digest are verified on a protected head. | | G-04 | Enterprise buyers need defensible retention, deletion, audit, and recovery semantics for scan evidence. | PRD §7, Issue #871, `docs/controlplane-schema-migration.md`, and current control-plane docs. | Integrate the reviewed retention/audit policy into the live control-plane store/API with tenant ownership and migration rollback. | real migration rehearsal, backup/restore evidence, tenant authorization tests, immutable audit verification, and current-head release proof. | | G-05 | Acquisition reviewers cannot yet consume one compact, exact-head evidence package spanning source, checks, provenance, and residual gaps. | `docs/OPERABILITY.md` and assurance-plane requirements exist; open PRs remain distributed evidence. | Produce a deterministic buyer evidence bundle that separates observed, unavailable, and inferred facts and binds every claim to SHA/run/artifact identifiers. | independently recomputable digest, no raw secrets, failed/unavailable distinction, protected-head and post-publish smoke evidence. | From 80c32e049772be32b148d3315521ca6ceff5514a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 10:34:23 +0900 Subject: [PATCH 018/192] docs: refresh remediation handoff head --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 59bf4b59..42a227e1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -90,7 +90,7 @@ merge evidence. | PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | | PR #1005, scan-assurance report consumer, head `d968a0e` | open, `feat/scan-assurance-927` target; local 1,047-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | -| PR #1006, remediation evidence handoff contract, head `20f0dfd` | open, `develop` target; exact local 1,013-test suite, focused 100% statement/branch coverage, and CodeGraph scan pass; required Checks queued; review required; qualifying approval absent | Provide a bounded, redacted, deterministic handoff artifact for standalone/naruon/contextual-orchestrator consumers | exact-head terminal Checks and qualifying review; dashboard clipboard actions, fallback, announcements, focus, and browser E2E remain open | +| PR #1006, remediation evidence handoff contract, head `9b9d79e` | open, `develop` target; exact local 1,013-test suite, focused 100% statement coverage, and CodeGraph scan pass; required Checks queued; review required; qualifying approval absent | Provide a bounded, redacted, deterministic handoff artifact for standalone/naruon/contextual-orchestrator consumers | exact-head terminal Checks and qualifying review; dashboard clipboard actions, fallback, announcements, focus, and browser E2E remain open | The live queue contains additional open PRs and security-failure coordination issues. The hourly loop must re-read them from GitHub before selecting work; From c694a6e15d6ba7f716eb2196fd3ccb9fcdc71362 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 10:42:41 +0900 Subject: [PATCH 019/192] docs(gaps): refresh remediation handoff security fix head --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 42a227e1..5570ecc1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -90,7 +90,7 @@ merge evidence. | PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | | PR #1005, scan-assurance report consumer, head `d968a0e` | open, `feat/scan-assurance-927` target; local 1,047-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | -| PR #1006, remediation evidence handoff contract, head `9b9d79e` | open, `develop` target; exact local 1,013-test suite, focused 100% statement coverage, and CodeGraph scan pass; required Checks queued; review required; qualifying approval absent | Provide a bounded, redacted, deterministic handoff artifact for standalone/naruon/contextual-orchestrator consumers | exact-head terminal Checks and qualifying review; dashboard clipboard actions, fallback, announcements, focus, and browser E2E remain open | +| PR #1006, remediation evidence handoff contract, head `a8f54b3` | open, `develop` target; exact local 1,013-test suite, focused 100% statement/branch coverage, and CodeGraph scan pass; required Checks queued; review required; qualifying approval absent | Provide a bounded, redacted, deterministic handoff artifact for standalone/naruon/contextual-orchestrator consumers | exact-head terminal Checks and qualifying review; dashboard clipboard actions, fallback, announcements, focus, and browser E2E remain open | The live queue contains additional open PRs and security-failure coordination issues. The hourly loop must re-read them from GitHub before selecting work; From 97f7aa55a38a61d92f1670cab26dbfb543aa6eff Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 10:43:57 +0900 Subject: [PATCH 020/192] docs: refresh remediation handoff validation --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5570ecc1..7287e1ec 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -90,7 +90,7 @@ merge evidence. | PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | | PR #1005, scan-assurance report consumer, head `d968a0e` | open, `feat/scan-assurance-927` target; local 1,047-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | -| PR #1006, remediation evidence handoff contract, head `a8f54b3` | open, `develop` target; exact local 1,013-test suite, focused 100% statement/branch coverage, and CodeGraph scan pass; required Checks queued; review required; qualifying approval absent | Provide a bounded, redacted, deterministic handoff artifact for standalone/naruon/contextual-orchestrator consumers | exact-head terminal Checks and qualifying review; dashboard clipboard actions, fallback, announcements, focus, and browser E2E remain open | +| PR #1006, remediation evidence handoff contract, head `949873d` | open, `develop` target; exact local 1,014-test suite, focused 100% statement/branch coverage, and CodeGraph scan pass; required Checks queued; review required; qualifying approval absent | Provide a bounded, redacted, deterministic handoff artifact for standalone/naruon/contextual-orchestrator consumers | exact-head terminal Checks and qualifying review; dashboard clipboard actions, fallback, announcements, focus, and browser E2E remain open | The live queue contains additional open PRs and security-failure coordination issues. The hourly loop must re-read them from GitHub before selecting work; From 0e14bbdadaf26d6c5f624629bb94aecaff887a4f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 10:50:57 +0900 Subject: [PATCH 021/192] docs: refresh shell detector head --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7287e1ec..914c2219 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -85,7 +85,7 @@ merge evidence. | PR #1000, source-bound workflow evidence, head `b1ec29b` | open, `develop` target; no failed Checks observed; `coverage-source-tree` queued; review required; qualifying approval absent | Bind GitHub workflow failure evidence to source, revision, artifact, freshness, and typed assessment | terminal exact-head Checks, current qualifying approval, protected merge | | PR #1002, dashboard DOM-XSS hardening, head `9932510` | open, `develop` target; required repository/security Checks queued; no failed Check observed; review required; qualifying approval absent | Escape untrusted numeric and identifier properties before dashboard `innerHTML` rendering | terminal SAST/security/browser evidence, current qualifying approval, protected merge | | PR #1001, console busy-state styling, head `71c4251` | open, `develop` target; required Checks queued; no failed Check observed; review required; qualifying approval absent | Keep disabled and `aria-busy` button state perceivable to visual and assistive users | terminal accessibility Checks, current qualifying approval, protected merge | -| PR #983, Python shell-spawning detector, head `3f9db72` | open, `develop` target; same-tree follow-up head; required Checks queued; predecessor-bound review state remains; qualifying approval absent | Distinguish implicit `os.system`/`os.popen` shell execution from `subprocess(..., shell=True)` | exact-head terminal Checks and current review evidence, qualifying approval, protected merge | +| PR #983, Python shell-spawning detector, head `c8cf4d2` | open, `develop` target; 7 focused detector tests and full 1,008-test suite pass; exact-head required Checks terminal-success; stale predecessor review still says changes requested; current-head review requested; qualifying approval absent | Distinguish implicit `os.system`/`os.popen` shell execution from `subprocess(..., shell=True)` | current-head review evidence, qualifying approval, protected merge | | PR #973, workflow-input command-injection detector, head `89deac8` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; current review decision not yet recorded | Detect caller-controlled string workflow inputs interpolated into shell run blocks | terminal SAST/coverage/security evidence, current qualifying approval, protected merge | | PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | From 0f98861fa6480d41fee24a7da6dccf1f48a35a7d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 10:56:00 +0900 Subject: [PATCH 022/192] docs: refresh retention diligence evidence --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 914c2219..96b49a90 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -66,7 +66,7 @@ protected-branch truth. | PR #954, hostname-unbound loopback SSRF detector, head `f1e2ce5` | open, `develop` target; all repository Checks terminal-success; visible threads resolved; repeated OpenCode requests remain; qualifying approval absent | Prevent hostname-bound SSRF exceptions from accepting loopback targets | exact-head qualifying approval and protected merge | | PR #930, dashboard state and focus, head `2e96553` | draft, `develop` target; repository Checks terminal-success; visible threads resolved; extensive predecessor OpenCode requests remain; qualifying approval absent | Make scan state, detail focus, external-reference behavior, and read-only console exposure perceivable | current-head review reconciliation, qualifying approval, and protected merge | | PR #996, reference-dedupe performance, head `51dd28a` | draft, `develop` target; repository Checks terminal-success; review absent; qualifying approval absent | Remove generator-frame allocation without changing reference normalization semantics | reproducible benchmark evidence, current review, and protected merge | -| PR #970, retention-audit diligence posture, head `db06f5e` | open, `develop` target; repository Checks terminal-success; visible threads resolved; OpenCode request remains; qualifying approval absent | Give buyers a non-secret, fail-closed retention and audit posture | exact-head qualifying approval and protected merge | +| PR #970, retention-audit diligence posture, head `db06f5e` | open, `develop` target; 13 retention-focused tests and full 1,014-test suite pass; repository Checks terminal-success; report-safety threads resolved; current-head review re-requested after the prior coverage-evidence failure; qualifying approval absent | Give buyers a non-secret, fail-closed retention and audit posture | current-head qualifying review, qualifying approval, and protected merge | | PR #967, protected PyPI publication, head `5a48b74` | open, `develop` target; repository Checks terminal-success; OpenCode requests remain; qualifying approval absent | Bind release publication to protected source and installable artifact evidence | exact-head qualifying approval and protected merge | | PR #972, evidence-qualified clean scans, head `4ba738a` | draft, `develop` target; repository and dedicated assurance Checks terminal-success; visible thread resolved; formal review COMMENTED; independent approval absent | Core assurance contract for the state gap below | leave Draft only after current-head review policy and qualifying approval; keep consumer follow-ups separately reviewable | | Issue #938 | open product gap | source-authoritative detector vertical slice | one real source fixture, independent oracle, persisted evidence, and black-box production path | From a1ca810fd3c8bb1c8c9efc9b2f44df783f16bc91 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 10:59:00 +0900 Subject: [PATCH 023/192] docs: track baseline PR head --- docs/product-technical-gap-baseline.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 96b49a90..8f8db308 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -91,6 +91,7 @@ merge evidence. | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | | PR #1005, scan-assurance report consumer, head `d968a0e` | open, `feat/scan-assurance-927` target; local 1,047-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | | PR #1006, remediation evidence handoff contract, head `949873d` | open, `develop` target; exact local 1,014-test suite, focused 100% statement/branch coverage, and CodeGraph scan pass; required Checks queued; review required; qualifying approval absent | Provide a bounded, redacted, deterministic handoff artifact for standalone/naruon/contextual-orchestrator consumers | exact-head terminal Checks and qualifying review; dashboard clipboard actions, fallback, announcements, focus, and browser E2E remain open | +| PR #999, product/technical gap baseline, head `0f98861` | open, `develop` target; docs-only queue refresh; required Checks queued after current-head updates; review required; qualifying approval absent | Keep buyer-visible gaps and exact PR evidence synchronized with active security work | terminal exact-head Checks, current review evidence, and protected merge | The live queue contains additional open PRs and security-failure coordination issues. The hourly loop must re-read them from GitHub before selecting work; From b54b71674e08d09daa6a64991187d3ed1fb17887 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 11:01:49 +0900 Subject: [PATCH 024/192] docs: track current baseline PR head --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8f8db308..37b3c569 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -91,7 +91,7 @@ merge evidence. | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | | PR #1005, scan-assurance report consumer, head `d968a0e` | open, `feat/scan-assurance-927` target; local 1,047-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | | PR #1006, remediation evidence handoff contract, head `949873d` | open, `develop` target; exact local 1,014-test suite, focused 100% statement/branch coverage, and CodeGraph scan pass; required Checks queued; review required; qualifying approval absent | Provide a bounded, redacted, deterministic handoff artifact for standalone/naruon/contextual-orchestrator consumers | exact-head terminal Checks and qualifying review; dashboard clipboard actions, fallback, announcements, focus, and browser E2E remain open | -| PR #999, product/technical gap baseline, head `0f98861` | open, `develop` target; docs-only queue refresh; required Checks queued after current-head updates; review required; qualifying approval absent | Keep buyer-visible gaps and exact PR evidence synchronized with active security work | terminal exact-head Checks, current review evidence, and protected merge | +| PR #999, product/technical gap baseline, head `a1ca810` | open, `develop` target; docs-only queue refresh; required Checks queued after current-head updates; review required; qualifying approval absent | Keep buyer-visible gaps and exact PR evidence synchronized with active security work | terminal exact-head Checks, current review evidence, and protected merge | The live queue contains additional open PRs and security-failure coordination issues. The hourly loop must re-read them from GitHub before selecting work; From 3aebf5f5ac725f445047aa300f8c90b482e43143 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 11:02:30 +0900 Subject: [PATCH 025/192] docs: avoid self-referential baseline head --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 37b3c569..be2db806 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -91,7 +91,7 @@ merge evidence. | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | | PR #1005, scan-assurance report consumer, head `d968a0e` | open, `feat/scan-assurance-927` target; local 1,047-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | | PR #1006, remediation evidence handoff contract, head `949873d` | open, `develop` target; exact local 1,014-test suite, focused 100% statement/branch coverage, and CodeGraph scan pass; required Checks queued; review required; qualifying approval absent | Provide a bounded, redacted, deterministic handoff artifact for standalone/naruon/contextual-orchestrator consumers | exact-head terminal Checks and qualifying review; dashboard clipboard actions, fallback, announcements, focus, and browser E2E remain open | -| PR #999, product/technical gap baseline, head `a1ca810` | open, `develop` target; docs-only queue refresh; required Checks queued after current-head updates; review required; qualifying approval absent | Keep buyer-visible gaps and exact PR evidence synchronized with active security work | terminal exact-head Checks, current review evidence, and protected merge | +| PR #999, product/technical gap baseline (this document) | self-referential maintenance PR; its live head SHA is intentionally kept in GitHub PR metadata rather than duplicated here; review, Checks, and approval gates remain external | Keep buyer-visible gaps and exact PR evidence synchronized with active security work | read the live PR head before relying on this document; preserve the exact-head records for all other queued PRs | The live queue contains additional open PRs and security-failure coordination issues. The hourly loop must re-read them from GitHub before selecting work; From 55e67e0ef8b95512248529678422dc4021070744 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 11:11:16 +0900 Subject: [PATCH 026/192] docs: refresh Python detector PR evidence --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index be2db806..7d2d7e10 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -85,7 +85,7 @@ merge evidence. | PR #1000, source-bound workflow evidence, head `b1ec29b` | open, `develop` target; no failed Checks observed; `coverage-source-tree` queued; review required; qualifying approval absent | Bind GitHub workflow failure evidence to source, revision, artifact, freshness, and typed assessment | terminal exact-head Checks, current qualifying approval, protected merge | | PR #1002, dashboard DOM-XSS hardening, head `9932510` | open, `develop` target; required repository/security Checks queued; no failed Check observed; review required; qualifying approval absent | Escape untrusted numeric and identifier properties before dashboard `innerHTML` rendering | terminal SAST/security/browser evidence, current qualifying approval, protected merge | | PR #1001, console busy-state styling, head `71c4251` | open, `develop` target; required Checks queued; no failed Check observed; review required; qualifying approval absent | Keep disabled and `aria-busy` button state perceivable to visual and assistive users | terminal accessibility Checks, current qualifying approval, protected merge | -| PR #983, Python shell-spawning detector, head `c8cf4d2` | open, `develop` target; 7 focused detector tests and full 1,008-test suite pass; exact-head required Checks terminal-success; stale predecessor review still says changes requested; current-head review requested; qualifying approval absent | Distinguish implicit `os.system`/`os.popen` shell execution from `subprocess(..., shell=True)` | current-head review evidence, qualifying approval, protected merge | +| PR #983, Python shell-spawning detector, head `59dcc82` | open, `develop` target; 9 focused detector tests and full 1,010-test suite pass locally; current-head required Checks are queued after the AST follow-up; stale OpenCode review remains predecessor-bound; current-head review requested; qualifying approval absent | Distinguish implicit `os.system`/`os.popen` shell execution from `subprocess(..., shell=True)` and close deeply nested-call false negatives | exact-head terminal Checks, current qualifying review, qualifying approval, protected merge | | PR #973, workflow-input command-injection detector, head `89deac8` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; current review decision not yet recorded | Detect caller-controlled string workflow inputs interpolated into shell run blocks | terminal SAST/coverage/security evidence, current qualifying approval, protected merge | | PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | From 3ceec03f84550e757f5be81b2d2264848a30edf4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 11:14:24 +0900 Subject: [PATCH 027/192] docs: record workflow-input detector fix --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7d2d7e10..0f4bc092 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -59,7 +59,7 @@ protected-branch truth. | PR #983, Python shell-spawning detector, head `40c4d24` | open, `develop` target; current tree has passed local focused/full tests; required Checks queued after a same-tree follow-up commit; current review evidence is predecessor-bound | Distinguish implicit `os.system`/`os.popen` shells from `subprocess(..., shell=True)` and cover nested arguments | exact-head terminal Checks, current review evidence, protected merge | | PR #969, dashboard upload proxy, head `9997f00` | open, `develop` target; current head restores HTML `hidden` tree exclusion after an external regression; required Checks and current review queued | Preserve one accessible upload action while keeping native file selection behavior | exact-head terminal Checks, current review evidence, protected merge | | PR #963, Java tenant authorization detector, head `9cbba72` | open, `develop` target; source-backed fixture and local full tests pass; required Checks and current review queued | Detect discarded tenant authorization context at Spring admin read/mutation sinks | exact-head terminal Checks, current review evidence, protected merge | -| PR #973, GitHub Actions workflow-input injection detector, head `89deac8` | open, `develop` target; required Checks queued; no live review finding observed in the current review API read | Trust-boundary detection for untrusted workflow inputs reaching commands | exact-head SAST, coverage, security, and protected-merge evidence | +| PR #973, GitHub Actions workflow-input injection detector, head `c90c192` | open, `develop` target; 21 focused and 1,022 full tests pass locally; CodeRabbit boundary/performance findings fixed and threads resolved; required Checks queued after the fix; current review requested; qualifying approval absent | Trust-boundary detection for untrusted workflow inputs reaching commands | exact-head SAST, coverage, security, current qualifying review, and protected-merge evidence | | PR #971, Java mutable MultipartFile detector, head `565917c` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; old OpenCode request remains while current-head rerun is queued | Detect unsafe mutable byte-array exposure across Java syntax variants | current-head OpenCode approval, terminal Checks, and protected merge | | PR #968, fail-open authentication-secret detector, head `4d030ff` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; current OpenCode approval absent | Prevent authentication findings from losing their declared CWE contract | current-head OpenCode approval, terminal Checks, and protected merge | | PR #966, orphaned workflow registry detector, head `b3f10ad` | open, `develop` target; all repository Checks terminal-success; visible threads resolved; OpenCode request remains; qualifying approval absent | Detect stale workflow registrations before assurance evidence is trusted | exact-head qualifying approval and protected merge | @@ -86,7 +86,7 @@ merge evidence. | PR #1002, dashboard DOM-XSS hardening, head `9932510` | open, `develop` target; required repository/security Checks queued; no failed Check observed; review required; qualifying approval absent | Escape untrusted numeric and identifier properties before dashboard `innerHTML` rendering | terminal SAST/security/browser evidence, current qualifying approval, protected merge | | PR #1001, console busy-state styling, head `71c4251` | open, `develop` target; required Checks queued; no failed Check observed; review required; qualifying approval absent | Keep disabled and `aria-busy` button state perceivable to visual and assistive users | terminal accessibility Checks, current qualifying approval, protected merge | | PR #983, Python shell-spawning detector, head `59dcc82` | open, `develop` target; 9 focused detector tests and full 1,010-test suite pass locally; current-head required Checks are queued after the AST follow-up; stale OpenCode review remains predecessor-bound; current-head review requested; qualifying approval absent | Distinguish implicit `os.system`/`os.popen` shell execution from `subprocess(..., shell=True)` and close deeply nested-call false negatives | exact-head terminal Checks, current qualifying review, qualifying approval, protected merge | -| PR #973, workflow-input command-injection detector, head `89deac8` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; current review decision not yet recorded | Detect caller-controlled string workflow inputs interpolated into shell run blocks | terminal SAST/coverage/security evidence, current qualifying approval, protected merge | +| PR #973, workflow-input command-injection detector, head `c90c192` | open, `develop` target; 21 focused and 1,022 full tests pass locally; required Checks queued after the boundary/performance fix; current review requested; qualifying approval absent | Detect caller-controlled string workflow inputs interpolated into shell run blocks | terminal exact-head SAST/coverage/security evidence, current qualifying review, qualifying approval, protected merge | | PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | | PR #1005, scan-assurance report consumer, head `d968a0e` | open, `feat/scan-assurance-927` target; local 1,047-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | From 7a6daba58ca3bcac74e13742fb2dc267a0fd6b0b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 11:15:58 +0900 Subject: [PATCH 028/192] docs: record dashboard upload review head --- docs/product-technical-gap-baseline.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0f4bc092..8083c79c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -91,6 +91,7 @@ merge evidence. | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | | PR #1005, scan-assurance report consumer, head `d968a0e` | open, `feat/scan-assurance-927` target; local 1,047-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | | PR #1006, remediation evidence handoff contract, head `949873d` | open, `develop` target; exact local 1,014-test suite, focused 100% statement/branch coverage, and CodeGraph scan pass; required Checks queued; review required; qualifying approval absent | Provide a bounded, redacted, deterministic handoff artifact for standalone/naruon/contextual-orchestrator consumers | exact-head terminal Checks and qualifying review; dashboard clipboard actions, fallback, announcements, focus, and browser E2E remain open | +| PR #969, dashboard upload proxy, head `29e2469` | open, `develop` target; 24 focused dashboard tests and full 1,004-test suite pass locally; CodeGraph scan reports 0 deploy blockers; current-head required Checks are queued; current-head review requested; qualifying approval absent | Keep the native file picker programmatically usable while excluding it from the accessibility tree and preserving one visible upload action | exact-head terminal Checks, current qualifying review, qualifying approval, protected merge | | PR #999, product/technical gap baseline (this document) | self-referential maintenance PR; its live head SHA is intentionally kept in GitHub PR metadata rather than duplicated here; review, Checks, and approval gates remain external | Keep buyer-visible gaps and exact PR evidence synchronized with active security work | read the live PR head before relying on this document; preserve the exact-head records for all other queued PRs | The live queue contains additional open PRs and security-failure coordination From 52116b45aa20a3732573d3a0337cf0c90014b87f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 11:18:49 +0900 Subject: [PATCH 029/192] docs: track workflow detector follow-up head --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8083c79c..ca6ec81d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -59,7 +59,7 @@ protected-branch truth. | PR #983, Python shell-spawning detector, head `40c4d24` | open, `develop` target; current tree has passed local focused/full tests; required Checks queued after a same-tree follow-up commit; current review evidence is predecessor-bound | Distinguish implicit `os.system`/`os.popen` shells from `subprocess(..., shell=True)` and cover nested arguments | exact-head terminal Checks, current review evidence, protected merge | | PR #969, dashboard upload proxy, head `9997f00` | open, `develop` target; current head restores HTML `hidden` tree exclusion after an external regression; required Checks and current review queued | Preserve one accessible upload action while keeping native file selection behavior | exact-head terminal Checks, current review evidence, protected merge | | PR #963, Java tenant authorization detector, head `9cbba72` | open, `develop` target; source-backed fixture and local full tests pass; required Checks and current review queued | Detect discarded tenant authorization context at Spring admin read/mutation sinks | exact-head terminal Checks, current review evidence, protected merge | -| PR #973, GitHub Actions workflow-input injection detector, head `c90c192` | open, `develop` target; 21 focused and 1,022 full tests pass locally; CodeRabbit boundary/performance findings fixed and threads resolved; required Checks queued after the fix; current review requested; qualifying approval absent | Trust-boundary detection for untrusted workflow inputs reaching commands | exact-head SAST, coverage, security, current qualifying review, and protected-merge evidence | +| PR #973, GitHub Actions workflow-input injection detector, head `72801c6` | open, `develop` target; 21 focused and 1,022 full tests pass locally; CodeRabbit boundary/performance findings fixed and threads resolved; required Checks queued after the fix; current review requested; qualifying approval absent | Trust-boundary detection for untrusted workflow inputs reaching commands | exact-head SAST, coverage, security, current qualifying review, and protected-merge evidence | | PR #971, Java mutable MultipartFile detector, head `565917c` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; old OpenCode request remains while current-head rerun is queued | Detect unsafe mutable byte-array exposure across Java syntax variants | current-head OpenCode approval, terminal Checks, and protected merge | | PR #968, fail-open authentication-secret detector, head `4d030ff` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; current OpenCode approval absent | Prevent authentication findings from losing their declared CWE contract | current-head OpenCode approval, terminal Checks, and protected merge | | PR #966, orphaned workflow registry detector, head `b3f10ad` | open, `develop` target; all repository Checks terminal-success; visible threads resolved; OpenCode request remains; qualifying approval absent | Detect stale workflow registrations before assurance evidence is trusted | exact-head qualifying approval and protected merge | @@ -86,7 +86,7 @@ merge evidence. | PR #1002, dashboard DOM-XSS hardening, head `9932510` | open, `develop` target; required repository/security Checks queued; no failed Check observed; review required; qualifying approval absent | Escape untrusted numeric and identifier properties before dashboard `innerHTML` rendering | terminal SAST/security/browser evidence, current qualifying approval, protected merge | | PR #1001, console busy-state styling, head `71c4251` | open, `develop` target; required Checks queued; no failed Check observed; review required; qualifying approval absent | Keep disabled and `aria-busy` button state perceivable to visual and assistive users | terminal accessibility Checks, current qualifying approval, protected merge | | PR #983, Python shell-spawning detector, head `59dcc82` | open, `develop` target; 9 focused detector tests and full 1,010-test suite pass locally; current-head required Checks are queued after the AST follow-up; stale OpenCode review remains predecessor-bound; current-head review requested; qualifying approval absent | Distinguish implicit `os.system`/`os.popen` shell execution from `subprocess(..., shell=True)` and close deeply nested-call false negatives | exact-head terminal Checks, current qualifying review, qualifying approval, protected merge | -| PR #973, workflow-input command-injection detector, head `c90c192` | open, `develop` target; 21 focused and 1,022 full tests pass locally; required Checks queued after the boundary/performance fix; current review requested; qualifying approval absent | Detect caller-controlled string workflow inputs interpolated into shell run blocks | terminal exact-head SAST/coverage/security evidence, current qualifying review, qualifying approval, protected merge | +| PR #973, workflow-input command-injection detector, head `72801c6` | open, `develop` target; 21 focused and 1,022 full tests pass locally; required Checks queued after the boundary/performance fix; current review requested; qualifying approval absent | Detect caller-controlled string workflow inputs interpolated into shell run blocks | terminal exact-head SAST/coverage/security evidence, current qualifying review, qualifying approval, protected merge | | PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | | PR #1005, scan-assurance report consumer, head `d968a0e` | open, `feat/scan-assurance-927` target; local 1,047-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | From 15f6d00ed49615e88ad685d4e140dedc97759d62 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 11:23:52 +0900 Subject: [PATCH 030/192] docs: record release scan failure --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ca6ec81d..c77faa5b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -67,7 +67,7 @@ protected-branch truth. | PR #930, dashboard state and focus, head `2e96553` | draft, `develop` target; repository Checks terminal-success; visible threads resolved; extensive predecessor OpenCode requests remain; qualifying approval absent | Make scan state, detail focus, external-reference behavior, and read-only console exposure perceivable | current-head review reconciliation, qualifying approval, and protected merge | | PR #996, reference-dedupe performance, head `51dd28a` | draft, `develop` target; repository Checks terminal-success; review absent; qualifying approval absent | Remove generator-frame allocation without changing reference normalization semantics | reproducible benchmark evidence, current review, and protected merge | | PR #970, retention-audit diligence posture, head `db06f5e` | open, `develop` target; 13 retention-focused tests and full 1,014-test suite pass; repository Checks terminal-success; report-safety threads resolved; current-head review re-requested after the prior coverage-evidence failure; qualifying approval absent | Give buyers a non-secret, fail-closed retention and audit posture | current-head qualifying review, qualifying approval, and protected merge | -| PR #967, protected PyPI publication, head `5a48b74` | open, `develop` target; repository Checks terminal-success; OpenCode requests remain; qualifying approval absent | Bind release publication to protected source and installable artifact evidence | exact-head qualifying approval and protected merge | +| PR #967, protected PyPI publication, head `5a48b74` | open, `develop` target; Strix Security Scan failed on exact head in run `31927961766` (archived job log unavailable); other repository Checks terminal-success; local CodeGraph scan has no deploy-blocking critical/high findings; OpenCode requests remain; qualifying approval absent | Bind release publication to protected source and installable artifact evidence | recover the archived Strix finding or obtain a current-head rerun after a verified fix, then exact-head qualifying review, approval, and protected merge | | PR #972, evidence-qualified clean scans, head `4ba738a` | draft, `develop` target; repository and dedicated assurance Checks terminal-success; visible thread resolved; formal review COMMENTED; independent approval absent | Core assurance contract for the state gap below | leave Draft only after current-head review policy and qualifying approval; keep consumer follow-ups separately reviewable | | Issue #938 | open product gap | source-authoritative detector vertical slice | one real source fixture, independent oracle, persisted evidence, and black-box production path | | Issue #927 | open product gap | buyer cannot distinguish zero findings from completed trusted coverage | evidence-qualified outcome model and accessible dashboard/report parity | From f64dabf5297653e586ba5f4db53ad6b404509c2b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 11:33:40 +0900 Subject: [PATCH 031/192] docs: record workflow detector remediation head --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c77faa5b..5dcbf62f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -59,7 +59,7 @@ protected-branch truth. | PR #983, Python shell-spawning detector, head `40c4d24` | open, `develop` target; current tree has passed local focused/full tests; required Checks queued after a same-tree follow-up commit; current review evidence is predecessor-bound | Distinguish implicit `os.system`/`os.popen` shells from `subprocess(..., shell=True)` and cover nested arguments | exact-head terminal Checks, current review evidence, protected merge | | PR #969, dashboard upload proxy, head `9997f00` | open, `develop` target; current head restores HTML `hidden` tree exclusion after an external regression; required Checks and current review queued | Preserve one accessible upload action while keeping native file selection behavior | exact-head terminal Checks, current review evidence, protected merge | | PR #963, Java tenant authorization detector, head `9cbba72` | open, `develop` target; source-backed fixture and local full tests pass; required Checks and current review queued | Detect discarded tenant authorization context at Spring admin read/mutation sinks | exact-head terminal Checks, current review evidence, protected merge | -| PR #973, GitHub Actions workflow-input injection detector, head `72801c6` | open, `develop` target; 21 focused and 1,022 full tests pass locally; CodeRabbit boundary/performance findings fixed and threads resolved; required Checks queued after the fix; current review requested; qualifying approval absent | Trust-boundary detection for untrusted workflow inputs reaching commands | exact-head SAST, coverage, security, current qualifying review, and protected-merge evidence | +| PR #973, GitHub Actions workflow-input injection detector, head `11b9843` | open, `develop` target; 22 focused and 1,023 full tests pass locally; CodeRabbit boundary/performance findings and Devin snippet-redaction finding fixed with resolved threads; required Checks queued after the fix; current review requested; qualifying approval absent | Trust-boundary detection for untrusted workflow inputs reaching commands | exact-head SAST, coverage, security, current qualifying review, and protected-merge evidence | | PR #971, Java mutable MultipartFile detector, head `565917c` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; old OpenCode request remains while current-head rerun is queued | Detect unsafe mutable byte-array exposure across Java syntax variants | current-head OpenCode approval, terminal Checks, and protected merge | | PR #968, fail-open authentication-secret detector, head `4d030ff` | open, `develop` target; terminal quality/security Checks passed; CodeRabbit thread resolved; current OpenCode approval absent | Prevent authentication findings from losing their declared CWE contract | current-head OpenCode approval, terminal Checks, and protected merge | | PR #966, orphaned workflow registry detector, head `b3f10ad` | open, `develop` target; all repository Checks terminal-success; visible threads resolved; OpenCode request remains; qualifying approval absent | Detect stale workflow registrations before assurance evidence is trusted | exact-head qualifying approval and protected merge | @@ -86,7 +86,7 @@ merge evidence. | PR #1002, dashboard DOM-XSS hardening, head `9932510` | open, `develop` target; required repository/security Checks queued; no failed Check observed; review required; qualifying approval absent | Escape untrusted numeric and identifier properties before dashboard `innerHTML` rendering | terminal SAST/security/browser evidence, current qualifying approval, protected merge | | PR #1001, console busy-state styling, head `71c4251` | open, `develop` target; required Checks queued; no failed Check observed; review required; qualifying approval absent | Keep disabled and `aria-busy` button state perceivable to visual and assistive users | terminal accessibility Checks, current qualifying approval, protected merge | | PR #983, Python shell-spawning detector, head `59dcc82` | open, `develop` target; 9 focused detector tests and full 1,010-test suite pass locally; current-head required Checks are queued after the AST follow-up; stale OpenCode review remains predecessor-bound; current-head review requested; qualifying approval absent | Distinguish implicit `os.system`/`os.popen` shell execution from `subprocess(..., shell=True)` and close deeply nested-call false negatives | exact-head terminal Checks, current qualifying review, qualifying approval, protected merge | -| PR #973, workflow-input command-injection detector, head `72801c6` | open, `develop` target; 21 focused and 1,022 full tests pass locally; required Checks queued after the boundary/performance fix; current review requested; qualifying approval absent | Detect caller-controlled string workflow inputs interpolated into shell run blocks | terminal exact-head SAST/coverage/security evidence, current qualifying review, qualifying approval, protected merge | +| PR #973, workflow-input command-injection detector, head `11b9843` | open, `develop` target; 22 focused and 1,023 full tests pass locally; boundary/performance and snippet-redaction findings fixed with resolved threads; required Checks queued after the current-head fix; current review requested; qualifying approval absent | Detect caller-controlled string workflow inputs interpolated into shell run blocks | terminal exact-head SAST/coverage/security evidence, current qualifying review, qualifying approval, protected merge | | PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | | PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | | PR #1005, scan-assurance report consumer, head `d968a0e` | open, `feat/scan-assurance-927` target; local 1,047-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | From 95310036cc86c64103675b0945a0af6e3ade6910 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 16:36:39 +0900 Subject: [PATCH 032/192] docs(baseline): refresh live-PR evidence (#1004 head, #1032, agent batch, central callers) and record hourly-loop wiring --- docs/product-technical-gap-baseline.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5dcbf62f..83b4e65d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -88,7 +88,10 @@ merge evidence. | PR #983, Python shell-spawning detector, head `59dcc82` | open, `develop` target; 9 focused detector tests and full 1,010-test suite pass locally; current-head required Checks are queued after the AST follow-up; stale OpenCode review remains predecessor-bound; current-head review requested; qualifying approval absent | Distinguish implicit `os.system`/`os.popen` shell execution from `subprocess(..., shell=True)` and close deeply nested-call false negatives | exact-head terminal Checks, current qualifying review, qualifying approval, protected merge | | PR #973, workflow-input command-injection detector, head `11b9843` | open, `develop` target; 22 focused and 1,023 full tests pass locally; boundary/performance and snippet-redaction findings fixed with resolved threads; required Checks queued after the current-head fix; current review requested; qualifying approval absent | Detect caller-controlled string workflow inputs interpolated into shell run blocks | terminal exact-head SAST/coverage/security evidence, current qualifying review, qualifying approval, protected merge | | PR #963, tenant authorization-scope detector, head `9cbba72` | open, `develop` target; `coverage-evidence` queued; no failed Check observed; predecessor-bound review state remains | Detect discarded tenant authorization context before Spring admin reads or mutations | terminal exact-head Checks and current review evidence, qualifying approval, protected merge | -| PR #1004, release-tooling cryptography remediation, head `ff95e69` | open, `develop` target; required Checks queued; review required; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | +| PR #1004, release-tooling cryptography remediation, head `c94b2c8` | open, `develop` target; hash-pinned lock at `cryptography==50.0.0`; CHANGELOG.d fragment added cooperatively; duplicate #1034 closed in its favor; required Checks queued; qualifying approval absent | Remove the high-severity Dependabot CVE-2026-69247 exposure by moving transitive `cryptography` from 49.0.0 to first patched 50.0.0 | terminal exact-head security/dependency Checks, current qualifying approval, protected merge; confirm Dependabot alert closure after merge | +| PR #1032, malicious shared-skill threat inventory rows, head `33f0780` | open, `develop` target; repository Checks terminal-success incl. CodeQL/Semgrep/Trivy; central `opencode-review` queued; closes #1031 | Names the homoglyph prompt-injection skill and placeholder-template threats so they become executable detection obligations (G-005 knowledge half) | central OpenCode review, terminal Checks, protected merge | +| PR batch #1025–#1030, Bolt/Palette agent optimizations and a11y/UX fixes | open, `develop` target; per-PR Checks state varies; independent approvals absent | Perf overhead removals (`rules.py` generators, dedupe), screen-reader tab guidance, ARIA busy visuals, upload proxy button | per-PR exact-head Checks, review reconciliation, protected merge | +| Central .github#1326, hourly review-repair callers minute 41 (appguardrail) / minute 44 (macos_utility_packs) | open, `main` target; contract trio + focused tests green locally (41 checks); org dispatch-target variable updated | Gives this repo its own bounded hourly RCA repair loop (G-007) | terminal Checks on the central PR, then one scheduled protected-develop consumer run as operational acceptance | | PR #1005, scan-assurance report consumer, head `d968a0e` | open, `feat/scan-assurance-927` target; local 1,047-test suite and exact core assurance coverage pass; required Checks queued; review required; qualifying approval absent | Carry qualified assurance state into buyer-facing reports and bind it to the exact findings artifact digest | current-head terminal Checks, qualifying review, protected parent/child merge order; dashboard, SARIF, and scanner-owned evidence production remain open | | PR #1006, remediation evidence handoff contract, head `949873d` | open, `develop` target; exact local 1,014-test suite, focused 100% statement/branch coverage, and CodeGraph scan pass; required Checks queued; review required; qualifying approval absent | Provide a bounded, redacted, deterministic handoff artifact for standalone/naruon/contextual-orchestrator consumers | exact-head terminal Checks and qualifying review; dashboard clipboard actions, fallback, announcements, focus, and browser E2E remain open | | PR #969, dashboard upload proxy, head `29e2469` | open, `develop` target; 24 focused dashboard tests and full 1,004-test suite pass locally; CodeGraph scan reports 0 deploy blockers; current-head required Checks are queued; current-head review requested; qualifying approval absent | Keep the native file picker programmatically usable while excluding it from the accessibility tree and preserving one visible upload action | exact-head terminal Checks, current qualifying review, qualifying approval, protected merge | @@ -152,6 +155,11 @@ non-conflicting diagnostic, documentation, or test work may proceed. Never use admin merge, force-push, review dismissal, required-check removal, fabricated runtime evidence, or a model's output as merge/release authority. +As of 2026-08-25 this repository also has its own bounded hourly caller +(central `.github#1326`, minute 41) with the dispatch-target allowlist entry +set; activation acceptance still requires one scheduled protected-develop +consumer run proving the exact `ContextualWisdomLab/appguardrail` head. + ## Standards and acceptance basis This baseline maps its delivery evidence to the following current primary From 74688cd627492c4fb39fce9e974d2947f0f16b82 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 17:10:42 +0900 Subject: [PATCH 033/192] docs(gaps): link recovered tenant-authz causal owner --- docs/product-technical-gap-baseline.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c58bd340..3cc0ee6d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -76,7 +76,8 @@ The table below is a point-in-time execution register. `queued`, `pending`, `COM | PR #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open, mergeable; repository-local Tests, Security Process, Security Scan, SAST Semgrep, Pinned HTTPS Coverage, OpenSSF Evidence Coverage, Retention Audit Coverage, and Scan path context coverage are newly queued | `_is_safe_url` preflight can be separated from the DNS decision used by a later credential-bearing `urllib` connection; detector family tracks destination, request, credential, reachability, multiline, dynamic-replacement, and unredirected-header boundaries | keep current-head control-flow regressions authoritative; do not reuse predecessor GREEN; merge only after exact-head checks and independent review | | PR #1068, empty-host / unresolved-DNS SSRF validator, head `62df0db1a831985fc34dbdc3565cfa2688facc98` | open, mergeable; causal control-plane validation now rejects empty host and DNS-resolution failure; current-head acceptance remains gated | malformed or unresolved destinations could previously cross a fail-open validation path; packaged `python-ssrf-empty-host-fail-open` preserves the reusable source-to-success-path pattern | retain historical vulnerable/fixed fixtures; require exact-head checks/review before merge; do not weaken DNS policy for dummy test domains | | PR #1036, shared-skill supply-chain detectors, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open, mergeable; repository workflows are queued/pending | malicious installable skill/agent manifests can use mixed Latin/Cyrillic identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current rules explicitly bound YAML/JSON syntax and defensive-prose false-positive edges | preserve structural-key and bounded flow-YAML regressions; current-head CI/review is required before integration | -| PR #963 / Issue #550, discarded tenant authorization context, head `c11b6e004c6477b66f04d9800c3ce7b1d10ce612` | open, mergeable; source-backed vulnerable/fixed fixtures retained; repository workflows queued | a tenant-admin permission check can be performed while the returned tenant context is discarded before global reads or tenant-sensitive mutations | keep live causal-owner repair provenance separate from the pinned regression oracle; refresh the protected-head negative oracle after canonical owner merge | +| PR #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open, mergeable; source-backed vulnerable/fixed fixtures retained; detector semantics unchanged while causal-owner traceability was refreshed; fresh repository workflows queued | a tenant-admin permission check can be performed while the returned tenant context is discarded before global reads or tenant-sensitive mutations | keep live causal-owner repair provenance separate from the pinned regression oracle; refresh the protected-head negative oracle after canonical owner merge | +| ContextualWisdomLab/clearfolio PR #541, causal owner for #550, head `1337efe45640740b338d021d64e41c045ecf7201` | open, mergeable; exact-head CI, Security Scan, SAST Semgrep, and fuzz are newly queued | concurrent head `020c0ec0337dce38cca4b7e653c5fb47fe6233c4` had reintroduced controller-local/global tenant filtering and keyless SHA-256 retry identity while deleting tenant-scoped application/repository and HMAC contracts/tests; `1337efe...` restores the complete validated predecessor tree as a normal descendant, retaining the concurrent commit in history | require fresh owner exact-head checks/review; after protected merge, refresh AppGuardrail #963 fixed-source oracle from protected Clearfolio rather than treating this open candidate as shipped truth | | Issue #309, `naruon` OpenSSF Best Practices badge | open LOW governance/posture finding; no code location and no reproducible source-to-sink path | project-security-program maturity signal, not an application vulnerability | do not manufacture a HIGH source detector; track remediation/evidence as governance posture | | Closed Issues #310/#311, Code Scanning configuration visibility | closed configuration/analysis-category findings | GitHub could not compare current-head analysis categories with the protected branch; this is an assurance-visibility defect, not a source vulnerability | retain as configuration/assurance corpus; detector work should target category/provenance drift only when executable evidence supports it | @@ -158,7 +159,8 @@ SLSA. (n.d.). *SLSA specification version 1.2*. Retrieved September 2, 2026, fro ## Next actions 1. Keep #1080, #1068, #1036, and #963 exact-head evidence separate; do not transfer predecessor GREEN or reviewer state. -2. When a current-head security review produces a reproducible FP/FN, add the smallest production `_scan_file`/runtime regression before or with the repair and retain both the vulnerable and safe oracle. -3. Advance G-06 only after the current DNS-TOCTOU family is stable enough to define an analyzer migration oracle; do not trade known coverage for architectural novelty. -4. Refresh this baseline after protected merges, causal-owner releases, materially new security corpus classes, or changes to PRD/ADR/ARCHITECTURE boundaries. -5. Do not call the baseline or product complete until the live PR/issue/source/check audit is re-run and residual gaps are explicit. \ No newline at end of file +2. Keep ContextualWisdomLab/clearfolio #541 exact-head owner evidence separate from AppGuardrail detector maturity; only refresh the fixed-source oracle after the canonical owner reaches protected merge. +3. When a current-head security review produces a reproducible FP/FN, add the smallest production `_scan_file`/runtime regression before or with the repair and retain both the vulnerable and safe oracle. +4. Advance G-06 only after the current DNS-TOCTOU family is stable enough to define an analyzer migration oracle; do not trade known coverage for architectural novelty. +5. Refresh this baseline after protected merges, causal-owner releases, materially new security corpus classes, or changes to PRD/ADR/ARCHITECTURE boundaries. +6. Do not call the baseline or product complete until the live PR/issue/source/check audit is re-run and residual gaps are explicit. \ No newline at end of file From 8e49900de379cc1bbe0294c463d74123bf543f36 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 18:18:39 +0900 Subject: [PATCH 034/192] docs(gap): add Actions poll-capacity security corpus --- docs/product-technical-gap-baseline.md | 30 +++++++++++++++----------- 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3cc0ee6d..1b03606f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -73,11 +73,13 @@ The table below is a point-in-time execution register. `queued`, `pending`, `COM | Work / corpus item | Exact observed state | Root-cause / product meaning | Gap / next safe action | | --- | --- | --- | --- | -| PR #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open, mergeable; repository-local Tests, Security Process, Security Scan, SAST Semgrep, Pinned HTTPS Coverage, OpenSSF Evidence Coverage, Retention Audit Coverage, and Scan path context coverage are newly queued | `_is_safe_url` preflight can be separated from the DNS decision used by a later credential-bearing `urllib` connection; detector family tracks destination, request, credential, reachability, multiline, dynamic-replacement, and unredirected-header boundaries | keep current-head control-flow regressions authoritative; do not reuse predecessor GREEN; merge only after exact-head checks and independent review | +| PR #1088 / Issue #1087, GitHub Actions transport-only polling bound, head `0c79c61347d0a9ecbc3cf9cb985661c412832bd0` | open, mergeable; Tests, Security Process, Security Scan, SAST Semgrep, Pinned HTTPS Coverage, OpenSSF Evidence Coverage, Retention Audit Coverage, and Scan path context coverage are all queued on the exact head | verified `ContextualWisdomLab/.github` incident: an unbounded verdict loop limited consecutive `gh api` transport failures but not the all-success/no-verdict path, allowing required-review runners to remain occupied for hours; protected owner repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` adds a 10,800-second total wall-clock bound | retain vulnerable/fixed source fixtures and FP/FN boundaries; require exact-head checks/review before merge; continue the stronger central one-shot runner-release prerequisite separately | +| ContextualWisdomLab/.github PR #1706, one-shot required-verdict runner release, head `ab0c19f70b06a23bac881a7fd232bb254cd79c7d` | reopened after an incorrect unmerged closure because protected `main` does not carry its remaining RED regression test; exact-head OSV, SAST, SBOM, Scorecard, Secret Scan, Python Security, Security Scan, and CodeQL runs are queued; PR metadata currently remains non-draft because the connected draft-state mutation returned a GraphQL schema error | protected `main@6f70174e338013fec9a000311bc72312f5d4dbf9` still polls up to a 3-hour deadline, while protected dispatch code/tests and the central product baseline already support/describe exact-run `rerun-failed-jobs`; the reopened test requires one live PR read + one review read and immediate fail-closed runner release | treat #1706 as Proposed/RED and not merge-ready; implement the production prerequisite at `.github`, reconcile obsolete poll-specific tests/docs, then require fresh exact-head CI/review; do not close the valid RED delta without complete successor carryover | +| PR #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open, mergeable; repository-local Tests, Security Process, Security Scan, SAST Semgrep, Pinned HTTPS Coverage, OpenSSF Evidence Coverage, Retention Audit Coverage, and Scan path context coverage are queued | `_is_safe_url` preflight can be separated from the DNS decision used by a later credential-bearing `urllib` connection; detector family tracks destination, request, credential, reachability, multiline, dynamic-replacement, and unredirected-header boundaries | keep current-head control-flow regressions authoritative; do not reuse predecessor GREEN; merge only after exact-head checks and independent review | | PR #1068, empty-host / unresolved-DNS SSRF validator, head `62df0db1a831985fc34dbdc3565cfa2688facc98` | open, mergeable; causal control-plane validation now rejects empty host and DNS-resolution failure; current-head acceptance remains gated | malformed or unresolved destinations could previously cross a fail-open validation path; packaged `python-ssrf-empty-host-fail-open` preserves the reusable source-to-success-path pattern | retain historical vulnerable/fixed fixtures; require exact-head checks/review before merge; do not weaken DNS policy for dummy test domains | -| PR #1036, shared-skill supply-chain detectors, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open, mergeable; repository workflows are queued/pending | malicious installable skill/agent manifests can use mixed Latin/Cyrillic identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current rules explicitly bound YAML/JSON syntax and defensive-prose false-positive edges | preserve structural-key and bounded flow-YAML regressions; current-head CI/review is required before integration | -| PR #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open, mergeable; source-backed vulnerable/fixed fixtures retained; detector semantics unchanged while causal-owner traceability was refreshed; fresh repository workflows queued | a tenant-admin permission check can be performed while the returned tenant context is discarded before global reads or tenant-sensitive mutations | keep live causal-owner repair provenance separate from the pinned regression oracle; refresh the protected-head negative oracle after canonical owner merge | -| ContextualWisdomLab/clearfolio PR #541, causal owner for #550, head `1337efe45640740b338d021d64e41c045ecf7201` | open, mergeable; exact-head CI, Security Scan, SAST Semgrep, and fuzz are newly queued | concurrent head `020c0ec0337dce38cca4b7e653c5fb47fe6233c4` had reintroduced controller-local/global tenant filtering and keyless SHA-256 retry identity while deleting tenant-scoped application/repository and HMAC contracts/tests; `1337efe...` restores the complete validated predecessor tree as a normal descendant, retaining the concurrent commit in history | require fresh owner exact-head checks/review; after protected merge, refresh AppGuardrail #963 fixed-source oracle from protected Clearfolio rather than treating this open candidate as shipped truth | +| PR #1036, shared-skill supply-chain detectors, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open, mergeable; repository workflows remain queued/pending | malicious installable skill/agent manifests can use mixed Latin/Cyrillic identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current rules explicitly bound YAML/JSON syntax and defensive-prose false-positive edges | preserve structural-key and bounded flow-YAML regressions; current-head CI/review is required before integration | +| PR #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open, mergeable; source-backed vulnerable/fixed fixtures retained; detector semantics unchanged while causal-owner traceability was refreshed | a tenant-admin permission check can be performed while the returned tenant context is discarded before global reads or tenant-sensitive mutations | keep live causal-owner repair provenance separate from the pinned regression oracle; refresh the protected-head negative oracle after canonical owner merge | +| ContextualWisdomLab/clearfolio PR #541, causal owner for #550, head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open, mergeable; descendant of security restoration `1337efe45640740b338d021d64e41c045ecf7201`; exact-head CI, Security Scan, SAST Semgrep, and fuzz are queued | concurrent `020c0ec0337dce38cca4b7e653c5fb47fe6233c4` had reintroduced controller-local/global tenant filtering and keyless SHA-256 retry identity while deleting tenant-scoped application/repository and HMAC contracts/tests; `1337efe...` restored the complete validated security tree non-destructively and `917b97...` preserves it while adding formatting/Javadoc refinements | require fresh owner exact-head checks/review; after protected merge, refresh AppGuardrail #963 fixed-source oracle from protected Clearfolio rather than treating this open candidate as shipped truth | | Issue #309, `naruon` OpenSSF Best Practices badge | open LOW governance/posture finding; no code location and no reproducible source-to-sink path | project-security-program maturity signal, not an application vulnerability | do not manufacture a HIGH source detector; track remediation/evidence as governance posture | | Closed Issues #310/#311, Code Scanning configuration visibility | closed configuration/analysis-category findings | GitHub could not compare current-head analysis categories with the protected branch; this is an assurance-visibility defect, not a source vulnerability | retain as configuration/assurance corpus; detector work should target category/provenance drift only when executable evidence supports it | @@ -108,12 +110,14 @@ Issue or registry identity can route the obligation but cannot assert pass/fail. | G-04 | Enterprise buyers need defensible retention, deletion, audit, and recovery semantics for scan evidence. | PRD retention requirements, control-plane schema/migration docs, and retention/audit assurance work. | Integrate retention/audit policy into the live control-plane store/API with tenant ownership, migration rollback, and recovery proof. | migration rehearsal, backup/restore, tenant authorization tests, immutable audit verification, release evidence | **Open.** Treat queued/partial posture checks as evidence state, not completed retention behavior. | | G-05 | Acquisition reviewers cannot yet consume one compact exact-head package spanning source, checks, provenance, causal repairs, and residual gaps. | OPERABILITY and assurance-plane contracts exist; evidence remains distributed across PRs/issues/runs. | Produce deterministic buyer evidence that separates observed, unavailable, and inferred facts and binds claims to SHA/run/artifact/release identifiers. | independently recomputable digest; no raw secrets; failed vs unavailable distinction; protected-head and post-publish smoke evidence | **Open.** This baseline is the human-readable register; it is not itself the signed buyer evidence package. | | G-06 | Security detector families with increasingly stateful regexes can diverge in control-flow/provenance semantics and create alternating FP/FN repairs. | #1080 review history repeatedly exercises destination, request, credential, reachability, branch, and mutation state across multiple rule identities. | Define a bounded Python structural/state analyzer for the shared provenance model while preserving rule IDs and regression corpus compatibility. | differential test corpus against existing family; no loss of historical positives; reviewed FP negatives remain negative; performance measured on realistic repositories | **Proposed.** Start only after the current #1080 exact-head repair set stabilizes enough to serve as migration oracle; do not replace working coverage with an unverified rewrite. | -| G-07 | The product/technical gap baseline itself can become stale while the active security corpus changes hourly. | PR #999 was based on August evidence while September security PRs and exact heads changed. | Make this document a maintained evidence register, refresh it from live GitHub state, and keep self-referential PR head outside the document. | protected merge of a current snapshot plus recurring future updates that distinguish historical snapshots from live metadata | **In progress in PR #999.** This refresh non-destructively synchronizes with current `develop` and records the 2026-09-02 security lanes. | +| G-07 | The product/technical gap baseline itself can become stale while the active security corpus changes hourly. | PR #999 was based on August evidence while September security PRs and exact heads changed. | Make this document a maintained evidence register, refresh it from live GitHub state, and keep self-referential PR head outside the document. | protected merge of a current snapshot plus recurring future updates that distinguish historical snapshots from live metadata | **In progress in PR #999.** This refresh records the 2026-09-02 security lanes and current causal-owner heads. | +| G-08 | Shared required-review/security capacity can be consumed by wait loops even when model execution belongs to a separate dispatch worker, delaying every unrelated protected PR. | `.github` incident 5c561→e293 proves transport-only retry bounds were insufficient; protected dispatch already validates exact `required_run_id` and can call `rerun-failed-jobs`, while protected required-verdict source still uses a 3-hour polling loop. Reopened #1706 contains the uncopied RED one-shot runner-release contract. | At canonical `.github`, change the required-verdict job to one authoritative live-PR read plus one paginated current-head review read, fail closed immediately when no verdict exists, and rely on the authenticated exact-run wake/rerun path after a formal receipt. | RED #1706 test becomes GREEN; obsolete polling-specific tests/docs reconciled; no real sleeps; exact-run/event/workflow/head validation retained; central exact-head CI/security/review GREEN; AppGuardrail #1088 fixed oracle still does not regress | **Proposed / prerequisite.** #1706 was reopened because its valid RED delta was closed without carryover. It must not merge until production satisfies the contract; draft-state transition remains operationally pending after a connector GraphQL schema failure. | ## Technical / TRD gaps - Built-in lightweight regex rules are valid only for explicitly tested syntax/control-flow. Structural patterns that cannot be represented safely must remain external-engine/planned or move behind an executable structural analyzer. - Detector-family state must use Python identifier case semantics while HTTP header/token semantics use protocol-appropriate case handling. +- GitHub Actions retry detectors must distinguish a per-request/transport bound from a total control-flow bound and must not infer that a sibling job's budget governs the vulnerable polling job. - Missing, queued, failed, stale, cancelled, and unavailable evidence are distinct typed states; none may become a clean result by omission. - The scanner/control/remediation/assurance boundaries are already distinct; do not create a shared database or cross-service SQL shortcut to combine them. - AppGuardrail is security tooling rather than mathematical-science code. A Rust/native component is justified only by measured security/isolation/performance evidence and must sit behind a versioned standalone contract. @@ -142,7 +146,7 @@ re-fetch PRs/issues/docs One writer owns a delta/branch at a time, but a queued review/check does not make unrelated safe implementation work stop. Re-fetch immediately before writes and preserve concurrent intent. Never use force-push, destructive rebase, self-approval, review dismissal as acceptance, required-check removal, warning suppression, fabricated runtime evidence, stale/predecessor Checks, or admin bypass. -A PR reaches zero only by protected merge or by verified complete successor carryover of every valid delta; simple closure is not completion. When a defect belongs to another ContextualWisdomLab repository or `.github`, repair and release the canonical owner first, then update the AppGuardrail regression/oracle and consumer contract rather than copying owner source or weakening a leaf gate. +A PR reaches zero only by protected merge or by verified complete successor carryover of every valid delta; simple closure is not completion. When a defect belongs to another ContextualWisdomLab repository or `.github`, repair and release the canonical owner first, then update the AppGuardrail regression/oracle and consumer contract rather than copying owner source or weakening a leaf gate. A valid RED prerequisite is preserved as Proposed/Draft until production satisfies it; it is not “complete” merely because a partial predecessor fix merged elsewhere. ## Standards and acceptance basis @@ -158,9 +162,11 @@ SLSA. (n.d.). *SLSA specification version 1.2*. Retrieved September 2, 2026, fro ## Next actions -1. Keep #1080, #1068, #1036, and #963 exact-head evidence separate; do not transfer predecessor GREEN or reviewer state. -2. Keep ContextualWisdomLab/clearfolio #541 exact-head owner evidence separate from AppGuardrail detector maturity; only refresh the fixed-source oracle after the canonical owner reaches protected merge. -3. When a current-head security review produces a reproducible FP/FN, add the smallest production `_scan_file`/runtime regression before or with the repair and retain both the vulnerable and safe oracle. -4. Advance G-06 only after the current DNS-TOCTOU family is stable enough to define an analyzer migration oracle; do not trade known coverage for architectural novelty. -5. Refresh this baseline after protected merges, causal-owner releases, materially new security corpus classes, or changes to PRD/ADR/ARCHITECTURE boundaries. -6. Do not call the baseline or product complete until the live PR/issue/source/check audit is re-run and residual gaps are explicit. \ No newline at end of file +1. Keep #1088, #1080, #1068, #1036, and #963 exact-head evidence separate; do not transfer predecessor GREEN or reviewer state. +2. Complete the `.github` G-08 prerequisite from reopened #1706: one-shot fail-closed required-verdict admission plus authenticated exact-run wake, then reconcile poll-specific tests/docs and require fresh central exact-head evidence. +3. Keep ContextualWisdomLab/clearfolio #541 exact-head owner evidence separate from AppGuardrail detector maturity; only refresh the fixed-source oracle after the canonical owner reaches protected merge. +4. When a current-head security review produces a reproducible FP/FN, add the smallest production `_scan_file`/runtime regression before or with the repair and retain both the vulnerable and safe oracle. +5. For #1088, add a sibling-job timeout/attempt/deadline adversarial regression before calling the lightweight detector complete; a bound in one job must not suppress a separate vulnerable polling job. +6. Advance G-06 only after the current DNS-TOCTOU family is stable enough to define an analyzer migration oracle; do not trade known coverage for architectural novelty. +7. Refresh this baseline after protected merges, causal-owner releases, materially new security corpus classes, or changes to PRD/ADR/ARCHITECTURE boundaries. +8. Do not call the baseline or product complete until the live PR/issue/source/check audit is re-run and residual gaps are explicit. \ No newline at end of file From d258ea5238b6c2e04958c8a0767b40eea8017806 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 19:07:26 +0900 Subject: [PATCH 035/192] docs(gaps): refresh review-runner security evidence --- docs/product-technical-gap-baseline.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1b03606f..1d40c83e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -73,8 +73,8 @@ The table below is a point-in-time execution register. `queued`, `pending`, `COM | Work / corpus item | Exact observed state | Root-cause / product meaning | Gap / next safe action | | --- | --- | --- | --- | -| PR #1088 / Issue #1087, GitHub Actions transport-only polling bound, head `0c79c61347d0a9ecbc3cf9cb985661c412832bd0` | open, mergeable; Tests, Security Process, Security Scan, SAST Semgrep, Pinned HTTPS Coverage, OpenSSF Evidence Coverage, Retention Audit Coverage, and Scan path context coverage are all queued on the exact head | verified `ContextualWisdomLab/.github` incident: an unbounded verdict loop limited consecutive `gh api` transport failures but not the all-success/no-verdict path, allowing required-review runners to remain occupied for hours; protected owner repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` adds a 10,800-second total wall-clock bound | retain vulnerable/fixed source fixtures and FP/FN boundaries; require exact-head checks/review before merge; continue the stronger central one-shot runner-release prerequisite separately | -| ContextualWisdomLab/.github PR #1706, one-shot required-verdict runner release, head `ab0c19f70b06a23bac881a7fd232bb254cd79c7d` | reopened after an incorrect unmerged closure because protected `main` does not carry its remaining RED regression test; exact-head OSV, SAST, SBOM, Scorecard, Secret Scan, Python Security, Security Scan, and CodeQL runs are queued; PR metadata currently remains non-draft because the connected draft-state mutation returned a GraphQL schema error | protected `main@6f70174e338013fec9a000311bc72312f5d4dbf9` still polls up to a 3-hour deadline, while protected dispatch code/tests and the central product baseline already support/describe exact-run `rerun-failed-jobs`; the reopened test requires one live PR read + one review read and immediate fail-closed runner release | treat #1706 as Proposed/RED and not merge-ready; implement the production prerequisite at `.github`, reconcile obsolete poll-specific tests/docs, then require fresh exact-head CI/review; do not close the valid RED delta without complete successor carryover | +| PR #1088 / Issue #1087, GitHub Actions transport-only polling bound, head `b68568a016cf7d4ba883b441d58e304aa14aa52f` | open, mergeable; Tests, Security Process, Security Scan, SAST Semgrep, Pinned HTTPS Coverage, OpenSSF Evidence Coverage, Retention Audit Coverage, and Scan path context coverage are all queued on the exact head; the latest review-derived repair makes renamed fail-closed total-deadline/attempt guards identifier-agnostic while retaining causal loop-local enforcement | verified `ContextualWisdomLab/.github` incident: an unbounded verdict loop limited consecutive `gh api` transport failures but not the all-success/no-verdict path, allowing required-review runners to remain occupied for hours; protected owner repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` adds a 10,800-second total wall-clock bound | retain vulnerable/fixed source fixtures and FP/FN boundaries; require exact-head checks/review before merge; do not treat non-enforcing clock text or sibling-job bounds as safety; continue the stronger central one-shot runner-release prerequisite separately | +| ContextualWisdomLab/.github PR #1706, one-shot required-verdict runner release, head `4a36b89d51951c604562608c3da43edec96b8db1` | open, mergeable, non-draft but explicitly Proposed/non-merge-ready; exact-head OSV, SAST, SBOM, Scorecard, Secret Scan, Python Security, Security Scan, and CodeQL runs are queued/pending; the current one-shot source-fix workflow proves the prerequisite regression is a genuine pytest RED, reconciles protected `main` non-destructively, applies deterministic repairs in-worktree, verifies focused/broader tests, removes temporary source-fix machinery before publication, refuses stale writer-head publication, and requires a workflow-triggering PAT rather than falling back to `github.token` | protected `main@6f70174e338013fec9a000311bc72312f5d4dbf9` still polls up to a 3-hour deadline, while protected dispatch code/tests and the central product baseline already support/describe exact-run `rerun-failed-jobs`; the retained RED contract requires one live PR read + one review read and immediate fail-closed runner release, and exact-run revalidation must bind a `pull_request_target` run through its PR/head payload rather than mistaking the run-level base `head_sha` for the PR head | treat #1706 as Proposed until its guarded one-shot writer publishes the production source repair and removes itself; then require the newly produced exact head's CI/security/current-head review before ordinary merge; do not race its active writer or close the valid RED delta without complete successor carryover | | PR #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open, mergeable; repository-local Tests, Security Process, Security Scan, SAST Semgrep, Pinned HTTPS Coverage, OpenSSF Evidence Coverage, Retention Audit Coverage, and Scan path context coverage are queued | `_is_safe_url` preflight can be separated from the DNS decision used by a later credential-bearing `urllib` connection; detector family tracks destination, request, credential, reachability, multiline, dynamic-replacement, and unredirected-header boundaries | keep current-head control-flow regressions authoritative; do not reuse predecessor GREEN; merge only after exact-head checks and independent review | | PR #1068, empty-host / unresolved-DNS SSRF validator, head `62df0db1a831985fc34dbdc3565cfa2688facc98` | open, mergeable; causal control-plane validation now rejects empty host and DNS-resolution failure; current-head acceptance remains gated | malformed or unresolved destinations could previously cross a fail-open validation path; packaged `python-ssrf-empty-host-fail-open` preserves the reusable source-to-success-path pattern | retain historical vulnerable/fixed fixtures; require exact-head checks/review before merge; do not weaken DNS policy for dummy test domains | | PR #1036, shared-skill supply-chain detectors, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open, mergeable; repository workflows remain queued/pending | malicious installable skill/agent manifests can use mixed Latin/Cyrillic identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current rules explicitly bound YAML/JSON syntax and defensive-prose false-positive edges | preserve structural-key and bounded flow-YAML regressions; current-head CI/review is required before integration | @@ -111,7 +111,7 @@ Issue or registry identity can route the obligation but cannot assert pass/fail. | G-05 | Acquisition reviewers cannot yet consume one compact exact-head package spanning source, checks, provenance, causal repairs, and residual gaps. | OPERABILITY and assurance-plane contracts exist; evidence remains distributed across PRs/issues/runs. | Produce deterministic buyer evidence that separates observed, unavailable, and inferred facts and binds claims to SHA/run/artifact/release identifiers. | independently recomputable digest; no raw secrets; failed vs unavailable distinction; protected-head and post-publish smoke evidence | **Open.** This baseline is the human-readable register; it is not itself the signed buyer evidence package. | | G-06 | Security detector families with increasingly stateful regexes can diverge in control-flow/provenance semantics and create alternating FP/FN repairs. | #1080 review history repeatedly exercises destination, request, credential, reachability, branch, and mutation state across multiple rule identities. | Define a bounded Python structural/state analyzer for the shared provenance model while preserving rule IDs and regression corpus compatibility. | differential test corpus against existing family; no loss of historical positives; reviewed FP negatives remain negative; performance measured on realistic repositories | **Proposed.** Start only after the current #1080 exact-head repair set stabilizes enough to serve as migration oracle; do not replace working coverage with an unverified rewrite. | | G-07 | The product/technical gap baseline itself can become stale while the active security corpus changes hourly. | PR #999 was based on August evidence while September security PRs and exact heads changed. | Make this document a maintained evidence register, refresh it from live GitHub state, and keep self-referential PR head outside the document. | protected merge of a current snapshot plus recurring future updates that distinguish historical snapshots from live metadata | **In progress in PR #999.** This refresh records the 2026-09-02 security lanes and current causal-owner heads. | -| G-08 | Shared required-review/security capacity can be consumed by wait loops even when model execution belongs to a separate dispatch worker, delaying every unrelated protected PR. | `.github` incident 5c561→e293 proves transport-only retry bounds were insufficient; protected dispatch already validates exact `required_run_id` and can call `rerun-failed-jobs`, while protected required-verdict source still uses a 3-hour polling loop. Reopened #1706 contains the uncopied RED one-shot runner-release contract. | At canonical `.github`, change the required-verdict job to one authoritative live-PR read plus one paginated current-head review read, fail closed immediately when no verdict exists, and rely on the authenticated exact-run wake/rerun path after a formal receipt. | RED #1706 test becomes GREEN; obsolete polling-specific tests/docs reconciled; no real sleeps; exact-run/event/workflow/head validation retained; central exact-head CI/security/review GREEN; AppGuardrail #1088 fixed oracle still does not regress | **Proposed / prerequisite.** #1706 was reopened because its valid RED delta was closed without carryover. It must not merge until production satisfies the contract; draft-state transition remains operationally pending after a connector GraphQL schema failure. | +| G-08 | Shared required-review/security capacity can be consumed by wait loops even when model execution belongs to a separate dispatch worker, delaying every unrelated protected PR. | `.github` incident 5c561→e293 proves transport-only retry bounds were insufficient; protected dispatch already validates an exact `required_run_id` and can call `rerun-failed-jobs`, while protected required-verdict source still uses a 3-hour polling loop. Reopened #1706 retains the RED one-shot runner-release contract and now stages a guarded deterministic source-repair publication path on its canonical writer branch. | At canonical `.github`, replace the required-verdict wait loop with one authoritative live-PR read plus one paginated current-head review read, fail closed immediately when no verdict exists, validate the exact `pull_request_target` run through its associated PR/head identity, and rely on the authenticated exact-run wake/rerun path after a formal receipt. | RED #1706 test becomes GREEN; obsolete polling-specific tests/docs reconciled; no real sleeps; exact-run/event/workflow/PR/head validation retained; temporary source-fix machinery deleted before publication; central exact-head CI/security/current-head review GREEN; AppGuardrail #1088 fixed oracle still does not regress | **Proposed / active prerequisite.** #1706 must not merge merely because its temporary writer exists: the source repair must first be published non-destructively from an unchanged writer head, the temporary machinery must disappear, and the resulting exact head must pass ordinary protection. | ## Technical / TRD gaps @@ -163,10 +163,10 @@ SLSA. (n.d.). *SLSA specification version 1.2*. Retrieved September 2, 2026, fro ## Next actions 1. Keep #1088, #1080, #1068, #1036, and #963 exact-head evidence separate; do not transfer predecessor GREEN or reviewer state. -2. Complete the `.github` G-08 prerequisite from reopened #1706: one-shot fail-closed required-verdict admission plus authenticated exact-run wake, then reconcile poll-specific tests/docs and require fresh central exact-head evidence. +2. Complete the `.github` G-08 prerequisite from reopened #1706 without racing its active canonical writer: publish the deterministic one-shot required-verdict repair only from the unchanged exact writer head, remove temporary source-fix machinery, then require fresh central exact-head evidence. 3. Keep ContextualWisdomLab/clearfolio #541 exact-head owner evidence separate from AppGuardrail detector maturity; only refresh the fixed-source oracle after the canonical owner reaches protected merge. 4. When a current-head security review produces a reproducible FP/FN, add the smallest production `_scan_file`/runtime regression before or with the repair and retain both the vulnerable and safe oracle. -5. For #1088, add a sibling-job timeout/attempt/deadline adversarial regression before calling the lightweight detector complete; a bound in one job must not suppress a separate vulnerable polling job. +5. For #1088, preserve renamed fail-closed total-deadline/attempt negatives and the non-enforcing-clock positive while exact-head `b68568a…` is validated; sibling-job timeout/attempt/deadline evidence must never suppress a separate vulnerable polling job. 6. Advance G-06 only after the current DNS-TOCTOU family is stable enough to define an analyzer migration oracle; do not trade known coverage for architectural novelty. 7. Refresh this baseline after protected merges, causal-owner releases, materially new security corpus classes, or changes to PRD/ADR/ARCHITECTURE boundaries. -8. Do not call the baseline or product complete until the live PR/issue/source/check audit is re-run and residual gaps are explicit. \ No newline at end of file +8. Do not call the baseline or product complete until the live PR/issue/source/check audit is re-run and residual gaps are explicit. From 7a2eacb3f7d0812df85e85b3d0790b5d80407b28 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 19:13:16 +0900 Subject: [PATCH 036/192] docs: refresh transport poll detector evidence --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1d40c83e..9eccb2c3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -73,7 +73,7 @@ The table below is a point-in-time execution register. `queued`, `pending`, `COM | Work / corpus item | Exact observed state | Root-cause / product meaning | Gap / next safe action | | --- | --- | --- | --- | -| PR #1088 / Issue #1087, GitHub Actions transport-only polling bound, head `b68568a016cf7d4ba883b441d58e304aa14aa52f` | open, mergeable; Tests, Security Process, Security Scan, SAST Semgrep, Pinned HTTPS Coverage, OpenSSF Evidence Coverage, Retention Audit Coverage, and Scan path context coverage are all queued on the exact head; the latest review-derived repair makes renamed fail-closed total-deadline/attempt guards identifier-agnostic while retaining causal loop-local enforcement | verified `ContextualWisdomLab/.github` incident: an unbounded verdict loop limited consecutive `gh api` transport failures but not the all-success/no-verdict path, allowing required-review runners to remain occupied for hours; protected owner repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` adds a 10,800-second total wall-clock bound | retain vulnerable/fixed source fixtures and FP/FN boundaries; require exact-head checks/review before merge; do not treat non-enforcing clock text or sibling-job bounds as safety; continue the stronger central one-shot runner-release prerequisite separately | +| PR #1088 / Issue #1087, GitHub Actions transport-only polling bound, head `cb12b27046d99c914029af656b2e47359350d186` | open, mergeable; Tests, Security Process, Security Scan, SAST Semgrep, Pinned HTTPS Coverage, OpenSSF Evidence Coverage, Retention Audit Coverage, and Scan path context coverage are queued/pending on the exact head; RED `92c4b63019d28d461ae358ea82df1bf1e53c9735` proved that uninitialized deadline/attempt-limit variables could falsely suppress a HIGH finding, and GREEN `cb12b27046d99c914029af656b2e47359350d186` now requires initialized causal total-bound state | verified `ContextualWisdomLab/.github` incident: an unbounded verdict loop limited consecutive `gh api` transport failures but not the all-success/no-verdict path, allowing required-review runners to remain occupied for hours; protected owner repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` adds a 10,800-second total wall-clock bound | retain vulnerable/fixed source fixtures and FP/FN boundaries; require exact-head checks/review before merge; do not treat non-enforcing clock text, sibling-job bounds, or comparisons against uninitialized variables as safety; continue the stronger central one-shot runner-release prerequisite separately | | ContextualWisdomLab/.github PR #1706, one-shot required-verdict runner release, head `4a36b89d51951c604562608c3da43edec96b8db1` | open, mergeable, non-draft but explicitly Proposed/non-merge-ready; exact-head OSV, SAST, SBOM, Scorecard, Secret Scan, Python Security, Security Scan, and CodeQL runs are queued/pending; the current one-shot source-fix workflow proves the prerequisite regression is a genuine pytest RED, reconciles protected `main` non-destructively, applies deterministic repairs in-worktree, verifies focused/broader tests, removes temporary source-fix machinery before publication, refuses stale writer-head publication, and requires a workflow-triggering PAT rather than falling back to `github.token` | protected `main@6f70174e338013fec9a000311bc72312f5d4dbf9` still polls up to a 3-hour deadline, while protected dispatch code/tests and the central product baseline already support/describe exact-run `rerun-failed-jobs`; the retained RED contract requires one live PR read + one review read and immediate fail-closed runner release, and exact-run revalidation must bind a `pull_request_target` run through its PR/head payload rather than mistaking the run-level base `head_sha` for the PR head | treat #1706 as Proposed until its guarded one-shot writer publishes the production source repair and removes itself; then require the newly produced exact head's CI/security/current-head review before ordinary merge; do not race its active writer or close the valid RED delta without complete successor carryover | | PR #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open, mergeable; repository-local Tests, Security Process, Security Scan, SAST Semgrep, Pinned HTTPS Coverage, OpenSSF Evidence Coverage, Retention Audit Coverage, and Scan path context coverage are queued | `_is_safe_url` preflight can be separated from the DNS decision used by a later credential-bearing `urllib` connection; detector family tracks destination, request, credential, reachability, multiline, dynamic-replacement, and unredirected-header boundaries | keep current-head control-flow regressions authoritative; do not reuse predecessor GREEN; merge only after exact-head checks and independent review | | PR #1068, empty-host / unresolved-DNS SSRF validator, head `62df0db1a831985fc34dbdc3565cfa2688facc98` | open, mergeable; causal control-plane validation now rejects empty host and DNS-resolution failure; current-head acceptance remains gated | malformed or unresolved destinations could previously cross a fail-open validation path; packaged `python-ssrf-empty-host-fail-open` preserves the reusable source-to-success-path pattern | retain historical vulnerable/fixed fixtures; require exact-head checks/review before merge; do not weaken DNS policy for dummy test domains | @@ -166,7 +166,7 @@ SLSA. (n.d.). *SLSA specification version 1.2*. Retrieved September 2, 2026, fro 2. Complete the `.github` G-08 prerequisite from reopened #1706 without racing its active canonical writer: publish the deterministic one-shot required-verdict repair only from the unchanged exact writer head, remove temporary source-fix machinery, then require fresh central exact-head evidence. 3. Keep ContextualWisdomLab/clearfolio #541 exact-head owner evidence separate from AppGuardrail detector maturity; only refresh the fixed-source oracle after the canonical owner reaches protected merge. 4. When a current-head security review produces a reproducible FP/FN, add the smallest production `_scan_file`/runtime regression before or with the repair and retain both the vulnerable and safe oracle. -5. For #1088, preserve renamed fail-closed total-deadline/attempt negatives and the non-enforcing-clock positive while exact-head `b68568a…` is validated; sibling-job timeout/attempt/deadline evidence must never suppress a separate vulnerable polling job. +5. For #1088, preserve renamed fail-closed total-deadline/attempt negatives, the non-enforcing-clock positive, and the uninitialized deadline/attempt-limit positives while exact-head `cb12b270…` is validated; sibling-job timeout/attempt/deadline evidence must never suppress a separate vulnerable polling job. 6. Advance G-06 only after the current DNS-TOCTOU family is stable enough to define an analyzer migration oracle; do not trade known coverage for architectural novelty. 7. Refresh this baseline after protected merges, causal-owner releases, materially new security corpus classes, or changes to PRD/ADR/ARCHITECTURE boundaries. -8. Do not call the baseline or product complete until the live PR/issue/source/check audit is re-run and residual gaps are explicit. +8. Do not call the baseline or product complete until the live PR/issue/source/check audit is re-run and residual gaps are explicit. \ No newline at end of file From fb54dda041b51f3452eb7a566479a9e0a8835eb5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 21:03:56 +0900 Subject: [PATCH 037/192] docs: refresh security corpus and structural analyzer gap --- docs/product-technical-gap-baseline.md | 194 +++++++++++-------------- 1 file changed, 87 insertions(+), 107 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9eccb2c3..648831b3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,172 +1,152 @@ # AppGuardrail product and technical gap baseline **Snapshot:** 2026-09-02 -**Authority:** protected `develop` documentation plus live GitHub PR/issue evidence -**Status:** working baseline; it is not a release, certification, or protected-branch capability claim +**Authority:** protected `develop` documentation plus live exact-head GitHub evidence +**Status:** working baseline; not a release, certification, or protected-branch capability claim -## Decision summary +## Goal and evidence contract -AppGuardrail is a persistent security layer for AI-assisted application development. Its buyer value is not the raw count of rules: retained security incidents must become durable, executable detection obligations with reproducible positive, negative, and inconclusive evidence, while prevention/hardening and scanner detection remain separate controls. +AppGuardrail is the ContextualWisdomLab security-defect corpus and executable detection/remediation boundary. Buyer value is not a rule count: a retained incident becomes useful only when the causal failure is reproducible, its preconditions and observable signals are explicit, safe lookalikes and equivalent misses are tested, the canonical source owner is repaired when necessary, and exact-head evidence survives ordinary protected integration. -The current delivery order is: +Issue text, registry rows, fixtures, predecessor checks, queued workflows, and model reviews are not detector truth. Executable scanner/analyzer evidence is authoritative. Runtime prevention and scanner detection are separate obligations. Missing, unavailable, stale, cancelled, failed, or inconclusive evidence never becomes `Clean Scan` by omission. -1. keep the organization security-defect corpus tied to causal source evidence rather than issue titles; -2. close high-risk detector false negatives and deployment-blocking false positives with the smallest safe test-first change; -3. repair the canonical causal owner when the defect is outside AppGuardrail, then retain that incident as AppGuardrail regression evidence; -4. make `Clean Scan` evidence-qualified rather than synonymous with zero findings; -5. make remediation, retention, audit, release provenance, and buyer evidence independently reproducible. +The development loop is: -An open PR, a queued workflow, a registry row, or a model review is not protected-branch truth. A claim becomes current only after the unchanged exact head satisfies its required Checks, current-head review-thread obligations, qualifying independent approval, and ordinary protected merge. +```text +security corpus → causal owner/root cause → RED regression → smallest safe repair +→ exact-head Checks/current-head review → ordinary protected merge/release +→ protected-owner oracle refresh → next corpus item / buyer-visible Gap +``` -## Product, technical, and architecture contract +Review, check, deployment, or release waits are non-blocking across independent safe lanes. Force push, destructive rebase, self-approval, gate weakening, warning suppression, detection bypass, stale-check reuse, and admin protection bypass are prohibited. -The accepted PRD and architecture define four separable planes: +## PRD / TRD / architecture status + +The protected PRD and `ARCHITECTURE.md` define four separable product planes: ```text -scan built-in executable detectors + optional external engines -remediate deterministic safe transforms + reviewable fix/verification guidance -control tenant-isolated scan history, drift, API keys, and webhooks -assurance SARIF, reports, SBOM, provenance, CI/release and buyer evidence +scan built-in executable detectors + provenance-preserving external engines +remediate deterministic safe transforms + reviewable verification guidance +control tenant-isolated scan/history/drift/API-key/webhook behavior +assurance SARIF, reports, SBOM, CI/release provenance and buyer evidence ``` -`docs/PRD.md` is the product-requirement authority; `docs/TRD.md` records technical contracts; `docs/UML.md` and the root `ARCHITECTURE.md` record component/control-flow structure; `docs/TRACEABILITY.md` binds controls to executable evidence; `docs/THREAT_MODEL.md`, `docs/TEST_STRATEGY.md`, and `docs/OPERABILITY.md` define abuse cases, verification, and operational proof. Existing ERD/schema material remains owned by the control-plane schema documentation; this baseline does not invent a second domain model or duplicate `ARCHITECTURE.md`. +`docs/PRD.md` remains product authority; `docs/TRD.md` records technical contracts; root `ARCHITECTURE.md` and `docs/UML.md` remain component/control-flow authorities; `docs/TRACEABILITY.md` binds defect classes to executable evidence; `docs/THREAT_MODEL.md`, `docs/TEST_STRATEGY.md`, and `docs/OPERABILITY.md` define abuse, verification and operations. This baseline does not create a competing architecture. -The protected PRD invariants require executable detector evidence, positive/negative/inconclusive tests, preserved external-engine provenance, fail-closed inconclusive handling, explicit tenant/egress boundaries, and a `Clean Scan` only after configured evidence completes successfully. Runtime prevention and scanner-detection coverage remain independent obligations. +**UML:** existing architecture/UML material remains authoritative; detector work that changes a component boundary must update it. +**ERD:** AppGuardrail detector fixtures and issue-corpus metadata are evidence artifacts, not a new transactional aggregate. Control-plane persistence remains the database authority; any new persisted evidence aggregate requires tenant ownership, lifecycle, retention/deletion, provenance, rollback and migration contracts before implementation. ## Context Map ```mermaid flowchart LR - SRC[Organization repositories and workflows\ncausal security defects] - CORPUS[AppGuardrail issue corpus\nincident identity + provenance] + SRC[ContextualWisdomLab repositories/workflows\nsecurity defects] + CORPUS[AppGuardrail issue corpus\nincident + provenance] OBL[Detection obligation\nroot cause + preconditions + signals] DET[Executable detector/analyzer] REG[Regression corpus\npositive / negative / inconclusive] - FIND[Normalized finding / SARIF] - GATE[Deploy / assurance gate] + FIND[Finding / SARIF / remediation] OWNER[Canonical causal owner\nsource/runtime/control-plane repair] - EVID[Exact-head checks + review + release evidence] + EVID[Exact-head checks + review + release] SRC --> CORPUS CORPUS --> OBL OBL --> DET REG --> DET DET --> FIND - FIND --> GATE SRC --> OWNER OWNER --> REG - DET --> EVID OWNER --> EVID + DET --> EVID ``` Responsibility boundaries: -- **AppGuardrail** owns executable detection, normalized findings, regression evidence, and remediation guidance for detectable defect classes. -- **The causal repository** owns the vulnerable application/runtime behavior and must carry the source fix when AppGuardrail is not the defect owner. -- **ContextualWisdomLab/.github** owns shared CI/review/security/release control-plane behavior; leaf repositories must not copy or weaken central controls to bypass an owner defect. -- **Optional external engines** retain their source/tool/version provenance; normalization never relabels their evidence as a built-in AppGuardrail finding. -- **Review/check infrastructure** is acceptance evidence, not product truth. A developer agent cannot self-approve or replace missing exact-head evidence with predecessor results. - -## Security-defect corpus refresh — 2026-09-02 +- **AppGuardrail** owns executable detection, normalized findings/SARIF, regression evidence, remediation and detector traceability. +- **The causal repository** owns vulnerable product/runtime behavior and must carry the source repair when AppGuardrail is not the defect owner. +- **ContextualWisdomLab/.github** owns organization CI/review/security/release control-plane behavior; leaf repositories must not copy or weaken a central control to bypass an owner defect. +- **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. +- **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -The table below is a point-in-time execution register. `queued`, `pending`, `COMMENTED`, or stale predecessor evidence is not passing evidence. +## Security-defect corpus — live 2026-09-02 snapshot -| Work / corpus item | Exact observed state | Root-cause / product meaning | Gap / next safe action | +| Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | -| PR #1088 / Issue #1087, GitHub Actions transport-only polling bound, head `cb12b27046d99c914029af656b2e47359350d186` | open, mergeable; Tests, Security Process, Security Scan, SAST Semgrep, Pinned HTTPS Coverage, OpenSSF Evidence Coverage, Retention Audit Coverage, and Scan path context coverage are queued/pending on the exact head; RED `92c4b63019d28d461ae358ea82df1bf1e53c9735` proved that uninitialized deadline/attempt-limit variables could falsely suppress a HIGH finding, and GREEN `cb12b27046d99c914029af656b2e47359350d186` now requires initialized causal total-bound state | verified `ContextualWisdomLab/.github` incident: an unbounded verdict loop limited consecutive `gh api` transport failures but not the all-success/no-verdict path, allowing required-review runners to remain occupied for hours; protected owner repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` adds a 10,800-second total wall-clock bound | retain vulnerable/fixed source fixtures and FP/FN boundaries; require exact-head checks/review before merge; do not treat non-enforcing clock text, sibling-job bounds, or comparisons against uninitialized variables as safety; continue the stronger central one-shot runner-release prerequisite separately | -| ContextualWisdomLab/.github PR #1706, one-shot required-verdict runner release, head `4a36b89d51951c604562608c3da43edec96b8db1` | open, mergeable, non-draft but explicitly Proposed/non-merge-ready; exact-head OSV, SAST, SBOM, Scorecard, Secret Scan, Python Security, Security Scan, and CodeQL runs are queued/pending; the current one-shot source-fix workflow proves the prerequisite regression is a genuine pytest RED, reconciles protected `main` non-destructively, applies deterministic repairs in-worktree, verifies focused/broader tests, removes temporary source-fix machinery before publication, refuses stale writer-head publication, and requires a workflow-triggering PAT rather than falling back to `github.token` | protected `main@6f70174e338013fec9a000311bc72312f5d4dbf9` still polls up to a 3-hour deadline, while protected dispatch code/tests and the central product baseline already support/describe exact-run `rerun-failed-jobs`; the retained RED contract requires one live PR read + one review read and immediate fail-closed runner release, and exact-run revalidation must bind a `pull_request_target` run through its PR/head payload rather than mistaking the run-level base `head_sha` for the PR head | treat #1706 as Proposed until its guarded one-shot writer publishes the production source repair and removes itself; then require the newly produced exact head's CI/security/current-head review before ordinary merge; do not race its active writer or close the valid RED delta without complete successor carryover | -| PR #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open, mergeable; repository-local Tests, Security Process, Security Scan, SAST Semgrep, Pinned HTTPS Coverage, OpenSSF Evidence Coverage, Retention Audit Coverage, and Scan path context coverage are queued | `_is_safe_url` preflight can be separated from the DNS decision used by a later credential-bearing `urllib` connection; detector family tracks destination, request, credential, reachability, multiline, dynamic-replacement, and unredirected-header boundaries | keep current-head control-flow regressions authoritative; do not reuse predecessor GREEN; merge only after exact-head checks and independent review | -| PR #1068, empty-host / unresolved-DNS SSRF validator, head `62df0db1a831985fc34dbdc3565cfa2688facc98` | open, mergeable; causal control-plane validation now rejects empty host and DNS-resolution failure; current-head acceptance remains gated | malformed or unresolved destinations could previously cross a fail-open validation path; packaged `python-ssrf-empty-host-fail-open` preserves the reusable source-to-success-path pattern | retain historical vulnerable/fixed fixtures; require exact-head checks/review before merge; do not weaken DNS policy for dummy test domains | -| PR #1036, shared-skill supply-chain detectors, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open, mergeable; repository workflows remain queued/pending | malicious installable skill/agent manifests can use mixed Latin/Cyrillic identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current rules explicitly bound YAML/JSON syntax and defensive-prose false-positive edges | preserve structural-key and bounded flow-YAML regressions; current-head CI/review is required before integration | -| PR #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open, mergeable; source-backed vulnerable/fixed fixtures retained; detector semantics unchanged while causal-owner traceability was refreshed | a tenant-admin permission check can be performed while the returned tenant context is discarded before global reads or tenant-sensitive mutations | keep live causal-owner repair provenance separate from the pinned regression oracle; refresh the protected-head negative oracle after canonical owner merge | -| ContextualWisdomLab/clearfolio PR #541, causal owner for #550, head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open, mergeable; descendant of security restoration `1337efe45640740b338d021d64e41c045ecf7201`; exact-head CI, Security Scan, SAST Semgrep, and fuzz are queued | concurrent `020c0ec0337dce38cca4b7e653c5fb47fe6233c4` had reintroduced controller-local/global tenant filtering and keyless SHA-256 retry identity while deleting tenant-scoped application/repository and HMAC contracts/tests; `1337efe...` restored the complete validated security tree non-destructively and `917b97...` preserves it while adding formatting/Javadoc refinements | require fresh owner exact-head checks/review; after protected merge, refresh AppGuardrail #963 fixed-source oracle from protected Clearfolio rather than treating this open candidate as shipped truth | -| Issue #309, `naruon` OpenSSF Best Practices badge | open LOW governance/posture finding; no code location and no reproducible source-to-sink path | project-security-program maturity signal, not an application vulnerability | do not manufacture a HIGH source detector; track remediation/evidence as governance posture | -| Closed Issues #310/#311, Code Scanning configuration visibility | closed configuration/analysis-category findings | GitHub could not compare current-head analysis categories with the protected branch; this is an assurance-visibility defect, not a source vulnerability | retain as configuration/assurance corpus; detector work should target category/provenance drift only when executable evidence supports it | - -The open security-label inventory is not the complete corpus. Closed incidents, source-side fixes, review-discovered false positives/false negatives, failed checks, and authenticated workflow evidence remain valid regression inputs when they encode a reproducible defect class. +| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, latest observed descendant `95d6afcb863a36660e0ee4191b284015c66bfaab` | open/mergeable; active review continues to expose regex control-flow/state FP/FN boundaries; predecessor Checks are not acceptance evidence | verified `ContextualWisdomLab/.github` required-review incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could hold a runner indefinitely relative to repository control flow | retain three current detector identities: historical transport-only, renamed causal transport-budget, and non-convergent bound-state mutation. The temporary shell-agnostic `break 0` HIGH companion was removed after review proved default Linux Actions fail-fast semantics can make it a blocker-class false positive. Repair remaining conditional-flow, reversed-declaration, quoted-command, and deadline-tightening findings before merge. | +| `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | +| `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but explicitly Proposed/non-merge-ready because connector draft transition failed; temporary v6 source-fix run is active on the current writer | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity. Previous source-fix exact logs showed focused event-driven GREEN followed by full-suite regression failures caused by stale/old wake-contract assumptions; current descendant repairs the temporary source writer and reruns RED→GREEN publication | do not merge the RED/source-fix machinery. Require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion, workflow-triggering publication credential, resulting exact-head central CI/security/current-head review, then ordinary merge. | +| AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | +| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, head `62df0db1a831985fc34dbdc3565cfa2688facc98` | open/mergeable | malformed or unresolved destinations could cross a fail-open validation path | preserve runtime fail-closed repair plus `python-ssrf-empty-host-fail-open` vulnerable/fixed regression; merge only on unchanged exact-head evidence. | +| AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; require exact-head CI/review. | +| AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | +| `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | +| Issue #309, `naruon` OpenSSF Best Practices badge | open LOW governance/posture; no code location or reproducible source→sink path | security-program maturity signal, not an application vulnerability | do not manufacture a HIGH source detector; track as governance evidence. | +| Closed #310/#311, Code Scanning analysis-category visibility | closed configuration/assurance findings | GitHub could not compare current analysis categories with protected branch | retain as assurance/configuration corpus; only add detector logic when executable category/provenance drift evidence exists. | + +Open `security` labels are not the whole corpus. Closed incidents, source-side fixes, review-discovered FP/FN boundaries, exact failed logs, and authenticated workflow evidence remain regression inputs when they encode a reproducible security failure class. ## Detector-development contract -For each security-relevant incident, extract and record: +Every retained security defect must record: -1. **root cause** — the security-relevant state transition or missing enforcement, not the issue title; -2. **preconditions** — data/control-flow, configuration, dependency, permission, secret, or workflow conditions required for the failure; -3. **observable signals** — evidence AppGuardrail can actually acquire without caller assertions; -4. **false-positive boundary** — safe flows that look textually similar but do not preserve the vulnerable path; -5. **false-negative boundary** — equivalent or adjacent syntax/control-flow not yet modeled; -6. **causal owner** — AppGuardrail detector, source repository/runtime, or `.github` control plane; -7. **regression evidence** — historical vulnerable incident plus fixed/negative/inconclusive oracle; -8. **acceptance evidence** — exact-head tests/security checks, current-head review, protected merge, and owner release/consumer bump where applicable. +1. **Root cause** — security-relevant state transition or missing enforcement, never title/string identity. +2. **Preconditions** — data/control-flow, configuration, dependency, permission, secret, workflow and environment conditions. +3. **Observable signals** — evidence AppGuardrail can acquire independently. +4. **False-positive boundary** — safe lookalikes, including runtime/shell/protocol semantics that make textual similarity non-causal. +5. **False-negative boundary** — equivalent syntax/control-flow not yet modeled. +6. **Causal owner** — AppGuardrail, product repository/runtime, or `.github` control plane. +7. **Regression evidence** — historical vulnerable incident plus fixed/negative/inconclusive oracle. +8. **Acceptance evidence** — unchanged exact-head tests/security checks, current-head review, protected merge, immutable owner release and consumer bump where a released owner contract is involved. -Issue or registry identity can route the obligation but cannot assert pass/fail. Where bounded regex state begins to diverge across detector-family members, prefer a small structural/state analyzer over accumulating incompatible textual exceptions; retain the historical regex fixtures as migration oracles. +Where regex families need path reachability, mutable state, shell semantics, or increasingly incompatible adjacency exceptions, stop treating another regular expression as the default answer. Preserve existing rule IDs and corpus as migration oracles and move the shared causal state into an executable structural analyzer. -## Buyer-facing gap register +## Buyer-visible Gap register -| ID | Buyer-visible gap | Current evidence | Smallest valuable slice | Exit evidence | Status / action | +| ID | Buyer-visible Gap | Current evidence | Smallest valuable slice | Exit evidence | Status | | --- | --- | --- | --- | --- | --- | -| G-01 | A buyer cannot always verify that AppGuardrail itself observed the authoritative source condition rather than receiving a caller assertion. | PRD-FR-002 and the issue-to-detection architecture require the boundary; several source-backed detector PRs now carry pinned fixtures. | Complete one detector family through `atomic cause → obligation → source identity → executable assessment → independent oracle → persisted evidence → API/report`. | positive, negative, malformed, unavailable, stale, duplicate, adversarial fixtures; production black-box path; exact source/artifact digest | **In progress.** Use the best source-backed security PR as the vertical slice; do not call open-PR evidence protected behavior. | -| G-02 | `0 findings` can overstate assurance when detectors, external tools, scope, or provenance are incomplete. | PRD invariant 10 and assurance-plane requirements define typed evidence states. | Carry `clean`, `findings_present`, `incomplete`, `failed`, and `untrusted` with scope, completion, freshness, commit, schema, and provenance across outputs. | dashboard, JSON, SARIF, reports, and deploy gate agree; missing/failed evidence never renders clean | **Open.** Keep evidence-qualified scan work separately reviewable and bind consumers to the exact findings artifact digest. | -| G-03 | A developer cannot safely transfer remediation/evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Existing remediation contracts and active handoff/UI work provide partial evidence only. | Keep a transport-neutral deterministic redacted bundle, then add CSP-safe listener-based UI actions and accessible fallback. | hostile text inert; exact copy/fallback behavior; provenance schema/digest verified on protected head | **Open.** UI work must retain CSP/accessibility evidence and avoid duplicate listeners or source-copy shortcuts. | -| G-04 | Enterprise buyers need defensible retention, deletion, audit, and recovery semantics for scan evidence. | PRD retention requirements, control-plane schema/migration docs, and retention/audit assurance work. | Integrate retention/audit policy into the live control-plane store/API with tenant ownership, migration rollback, and recovery proof. | migration rehearsal, backup/restore, tenant authorization tests, immutable audit verification, release evidence | **Open.** Treat queued/partial posture checks as evidence state, not completed retention behavior. | -| G-05 | Acquisition reviewers cannot yet consume one compact exact-head package spanning source, checks, provenance, causal repairs, and residual gaps. | OPERABILITY and assurance-plane contracts exist; evidence remains distributed across PRs/issues/runs. | Produce deterministic buyer evidence that separates observed, unavailable, and inferred facts and binds claims to SHA/run/artifact/release identifiers. | independently recomputable digest; no raw secrets; failed vs unavailable distinction; protected-head and post-publish smoke evidence | **Open.** This baseline is the human-readable register; it is not itself the signed buyer evidence package. | -| G-06 | Security detector families with increasingly stateful regexes can diverge in control-flow/provenance semantics and create alternating FP/FN repairs. | #1080 review history repeatedly exercises destination, request, credential, reachability, branch, and mutation state across multiple rule identities. | Define a bounded Python structural/state analyzer for the shared provenance model while preserving rule IDs and regression corpus compatibility. | differential test corpus against existing family; no loss of historical positives; reviewed FP negatives remain negative; performance measured on realistic repositories | **Proposed.** Start only after the current #1080 exact-head repair set stabilizes enough to serve as migration oracle; do not replace working coverage with an unverified rewrite. | -| G-07 | The product/technical gap baseline itself can become stale while the active security corpus changes hourly. | PR #999 was based on August evidence while September security PRs and exact heads changed. | Make this document a maintained evidence register, refresh it from live GitHub state, and keep self-referential PR head outside the document. | protected merge of a current snapshot plus recurring future updates that distinguish historical snapshots from live metadata | **In progress in PR #999.** This refresh records the 2026-09-02 security lanes and current causal-owner heads. | -| G-08 | Shared required-review/security capacity can be consumed by wait loops even when model execution belongs to a separate dispatch worker, delaying every unrelated protected PR. | `.github` incident 5c561→e293 proves transport-only retry bounds were insufficient; protected dispatch already validates an exact `required_run_id` and can call `rerun-failed-jobs`, while protected required-verdict source still uses a 3-hour polling loop. Reopened #1706 retains the RED one-shot runner-release contract and now stages a guarded deterministic source-repair publication path on its canonical writer branch. | At canonical `.github`, replace the required-verdict wait loop with one authoritative live-PR read plus one paginated current-head review read, fail closed immediately when no verdict exists, validate the exact `pull_request_target` run through its associated PR/head identity, and rely on the authenticated exact-run wake/rerun path after a formal receipt. | RED #1706 test becomes GREEN; obsolete polling-specific tests/docs reconciled; no real sleeps; exact-run/event/workflow/PR/head validation retained; temporary source-fix machinery deleted before publication; central exact-head CI/security/current-head review GREEN; AppGuardrail #1088 fixed oracle still does not regress | **Proposed / active prerequisite.** #1706 must not merge merely because its temporary writer exists: the source repair must first be published non-destructively from an unchanged writer head, the temporary machinery must disappear, and the resulting exact head must pass ordinary protection. | +| G-01 | A buyer cannot always prove AppGuardrail observed the authoritative source condition instead of trusting a caller assertion. | PRD detector authority plus source-backed security PRs | one end-to-end source identity → executable assessment → immutable evidence/report slice | positive/negative/malformed/unavailable/stale/adversarial cases; exact source digest and black-box production path | **In progress** | +| G-02 | `0 findings` can overstate assurance when detectors/tools/scope/provenance are incomplete. | PRD typed evidence contract | propagate `clean`, `findings_present`, `incomplete`, `failed`, `untrusted` consistently | dashboard/JSON/SARIF/report/gate agree; missing evidence never renders clean | **Open** | +| G-03 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | +| G-04 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | +| G-05 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 already needs job/run/loop identity, safety-state causality, mutation convergence, command execution and shell semantics | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; conditional branch reachability, command-vs-quoted text, declaration order, selected shell/fail-fast state, and realistic performance measured | **Proposed, now priority architecture Gap** | +| G-06 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | +| G-07 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps -- Built-in lightweight regex rules are valid only for explicitly tested syntax/control-flow. Structural patterns that cannot be represented safely must remain external-engine/planned or move behind an executable structural analyzer. -- Detector-family state must use Python identifier case semantics while HTTP header/token semantics use protocol-appropriate case handling. -- GitHub Actions retry detectors must distinguish a per-request/transport bound from a total control-flow bound and must not infer that a sibling job's budget governs the vulnerable polling job. -- Missing, queued, failed, stale, cancelled, and unavailable evidence are distinct typed states; none may become a clean result by omission. -- The scanner/control/remediation/assurance boundaries are already distinct; do not create a shared database or cross-service SQL shortcut to combine them. -- AppGuardrail is security tooling rather than mathematical-science code. A Rust/native component is justified only by measured security/isolation/performance evidence and must sit behind a versioned standalone contract. -- Future database/schema work must use descriptive two-word-or-longer names, normalized tenant ownership, migration rollback, and measured partition/locking strategy. No schema change is introduced by this document. - -## UML / ERD status +- Built-in regex rules are valid only for explicitly tested syntax/control-flow. Structural semantics not safely representable must move to an executable analyzer or remain an explicit gap. +- GitHub Actions polling analysis must distinguish per-request transport budgets from total control-flow bounds, preserve job/run/loop locality, model branch reachability, distinguish executable commands from quoted/comment text, and account for selected shell/fail-fast semantics before using shell errors as safety or vulnerability evidence. +- Safety state is causal, not nominal: initialization must precede the candidate loop; deadlines/limits/counters must converge; state in sibling/earlier loops cannot sanitize another loop. +- Missing/queued/failed/stale/cancelled/unavailable evidence are distinct typed states. +- AppGuardrail is security tooling, not mathematical-science code. Rust/native work requires measured isolation/performance justification and a versioned boundary rather than language preference alone. +- Any future database changes use normalized tenant ownership, descriptive identifiers, migration rollback and measured locking/partition strategy; this document introduces no schema. -- **UML:** root architecture and `docs/UML.md` remain the authority for scanner, findings, control-plane, and assurance interactions. Security-detector changes that alter a component boundary must update those diagrams rather than embedding a competing architecture here. -- **ERD:** control-plane persistence remains the only relevant database boundary for this baseline. Detector fixtures and issue-corpus metadata are evidence artifacts, not new transactional aggregates. Any new persisted evidence aggregate must first define tenant ownership, lifecycle, retention/deletion, provenance, and migration semantics in the canonical schema documentation. - -## Governance and development loop - -The loop is PR-first, exact-head, non-destructive, and **non-blocking across independent safe lanes**: +## Governance and next actions ```text -re-fetch PRs/issues/docs -→ review current heads and exact checks/logs -→ repair valid finding on the canonical writer branch -→ add/retain regression evidence -→ push without force -→ regenerate exact-head checks -→ while that head waits, continue another non-conflicting security lane -→ merge/auto-merge only through ordinary protection -→ re-read corpus and product gaps +re-fetch docs/issues/PRs/current heads +→ inspect reviews, unresolved threads and exact logs +→ RED regression on canonical writer +→ smallest causal repair +→ fresh exact-head Checks +→ continue another independent safe lane while waiting +→ ordinary protected merge/release only when current evidence is satisfied +→ refresh owner oracle + corpus + this baseline ``` -One writer owns a delta/branch at a time, but a queued review/check does not make unrelated safe implementation work stop. Re-fetch immediately before writes and preserve concurrent intent. Never use force-push, destructive rebase, self-approval, review dismissal as acceptance, required-check removal, warning suppression, fabricated runtime evidence, stale/predecessor Checks, or admin bypass. - -A PR reaches zero only by protected merge or by verified complete successor carryover of every valid delta; simple closure is not completion. When a defect belongs to another ContextualWisdomLab repository or `.github`, repair and release the canonical owner first, then update the AppGuardrail regression/oracle and consumer contract rather than copying owner source or weakening a leaf gate. A valid RED prerequisite is preserved as Proposed/Draft until production satisfies it; it is not “complete” merely because a partial predecessor fix merged elsewhere. +1. Continue #1088 by repairing current review blockers; do not restore the removed shell-ambiguous `break 0` HIGH rule without an executable selected-shell/fail-fast model. +2. Treat #1088's repeated regex-state divergence as the migration oracle for G-05 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. +3. Let `.github` #1706 remain Proposed until its active source-fix run produces durable owner source, full-suite GREEN and self-removal of temporary machinery; then require the resulting exact-head central protection normally. +4. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. +5. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. +6. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. ## Standards and acceptance basis -These references guide control design and acceptance evidence; they are not a claim of CSAP, SOC 2, or any other certification. - -### References (APA 7th) +These references guide control design; they are not a claim of CSAP, SOC 2, or another certification. National Institute of Standards and Technology. (2022). *Secure software development framework (SSDF) version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST Special Publication 800-218). https://doi.org/10.6028/NIST.SP.800-218 OWASP Foundation. (2025). *OWASP Application Security Verification Standard (ASVS) 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/ SLSA. (n.d.). *SLSA specification version 1.2*. Retrieved September 2, 2026, from https://slsa.dev/spec/v1.2/ - -## Next actions - -1. Keep #1088, #1080, #1068, #1036, and #963 exact-head evidence separate; do not transfer predecessor GREEN or reviewer state. -2. Complete the `.github` G-08 prerequisite from reopened #1706 without racing its active canonical writer: publish the deterministic one-shot required-verdict repair only from the unchanged exact writer head, remove temporary source-fix machinery, then require fresh central exact-head evidence. -3. Keep ContextualWisdomLab/clearfolio #541 exact-head owner evidence separate from AppGuardrail detector maturity; only refresh the fixed-source oracle after the canonical owner reaches protected merge. -4. When a current-head security review produces a reproducible FP/FN, add the smallest production `_scan_file`/runtime regression before or with the repair and retain both the vulnerable and safe oracle. -5. For #1088, preserve renamed fail-closed total-deadline/attempt negatives, the non-enforcing-clock positive, and the uninitialized deadline/attempt-limit positives while exact-head `cb12b270…` is validated; sibling-job timeout/attempt/deadline evidence must never suppress a separate vulnerable polling job. -6. Advance G-06 only after the current DNS-TOCTOU family is stable enough to define an analyzer migration oracle; do not trade known coverage for architectural novelty. -7. Refresh this baseline after protected merges, causal-owner releases, materially new security corpus classes, or changes to PRD/ADR/ARCHITECTURE boundaries. -8. Do not call the baseline or product complete until the live PR/issue/source/check audit is re-run and residual gaps are explicit. \ No newline at end of file From 988e2c364117db08dabc5ae5ad014366221ba1e1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 22:06:33 +0900 Subject: [PATCH 038/192] docs(gap): refresh unreachable poll-bound evidence --- docs/product-technical-gap-baseline.md | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 648831b3..994774b3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -72,7 +72,7 @@ Responsibility boundaries: | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | -| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, latest observed descendant `95d6afcb863a36660e0ee4191b284015c66bfaab` | open/mergeable; active review continues to expose regex control-flow/state FP/FN boundaries; predecessor Checks are not acceptance evidence | verified `ContextualWisdomLab/.github` required-review incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could hold a runner indefinitely relative to repository control flow | retain three current detector identities: historical transport-only, renamed causal transport-budget, and non-convergent bound-state mutation. The temporary shell-agnostic `break 0` HIGH companion was removed after review proved default Linux Actions fail-fast semantics can make it a blocker-class false positive. Repair remaining conditional-flow, reversed-declaration, quoted-command, and deadline-tightening findings before merge. | +| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `52ab76181f9f6a40a25a0fe1b1e628faacab9eec` | open/mergeable; current exact-head workflows regenerated; CodeQL PR run `33633556278` is `startup_failure` with zero materialized jobs while Tests/security lanes remain queued | verified `ContextualWisdomLab/.github` required-review incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could hold a runner indefinitely relative to repository control flow. Current review also proved that a textual deadline/attempt exit is not a real bound when an unconditional `continue` makes that exit unreachable. | retain four current detector identities: historical transport-only, renamed causal transport-budget, non-convergent bound-state mutation, and `github-actions-poll-bound-unreachable-exit`. Finish remaining finite-loop, independent-total-bound, executable-`$()` token and `break`/`fi` structural obligations before merge; do not transfer predecessor Checks. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but explicitly Proposed/non-merge-ready because connector draft transition failed; temporary v6 source-fix run is active on the current writer | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity. Previous source-fix exact logs showed focused event-driven GREEN followed by full-suite regression failures caused by stale/old wake-contract assumptions; current descendant repairs the temporary source writer and reruns RED→GREEN publication | do not merge the RED/source-fix machinery. Require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion, workflow-triggering publication credential, resulting exact-head central CI/security/current-head review, then ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | @@ -108,16 +108,16 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-02 | `0 findings` can overstate assurance when detectors/tools/scope/provenance are incomplete. | PRD typed evidence contract | propagate `clean`, `findings_present`, `incomplete`, `failed`, `untrusted` consistently | dashboard/JSON/SARIF/report/gate agree; missing evidence never renders clean | **Open** | | G-03 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | | G-04 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-05 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 already needs job/run/loop identity, safety-state causality, mutation convergence, command execution and shell semantics | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; conditional branch reachability, command-vs-quoted text, declaration order, selected shell/fail-fast state, and realistic performance measured | **Proposed, now priority architecture Gap** | +| G-05 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 now needs job/run/loop identity, safety-state causality, mutation convergence, reachable-exit proof, command execution and shell semantics | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; conditional branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | | G-06 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | | G-07 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps - Built-in regex rules are valid only for explicitly tested syntax/control-flow. Structural semantics not safely representable must move to an executable analyzer or remain an explicit gap. -- GitHub Actions polling analysis must distinguish per-request transport budgets from total control-flow bounds, preserve job/run/loop locality, model branch reachability, distinguish executable commands from quoted/comment text, and account for selected shell/fail-fast semantics before using shell errors as safety or vulnerability evidence. -- Safety state is causal, not nominal: initialization must precede the candidate loop; deadlines/limits/counters must converge; state in sibling/earlier loops cannot sanitize another loop. -- Missing/queued/failed/stale/cancelled/unavailable evidence are distinct typed states. +- GitHub Actions polling analysis must distinguish per-request transport budgets from total control-flow bounds, preserve job/run/loop locality, model branch and exit reachability, distinguish executable commands from quoted/comment text, and account for selected shell/fail-fast semantics before using shell errors as safety or vulnerability evidence. +- Safety state is causal, not nominal: initialization must precede the candidate loop; deadlines/limits/counters must converge; state in sibling/earlier loops cannot sanitize another loop; textual `exit` is not safety evidence when a prior unconditional transfer makes it unreachable; an independent monotonic total bound must remain authoritative even if a non-owning retry counter resets. +- Missing/queued/failed/stale/cancelled/unavailable evidence are distinct typed states. A required workflow `startup_failure` with zero jobs is control-plane/infrastructure evidence, not a source-test success or failure and never transfers from another head. - AppGuardrail is security tooling, not mathematical-science code. Rust/native work requires measured isolation/performance justification and a versioned boundary rather than language preference alone. - Any future database changes use normalized tenant ownership, descriptive identifiers, migration rollback and measured locking/partition strategy; this document introduces no schema. @@ -134,12 +134,13 @@ re-fetch docs/issues/PRs/current heads → refresh owner oracle + corpus + this baseline ``` -1. Continue #1088 by repairing current review blockers; do not restore the removed shell-ambiguous `break 0` HIGH rule without an executable selected-shell/fail-fast model. -2. Treat #1088's repeated regex-state divergence as the migration oracle for G-05 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. -3. Let `.github` #1706 remain Proposed until its active source-fix run produces durable owner source, full-suite GREEN and self-removal of temporary machinery; then require the resulting exact-head central protection normally. -4. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. -5. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. -6. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. +1. Continue #1088 by repairing current review blockers; keep the new unreachable-exit regression and companion as executable evidence, and do not restore the removed shell-ambiguous `break 0` HIGH rule without an executable selected-shell/fail-fast model. +2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-05 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. +3. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. Do not churn leaf source or reuse predecessor GREEN; central queue/startup diagnostics remain canonical-owner work. +4. Let `.github` #1706 remain Proposed until its active source-fix run produces durable owner source, full-suite GREEN and self-removal of temporary machinery; then require the resulting exact-head central protection normally. +5. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. +6. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. +7. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. ## Standards and acceptance basis From 487bf92f0b06c83cc9e93bc922471c5666642dbf Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 23:14:55 +0900 Subject: [PATCH 039/192] docs: refresh #1087 exact-head security gap evidence --- docs/product-technical-gap-baseline.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 994774b3..dc1f9548 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -72,7 +72,7 @@ Responsibility boundaries: | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | -| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `52ab76181f9f6a40a25a0fe1b1e628faacab9eec` | open/mergeable; current exact-head workflows regenerated; CodeQL PR run `33633556278` is `startup_failure` with zero materialized jobs while Tests/security lanes remain queued | verified `ContextualWisdomLab/.github` required-review incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could hold a runner indefinitely relative to repository control flow. Current review also proved that a textual deadline/attempt exit is not a real bound when an unconditional `continue` makes that exit unreachable. | retain four current detector identities: historical transport-only, renamed causal transport-budget, non-convergent bound-state mutation, and `github-actions-poll-bound-unreachable-exit`. Finish remaining finite-loop, independent-total-bound, executable-`$()` token and `break`/`fi` structural obligations before merge; do not transfer predecessor Checks. | +| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `27fbf015b499203ff35ea9c7ff424a61450b5fdf` | open/mergeable but explicitly not merge-ready; RED/contract `34bc96c40a2dbeac8909fb763968468445f2f1b5` and state-reset repair `27fbf015...` are current. CodeQL PR run `33640116203` is `startup_failure` with zero materialized jobs while Tests/security/SAST/coverage lanes remain queued | verified `ContextualWisdomLab/.github` required-review incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could hold a runner indefinitely relative to repository control flow. Review-derived detector risks now include finite-loop back-edge proof, independent monotonic total bounds, executable command-token proof, and real ownership of `break`/`exit 0` versus `fi`. | retain the four detector identities and current regression corpus. The state-reset companion now handles an independent monotonic total bound, direct post-sleep termination, and executable `gh api` token evidence. Repair the historical/generic/unreachable quoted-command boundary and historical/generic `break`/unrelated-`fi` structural boundary before merge; do not transfer predecessor Checks. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but explicitly Proposed/non-merge-ready because connector draft transition failed; temporary v6 source-fix run is active on the current writer | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity. Previous source-fix exact logs showed focused event-driven GREEN followed by full-suite regression failures caused by stale/old wake-contract assumptions; current descendant repairs the temporary source writer and reruns RED→GREEN publication | do not merge the RED/source-fix machinery. Require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion, workflow-triggering publication credential, resulting exact-head central CI/security/current-head review, then ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | @@ -108,8 +108,8 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-02 | `0 findings` can overstate assurance when detectors/tools/scope/provenance are incomplete. | PRD typed evidence contract | propagate `clean`, `findings_present`, `incomplete`, `failed`, `untrusted` consistently | dashboard/JSON/SARIF/report/gate agree; missing evidence never renders clean | **Open** | | G-03 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | | G-04 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-05 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 now needs job/run/loop identity, safety-state causality, mutation convergence, reachable-exit proof, command execution and shell semantics | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; conditional branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | -| G-06 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | +| G-05 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 exact head `27fbf015...` now carries RED migration oracles for independent total bounds, post-sleep finite termination, quoted command substitution and unrelated-`fi` ownership | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; conditional branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | +| G-06 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and now includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | | G-07 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -134,9 +134,9 @@ re-fetch docs/issues/PRs/current heads → refresh owner oracle + corpus + this baseline ``` -1. Continue #1088 by repairing current review blockers; keep the new unreachable-exit regression and companion as executable evidence, and do not restore the removed shell-ambiguous `break 0` HIGH rule without an executable selected-shell/fail-fast model. +1. Continue #1088 from RED `34bc96c...`: state-reset finite-loop/independent-bound/quoted-command semantics are repaired on `27fbf015...`, but historical/generic/unreachable executable-token proof and historical/generic `break`/unrelated-`fi` ownership remain blocking production obligations. 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-05 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. -3. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. Do not churn leaf source or reuse predecessor GREEN; central queue/startup diagnostics remain canonical-owner work. +3. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. 4. Let `.github` #1706 remain Proposed until its active source-fix run produces durable owner source, full-suite GREEN and self-removal of temporary machinery; then require the resulting exact-head central protection normally. 5. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. 6. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. @@ -150,4 +150,4 @@ National Institute of Standards and Technology. (2022). *Secure software develop OWASP Foundation. (2025). *OWASP Application Security Verification Standard (ASVS) 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/ -SLSA. (n.d.). *SLSA specification version 1.2*. Retrieved September 2, 2026, from https://slsa.dev/spec/v1.2/ +SLSA. (n.d.). *SLSA specification version 1.2*. Retrieved September 2, 2026, from https://slsa.dev/spec/v1.2/ \ No newline at end of file From ad55a2ec5e77adf0ee14f30f5d2e089901ee8760 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 23:24:15 +0900 Subject: [PATCH 040/192] docs: record exact-log SSRF test RCA --- docs/product-technical-gap-baseline.md | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index dc1f9548..08532d2e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -74,10 +74,10 @@ Responsibility boundaries: | --- | --- | --- | --- | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `27fbf015b499203ff35ea9c7ff424a61450b5fdf` | open/mergeable but explicitly not merge-ready; RED/contract `34bc96c40a2dbeac8909fb763968468445f2f1b5` and state-reset repair `27fbf015...` are current. CodeQL PR run `33640116203` is `startup_failure` with zero materialized jobs while Tests/security/SAST/coverage lanes remain queued | verified `ContextualWisdomLab/.github` required-review incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could hold a runner indefinitely relative to repository control flow. Review-derived detector risks now include finite-loop back-edge proof, independent monotonic total bounds, executable command-token proof, and real ownership of `break`/`exit 0` versus `fi`. | retain the four detector identities and current regression corpus. The state-reset companion now handles an independent monotonic total bound, direct post-sleep termination, and executable `gh api` token evidence. Repair the historical/generic/unreachable quoted-command boundary and historical/generic `break`/unrelated-`fi` structural boundary before merge; do not transfer predecessor Checks. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | -| `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but explicitly Proposed/non-merge-ready because connector draft transition failed; temporary v6 source-fix run is active on the current writer | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity. Previous source-fix exact logs showed focused event-driven GREEN followed by full-suite regression failures caused by stale/old wake-contract assumptions; current descendant repairs the temporary source writer and reruns RED→GREEN publication | do not merge the RED/source-fix machinery. Require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion, workflow-triggering publication credential, resulting exact-head central CI/security/current-head review, then ordinary merge. | +| `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | -| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, head `62df0db1a831985fc34dbdc3565cfa2688facc98` | open/mergeable | malformed or unresolved destinations could cross a fail-open validation path | preserve runtime fail-closed repair plus `python-ssrf-empty-host-fail-open` vulnerable/fixed regression; merge only on unchanged exact-head evidence. | -| AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; require exact-head CI/review. | +| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `5b79be8144f0444535ab12290851b7f8afe28538` | open/mergeable. Predecessor `62df0db...` exact Tests and Pinned HTTPS failed the same redirect test; current descendant repairs the test fixture and has fresh checks queued | malformed/unresolved destinations previously crossed fail-open validation. The production fix correctly makes unresolved DNS non-public; the failed test still depended on unresolved `hooks.example.com`, so Tests reported `1 failed, 1034 passed` and Pinned HTTPS `1 failed, 121 passed`. This was test-fixture drift, not a reason to loosen validation. | keep runtime fail-closed and `python-ssrf-empty-host-fail-open`. Current test stubs DNS to deterministic public `8.8.8.8` while retaining the hostname redirect scenario. Require new exact-head Tests/Pinned HTTPS/security/review GREEN; never reuse predecessor successes. | +| AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows are now terminal-success and review threads are resolved, but no qualifying independent `APPROVED` review is present and REST reports `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; do not self-approve or bypass the remaining protected review gate. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | | Issue #309, `naruon` OpenSSF Best Practices badge | open LOW governance/posture; no code location or reproducible source→sink path | security-program maturity signal, not an application vulnerability | do not manufacture a HIGH source detector; track as governance evidence. | @@ -108,8 +108,8 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-02 | `0 findings` can overstate assurance when detectors/tools/scope/provenance are incomplete. | PRD typed evidence contract | propagate `clean`, `findings_present`, `incomplete`, `failed`, `untrusted` consistently | dashboard/JSON/SARIF/report/gate agree; missing evidence never renders clean | **Open** | | G-03 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | | G-04 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-05 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 exact head `27fbf015...` now carries RED migration oracles for independent total bounds, post-sleep finite termination, quoted command substitution and unrelated-`fi` ownership | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; conditional branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | -| G-06 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and now includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | +| G-05 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 exact head `27fbf015...` carries RED migration oracles for independent total bounds, post-sleep finite termination, quoted command substitution and unrelated-`fi` ownership | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; conditional branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | +| G-06 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | | G-07 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -117,6 +117,7 @@ Where regex families need path reachability, mutable state, shell semantics, or - Built-in regex rules are valid only for explicitly tested syntax/control-flow. Structural semantics not safely representable must move to an executable analyzer or remain an explicit gap. - GitHub Actions polling analysis must distinguish per-request transport budgets from total control-flow bounds, preserve job/run/loop locality, model branch and exit reachability, distinguish executable commands from quoted/comment text, and account for selected shell/fail-fast semantics before using shell errors as safety or vulnerability evidence. - Safety state is causal, not nominal: initialization must precede the candidate loop; deadlines/limits/counters must converge; state in sibling/earlier loops cannot sanitize another loop; textual `exit` is not safety evidence when a prior unconditional transfer makes it unreachable; an independent monotonic total bound must remain authoritative even if a non-owning retry counter resets. +- URL-validation tests that prove a public resolved hostname must control DNS deterministically. Reserved/example hostnames are not evidence that production should accept unresolved destinations. - Missing/queued/failed/stale/cancelled/unavailable evidence are distinct typed states. A required workflow `startup_failure` with zero jobs is control-plane/infrastructure evidence, not a source-test success or failure and never transfers from another head. - AppGuardrail is security tooling, not mathematical-science code. Rust/native work requires measured isolation/performance justification and a versioned boundary rather than language preference alone. - Any future database changes use normalized tenant ownership, descriptive identifiers, migration rollback and measured locking/partition strategy; this document introduces no schema. @@ -136,11 +137,12 @@ re-fetch docs/issues/PRs/current heads 1. Continue #1088 from RED `34bc96c...`: state-reset finite-loop/independent-bound/quoted-command semantics are repaired on `27fbf015...`, but historical/generic/unreachable executable-token proof and historical/generic `break`/unrelated-`fi` ownership remain blocking production obligations. 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-05 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. -3. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. -4. Let `.github` #1706 remain Proposed until its active source-fix run produces durable owner source, full-suite GREEN and self-removal of temporary machinery; then require the resulting exact-head central protection normally. -5. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. -6. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. -7. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. +3. Revalidate #1068 on exact head `5b79be8144f...`; the prior Tests and Pinned HTTPS failures were the same stale unresolved-domain test fixture and are repaired without weakening fail-closed DNS policy. +4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. +5. Do not self-approve #1036: its eight repository-owned workflows are GREEN and threads are resolved, but it remains protection-blocked without a qualifying independent approval. +6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. +7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. +8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. ## Standards and acceptance basis @@ -150,4 +152,4 @@ National Institute of Standards and Technology. (2022). *Secure software develop OWASP Foundation. (2025). *OWASP Application Security Verification Standard (ASVS) 5.0.0*. https://owasp.org/www-project-application-security-verification-standard/ -SLSA. (n.d.). *SLSA specification version 1.2*. Retrieved September 2, 2026, from https://slsa.dev/spec/v1.2/ \ No newline at end of file +SLSA. (n.d.). *SLSA specification version 1.2*. Retrieved September 2, 2026, from https://slsa.dev/spec/v1.2/ From b3b7fa00e5c1f021aa6082d8654e16b2dfec364e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 08:03:31 +0900 Subject: [PATCH 041/192] docs: record hostless SSRF successor consolidation --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 08532d2e..5066b6fa 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-02 +**Snapshot:** 2026-09-07 **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,7 +68,7 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-02 snapshot +## Security-defect corpus — live 2026-09-07 snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | @@ -76,7 +76,7 @@ Responsibility boundaries: | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | -| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `5b79be8144f0444535ab12290851b7f8afe28538` | open/mergeable. Predecessor `62df0db...` exact Tests and Pinned HTTPS failed the same redirect test; current descendant repairs the test fixture and has fresh checks queued | malformed/unresolved destinations previously crossed fail-open validation. The production fix correctly makes unresolved DNS non-public; the failed test still depended on unresolved `hooks.example.com`, so Tests reported `1 failed, 1034 passed` and Pinned HTTPS `1 failed, 121 passed`. This was test-fixture drift, not a reason to loosen validation. | keep runtime fail-closed and `python-ssrf-empty-host-fail-open`. Current test stubs DNS to deterministic public `8.8.8.8` while retaining the hostname redirect scenario. Require new exact-head Tests/Pinned HTTPS/security/review GREEN; never reuse predecessor successes. | +| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` | open/mergeable/Draft. Eight repository-local exact-head workflows are terminal success; CodeQL PR `33996585942` dispatched successfully but remains `VERDICT_STATE=pending`, so its deliberate failed handoff is not terminal acceptance. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows are now terminal-success and review threads are resolved, but no qualifying independent `APPROVED` review is present and REST reports `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; do not self-approve or bypass the remaining protected review gate. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | @@ -137,7 +137,7 @@ re-fetch docs/issues/PRs/current heads 1. Continue #1088 from RED `34bc96c...`: state-reset finite-loop/independent-bound/quoted-command semantics are repaired on `27fbf015...`, but historical/generic/unreachable executable-token proof and historical/generic `break`/unrelated-`fi` ownership remain blocking production obligations. 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-05 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. -3. Revalidate #1068 on exact head `5b79be8144f...`; the prior Tests and Pinned HTTPS failures were the same stale unresolved-domain test fixture and are repaired without weakening fail-closed DNS policy. +3. Keep #1068 on exact head `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` as the single Draft hostless/unresolved-DNS lane. Eight repository workflows are GREEN, but CodeQL is still an authenticated-dispatch `pending` handoff, no independent approval exists, and one detector thread remains unresolved; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. 5. Do not self-approve #1036: its eight repository-owned workflows are GREEN and threads are resolved, but it remains protection-blocked without a qualifying independent approval. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. From 99c7a769bd5c3d9a305cfcb911cb500be6f2b7ce Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 08:06:53 +0900 Subject: [PATCH 042/192] docs: add dashboard injection security lane --- docs/product-technical-gap-baseline.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5066b6fa..e26fa326 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -76,6 +76,7 @@ Responsibility boundaries: | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | +| AppGuardrail #1117, dashboard scan-history attribute injection, exact head `b382f528b2b4fc3815f4fe8f3c554ccf93eb1db7` | open/mergeable/Draft; zero unresolved review threads after the current test-only repairs. All nine repository workflows are newly queued/pending and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; count fields also require numeric coercion before interpolation. The branch escapes the id, coerces counts, and uses a real Chromium regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | | AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` | open/mergeable/Draft. Eight repository-local exact-head workflows are terminal success; CodeQL PR `33996585942` dispatched successfully but remains `VERDICT_STATE=pending`, so its deliberate failed handoff is not terminal acceptance. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows are now terminal-success and review threads are resolved, but no qualifying independent `APPROVED` review is present and REST reports `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; do not self-approve or bypass the remaining protected review gate. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | @@ -144,6 +145,7 @@ re-fetch docs/issues/PRs/current heads 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. +9. Keep #1117 at exact head `b382f528b2b4fc3815f4fe8f3c554ccf93eb1db7` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. ## Standards and acceptance basis These references guide control design; they are not a claim of CSAP, SOC 2, or another certification. From 4649db0656d4d96f556259595bb94e83ed6646f4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 08:56:40 +0900 Subject: [PATCH 043/192] docs: refresh dashboard XSS exact-head evidence --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e26fa326..ffad89cb 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -76,7 +76,7 @@ Responsibility boundaries: | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | -| AppGuardrail #1117, dashboard scan-history attribute injection, exact head `b382f528b2b4fc3815f4fe8f3c554ccf93eb1db7` | open/mergeable/Draft; zero unresolved review threads after the current test-only repairs. All nine repository workflows are newly queued/pending and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; count fields also require numeric coercion before interpolation. The branch escapes the id, coerces counts, and uses a real Chromium regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | +| AppGuardrail #1117, dashboard scan-history attribute injection, exact head `be303c20ad557d4b3dfb10c90cf5cfb56a0f7063` | open/mergeable/Draft; zero unresolved review threads after the current test-only repairs. All nine repository workflows are newly queued/pending and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; count fields also require numeric coercion before interpolation. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `be303c20...` preserves the CI delta and restores both reviewed test invariants. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | | AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` | open/mergeable/Draft. Eight repository-local exact-head workflows are terminal success; CodeQL PR `33996585942` dispatched successfully but remains `VERDICT_STATE=pending`, so its deliberate failed handoff is not terminal acceptance. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows are now terminal-success and review threads are resolved, but no qualifying independent `APPROVED` review is present and REST reports `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; do not self-approve or bypass the remaining protected review gate. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | @@ -145,7 +145,7 @@ re-fetch docs/issues/PRs/current heads 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. -9. Keep #1117 at exact head `b382f528b2b4fc3815f4fe8f3c554ccf93eb1db7` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. +9. Keep #1117 at exact head `be303c20ad557d4b3dfb10c90cf5cfb56a0f7063` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. ## Standards and acceptance basis These references guide control design; they are not a claim of CSAP, SOC 2, or another certification. From 873ae16d903052a6ff71f34ea51671854035072f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 08:57:03 +0900 Subject: [PATCH 044/192] docs: correct exact-head review gate evidence --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ffad89cb..a5be20eb 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -78,7 +78,7 @@ Responsibility boundaries: | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | | AppGuardrail #1117, dashboard scan-history attribute injection, exact head `be303c20ad557d4b3dfb10c90cf5cfb56a0f7063` | open/mergeable/Draft; zero unresolved review threads after the current test-only repairs. All nine repository workflows are newly queued/pending and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; count fields also require numeric coercion before interpolation. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `be303c20...` preserves the CI delta and restores both reviewed test invariants. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | | AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` | open/mergeable/Draft. Eight repository-local exact-head workflows are terminal success; CodeQL PR `33996585942` dispatched successfully but remains `VERDICT_STATE=pending`, so its deliberate failed handoff is not terminal acceptance. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | -| AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows are now terminal-success and review threads are resolved, but no qualifying independent `APPROVED` review is present and REST reports `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; do not self-approve or bypass the remaining protected review gate. | +| AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows are terminal-success, all review threads are resolved, and Noema records an independent SHA-bound `APPROVED` review, but required OpenCode and Strix attempt-2 jobs remain queued and REST reports `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after OpenCode and Strix reach terminal success under ordinary protection. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | | Issue #309, `naruon` OpenSSF Best Practices badge | open LOW governance/posture; no code location or reproducible source→sink path | security-program maturity signal, not an application vulnerability | do not manufacture a HIGH source detector; track as governance evidence. | @@ -140,7 +140,7 @@ re-fetch docs/issues/PRs/current heads 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-05 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. 3. Keep #1068 on exact head `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` as the single Draft hostless/unresolved-DNS lane. Eight repository workflows are GREEN, but CodeQL is still an authenticated-dispatch `pending` handoff, no independent approval exists, and one detector thread remains unresolved; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. -5. Do not self-approve #1036: its eight repository-owned workflows are GREEN and threads are resolved, but it remains protection-blocked without a qualifying independent approval. +5. Keep #1036's existing squash auto-merge: eight repository workflows, resolved threads, and exact-SHA Noema approval are present, while attempt-2 OpenCode and Strix jobs remain queued; do not bypass those required workflows. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. From 4c5e83ed9aee4cd687495de870be855b8b3fd404 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:00:01 +0900 Subject: [PATCH 045/192] docs: record summary-count XSS successor lane --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a5be20eb..9d9d7da9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -76,7 +76,7 @@ Responsibility boundaries: | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | -| AppGuardrail #1117, dashboard scan-history attribute injection, exact head `be303c20ad557d4b3dfb10c90cf5cfb56a0f7063` | open/mergeable/Draft; zero unresolved review threads after the current test-only repairs. All nine repository workflows are newly queued/pending and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; count fields also require numeric coercion before interpolation. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `be303c20...` preserves the CI delta and restores both reviewed test invariants. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | +| AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads after the current test-only repairs. All nine repository workflows are newly queued/pending and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | | AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` | open/mergeable/Draft. Eight repository-local exact-head workflows are terminal success; CodeQL PR `33996585942` dispatched successfully but remains `VERDICT_STATE=pending`, so its deliberate failed handoff is not terminal acceptance. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows are terminal-success, all review threads are resolved, and Noema records an independent SHA-bound `APPROVED` review, but required OpenCode and Strix attempt-2 jobs remain queued and REST reports `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after OpenCode and Strix reach terminal success under ordinary protection. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | @@ -145,7 +145,7 @@ re-fetch docs/issues/PRs/current heads 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. -9. Keep #1117 at exact head `be303c20ad557d4b3dfb10c90cf5cfb56a0f7063` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. +9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. ## Standards and acceptance basis These references guide control design; they are not a claim of CSAP, SOC 2, or another certification. From 26a7e6624085e303e9d034a36c677759927d310f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:04:45 +0900 Subject: [PATCH 046/192] docs: record Actions release-queue RCA --- docs/product-technical-gap-baseline.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 9d9d7da9..022f1143 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -76,9 +76,10 @@ Responsibility boundaries: | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | -| AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads after the current test-only repairs. All nine repository workflows are newly queued/pending and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | +| AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. Exact-head Tests plus OpenSSF, scan-path, pinned-HTTPS and retention coverage are terminal success; Security Process, Security Scan, SAST and CodeQL remain queued, and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | | AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` | open/mergeable/Draft. Eight repository-local exact-head workflows are terminal success; CodeQL PR `33996585942` dispatched successfully but remains `VERDICT_STATE=pending`, so its deliberate failed handoff is not terminal acceptance. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows are terminal-success, all review threads are resolved, and Noema records an independent SHA-bound `APPROVED` review, but required OpenCode and Strix attempt-2 jobs remain queued and REST reports `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after OpenCode and Strix reach terminal success under ordinary protection. | +| AppGuardrail #1111, repository Actions queue/consolidation, exact head `784b9903bcfa419c5c117f06041624755dc13321` | open/mergeable with ordinary squash auto-merge enabled; fresh Tests/Security/SAST/CodeQL are queued and no qualifying approval is present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract now requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | | Issue #309, `naruon` OpenSSF Best Practices badge | open LOW governance/posture; no code location or reproducible source→sink path | security-program maturity signal, not an application vulnerability | do not manufacture a HIGH source detector; track as governance evidence. | From f65307854b4f726f27204096e15a7ef1c2818c40 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:08:00 +0900 Subject: [PATCH 047/192] docs: refresh #1068 source-neutral exact head --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 022f1143..6d6dd7c9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -77,7 +77,7 @@ Responsibility boundaries: | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | | AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. Exact-head Tests plus OpenSSF, scan-path, pinned-HTTPS and retention coverage are terminal success; Security Process, Security Scan, SAST and CodeQL remain queued, and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | -| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` | open/mergeable/Draft. Eight repository-local exact-head workflows are terminal success; CodeQL PR `33996585942` dispatched successfully but remains `VERDICT_STATE=pending`, so its deliberate failed handoff is not terminal acceptance. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | +| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `5897711198b148ae5e5b85ff4308ff0b4d387487` | open/mergeable/Draft. Fresh comparison from `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` is ahead 1 / behind 0 with zero changed files, so the concurrent head is source-neutral rather than a security delta. On the current exact head, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success; Security Scan, SAST Semgrep and CodeQL are queued. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows are terminal-success, all review threads are resolved, and Noema records an independent SHA-bound `APPROVED` review, but required OpenCode and Strix attempt-2 jobs remain queued and REST reports `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after OpenCode and Strix reach terminal success under ordinary protection. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `784b9903bcfa419c5c117f06041624755dc13321` | open/mergeable with ordinary squash auto-merge enabled; fresh Tests/Security/SAST/CodeQL are queued and no qualifying approval is present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract now requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | @@ -139,7 +139,7 @@ re-fetch docs/issues/PRs/current heads 1. Continue #1088 from RED `34bc96c...`: state-reset finite-loop/independent-bound/quoted-command semantics are repaired on `27fbf015...`, but historical/generic/unreachable executable-token proof and historical/generic `break`/unrelated-`fi` ownership remain blocking production obligations. 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-05 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. -3. Keep #1068 on exact head `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` as the single Draft hostless/unresolved-DNS lane. Eight repository workflows are GREEN, but CodeQL is still an authenticated-dispatch `pending` handoff, no independent approval exists, and one detector thread remains unresolved; #1128 is retired only by verified complete carryover. +3. Keep #1068 on source-neutral exact head `5897711198b148ae5e5b85ff4308ff0b4d387487` as the single Draft hostless/unresolved-DNS lane. Six repository workflows are GREEN; Security Scan, SAST Semgrep and CodeQL are queued, no independent approval exists, and one detector thread remains unresolved; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. 5. Keep #1036's existing squash auto-merge: eight repository workflows, resolved threads, and exact-SHA Noema approval are present, while attempt-2 OpenCode and Strix jobs remain queued; do not bypass those required workflows. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. From 5272debb60ca1c23f06b1cd9150ffab53bbb2d12 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:10:07 +0900 Subject: [PATCH 048/192] docs: restore stable Gap identities --- docs/product-technical-gap-baseline.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6d6dd7c9..297b5dd1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -108,11 +108,12 @@ Where regex families need path reachability, mutable state, shell semantics, or | --- | --- | --- | --- | --- | --- | | G-01 | A buyer cannot always prove AppGuardrail observed the authoritative source condition instead of trusting a caller assertion. | PRD detector authority plus source-backed security PRs | one end-to-end source identity → executable assessment → immutable evidence/report slice | positive/negative/malformed/unavailable/stale/adversarial cases; exact source digest and black-box production path | **In progress** | | G-02 | `0 findings` can overstate assurance when detectors/tools/scope/provenance are incomplete. | PRD typed evidence contract | propagate `clean`, `findings_present`, `incomplete`, `failed`, `untrusted` consistently | dashboard/JSON/SARIF/report/gate agree; missing evidence never renders clean | **Open** | -| G-03 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | -| G-04 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-05 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 exact head `27fbf015...` carries RED migration oracles for independent total bounds, post-sleep finite termination, quoted command substitution and unrelated-`fi` ownership | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; conditional branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | -| G-06 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-07 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-03 | A developer cannot safely transfer remediation/evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928 remains open; PR #1006 at exact head `f591d6d3136ae2bee118c2f1b68dd68b08a5d26f` is active-PR evidence for a transport-neutral, deterministic, redacted and digest-verified JSON contract, while the dashboard UI slice remains explicitly separate. | retain the standalone versioned bundle boundary; then add CSP-safe listener-based copy actions, accessible fallback/live-region behavior, focus handling and browser E2E after the design/Storybook gate | hostile text remains inert; no duplicate listeners; exact success/rejection/fallback behavior; provenance schema and digest verified on an unchanged protected head | **Open / active in #1006** | +| G-04 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | +| G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | +| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 exact head `27fbf015...` carries RED migration oracles for independent total bounds, post-sleep finite termination, quoted command substitution and unrelated-`fi` ownership | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; conditional branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | +| G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -138,7 +139,7 @@ re-fetch docs/issues/PRs/current heads ``` 1. Continue #1088 from RED `34bc96c...`: state-reset finite-loop/independent-bound/quoted-command semantics are repaired on `27fbf015...`, but historical/generic/unreachable executable-token proof and historical/generic `break`/unrelated-`fi` ownership remain blocking production obligations. -2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-05 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. +2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. 3. Keep #1068 on source-neutral exact head `5897711198b148ae5e5b85ff4308ff0b4d387487` as the single Draft hostless/unresolved-DNS lane. Six repository workflows are GREEN; Security Scan, SAST Semgrep and CodeQL are queued, no independent approval exists, and one detector thread remains unresolved; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. 5. Keep #1036's existing squash auto-merge: eight repository workflows, resolved threads, and exact-SHA Noema approval are present, while attempt-2 OpenCode and Strix jobs remain queued; do not bypass those required workflows. From fceb8dffa354ba6e6927865b4c4ce87eeee35305 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:11:07 +0900 Subject: [PATCH 049/192] docs: record #1068 CodeQL pending handoff --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 297b5dd1..48f27e2a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -77,7 +77,7 @@ Responsibility boundaries: | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | | AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. Exact-head Tests plus OpenSSF, scan-path, pinned-HTTPS and retention coverage are terminal success; Security Process, Security Scan, SAST and CodeQL remain queued, and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | -| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `5897711198b148ae5e5b85ff4308ff0b4d387487` | open/mergeable/Draft. Fresh comparison from `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` is ahead 1 / behind 0 with zero changed files, so the concurrent head is source-neutral rather than a security delta. On the current exact head, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success; Security Scan, SAST Semgrep and CodeQL are queued. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | +| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `5897711198b148ae5e5b85ff4308ff0b4d387487` | open/mergeable/Draft. Fresh comparison from `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` is ahead 1 / behind 0 with zero changed files, so the concurrent head is source-neutral rather than a security delta. On the current exact head, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success. CodeQL PR run `34065835006`, Python job `101578209369`, dispatched successfully and then deliberately failed with `VERDICT_STATE=pending` until the authenticated terminal verdict reruns that exact job; Security Scan and SAST Semgrep remain queued. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows are terminal-success, all review threads are resolved, and Noema records an independent SHA-bound `APPROVED` review, but required OpenCode and Strix attempt-2 jobs remain queued and REST reports `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after OpenCode and Strix reach terminal success under ordinary protection. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `784b9903bcfa419c5c117f06041624755dc13321` | open/mergeable with ordinary squash auto-merge enabled; fresh Tests/Security/SAST/CodeQL are queued and no qualifying approval is present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract now requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | @@ -140,7 +140,7 @@ re-fetch docs/issues/PRs/current heads 1. Continue #1088 from RED `34bc96c...`: state-reset finite-loop/independent-bound/quoted-command semantics are repaired on `27fbf015...`, but historical/generic/unreachable executable-token proof and historical/generic `break`/unrelated-`fi` ownership remain blocking production obligations. 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. -3. Keep #1068 on source-neutral exact head `5897711198b148ae5e5b85ff4308ff0b4d387487` as the single Draft hostless/unresolved-DNS lane. Six repository workflows are GREEN; Security Scan, SAST Semgrep and CodeQL are queued, no independent approval exists, and one detector thread remains unresolved; #1128 is retired only by verified complete carryover. +3. Keep #1068 on source-neutral exact head `5897711198b148ae5e5b85ff4308ff0b4d387487` as the single Draft hostless/unresolved-DNS lane. Six repository workflows are GREEN; CodeQL exact logs show successful dispatch followed by the fail-closed `VERDICT_STATE=pending` handoff, Security Scan and SAST Semgrep are queued, no independent approval exists, and one detector thread remains unresolved; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. 5. Keep #1036's existing squash auto-merge: eight repository workflows, resolved threads, and exact-SHA Noema approval are present, while attempt-2 OpenCode and Strix jobs remain queued; do not bypass those required workflows. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. From 8122cbb200cdb482566549919103341fe9b0fee4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:53:51 +0900 Subject: [PATCH 050/192] docs: refresh exact-head review evidence --- docs/product-technical-gap-baseline.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 48f27e2a..629e04b9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -76,9 +76,9 @@ Responsibility boundaries: | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | -| AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. Exact-head Tests plus OpenSSF, scan-path, pinned-HTTPS and retention coverage are terminal success; Security Process, Security Scan, SAST and CodeQL remain queued, and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | -| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `5897711198b148ae5e5b85ff4308ff0b4d387487` | open/mergeable/Draft. Fresh comparison from `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` is ahead 1 / behind 0 with zero changed files, so the concurrent head is source-neutral rather than a security delta. On the current exact head, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success. CodeQL PR run `34065835006`, Python job `101578209369`, dispatched successfully and then deliberately failed with `VERDICT_STATE=pending` until the authenticated terminal verdict reruns that exact job; Security Scan and SAST Semgrep remain queued. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | -| AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows are terminal-success, all review threads are resolved, and Noema records an independent SHA-bound `APPROVED` review, but required OpenCode and Strix attempt-2 jobs remain queued and REST reports `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after OpenCode and Strix reach terminal success under ordinary protection. | +| AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. Exact-head Tests plus OpenSSF, scan-path, pinned-HTTPS and retention coverage are terminal success; Security Process, Security Scan, SAST and CodeQL remain queued, and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | +| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` | open/mergeable/Draft. Fresh comparisons show `5897711198b148ae5e5b85ff4308ff0b4d387487` is ahead 1 / behind 0 from `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` with zero changed files, and current head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` is one further zero-file descendant; both concurrent commits are source-neutral rather than security deltas. On the current exact head, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success. CodeQL PR run `34065835006`, Python job `101578209369`, dispatched successfully and then deliberately failed with `VERDICT_STATE=pending` until the authenticated terminal verdict reruns that exact job; Security Scan and SAST Semgrep remain queued. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | +| AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows, Strix, and CodeQL are terminal-success; all review threads are resolved and Noema records an independent SHA-bound `APPROVED` review. Required `opencode-review` attempt 2 dispatched successfully but failed closed because no authenticated exact-head OpenCode verdict yet exists; central dispatch run `34069453772` is queued and REST remains `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after the queued central OpenCode dispatch publishes an authenticated exact-head verdict and its failed required job is rerun successfully under ordinary protection. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `784b9903bcfa419c5c117f06041624755dc13321` | open/mergeable with ordinary squash auto-merge enabled; fresh Tests/Security/SAST/CodeQL are queued and no qualifying approval is present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract now requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | @@ -140,9 +140,9 @@ re-fetch docs/issues/PRs/current heads 1. Continue #1088 from RED `34bc96c...`: state-reset finite-loop/independent-bound/quoted-command semantics are repaired on `27fbf015...`, but historical/generic/unreachable executable-token proof and historical/generic `break`/unrelated-`fi` ownership remain blocking production obligations. 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. -3. Keep #1068 on source-neutral exact head `5897711198b148ae5e5b85ff4308ff0b4d387487` as the single Draft hostless/unresolved-DNS lane. Six repository workflows are GREEN; CodeQL exact logs show successful dispatch followed by the fail-closed `VERDICT_STATE=pending` handoff, Security Scan and SAST Semgrep are queued, no independent approval exists, and one detector thread remains unresolved; #1128 is retired only by verified complete carryover. +3. Keep #1068 on source-neutral exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` as the single Draft hostless/unresolved-DNS lane. Six repository workflows are GREEN; CodeQL exact logs show successful dispatch followed by the fail-closed `VERDICT_STATE=pending` handoff, Security Scan and SAST Semgrep are queued, no independent approval exists, and one detector thread remains unresolved; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. -5. Keep #1036's existing squash auto-merge: eight repository workflows, resolved threads, and exact-SHA Noema approval are present, while attempt-2 OpenCode and Strix jobs remain queued; do not bypass those required workflows. +5. Keep #1036's existing squash auto-merge: eight repository workflows, Strix, CodeQL, resolved threads, and exact-SHA Noema approval are present; OpenCode failed closed only because its exact-head verdict is still absent and central dispatch `34069453772` is queued; do not bypass those required workflows. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. From 1eb19ebe9096d9415db4642ca4725af75f68c48c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:54:23 +0900 Subject: [PATCH 051/192] docs: bind checks to current exact heads --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 629e04b9..c2827f1f 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -76,8 +76,8 @@ Responsibility boundaries: | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | -| AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. Exact-head Tests plus OpenSSF, scan-path, pinned-HTTPS and retention coverage are terminal success; Security Process, Security Scan, SAST and CodeQL remain queued, and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | -| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` | open/mergeable/Draft. Fresh comparisons show `5897711198b148ae5e5b85ff4308ff0b4d387487` is ahead 1 / behind 0 from `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` with zero changed files, and current head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` is one further zero-file descendant; both concurrent commits are source-neutral rather than security deltas. On the current exact head, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success. CodeQL PR run `34065835006`, Python job `101578209369`, dispatched successfully and then deliberately failed with `VERDICT_STATE=pending` until the authenticated terminal verdict reruns that exact job; Security Scan and SAST Semgrep remain queued. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | +| AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. Exact-head Tests, Security Process, OpenSSF, scan-path, pinned-HTTPS and retention coverage are terminal success; Security Scan, SAST and CodeQL PR remain queued, and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | +| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` | open/mergeable/Draft. Fresh comparisons show `5897711198b148ae5e5b85ff4308ff0b4d387487` is ahead 1 / behind 0 from `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` with zero changed files, and current head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` is one further zero-file descendant; both concurrent commits are source-neutral rather than security deltas. On the current exact head, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success; Security Scan run `34069018145`, SAST Semgrep `34069018243`, and CodeQL PR `34069018121` remain queued. The predecessor head's pending CodeQL handoff is historical RCA only and does not transfer as current-head acceptance. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows, Strix, and CodeQL are terminal-success; all review threads are resolved and Noema records an independent SHA-bound `APPROVED` review. Required `opencode-review` attempt 2 dispatched successfully but failed closed because no authenticated exact-head OpenCode verdict yet exists; central dispatch run `34069453772` is queued and REST remains `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after the queued central OpenCode dispatch publishes an authenticated exact-head verdict and its failed required job is rerun successfully under ordinary protection. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `784b9903bcfa419c5c117f06041624755dc13321` | open/mergeable with ordinary squash auto-merge enabled; fresh Tests/Security/SAST/CodeQL are queued and no qualifying approval is present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract now requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | @@ -140,7 +140,7 @@ re-fetch docs/issues/PRs/current heads 1. Continue #1088 from RED `34bc96c...`: state-reset finite-loop/independent-bound/quoted-command semantics are repaired on `27fbf015...`, but historical/generic/unreachable executable-token proof and historical/generic `break`/unrelated-`fi` ownership remain blocking production obligations. 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. -3. Keep #1068 on source-neutral exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` as the single Draft hostless/unresolved-DNS lane. Six repository workflows are GREEN; CodeQL exact logs show successful dispatch followed by the fail-closed `VERDICT_STATE=pending` handoff, Security Scan and SAST Semgrep are queued, no independent approval exists, and one detector thread remains unresolved; #1128 is retired only by verified complete carryover. +3. Keep #1068 on source-neutral exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` as the single Draft hostless/unresolved-DNS lane. Six repository workflows are GREEN; current-head Security Scan, SAST Semgrep and CodeQL PR are queued, no independent approval exists, and one detector thread remains unresolved; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. 5. Keep #1036's existing squash auto-merge: eight repository workflows, Strix, CodeQL, resolved threads, and exact-SHA Noema approval are present; OpenCode failed closed only because its exact-head verdict is still absent and central dispatch `34069453772` is queued; do not bypass those required workflows. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. From 8fea057ac8591ba56d8d53b8c26e0e7dae959c50 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:57:16 +0900 Subject: [PATCH 052/192] docs: record scalar release-concurrency contract --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c2827f1f..1720e8b4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -79,7 +79,7 @@ Responsibility boundaries: | AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. Exact-head Tests, Security Process, OpenSSF, scan-path, pinned-HTTPS and retention coverage are terminal success; Security Scan, SAST and CodeQL PR remain queued, and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | | AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` | open/mergeable/Draft. Fresh comparisons show `5897711198b148ae5e5b85ff4308ff0b4d387487` is ahead 1 / behind 0 from `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` with zero changed files, and current head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` is one further zero-file descendant; both concurrent commits are source-neutral rather than security deltas. On the current exact head, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success; Security Scan run `34069018145`, SAST Semgrep `34069018243`, and CodeQL PR `34069018121` remain queued. The predecessor head's pending CodeQL handoff is historical RCA only and does not transfer as current-head acceptance. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows, Strix, and CodeQL are terminal-success; all review threads are resolved and Noema records an independent SHA-bound `APPROVED` review. Required `opencode-review` attempt 2 dispatched successfully but failed closed because no authenticated exact-head OpenCode verdict yet exists; central dispatch run `34069453772` is queued and REST remains `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after the queued central OpenCode dispatch publishes an authenticated exact-head verdict and its failed required job is rerun successfully under ordinary protection. | -| AppGuardrail #1111, repository Actions queue/consolidation, exact head `784b9903bcfa419c5c117f06041624755dc13321` | open/mergeable with ordinary squash auto-merge enabled; fresh Tests/Security/SAST/CodeQL are queued and no qualifying approval is present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract now requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | +| AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; all workflows were regenerated for the new exact head and are queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | | Issue #309, `naruon` OpenSSF Best Practices badge | open LOW governance/posture; no code location or reproducible source→sink path | security-program maturity signal, not an application vulnerability | do not manufacture a HIGH source detector; track as governance evidence. | From 8d68eb0a13943b38f5f4e507c743e6ddc7fad311 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 11:03:45 +0900 Subject: [PATCH 053/192] docs(gaps): record webhook storage-boundary repair --- docs/product-technical-gap-baseline.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1720e8b4..924d1135 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -76,10 +76,11 @@ Responsibility boundaries: | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | -| AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. Exact-head Tests, Security Process, OpenSSF, scan-path, pinned-HTTPS and retention coverage are terminal success; Security Scan, SAST and CodeQL PR remain queued, and no qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | -| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` | open/mergeable/Draft. Fresh comparisons show `5897711198b148ae5e5b85ff4308ff0b4d387487` is ahead 1 / behind 0 from `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` with zero changed files, and current head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` is one further zero-file descendant; both concurrent commits are source-neutral rather than security deltas. On the current exact head, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success; Security Scan run `34069018145`, SAST Semgrep `34069018243`, and CodeQL PR `34069018121` remain queued. The predecessor head's pending CodeQL handoff is historical RCA only and does not transfer as current-head acceptance. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | -| AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows, Strix, and CodeQL are terminal-success; all review threads are resolved and Noema records an independent SHA-bound `APPROVED` review. Required `opencode-review` attempt 2 dispatched successfully but failed closed because no authenticated exact-head OpenCode verdict yet exists; central dispatch run `34069453772` is queued and REST remains `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after the queued central OpenCode dispatch publishes an authenticated exact-head verdict and its failed required job is rerun successfully under ordinary protection. | -| AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; all workflows were regenerated for the new exact head and are queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | +| AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. All nine repository workflows except CodeQL PR are terminal success. CodeQL PR `34068384347` failed closed only after authenticated dispatch with `VERDICT_STATE=pending`; central exact-head scan runs `34072930847` and `34072932500` are queued. No qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | +| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` | open/mergeable/Draft. Fresh comparisons show `5897711198b148ae5e5b85ff4308ff0b4d387487` is ahead 1 / behind 0 from `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` with zero changed files, and current head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` is one further zero-file descendant; both concurrent commits are source-neutral rather than security deltas. On the current exact head, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success; Security Scan `34069018145` and SAST Semgrep `34069018243` are terminal success. CodeQL PR `34069018121` failed closed only after authenticated dispatch with `VERDICT_STATE=pending`; its two exact-head central scan runs `34073418036` and `34073479430` are queued. The current CodeQL handoff is not source failure and remains non-success until the central scans publish terminal authenticated verdicts and rerun the exact failed shards. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | +| AppGuardrail #1107, webhook storage admission, exact head `6813d2a36c0bc13b343aa7890c8007e64af814c3` | open/mergeable/Draft with one current review thread intentionally left open; nine fresh hosted workflows are queued/pending. Local RED on `a1f4f7e6...` produced the expected storage/API empty-string failures; local GREEN on the exact repaired tree is 3/3 targeted and 31/31 related tests. | the HTTP route and directly callable persistence function had duplicated URL validation, so the documented empty-string clear value was rejected before the existing `url or None` storage normalization. The exact repair makes `set_webhook` the single validation/persistence boundary, normalizes only `""` to `None`, keeps other non-string/unsafe values fail-closed, and preserves the API 400 mapping. This does not claim delivery-time DNS pinning. | keep Draft; require exact-head hosted checks/current review, then integrate #1068 non-destructively after its unresolved-DNS validator reaches protected `develop`. Do not copy or weaken the #1068 prerequisite. | +| AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows, Strix, and CodeQL are terminal-success; all review threads are resolved and Noema records an independent SHA-bound `APPROVED` review. Required `opencode-review` is queued again on the same exact head while central dispatch run `34069453772` remains queued; REST remains `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after the queued central OpenCode dispatch publishes an authenticated exact-head verdict and its failed required job is rerun successfully under ordinary protection. | +| AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; Tests and Security Process are terminal success; Security Scan, SAST, CodeQL, Strix, Noema and OpenCode remain queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | | Issue #309, `naruon` OpenSSF Best Practices badge | open LOW governance/posture; no code location or reproducible source→sink path | security-program maturity signal, not an application vulnerability | do not manufacture a HIGH source detector; track as governance evidence. | From 1a688e8031f20e41a1c19bd42688b11898bc5601 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 11:05:52 +0900 Subject: [PATCH 054/192] docs(gaps): record non-destructive webhook repair recovery --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 924d1135..daceec96 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -78,7 +78,7 @@ Responsibility boundaries: | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | | AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. All nine repository workflows except CodeQL PR are terminal success. CodeQL PR `34068384347` failed closed only after authenticated dispatch with `VERDICT_STATE=pending`; central exact-head scan runs `34072930847` and `34072932500` are queued. No qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | | AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` | open/mergeable/Draft. Fresh comparisons show `5897711198b148ae5e5b85ff4308ff0b4d387487` is ahead 1 / behind 0 from `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` with zero changed files, and current head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` is one further zero-file descendant; both concurrent commits are source-neutral rather than security deltas. On the current exact head, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success; Security Scan `34069018145` and SAST Semgrep `34069018243` are terminal success. CodeQL PR `34069018121` failed closed only after authenticated dispatch with `VERDICT_STATE=pending`; its two exact-head central scan runs `34073418036` and `34073479430` are queued. The current CodeQL handoff is not source failure and remains non-success until the central scans publish terminal authenticated verdicts and rerun the exact failed shards. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | -| AppGuardrail #1107, webhook storage admission, exact head `6813d2a36c0bc13b343aa7890c8007e64af814c3` | open/mergeable/Draft with one current review thread intentionally left open; nine fresh hosted workflows are queued/pending. Local RED on `a1f4f7e6...` produced the expected storage/API empty-string failures; local GREEN on the exact repaired tree is 3/3 targeted and 31/31 related tests. | the HTTP route and directly callable persistence function had duplicated URL validation, so the documented empty-string clear value was rejected before the existing `url or None` storage normalization. The exact repair makes `set_webhook` the single validation/persistence boundary, normalizes only `""` to `None`, keeps other non-string/unsafe values fail-closed, and preserves the API 400 mapping. This does not claim delivery-time DNS pinning. | keep Draft; require exact-head hosted checks/current review, then integrate #1068 non-destructively after its unresolved-DNS validator reaches protected `develop`. Do not copy or weaken the #1068 prerequisite. | +| AppGuardrail #1107, webhook storage admission, exact head `8ae48f1bf5bb93628b1fec5a4cac273f994de094` | open/mergeable/Draft with one current review thread intentionally left open; nine fresh hosted workflows are queued/pending. Local RED on `a1f4f7e6...` produced the expected storage/API empty-string failures; local GREEN on the exact repaired tree is 3/3 targeted and 31/31 related tests. | the HTTP route and directly callable persistence function had duplicated URL validation, so the documented empty-string clear value was rejected before the existing `url or None` storage normalization. The GREEN repair `6813d2a3...` makes `set_webhook` the single validation/persistence boundary, normalizes only `""` to `None`, keeps other non-string/unsafe values fail-closed, and preserves the API 400 mapping. Concurrent `6d7bae70...` deleted the RED corpus and reverted production while adding generated doctrine; normal descendant `8ae48f1b...` preserves that history and restores the verified GREEN tree exactly (ahead 2 / behind 0, zero changed files). This does not claim delivery-time DNS pinning. | keep Draft; require exact-head hosted checks/current review, then integrate #1068 non-destructively after its unresolved-DNS validator reaches protected `develop`. Do not copy or weaken the #1068 prerequisite. | | AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows, Strix, and CodeQL are terminal-success; all review threads are resolved and Noema records an independent SHA-bound `APPROVED` review. Required `opencode-review` is queued again on the same exact head while central dispatch run `34069453772` remains queued; REST remains `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after the queued central OpenCode dispatch publishes an authenticated exact-head verdict and its failed required job is rerun successfully under ordinary protection. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; Tests and Security Process are terminal success; Security Scan, SAST, CodeQL, Strix, Noema and OpenCode remain queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | From 0128463b5bd6a09273c0fe33dffe509ce753604b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 12:08:02 +0900 Subject: [PATCH 055/192] docs(gap): record local-sink detector RCA --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index daceec96..3b6ea458 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -78,7 +78,7 @@ Responsibility boundaries: | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | | AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. All nine repository workflows except CodeQL PR are terminal success. CodeQL PR `34068384347` failed closed only after authenticated dispatch with `VERDICT_STATE=pending`; central exact-head scan runs `34072930847` and `34072932500` are queued. No qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | | AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` | open/mergeable/Draft. Fresh comparisons show `5897711198b148ae5e5b85ff4308ff0b4d387487` is ahead 1 / behind 0 from `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` with zero changed files, and current head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` is one further zero-file descendant; both concurrent commits are source-neutral rather than security deltas. On the current exact head, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success; Security Scan `34069018145` and SAST Semgrep `34069018243` are terminal success. CodeQL PR `34069018121` failed closed only after authenticated dispatch with `VERDICT_STATE=pending`; its two exact-head central scan runs `34073418036` and `34073479430` are queued. The current CodeQL handoff is not source failure and remains non-success until the central scans publish terminal authenticated verdicts and rerun the exact failed shards. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | -| AppGuardrail #1107, webhook storage admission, exact head `8ae48f1bf5bb93628b1fec5a4cac273f994de094` | open/mergeable/Draft with one current review thread intentionally left open; nine fresh hosted workflows are queued/pending. Local RED on `a1f4f7e6...` produced the expected storage/API empty-string failures; local GREEN on the exact repaired tree is 3/3 targeted and 31/31 related tests. | the HTTP route and directly callable persistence function had duplicated URL validation, so the documented empty-string clear value was rejected before the existing `url or None` storage normalization. The GREEN repair `6813d2a3...` makes `set_webhook` the single validation/persistence boundary, normalizes only `""` to `None`, keeps other non-string/unsafe values fail-closed, and preserves the API 400 mapping. Concurrent `6d7bae70...` deleted the RED corpus and reverted production while adding generated doctrine; normal descendant `8ae48f1b...` preserves that history and restores the verified GREEN tree exactly (ahead 2 / behind 0, zero changed files). This does not claim delivery-time DNS pinning. | keep Draft; require exact-head hosted checks/current review, then integrate #1068 non-destructively after its unresolved-DNS validator reaches protected `develop`. Do not copy or weaken the #1068 prerequisite. | +| AppGuardrail #1107, webhook storage admission and detector precision, exact head `f10795e294df5b0d9797fc50b201126c998a3632` | open/mergeable/Draft. Exact-head Security Process `34077096473` exposed the local-sink detector false positive; the repaired head has nine fresh hosted workflows queued/pending. Local GREEN is 27/27 stored-SSRF tests, 37/37 SSRF/documentation tests, 1,009/1,009 repository tests, and zero deploy-blocking findings in the real repository scan. CodeGraph was unavailable locally. | the HTTP route and directly callable persistence function had duplicated validation, rejecting the documented empty-string clear value. The runtime repair makes `set_webhook` the single validation/persistence boundary. The existing `python-stored-ssrf-webhook-url` regex then reported the safe delegated route because it did not inspect the local sink body. RED `ead954ad...` fixes the FP/FN contract: one unique top-level, non-rebound sink with unconditional unsafe rejection before SQLite use is negative; unrelated conditional validation and symbol rebinding remain positive. GREEN `f18fec7c...` adds the bounded stdlib AST proof and `f10795e...` records traceability. | keep Draft; require fresh exact-head hosted checks/current review, then integrate #1068 non-destructively after its unresolved-DNS validator reaches protected `develop`. Do not treat persistence validation as delivery-time DNS pinning or weaken the #1068 prerequisite. | | AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows, Strix, and CodeQL are terminal-success; all review threads are resolved and Noema records an independent SHA-bound `APPROVED` review. Required `opencode-review` is queued again on the same exact head while central dispatch run `34069453772` remains queued; REST remains `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after the queued central OpenCode dispatch publishes an authenticated exact-head verdict and its failed required job is rerun successfully under ordinary protection. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; Tests and Security Process are terminal success; Security Scan, SAST, CodeQL, Strix, Noema and OpenCode remain queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | From 7aafe4726d068cb66c51b8cc59438181e98587b7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 12:11:42 +0900 Subject: [PATCH 056/192] docs(gap): refresh #1088 RED obligations --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3b6ea458..d0cfb20a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -72,7 +72,7 @@ Responsibility boundaries: | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | -| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `27fbf015b499203ff35ea9c7ff424a61450b5fdf` | open/mergeable but explicitly not merge-ready; RED/contract `34bc96c40a2dbeac8909fb763968468445f2f1b5` and state-reset repair `27fbf015...` are current. CodeQL PR run `33640116203` is `startup_failure` with zero materialized jobs while Tests/security/SAST/coverage lanes remain queued | verified `ContextualWisdomLab/.github` required-review incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could hold a runner indefinitely relative to repository control flow. Review-derived detector risks now include finite-loop back-edge proof, independent monotonic total bounds, executable command-token proof, and real ownership of `break`/`exit 0` versus `fi`. | retain the four detector identities and current regression corpus. The state-reset companion now handles an independent monotonic total bound, direct post-sleep termination, and executable `gh api` token evidence. Repair the historical/generic/unreachable quoted-command boundary and historical/generic `break`/unrelated-`fi` structural boundary before merge; do not transfer predecessor Checks. | +| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `b34670b8130f1857a8e53e6baf7cd5933826da29` | open/mergeable/Draft and explicitly not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` pins two unimplemented detector-precision contracts: forward `-gt` finite total guards and statically positive owning-job `${{ 20 }}` timeout expressions. CodeQL PR `33682765699` is `startup_failure` with zero jobs; the remaining exact-head Tests/security/SAST/coverage/OSV/Scorecard lanes were queued at the last fresh read. | verified `ContextualWisdomLab/.github` required-review incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could hold a runner indefinitely relative to repository control flow. Current FP boundaries require forward finite total-attempt/deadline comparisons and statically provable positive expression timeouts without treating reversed comparisons, dynamic/zero/negative expressions, or sibling-job timeouts as safety. | keep all four detector identities and current corpus as G-06 migration oracles. Implement the two RED contracts before returning from Draft; require fresh exact-head Checks and review, and never transfer predecessor evidence. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | @@ -112,7 +112,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-03 | A developer cannot safely transfer remediation/evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928 remains open; PR #1006 at exact head `f591d6d3136ae2bee118c2f1b68dd68b08a5d26f` is active-PR evidence for a transport-neutral, deterministic, redacted and digest-verified JSON contract, while the dashboard UI slice remains explicitly separate. | retain the standalone versioned bundle boundary; then add CSP-safe listener-based copy actions, accessible fallback/live-region behavior, focus handling and browser E2E after the design/Storybook gate | hostile text remains inert; no duplicate listeners; exact success/rejection/fallback behavior; provenance schema and digest verified on an unchanged protected head | **Open / active in #1006** | | G-04 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 exact head `27fbf015...` carries RED migration oracles for independent total bounds, post-sleep finite termination, quoted command substitution and unrelated-`fi` ownership | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; conditional branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | +| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 exact head `b34670b8...` carries RED `d50f49c...` for forward `-gt` total guards and statically positive owning-job timeout expressions | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | | G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | @@ -139,7 +139,7 @@ re-fetch docs/issues/PRs/current heads → refresh owner oracle + corpus + this baseline ``` -1. Continue #1088 from RED `34bc96c...`: state-reset finite-loop/independent-bound/quoted-command semantics are repaired on `27fbf015...`, but historical/generic/unreachable executable-token proof and historical/generic `break`/unrelated-`fi` ownership remain blocking production obligations. +1. Continue #1088 from RED `d50f49c...` on exact head `b34670b8...`: implement forward `-gt` as a finite causally initialized total deadline/attempt guard and accept only statically positive owning-job timeout expressions; reversed/non-expiring comparisons, zero/negative/dynamic values, empty expressions and sibling-job timeouts remain positive findings. 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. 3. Keep #1068 on source-neutral exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` as the single Draft hostless/unresolved-DNS lane. Six repository workflows are GREEN; current-head Security Scan, SAST Semgrep and CodeQL PR are queued, no independent approval exists, and one detector thread remains unresolved; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. From a4a6b513468873fd47d6cb86d76a3a460b02c83b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 13:05:36 +0900 Subject: [PATCH 057/192] docs: refresh product-technical gap baseline --- docs/product-technical-gap-baseline.md | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d0cfb20a..8905b6b9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 +**Snapshot:** 2026-09-07 04:00 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,18 +68,21 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 snapshot +## Security-defect corpus — live 2026-09-07 04:00 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | -| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `b34670b8130f1857a8e53e6baf7cd5933826da29` | open/mergeable/Draft and explicitly not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` pins two unimplemented detector-precision contracts: forward `-gt` finite total guards and statically positive owning-job `${{ 20 }}` timeout expressions. CodeQL PR `33682765699` is `startup_failure` with zero jobs; the remaining exact-head Tests/security/SAST/coverage/OSV/Scorecard lanes were queued at the last fresh read. | verified `ContextualWisdomLab/.github` required-review incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could hold a runner indefinitely relative to repository control flow. Current FP boundaries require forward finite total-attempt/deadline comparisons and statically provable positive expression timeouts without treating reversed comparisons, dynamic/zero/negative expressions, or sibling-job timeouts as safety. | keep all four detector identities and current corpus as G-06 migration oracles. Implement the two RED contracts before returning from Draft; require fresh exact-head Checks and review, and never transfer predecessor evidence. | +| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `b34670b8130f1857a8e53e6baf7cd5933826da29` | open/mergeable/Draft; REST `mergeable_state=blocked`; explicitly not merge-ready. Do not Close #1087. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` pins two unimplemented detector-precision contracts: forward `-gt` finite total guards and statically positive owning-job `${{ 20 }}` timeout expressions. CodeQL PR `33682765699` is `startup_failure` with zero jobs; predecessor queued Tests/security/SAST/coverage/OSV/Scorecard lanes are not current GREEN. G-06 owns the structural GitHub Actions + shell analyzer Gap. | verified `ContextualWisdomLab/.github` required-review incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could hold a runner indefinitely relative to repository control flow. Current FP boundaries require forward finite total-attempt/deadline comparisons and statically provable positive expression timeouts without treating reversed comparisons, dynamic/zero/negative expressions, or sibling-job timeouts as safety. | keep all four detector identities and current corpus as G-06 migration oracles. Implement the two RED contracts before returning from Draft; require fresh exact-head Checks and review, and never transfer predecessor evidence. | +| CWL successor branch `security/cwl-issue-detector-families`, local commit `acc3abc1f8302be80dc82b72121b1cde7b0e2b05` | no GitHub PR; not stacked on current #998 head `f0786f6`. The unique commit is missing the `develop@e71d37e` merge and dotted-import lock. Commit text and ADR-0007 Status Proposed say this branch must not Close #1087 or #929. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. Overlapping poll-bound and orphan-registry files are restack delta only. | keep canonical owners #1088 (poll bounds) and #966 (orphans). Successor unique delta is Issue #1099 Claude plugin/marketplace detector, Issue #1106 password-indirection precision lock, and ADR-0007 Status Proposed. Restack only after those owners land; never Close #1087/#929 from this branch. | +| AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft; REST `mergeable_state=blocked` after a non-force update-branch onto `develop@e71d37e`. Repository Tests, Security Process, coverage, and CodeQL analyze jobs have current-head passes while required Noema/OpenCode/SAST/Security Scan/Strix/CodeQL PR remain queued. OpenCode `CHANGES_REQUESTED` exists only on predecessor SHAs `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc` and is infrastructure-derived; no current-head Noema review object exists. GitHub `reviewDecision` remains `CHANGES_REQUESTED`. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the infrastructure-derived review/check blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | +| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `f0786f6ab419746619afad296532a2922881180f` | open/Draft; REST `mergeable_state=blocked` after a non-force merge of `develop@e71d37e` plus `test(sast)` dotted-import lock `f0786f6`. All four CodeRabbit threads are resolved. Stale OpenCode `CHANGES_REQUESTED` on `e2b06378352260960e6b1038e139ee7e0a33217a` is not current-head; GitHub `reviewDecision` still shows that predecessor robot review. Robot reviews are not GitHub `APPROVE`. Latest exact-head rerun has Tests 3.11/3.13 passing while required Noema/OpenCode/SAST/Security Scan/Strix/CodeQL PR remain queued/pending, so current-head gates are not terminal-success. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head quality/security/SAST/coverage/semantic-review gates are terminal-success and a qualifying independent non-author approval exists. Do not treat CodeRabbit success, Devin skip, or stale OpenCode `CHANGES_REQUESTED` as merge authority. Do not Close #983 from this snapshot. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | | AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. All nine repository workflows except CodeQL PR are terminal success. CodeQL PR `34068384347` failed closed only after authenticated dispatch with `VERDICT_STATE=pending`; central exact-head scan runs `34072930847` and `34072932500` are queued. No qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | -| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` | open/mergeable/Draft. Fresh comparisons show `5897711198b148ae5e5b85ff4308ff0b4d387487` is ahead 1 / behind 0 from `a1174b33d194ec2421015cb54fa327bd5b6f7ad0` with zero changed files, and current head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` is one further zero-file descendant; both concurrent commits are source-neutral rather than security deltas. On the current exact head, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success; Security Scan `34069018145` and SAST Semgrep `34069018243` are terminal success. CodeQL PR `34069018121` failed closed only after authenticated dispatch with `VERDICT_STATE=pending`; its two exact-head central scan runs `34073418036` and `34073479430` are queued. The current CodeQL handoff is not source failure and remains non-success until the central scans publish terminal authenticated verdicts and rerun the exact failed shards. No qualifying independent `APPROVED` review exists and one detector thread remains unresolved/outdated. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for authenticated terminal exact-head CodeQL, qualifying independent approval, and review-thread completion; never reuse predecessor results or recreate a duplicate hostless lane. | +| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `325d48e0249b715bd33d48e45c597240dfb80a77` | open/mergeable/Draft; REST `mergeable_state=blocked`. Exact head `325d48e...` is a source-neutral empty-file descendant of `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` (`ahead 1` / zero changed files; commit message is a Strix timeout CI retrigger) and does not add a security delta. On this retrigger, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success, while Strix, SAST Semgrep, Noema, CodeQL compatibility analysis, and some Security Scan jobs remain pending. Predecessor CodeQL pending-handoff evidence does not transfer. No qualifying independent `APPROVED` review exists. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for current-head Strix/SAST/Noema/CodeQL and qualifying independent approval; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1107, webhook storage admission and detector precision, exact head `f10795e294df5b0d9797fc50b201126c998a3632` | open/mergeable/Draft. Exact-head Security Process `34077096473` exposed the local-sink detector false positive; the repaired head has nine fresh hosted workflows queued/pending. Local GREEN is 27/27 stored-SSRF tests, 37/37 SSRF/documentation tests, 1,009/1,009 repository tests, and zero deploy-blocking findings in the real repository scan. CodeGraph was unavailable locally. | the HTTP route and directly callable persistence function had duplicated validation, rejecting the documented empty-string clear value. The runtime repair makes `set_webhook` the single validation/persistence boundary. The existing `python-stored-ssrf-webhook-url` regex then reported the safe delegated route because it did not inspect the local sink body. RED `ead954ad...` fixes the FP/FN contract: one unique top-level, non-rebound sink with unconditional unsafe rejection before SQLite use is negative; unrelated conditional validation and symbol rebinding remain positive. GREEN `f18fec7c...` adds the bounded stdlib AST proof and `f10795e...` records traceability. | keep Draft; require fresh exact-head hosted checks/current review, then integrate #1068 non-destructively after its unresolved-DNS validator reaches protected `develop`. Do not treat persistence validation as delivery-time DNS pinning or weaken the #1068 prerequisite. | -| AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; eight repository-owned exact-head workflows, Strix, and CodeQL are terminal-success; all review threads are resolved and Noema records an independent SHA-bound `APPROVED` review. Required `opencode-review` is queued again on the same exact head while central dispatch run `34069453772` remains queued; REST remains `mergeable_state=blocked` | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after the queued central OpenCode dispatch publishes an authenticated exact-head verdict and its failed required job is rerun successfully under ordinary protection. | +| AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; REST `mergeable_state=blocked`. Eight repository-owned exact-head workflows, Strix, and CodeQL are terminal-success; all review threads are resolved and Noema records an independent SHA-bound `APPROVED` review on `661d5138...`. Required `opencode-review` job `101591991035` failed closed because no authenticated `opencode-agent` verdict exists; central dispatch run `34069453772` remains queued. GitHub `reviewDecision` is `REVIEW_REQUIRED`; robot/Noema reviews are not by themselves protected merge authority. | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after the queued central OpenCode dispatch publishes an authenticated exact-head verdict and its failed required job is rerun successfully under ordinary protection. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; Tests and Security Process are terminal success; Security Scan, SAST, CodeQL, Strix, Noema and OpenCode remain queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | @@ -112,9 +115,9 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-03 | A developer cannot safely transfer remediation/evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928 remains open; PR #1006 at exact head `f591d6d3136ae2bee118c2f1b68dd68b08a5d26f` is active-PR evidence for a transport-neutral, deterministic, redacted and digest-verified JSON contract, while the dashboard UI slice remains explicitly separate. | retain the standalone versioned bundle boundary; then add CSP-safe listener-based copy actions, accessible fallback/live-region behavior, focus handling and browser E2E after the design/Storybook gate | hostile text remains inert; no duplicate listeners; exact success/rejection/fallback behavior; provenance schema and digest verified on an unchanged protected head | **Open / active in #1006** | | G-04 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 exact head `b34670b8...` carries RED `d50f49c...` for forward `-gt` total guards and statically positive owning-job timeout expressions | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | +| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 exact head `b34670b8...` carries RED `d50f49c...` for forward `-gt` total guards and statically positive owning-job timeout expressions. CWL successor `acc3abc` is not stacked and must not Close #1087/#929. | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 04:00 UTC records #998/#983 `f0786f6`, unstacked CWL successor `acc3abc`, #966 `f707289`, #1088 Draft RED `d50f49c`, and #1036 OpenCode fail-closed | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -141,14 +144,17 @@ re-fetch docs/issues/PRs/current heads 1. Continue #1088 from RED `d50f49c...` on exact head `b34670b8...`: implement forward `-gt` as a finite causally initialized total deadline/attempt guard and accept only statically positive owning-job timeout expressions; reversed/non-expiring comparisons, zero/negative/dynamic values, empty expressions and sibling-job timeouts remain positive findings. 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. -3. Keep #1068 on source-neutral exact head `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` as the single Draft hostless/unresolved-DNS lane. Six repository workflows are GREEN; current-head Security Scan, SAST Semgrep and CodeQL PR are queued, no independent approval exists, and one detector thread remains unresolved; #1128 is retired only by verified complete carryover. +3. Keep #1068 on source-neutral exact head `325d48e0249b715bd33d48e45c597240dfb80a77` as the single Draft hostless/unresolved-DNS lane. The head is an empty-file descendant of `a06a96fc...`; repository Tests/coverage/Security Process are GREEN on this retrigger while Strix/SAST/Noema/CodeQL-compat remain pending; no independent approval exists; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. -5. Keep #1036's existing squash auto-merge: eight repository workflows, Strix, CodeQL, resolved threads, and exact-SHA Noema approval are present; OpenCode failed closed only because its exact-head verdict is still absent and central dispatch `34069453772` is queued; do not bypass those required workflows. +5. Keep #1036's existing squash auto-merge: eight repository workflows, Strix, CodeQL, resolved threads, and exact-SHA Noema approval are present; OpenCode job `101591991035` failed closed waiting an authenticated verdict and central dispatch `34069453772` is queued; do not bypass those required workflows. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. - 9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. +10. Keep #998 Draft at `f0786f6` until current-head gates are terminal-success. Stale OpenCode `CHANGES_REQUESTED` on `e2b0637` is not current-head. Robot reviews are not GitHub `APPROVE`. Do not Close #983 from this snapshot. +11. Keep #966 at `f707289` as the canonical orphan-detector owner. Repair the infrastructure-derived OpenCode `CHANGES_REQUESTED`; Relates to #929 and must not Close it. +12. Do not stack or open CWL successor `acc3abc` as a closer of #1087/#929. Unique delta remains #1099 Claude plugin detector, #1106 password-indirection precision lock, and ADR-0007 Status Proposed. + ## Standards and acceptance basis These references guide control design; they are not a claim of CSAP, SOC 2, or another certification. From daa371c2696170a9883084e0a0d0cb9f229d48fb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 13:19:55 +0900 Subject: [PATCH 058/192] docs: refresh product-technical gap baseline --- docs/product-technical-gap-baseline.md | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8905b6b9..8bea3278 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 04:00 UTC +**Snapshot:** 2026-09-07 04:16 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 04:00 UTC snapshot +## Security-defect corpus — live 2026-09-07 04:16 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | -| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `b34670b8130f1857a8e53e6baf7cd5933826da29` | open/mergeable/Draft; REST `mergeable_state=blocked`; explicitly not merge-ready. Do not Close #1087. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` pins two unimplemented detector-precision contracts: forward `-gt` finite total guards and statically positive owning-job `${{ 20 }}` timeout expressions. CodeQL PR `33682765699` is `startup_failure` with zero jobs; predecessor queued Tests/security/SAST/coverage/OSV/Scorecard lanes are not current GREEN. G-06 owns the structural GitHub Actions + shell analyzer Gap. | verified `ContextualWisdomLab/.github` required-review incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could hold a runner indefinitely relative to repository control flow. Current FP boundaries require forward finite total-attempt/deadline comparisons and statically provable positive expression timeouts without treating reversed comparisons, dynamic/zero/negative expressions, or sibling-job timeouts as safety. | keep all four detector identities and current corpus as G-06 migration oracles. Implement the two RED contracts before returning from Draft; require fresh exact-head Checks and review, and never transfer predecessor evidence. | -| CWL successor branch `security/cwl-issue-detector-families`, local commit `acc3abc1f8302be80dc82b72121b1cde7b0e2b05` | no GitHub PR; not stacked on current #998 head `f0786f6`. The unique commit is missing the `develop@e71d37e` merge and dotted-import lock. Commit text and ADR-0007 Status Proposed say this branch must not Close #1087 or #929. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. Overlapping poll-bound and orphan-registry files are restack delta only. | keep canonical owners #1088 (poll bounds) and #966 (orphans). Successor unique delta is Issue #1099 Claude plugin/marketplace detector, Issue #1106 password-indirection precision lock, and ADR-0007 Status Proposed. Restack only after those owners land; never Close #1087/#929 from this branch. | -| AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft; REST `mergeable_state=blocked` after a non-force update-branch onto `develop@e71d37e`. Repository Tests, Security Process, coverage, and CodeQL analyze jobs have current-head passes while required Noema/OpenCode/SAST/Security Scan/Strix/CodeQL PR remain queued. OpenCode `CHANGES_REQUESTED` exists only on predecessor SHAs `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc` and is infrastructure-derived; no current-head Noema review object exists. GitHub `reviewDecision` remains `CHANGES_REQUESTED`. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the infrastructure-derived review/check blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | -| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `f0786f6ab419746619afad296532a2922881180f` | open/Draft; REST `mergeable_state=blocked` after a non-force merge of `develop@e71d37e` plus `test(sast)` dotted-import lock `f0786f6`. All four CodeRabbit threads are resolved. Stale OpenCode `CHANGES_REQUESTED` on `e2b06378352260960e6b1038e139ee7e0a33217a` is not current-head; GitHub `reviewDecision` still shows that predecessor robot review. Robot reviews are not GitHub `APPROVE`. Latest exact-head rerun has Tests 3.11/3.13 passing while required Noema/OpenCode/SAST/Security Scan/Strix/CodeQL PR remain queued/pending, so current-head gates are not terminal-success. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head quality/security/SAST/coverage/semantic-review gates are terminal-success and a qualifying independent non-author approval exists. Do not treat CodeRabbit success, Devin skip, or stale OpenCode `CHANGES_REQUESTED` as merge authority. Do not Close #983 from this snapshot. | +| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` | open/Draft; REST `mergeable_state=blocked`; not merge-ready. Previous snapshot head `b34670b8130f1857a8e53e6baf7cd5933826da29` pinned RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6`. Production repair `99bdf459cf7939896740c61c2c3fe9c222377312` (`fix(actions): honor strict -gt bounds and constant timeouts`) now precedes docs head `e63c342`. Exact-head Tests, Security Process, coverage, CodeQL, SAST, Noema, and OpenCode jobs are queued/pending; skipped gitleaks/cancel-closed are not GREEN. Do not claim terminal success. Stale PR-body text still describing unimplemented RED at `b34670b` is not current-head. G-06 still owns the structural GitHub Actions + shell analyzer Gap. Do not Close #1087. | verified `ContextualWisdomLab/.github` required-review incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could hold a runner indefinitely relative to repository control flow. `99bdf45` treats causally initialized forward `-gt` like `-ge` for total deadline/attempt guards and accepts statically positive owning-job `timeout-minutes: ${{ N }}`; zero/negative/dynamic/reversed/sibling-job bounds remain unproved. | keep all four detector identities and current corpus as G-06 migration oracles. Stay Draft until current-head Checks are terminal-success and current-head review exists; never transfer predecessor evidence. | +| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `3f645f378411a292ec04cb79bdbca61c8720ff99` | open/Draft successor stacked on #998. Base exact head is `948c5f8ebee02dcb621bced98adb8a9b462bd880`; successor head is a non-force merge of that commit onto `1e9b5b5735c63a1f3a820d4a0395692ce3836928`. REST `mergeable_state=clean` is versus the #998 branch, not protected `develop`. `closingIssuesReferences` is empty. Unique delta is Issue #1099 Claude plugin/marketplace SAST, Issue #1106 password-indirection precision lock, and ADR-0007 Status Proposed. Competing poll-loop and orphan production modules, tests, and changelog fragments are absent from the current file list. Current checks are only skipped robot reviews. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. This successor maps #1087/#929 without replacing those writers. | keep canonical owners #1088 (poll bounds) and #966 (orphans). Do not Close #1087, #929, or #983. Do not treat stack-clean mergeability onto #998 as protected `develop` behavior. | +| AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | +| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST `mergeable_state=blocked`. Exact head is `ci(sast): dispatch Python shell AST coverage on current heads`, not `f0786f6`. GitHub records Tests 3.11/3.13 success on `948c5f8`. The dedicated Python shell AST coverage workflow is `active` after being re-enabled; `workflow_dispatch` run `34081694664` on `948c5f8` is queued (`exact-branch-coverage` is not terminal). Required Noema/OpenCode/SAST/Security Scan/Strix/CodeQL PR remain queued/pending. Stale OpenCode `CHANGES_REQUESTED` on `e2b0637` is not current-head. CodeRabbit/Devin `success` on this Draft are skipped robot reviews, not GitHub `APPROVE`. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head quality/security/SAST/dedicated-coverage/semantic-review gates are terminal-success and a qualifying independent non-author approval exists. Do not treat robot reviews as merge authority. Do not Close #983 from this snapshot. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | @@ -115,9 +115,9 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-03 | A developer cannot safely transfer remediation/evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928 remains open; PR #1006 at exact head `f591d6d3136ae2bee118c2f1b68dd68b08a5d26f` is active-PR evidence for a transport-neutral, deterministic, redacted and digest-verified JSON contract, while the dashboard UI slice remains explicitly separate. | retain the standalone versioned bundle boundary; then add CSP-safe listener-based copy actions, accessible fallback/live-region behavior, focus handling and browser E2E after the design/Storybook gate | hostile text remains inert; no duplicate listeners; exact success/rejection/fallback behavior; provenance schema and digest verified on an unchanged protected head | **Open / active in #1006** | | G-04 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 exact head `b34670b8...` carries RED `d50f49c...` for forward `-gt` total guards and statically positive owning-job timeout expressions. CWL successor `acc3abc` is not stacked and must not Close #1087/#929. | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | +| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 exact head `e63c342...` follows `99bdf45` (`honor strict -gt bounds and constant timeouts`) after RED pin `d50f49c...`. Exact-head Checks are queued, not GREEN. #1129 maps the family and must not Close #1087/#929. | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 04:00 UTC records #998/#983 `f0786f6`, unstacked CWL successor `acc3abc`, #966 `f707289`, #1088 Draft RED `d50f49c`, and #1036 OpenCode fail-closed | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 04:16 UTC records #998/#983 Draft `948c5f8`, stacked #1129 `3f645f3`, #966 `f707289` BEHIND-resolved/BLOCKED, and #1088 Draft `e63c342` after `99bdf45` | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -142,7 +142,7 @@ re-fetch docs/issues/PRs/current heads → refresh owner oracle + corpus + this baseline ``` -1. Continue #1088 from RED `d50f49c...` on exact head `b34670b8...`: implement forward `-gt` as a finite causally initialized total deadline/attempt guard and accept only statically positive owning-job timeout expressions; reversed/non-expiring comparisons, zero/negative/dynamic values, empty expressions and sibling-job timeouts remain positive findings. +1. Continue #1088 from exact head `e63c342...` after `99bdf45` (`honor strict -gt bounds and constant timeouts`). Stay Draft until current-head Checks are terminal-success; do not claim GREEN from queued jobs. Reversed/non-expiring comparisons, zero/negative/dynamic values, empty expressions and sibling-job timeouts remain positive findings. Do not Close #1087. 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. 3. Keep #1068 on source-neutral exact head `325d48e0249b715bd33d48e45c597240dfb80a77` as the single Draft hostless/unresolved-DNS lane. The head is an empty-file descendant of `a06a96fc...`; repository Tests/coverage/Security Process are GREEN on this retrigger while Strix/SAST/Noema/CodeQL-compat remain pending; no independent approval exists; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. @@ -151,9 +151,9 @@ re-fetch docs/issues/PRs/current heads 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. 9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. -10. Keep #998 Draft at `f0786f6` until current-head gates are terminal-success. Stale OpenCode `CHANGES_REQUESTED` on `e2b0637` is not current-head. Robot reviews are not GitHub `APPROVE`. Do not Close #983 from this snapshot. -11. Keep #966 at `f707289` as the canonical orphan-detector owner. Repair the infrastructure-derived OpenCode `CHANGES_REQUESTED`; Relates to #929 and must not Close it. -12. Do not stack or open CWL successor `acc3abc` as a closer of #1087/#929. Unique delta remains #1099 Claude plugin detector, #1106 password-indirection precision lock, and ADR-0007 Status Proposed. +10. Keep #998 Draft at `948c5f8` until current-head gates, including dedicated Python shell AST coverage run `34081694664`, are terminal-success. Tests success is not merge authority. Robot reviews are not GitHub `APPROVE`. Do not Close #983 from this snapshot. +11. Keep #966 at `f707289` as the canonical orphan-detector owner. BEHIND is resolved; BLOCKED remains on predecessor OpenCode `CHANGES_REQUESTED` / recorded Noema 502. Relates to #929 and must not Close it. +12. Keep #1129 Draft stacked on #998 at `3f645f3`. Unique delta remains #1099 Claude plugin detector, #1106 password-indirection precision lock, and ADR-0007 Status Proposed. Do not Close #1087, #929, or #983. ## Standards and acceptance basis From e3cb3a2d57da54f31739ce92fff307c5d8d2b3d0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 13:24:48 +0900 Subject: [PATCH 059/192] docs: record polling single-writer repair --- docs/product-technical-gap-baseline.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8bea3278..28e25596 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 04:16 UTC +**Snapshot:** 2026-09-07 04:25 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,11 +68,11 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 04:16 UTC snapshot +## Security-defect corpus — live 2026-09-07 04:25 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | -| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` | open/Draft; REST `mergeable_state=blocked`; not merge-ready. Previous snapshot head `b34670b8130f1857a8e53e6baf7cd5933826da29` pinned RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6`. Production repair `99bdf459cf7939896740c61c2c3fe9c222377312` (`fix(actions): honor strict -gt bounds and constant timeouts`) now precedes docs head `e63c342`. Exact-head Tests, Security Process, coverage, CodeQL, SAST, Noema, and OpenCode jobs are queued/pending; skipped gitleaks/cancel-closed are not GREEN. Do not claim terminal success. Stale PR-body text still describing unimplemented RED at `b34670b` is not current-head. G-06 still owns the structural GitHub Actions + shell analyzer Gap. Do not Close #1087. | verified `ContextualWisdomLab/.github` required-review incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could hold a runner indefinitely relative to repository control flow. `99bdf45` treats causally initialized forward `-gt` like `-ge` for total deadline/attempt guards and accepts statically positive owning-job `timeout-minutes: ${{ N }}`; zero/negative/dynamic/reversed/sibling-job bounds remain unproved. | keep all four detector identities and current corpus as G-06 migration oracles. Stay Draft until current-head Checks are terminal-success and current-head review exists; never transfer predecessor evidence. | +| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. All nine repository workflows on `d9744331...` are fresh queued/pending, so predecessor GREEN does not transfer. No qualifying independent approval exists; current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `3f645f378411a292ec04cb79bdbca61c8720ff99` | open/Draft successor stacked on #998. Base exact head is `948c5f8ebee02dcb621bced98adb8a9b462bd880`; successor head is a non-force merge of that commit onto `1e9b5b5735c63a1f3a820d4a0395692ce3836928`. REST `mergeable_state=clean` is versus the #998 branch, not protected `develop`. `closingIssuesReferences` is empty. Unique delta is Issue #1099 Claude plugin/marketplace SAST, Issue #1106 password-indirection precision lock, and ADR-0007 Status Proposed. Competing poll-loop and orphan production modules, tests, and changelog fragments are absent from the current file list. Current checks are only skipped robot reviews. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. This successor maps #1087/#929 without replacing those writers. | keep canonical owners #1088 (poll bounds) and #966 (orphans). Do not Close #1087, #929, or #983. Do not treat stack-clean mergeability onto #998 as protected `develop` behavior. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | | AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST `mergeable_state=blocked`. Exact head is `ci(sast): dispatch Python shell AST coverage on current heads`, not `f0786f6`. GitHub records Tests 3.11/3.13 success on `948c5f8`. The dedicated Python shell AST coverage workflow is `active` after being re-enabled; `workflow_dispatch` run `34081694664` on `948c5f8` is queued (`exact-branch-coverage` is not terminal). Required Noema/OpenCode/SAST/Security Scan/Strix/CodeQL PR remain queued/pending. Stale OpenCode `CHANGES_REQUESTED` on `e2b0637` is not current-head. CodeRabbit/Devin `success` on this Draft are skipped robot reviews, not GitHub `APPROVE`. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head quality/security/SAST/dedicated-coverage/semantic-review gates are terminal-success and a qualifying independent non-author approval exists. Do not treat robot reviews as merge authority. Do not Close #983 from this snapshot. | @@ -115,9 +115,9 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-03 | A developer cannot safely transfer remediation/evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928 remains open; PR #1006 at exact head `f591d6d3136ae2bee118c2f1b68dd68b08a5d26f` is active-PR evidence for a transport-neutral, deterministic, redacted and digest-verified JSON contract, while the dashboard UI slice remains explicitly separate. | retain the standalone versioned bundle boundary; then add CSP-safe listener-based copy actions, accessible fallback/live-region behavior, focus handling and browser E2E after the design/Storybook gate | hostile text remains inert; no duplicate listeners; exact success/rejection/fallback behavior; provenance schema and digest verified on an unchanged protected head | **Open / active in #1006** | | G-04 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 current review histories; #1088 exact head `e63c342...` follows `99bdf45` (`honor strict -gt bounds and constant timeouts`) after RED pin `d50f49c...`. Exact-head Checks are queued, not GREEN. #1129 maps the family and must not Close #1087/#929. | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | +| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 review histories; #1088 current exact head `d9744331...` is a docs-only single-writer cleanup after RED `d50f49c...`, production `99bdf459...`, and docs `e63c342...`. Fresh exact-head Checks are queued, not GREEN. #1129 maps the family and must not Close #1087/#929. | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 04:16 UTC records #998/#983 Draft `948c5f8`, stacked #1129 `3f645f3`, #966 `f707289` BEHIND-resolved/BLOCKED, and #1088 Draft `e63c342` after `99bdf45` | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 04:25 UTC records #998/#983 Draft `948c5f8`, stacked #1129 `3f645f3`, #966 `f707289` BEHIND-resolved/BLOCKED, and #1088 Draft `d9744331` after verified removal of its duplicate baseline copy. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -142,7 +142,7 @@ re-fetch docs/issues/PRs/current heads → refresh owner oracle + corpus + this baseline ``` -1. Continue #1088 from exact head `e63c342...` after `99bdf45` (`honor strict -gt bounds and constant timeouts`). Stay Draft until current-head Checks are terminal-success; do not claim GREEN from queued jobs. Reversed/non-expiring comparisons, zero/negative/dynamic values, empty expressions and sibling-job timeouts remain positive findings. Do not Close #1087. +1. Continue #1088 from exact head `d9744331...`, a docs-only single-writer cleanup after `99bdf459...` repaired strict `-gt` bounds and constant timeout expressions. All nine workflows are fresh queued; stay Draft and do not transfer `e63c342...` evidence. Keep `docs/product-technical-gap-baseline.md` solely on #999. Do not Close #1087. 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. 3. Keep #1068 on source-neutral exact head `325d48e0249b715bd33d48e45c597240dfb80a77` as the single Draft hostless/unresolved-DNS lane. The head is an empty-file descendant of `a06a96fc...`; repository Tests/coverage/Security Process are GREEN on this retrigger while Strix/SAST/Noema/CodeQL-compat remain pending; no independent approval exists; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. From 2f42df51406c48b3407df77b8e1f32b1d775c48a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 13:57:34 +0900 Subject: [PATCH 060/192] docs: record Python 3.14 language-path repair --- docs/product-technical-gap-baseline.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 28e25596..d5194f31 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 04:25 UTC +**Snapshot:** 2026-09-07 04:57 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,11 +68,11 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 04:25 UTC snapshot +## Security-defect corpus — live 2026-09-07 04:57 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | -| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. All nine repository workflows on `d9744331...` are fresh queued/pending, so predecessor GREEN does not transfer. No qualifying independent approval exists; current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | +| AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `3f645f378411a292ec04cb79bdbca61c8720ff99` | open/Draft successor stacked on #998. Base exact head is `948c5f8ebee02dcb621bced98adb8a9b462bd880`; successor head is a non-force merge of that commit onto `1e9b5b5735c63a1f3a820d4a0395692ce3836928`. REST `mergeable_state=clean` is versus the #998 branch, not protected `develop`. `closingIssuesReferences` is empty. Unique delta is Issue #1099 Claude plugin/marketplace SAST, Issue #1106 password-indirection precision lock, and ADR-0007 Status Proposed. Competing poll-loop and orphan production modules, tests, and changelog fragments are absent from the current file list. Current checks are only skipped robot reviews. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. This successor maps #1087/#929 without replacing those writers. | keep canonical owners #1088 (poll bounds) and #966 (orphans). Do not Close #1087, #929, or #983. Do not treat stack-clean mergeability onto #998 as protected `develop` behavior. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | | AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST `mergeable_state=blocked`. Exact head is `ci(sast): dispatch Python shell AST coverage on current heads`, not `f0786f6`. GitHub records Tests 3.11/3.13 success on `948c5f8`. The dedicated Python shell AST coverage workflow is `active` after being re-enabled; `workflow_dispatch` run `34081694664` on `948c5f8` is queued (`exact-branch-coverage` is not terminal). Required Noema/OpenCode/SAST/Security Scan/Strix/CodeQL PR remain queued/pending. Stale OpenCode `CHANGES_REQUESTED` on `e2b0637` is not current-head. CodeRabbit/Devin `success` on this Draft are skipped robot reviews, not GitHub `APPROVE`. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head quality/security/SAST/dedicated-coverage/semantic-review gates are terminal-success and a qualifying independent non-author approval exists. Do not treat robot reviews as merge authority. Do not Close #983 from this snapshot. | @@ -82,7 +82,7 @@ Responsibility boundaries: | AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. All nine repository workflows except CodeQL PR are terminal success. CodeQL PR `34068384347` failed closed only after authenticated dispatch with `VERDICT_STATE=pending`; central exact-head scan runs `34072930847` and `34072932500` are queued. No qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | | AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `325d48e0249b715bd33d48e45c597240dfb80a77` | open/mergeable/Draft; REST `mergeable_state=blocked`. Exact head `325d48e...` is a source-neutral empty-file descendant of `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` (`ahead 1` / zero changed files; commit message is a Strix timeout CI retrigger) and does not add a security delta. On this retrigger, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success, while Strix, SAST Semgrep, Noema, CodeQL compatibility analysis, and some Security Scan jobs remain pending. Predecessor CodeQL pending-handoff evidence does not transfer. No qualifying independent `APPROVED` review exists. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for current-head Strix/SAST/Noema/CodeQL and qualifying independent approval; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1107, webhook storage admission and detector precision, exact head `f10795e294df5b0d9797fc50b201126c998a3632` | open/mergeable/Draft. Exact-head Security Process `34077096473` exposed the local-sink detector false positive; the repaired head has nine fresh hosted workflows queued/pending. Local GREEN is 27/27 stored-SSRF tests, 37/37 SSRF/documentation tests, 1,009/1,009 repository tests, and zero deploy-blocking findings in the real repository scan. CodeGraph was unavailable locally. | the HTTP route and directly callable persistence function had duplicated validation, rejecting the documented empty-string clear value. The runtime repair makes `set_webhook` the single validation/persistence boundary. The existing `python-stored-ssrf-webhook-url` regex then reported the safe delegated route because it did not inspect the local sink body. RED `ead954ad...` fixes the FP/FN contract: one unique top-level, non-rebound sink with unconditional unsafe rejection before SQLite use is negative; unrelated conditional validation and symbol rebinding remain positive. GREEN `f18fec7c...` adds the bounded stdlib AST proof and `f10795e...` records traceability. | keep Draft; require fresh exact-head hosted checks/current review, then integrate #1068 non-destructively after its unresolved-DNS validator reaches protected `develop`. Do not treat persistence validation as delivery-time DNS pinning or weaken the #1068 prerequisite. | -| AppGuardrail #1036, shared-skill supply-chain detection, head `661d5138f1d6db5db0890b7c6ca14042440d6264` | open/mergeable; REST `mergeable_state=blocked`. Eight repository-owned exact-head workflows, Strix, and CodeQL are terminal-success; all review threads are resolved and Noema records an independent SHA-bound `APPROVED` review on `661d5138...`. Required `opencode-review` job `101591991035` failed closed because no authenticated `opencode-agent` verdict exists; central dispatch run `34069453772` remains queued. GitHub `reviewDecision` is `REVIEW_REQUIRED`; robot/Noema reviews are not by themselves protected merge authority. | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; current grammar deliberately bounds YAML/JSON/prose scope | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; allow the existing squash auto-merge only after the queued central OpenCode dispatch publishes an authenticated exact-head verdict and its failed required job is rerun successfully under ordinary protection. | +| AppGuardrail #1036, shared-skill supply-chain detection, exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99` | open/non-Draft/mergeable with ordinary squash auto-merge enabled. Central OpenCode run `34069453772` reached Python 3.14 coverage and failed `test_string_path_language_detection_matches_path_objects[src/....py]`: the prior head mixed runtime-dependent `Path.suffix` with a stable final-dot string rule. Commit `fdb49c3...` applies the same name-based rule to both public input forms; focused tests passed 22/22 and the full local suite passed 1,031/1,031. All nine repository workflows on the new head are fresh queued, so predecessor checks, Noema approval and review receipts do not transfer. | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; language-axis evidence must also remain identical for equivalent `str` and `Path` inputs across supported runtimes. | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; require fresh Python 3.14 Tests, security/SAST/CodeQL and current-head OpenCode/Strix/Noema review before ordinary auto-merge. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; Tests and Security Process are terminal success; Security Scan, SAST, CodeQL, Strix, Noema and OpenCode remain queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | @@ -117,7 +117,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 review histories; #1088 current exact head `d9744331...` is a docs-only single-writer cleanup after RED `d50f49c...`, production `99bdf459...`, and docs `e63c342...`. Fresh exact-head Checks are queued, not GREEN. #1129 maps the family and must not Close #1087/#929. | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 04:25 UTC records #998/#983 Draft `948c5f8`, stacked #1129 `3f645f3`, #966 `f707289` BEHIND-resolved/BLOCKED, and #1088 Draft `d9744331` after verified removal of its duplicate baseline copy. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 04:57 UTC records #998/#983 Draft `948c5f8`, stacked #1129 `3f645f3`, #966 `f707289` BEHIND-resolved/BLOCKED, and #1088 Draft `d9744331` after verified removal of its duplicate baseline copy, and #1036 `fdb49c3` after repairing the Python 3.14 Path/String language-axis mismatch exposed by central coverage. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -142,11 +142,11 @@ re-fetch docs/issues/PRs/current heads → refresh owner oracle + corpus + this baseline ``` -1. Continue #1088 from exact head `d9744331...`, a docs-only single-writer cleanup after `99bdf459...` repaired strict `-gt` bounds and constant timeout expressions. All nine workflows are fresh queued; stay Draft and do not transfer `e63c342...` evidence. Keep `docs/product-technical-gap-baseline.md` solely on #999. Do not Close #1087. +1. Continue #1088 from exact head `d9744331...`, a docs-only single-writer cleanup after `99bdf459...` repaired strict `-gt` bounds and constant timeout expressions. Six repository workflows are terminal success while Security Scan, SAST Semgrep and CodeQL PR remain queued; stay Draft and do not transfer `e63c342...` evidence. Keep `docs/product-technical-gap-baseline.md` solely on #999. Do not Close #1087. 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. 3. Keep #1068 on source-neutral exact head `325d48e0249b715bd33d48e45c597240dfb80a77` as the single Draft hostless/unresolved-DNS lane. The head is an empty-file descendant of `a06a96fc...`; repository Tests/coverage/Security Process are GREEN on this retrigger while Strix/SAST/Noema/CodeQL-compat remain pending; no independent approval exists; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. -5. Keep #1036's existing squash auto-merge: eight repository workflows, Strix, CodeQL, resolved threads, and exact-SHA Noema approval are present; OpenCode job `101591991035` failed closed waiting an authenticated verdict and central dispatch `34069453772` is queued; do not bypass those required workflows. +5. Keep #1036's ordinary squash auto-merge on exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99`. Central run `34069453772` exposed the Python 3.14 `Path.suffix` divergence; `fdb49c3...` repairs it with the existing name-based rule and local 22/22 focused plus 1,031/1,031 full GREEN. All nine hosted workflows are newly queued; require fresh current-head OpenCode/Strix/Noema and security/code-scanning evidence without transferring predecessor approval. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. From e02cfc80ccdc2b5ed579c184b76ece4c7d07986c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 14:15:16 +0900 Subject: [PATCH 061/192] docs: refresh gap baseline for CWL receipts and LifeOS lock Record live 2026-09-07 05:13 UTC exact heads: #998 Draft 948c5f8 with 15 SUCCESS and queued admission, stacked #1129 4a026d5 unique #1099 receipts plus #1106 LifeOS skip-auth lock, and #1036 Draft waiting authenticated OpenCode. Do not claim open candidates as protected behavior. --- docs/product-technical-gap-baseline.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d5194f31..5d41c46b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 04:57 UTC +**Snapshot:** 2026-09-07 05:13 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,21 +68,21 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 04:57 UTC snapshot +## Security-defect corpus — live 2026-09-07 05:13 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `3f645f378411a292ec04cb79bdbca61c8720ff99` | open/Draft successor stacked on #998. Base exact head is `948c5f8ebee02dcb621bced98adb8a9b462bd880`; successor head is a non-force merge of that commit onto `1e9b5b5735c63a1f3a820d4a0395692ce3836928`. REST `mergeable_state=clean` is versus the #998 branch, not protected `develop`. `closingIssuesReferences` is empty. Unique delta is Issue #1099 Claude plugin/marketplace SAST, Issue #1106 password-indirection precision lock, and ADR-0007 Status Proposed. Competing poll-loop and orphan production modules, tests, and changelog fragments are absent from the current file list. Current checks are only skipped robot reviews. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. This successor maps #1087/#929 without replacing those writers. | keep canonical owners #1088 (poll bounds) and #966 (orphans). Do not Close #1087, #929, or #983. Do not treat stack-clean mergeability onto #998 as protected `develop` behavior. | +| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `4a026d5f2938685844efab95f7dd52e98564883d` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `4a026d5...` is a non-force descendant of `3f645f378411a292ec04cb79bdbca61c8720ff99`. REST mergeability is versus the #998 branch, not protected `develop`. Unique delta is Issue #1099 Claude plugin/marketplace SAST plus a secret-free deterministic scan receipt and symlink-escape fail-closed; Issue #1106 password-indirection precision lock including LifeOS #247 test-title/authority wording and `*.integration.test.*` context; ADR-0007 Status Proposed. Local evidence: 54 related tests passed and `claude_plugin_detector.py` statement coverage 424/424. Competing poll-loop and orphan production modules remain absent. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. This successor maps #1087/#929 without replacing those writers. Incidental `author`/`authority` wording in explicit test files is not a deploy-blocking skip-auth finding. | keep canonical owners #1088 (poll bounds) and #966 (orphans). Do not Close #1087, #929, #983, or #1106. Do not treat stack-clean mergeability onto #998 as protected `develop` behavior. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | -| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST `mergeable_state=blocked`. Exact head is `ci(sast): dispatch Python shell AST coverage on current heads`, not `f0786f6`. GitHub records Tests 3.11/3.13 success on `948c5f8`. The dedicated Python shell AST coverage workflow is `active` after being re-enabled; `workflow_dispatch` run `34081694664` on `948c5f8` is queued (`exact-branch-coverage` is not terminal). Required Noema/OpenCode/SAST/Security Scan/Strix/CodeQL PR remain queued/pending. Stale OpenCode `CHANGES_REQUESTED` on `e2b0637` is not current-head. CodeRabbit/Devin `success` on this Draft are skipped robot reviews, not GitHub `APPROVE`. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head quality/security/SAST/dedicated-coverage/semantic-review gates are terminal-success and a qualifying independent non-author approval exists. Do not treat robot reviews as merge authority. Do not Close #983 from this snapshot. | +| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`. Exact head is `ci(sast): dispatch Python shell AST coverage on current heads`, not `f0786f6`. Live 05:13 UTC snapshot: 15 SUCCESS checks including Tests 3.11/3.13, exact-coverage, appguardrail-scan, CodeQL, and Trivy; admission/bootstrap/scan-pr-queue/`exact-branch-coverage` remain QUEUED. Stale OpenCode `CHANGES_REQUESTED` on `e2b0637` is not current-head. CodeRabbit/Devin `success` on this Draft are skipped robot reviews, not GitHub `APPROVE`. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head quality/security/SAST/dedicated-coverage/semantic-review gates are terminal-success and a qualifying independent non-author approval exists. Do not wait on admission as the only lane. Do not Close #983 from this snapshot. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | | AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. All nine repository workflows except CodeQL PR are terminal success. CodeQL PR `34068384347` failed closed only after authenticated dispatch with `VERDICT_STATE=pending`; central exact-head scan runs `34072930847` and `34072932500` are queued. No qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | | AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `325d48e0249b715bd33d48e45c597240dfb80a77` | open/mergeable/Draft; REST `mergeable_state=blocked`. Exact head `325d48e...` is a source-neutral empty-file descendant of `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` (`ahead 1` / zero changed files; commit message is a Strix timeout CI retrigger) and does not add a security delta. On this retrigger, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success, while Strix, SAST Semgrep, Noema, CodeQL compatibility analysis, and some Security Scan jobs remain pending. Predecessor CodeQL pending-handoff evidence does not transfer. No qualifying independent `APPROVED` review exists. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for current-head Strix/SAST/Noema/CodeQL and qualifying independent approval; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1107, webhook storage admission and detector precision, exact head `f10795e294df5b0d9797fc50b201126c998a3632` | open/mergeable/Draft. Exact-head Security Process `34077096473` exposed the local-sink detector false positive; the repaired head has nine fresh hosted workflows queued/pending. Local GREEN is 27/27 stored-SSRF tests, 37/37 SSRF/documentation tests, 1,009/1,009 repository tests, and zero deploy-blocking findings in the real repository scan. CodeGraph was unavailable locally. | the HTTP route and directly callable persistence function had duplicated validation, rejecting the documented empty-string clear value. The runtime repair makes `set_webhook` the single validation/persistence boundary. The existing `python-stored-ssrf-webhook-url` regex then reported the safe delegated route because it did not inspect the local sink body. RED `ead954ad...` fixes the FP/FN contract: one unique top-level, non-rebound sink with unconditional unsafe rejection before SQLite use is negative; unrelated conditional validation and symbol rebinding remain positive. GREEN `f18fec7c...` adds the bounded stdlib AST proof and `f10795e...` records traceability. | keep Draft; require fresh exact-head hosted checks/current review, then integrate #1068 non-destructively after its unresolved-DNS validator reaches protected `develop`. Do not treat persistence validation as delivery-time DNS pinning or weaken the #1068 prerequisite. | -| AppGuardrail #1036, shared-skill supply-chain detection, exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99` | open/non-Draft/mergeable with ordinary squash auto-merge enabled. Central OpenCode run `34069453772` reached Python 3.14 coverage and failed `test_string_path_language_detection_matches_path_objects[src/....py]`: the prior head mixed runtime-dependent `Path.suffix` with a stable final-dot string rule. Commit `fdb49c3...` applies the same name-based rule to both public input forms; focused tests passed 22/22 and the full local suite passed 1,031/1,031. All nine repository workflows on the new head are fresh queued, so predecessor checks, Noema approval and review receipts do not transfer. | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; language-axis evidence must also remain identical for equivalent `str` and `Path` inputs across supported runtimes. | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; require fresh Python 3.14 Tests, security/SAST/CodeQL and current-head OpenCode/Strix/Noema review before ordinary auto-merge. | +| AppGuardrail #1036, shared-skill supply-chain detection, exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; `reviewDecision=REVIEW_REQUIRED`; `autoMergeRequest` is null. Central OpenCode run `34069453772` reached Python 3.14 coverage and failed `test_string_path_language_detection_matches_path_objects[src/....py]`; `fdb49c3...` applies the same name-based rule to both public input forms. Predecessor checks, Noema approval, and review receipts do not transfer. Wait authenticated current-head OpenCode; do not Close. | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; language-axis evidence must also remain identical for equivalent `str` and `Path` inputs across supported runtimes. | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; require fresh Python 3.14 Tests, security/SAST/CodeQL and current-head OpenCode/Strix/Noema review before ordinary merge. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; Tests and Security Process are terminal success; Security Scan, SAST, CodeQL, Strix, Noema and OpenCode remain queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | @@ -117,7 +117,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 review histories; #1088 current exact head `d9744331...` is a docs-only single-writer cleanup after RED `d50f49c...`, production `99bdf459...`, and docs `e63c342...`. Fresh exact-head Checks are queued, not GREEN. #1129 maps the family and must not Close #1087/#929. | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 04:57 UTC records #998/#983 Draft `948c5f8`, stacked #1129 `3f645f3`, #966 `f707289` BEHIND-resolved/BLOCKED, and #1088 Draft `d9744331` after verified removal of its duplicate baseline copy, and #1036 `fdb49c3` after repairing the Python 3.14 Path/String language-axis mismatch exposed by central coverage. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 05:13 UTC records #998/#983 Draft `948c5f8` with 15 SUCCESS and admission still queued, stacked #1129 `4a026d5` after LifeOS #247 skip-auth lock and Claude plugin receipts, #966 `f707289` BEHIND-resolved/BLOCKED, #1088 Draft `d9744331`, and #1036 Draft `fdb49c3` waiting authenticated OpenCode. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -146,14 +146,14 @@ re-fetch docs/issues/PRs/current heads 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. 3. Keep #1068 on source-neutral exact head `325d48e0249b715bd33d48e45c597240dfb80a77` as the single Draft hostless/unresolved-DNS lane. The head is an empty-file descendant of `a06a96fc...`; repository Tests/coverage/Security Process are GREEN on this retrigger while Strix/SAST/Noema/CodeQL-compat remain pending; no independent approval exists; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. -5. Keep #1036's ordinary squash auto-merge on exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99`. Central run `34069453772` exposed the Python 3.14 `Path.suffix` divergence; `fdb49c3...` repairs it with the existing name-based rule and local 22/22 focused plus 1,031/1,031 full GREEN. All nine hosted workflows are newly queued; require fresh current-head OpenCode/Strix/Noema and security/code-scanning evidence without transferring predecessor approval. +5. Keep #1036 Draft on exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99`. Auto-merge is absent; `reviewDecision=REVIEW_REQUIRED`. Wait authenticated current-head OpenCode/Strix/Noema; do not Close and do not transfer predecessor approval. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. 9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. -10. Keep #998 Draft at `948c5f8` until current-head gates, including dedicated Python shell AST coverage run `34081694664`, are terminal-success. Tests success is not merge authority. Robot reviews are not GitHub `APPROVE`. Do not Close #983 from this snapshot. +10. Keep #998 Draft at `948c5f8` until current-head gates, including dedicated Python shell AST coverage and admission, are terminal-success. 15 SUCCESS checks at 05:13 UTC are not merge authority. Robot reviews are not GitHub `APPROVE`. Do not Close #983 from this snapshot. 11. Keep #966 at `f707289` as the canonical orphan-detector owner. BEHIND is resolved; BLOCKED remains on predecessor OpenCode `CHANGES_REQUESTED` / recorded Noema 502. Relates to #929 and must not Close it. -12. Keep #1129 Draft stacked on #998 at `3f645f3`. Unique delta remains #1099 Claude plugin detector, #1106 password-indirection precision lock, and ADR-0007 Status Proposed. Do not Close #1087, #929, or #983. +12. Keep #1129 Draft stacked on #998 at `4a026d5`. Unique delta remains #1099 Claude plugin detector plus scan receipts/symlink fail-closed, #1106 LifeOS skip-auth/test-context lock, and ADR-0007 Status Proposed. Do not Close #1087, #929, #983, or #1106. ## Standards and acceptance basis From 375a4d77b3a83c726140552f8e2ca3bd9186c913 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 14:41:20 +0900 Subject: [PATCH 062/192] docs: refresh gap baseline after restack and Draft repair Summary: - Record 05:40 UTC exact-head evidence for #998 coverage/bootstrap SUCCESS, #972/#1006 non-force restacks onto develop@e71d37e, and #1130 Draft under canonical #1107. - Mark G-02 in progress on #972 and G-06 as a stacked successor of #1088 rather than further regex growth. Rationale: - #999 is the single writer of the product-technical gap baseline. - Restacked heads invalidate predecessor GREEN; the snapshot must not claim protected capability. Tests: - documentation-only; no scanner behavior change --- CHANGELOG.d/999-gap-baseline-0540.md | 3 +++ docs/product-technical-gap-baseline.md | 23 +++++++++++++++-------- 2 files changed, 18 insertions(+), 8 deletions(-) create mode 100644 CHANGELOG.d/999-gap-baseline-0540.md diff --git a/CHANGELOG.d/999-gap-baseline-0540.md b/CHANGELOG.d/999-gap-baseline-0540.md new file mode 100644 index 00000000..4d0652c7 --- /dev/null +++ b/CHANGELOG.d/999-gap-baseline-0540.md @@ -0,0 +1,3 @@ +# Gap baseline snapshot 2026-09-07 05:40 UTC + +Records live exact-head evidence for the commercial-readiness loop: #998 coverage/bootstrap SUCCESS, #972 and #1006 non-force restacks onto `develop@e71d37e`, #1130 Draft under canonical #1107, and G-06 structural analyzer successor stacked on #1088. This is documentation of Proposed work, not a protected capability claim. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 5d41c46b..37b1c9aa 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 05:13 UTC +**Snapshot:** 2026-09-07 05:40 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,20 +68,23 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 05:13 UTC snapshot +## Security-defect corpus — live 2026-09-07 05:40 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `4a026d5f2938685844efab95f7dd52e98564883d` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `4a026d5...` is a non-force descendant of `3f645f378411a292ec04cb79bdbca61c8720ff99`. REST mergeability is versus the #998 branch, not protected `develop`. Unique delta is Issue #1099 Claude plugin/marketplace SAST plus a secret-free deterministic scan receipt and symlink-escape fail-closed; Issue #1106 password-indirection precision lock including LifeOS #247 test-title/authority wording and `*.integration.test.*` context; ADR-0007 Status Proposed. Local evidence: 54 related tests passed and `claude_plugin_detector.py` statement coverage 424/424. Competing poll-loop and orphan production modules remain absent. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. This successor maps #1087/#929 without replacing those writers. Incidental `author`/`authority` wording in explicit test files is not a deploy-blocking skip-auth finding. | keep canonical owners #1088 (poll bounds) and #966 (orphans). Do not Close #1087, #929, #983, or #1106. Do not treat stack-clean mergeability onto #998 as protected `develop` behavior. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | -| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`. Exact head is `ci(sast): dispatch Python shell AST coverage on current heads`, not `f0786f6`. Live 05:13 UTC snapshot: 15 SUCCESS checks including Tests 3.11/3.13, exact-coverage, appguardrail-scan, CodeQL, and Trivy; admission/bootstrap/scan-pr-queue/`exact-branch-coverage` remain QUEUED. Stale OpenCode `CHANGES_REQUESTED` on `e2b0637` is not current-head. CodeRabbit/Devin `success` on this Draft are skipped robot reviews, not GitHub `APPROVE`. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head quality/security/SAST/dedicated-coverage/semantic-review gates are terminal-success and a qualifying independent non-author approval exists. Do not wait on admission as the only lane. Do not Close #983 from this snapshot. | +| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`. Exact head is unchanged. Live 05:40 UTC: Tests 3.11/3.13, exact-coverage, `exact-branch-coverage`, `required-workflow-bootstrap`, `scan-pr-queue`, Admit current pull request head, appguardrail-scan, CodeQL, and Trivy are terminal success. Remaining queued/pending: Strix, Semgrep, Noema, scorecard, osv-scan, dependency-review, one `admit-current-head` rerun, and `trivy-fs`. Stale OpenCode `CHANGES_REQUESTED` on `e2b0637` is not current-head. CodeRabbit/Devin `success` on this Draft are skipped robot reviews, not GitHub `APPROVE`. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head quality/security/SAST/semantic-review gates are terminal-success and a qualifying independent non-author approval exists. Dedicated coverage and bootstrap are no longer the blocker. Do not Close #983 from this snapshot. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | | AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. All nine repository workflows except CodeQL PR are terminal success. CodeQL PR `34068384347` failed closed only after authenticated dispatch with `VERDICT_STATE=pending`; central exact-head scan runs `34072930847` and `34072932500` are queued. No qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | | AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `325d48e0249b715bd33d48e45c597240dfb80a77` | open/mergeable/Draft; REST `mergeable_state=blocked`. Exact head `325d48e...` is a source-neutral empty-file descendant of `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` (`ahead 1` / zero changed files; commit message is a Strix timeout CI retrigger) and does not add a security delta. On this retrigger, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success, while Strix, SAST Semgrep, Noema, CodeQL compatibility analysis, and some Security Scan jobs remain pending. Predecessor CodeQL pending-handoff evidence does not transfer. No qualifying independent `APPROVED` review exists. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for current-head Strix/SAST/Noema/CodeQL and qualifying independent approval; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1107, webhook storage admission and detector precision, exact head `f10795e294df5b0d9797fc50b201126c998a3632` | open/mergeable/Draft. Exact-head Security Process `34077096473` exposed the local-sink detector false positive; the repaired head has nine fresh hosted workflows queued/pending. Local GREEN is 27/27 stored-SSRF tests, 37/37 SSRF/documentation tests, 1,009/1,009 repository tests, and zero deploy-blocking findings in the real repository scan. CodeGraph was unavailable locally. | the HTTP route and directly callable persistence function had duplicated validation, rejecting the documented empty-string clear value. The runtime repair makes `set_webhook` the single validation/persistence boundary. The existing `python-stored-ssrf-webhook-url` regex then reported the safe delegated route because it did not inspect the local sink body. RED `ead954ad...` fixes the FP/FN contract: one unique top-level, non-rebound sink with unconditional unsafe rejection before SQLite use is negative; unrelated conditional validation and symbol rebinding remain positive. GREEN `f18fec7c...` adds the bounded stdlib AST proof and `f10795e...` records traceability. | keep Draft; require fresh exact-head hosted checks/current review, then integrate #1068 non-destructively after its unresolved-DNS validator reaches protected `develop`. Do not treat persistence validation as delivery-time DNS pinning or weaken the #1068 prerequisite. | +| AppGuardrail #1130, Jules webhook SSRF subset, exact head `0243a1a5a1cef758b14ae85f87b2ea1dd86e9e82` | converted to Draft at 05:37 UTC. Effective delta is `set_webhook`/route plumbing, a regex `try`/`except ValueError` lookaround, and `.jules/sentinel.md`. No runtime tests and no AST FP/FN contract. Canonical owner remains #1107. | same storage-boundary SSRF class as #1107, implemented as a weaker regex-only slice | keep Draft. Do not Close until complete carryover onto #1107 is verified. Do not race #1107 to `develop`. | +| AppGuardrail #972 / Issue #927, branch `feat/scan-assurance-927`, exact head `c488cfffe4dd95a9be8b8ed99e77a86cc8d5d81f` | open/Draft. Non-force restack onto protected `develop@e71d37e` completed 05:37 UTC (`ahead` of predecessor `4ba738a...` by the merge commit only). REST `mergeable=MERGEABLE`, `mergeStateStatus=BLOCKED`. Fresh exact-head checks are in flight and do not inherit predecessor GREEN. | `0 findings` must not render as `clean` unless repository/commit identity, findings digest, detector completion, requested engines, scope, freshness, and gate accounting all verify. Ambiguous evidence is `untrusted`/`failed`/`incomplete`. | keep Draft through current-head Tests/security/SAST/CodeQL/dedicated assurance coverage and independent review. #1005 remains the report-consumer successor and must restack after this head is stable. Do not Close #927. | +| AppGuardrail #1006 / Issue #928, branch `feat/issue-928-evidence-handoff`, exact head `35c28e22b5d50f1da943718cdb1984dcee098d62` | open/non-Draft. Non-force restack onto `develop@e71d37e` completed 05:37 UTC. REST `mergeable=MERGEABLE`, `mergeStateStatus=BLOCKED`. Dashboard clipboard/UI slice remains out of scope. | transport-neutral, redacted, digest-verified remediation bundle so an agent workflow cannot copy hostile or unbounded evidence | require fresh exact-head checks after restack; keep the UI/CSP/Storybook slice as a later G-03 successor. Do not Close #928. | | AppGuardrail #1036, shared-skill supply-chain detection, exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; `reviewDecision=REVIEW_REQUIRED`; `autoMergeRequest` is null. Central OpenCode run `34069453772` reached Python 3.14 coverage and failed `test_string_path_language_detection_matches_path_objects[src/....py]`; `fdb49c3...` applies the same name-based rule to both public input forms. Predecessor checks, Noema approval, and review receipts do not transfer. Wait authenticated current-head OpenCode; do not Close. | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; language-axis evidence must also remain identical for equivalent `str` and `Path` inputs across supported runtimes. | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; require fresh Python 3.14 Tests, security/SAST/CodeQL and current-head OpenCode/Strix/Noema review before ordinary merge. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; Tests and Security Process are terminal success; Security Scan, SAST, CodeQL, Strix, Noema and OpenCode remain queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | @@ -111,13 +114,13 @@ Where regex families need path reachability, mutable state, shell semantics, or | ID | Buyer-visible Gap | Current evidence | Smallest valuable slice | Exit evidence | Status | | --- | --- | --- | --- | --- | --- | | G-01 | A buyer cannot always prove AppGuardrail observed the authoritative source condition instead of trusting a caller assertion. | PRD detector authority plus source-backed security PRs | one end-to-end source identity → executable assessment → immutable evidence/report slice | positive/negative/malformed/unavailable/stale/adversarial cases; exact source digest and black-box production path | **In progress** | -| G-02 | `0 findings` can overstate assurance when detectors/tools/scope/provenance are incomplete. | PRD typed evidence contract | propagate `clean`, `findings_present`, `incomplete`, `failed`, `untrusted` consistently | dashboard/JSON/SARIF/report/gate agree; missing evidence never renders clean | **Open** | -| G-03 | A developer cannot safely transfer remediation/evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928 remains open; PR #1006 at exact head `f591d6d3136ae2bee118c2f1b68dd68b08a5d26f` is active-PR evidence for a transport-neutral, deterministic, redacted and digest-verified JSON contract, while the dashboard UI slice remains explicitly separate. | retain the standalone versioned bundle boundary; then add CSP-safe listener-based copy actions, accessible fallback/live-region behavior, focus handling and browser E2E after the design/Storybook gate | hostile text remains inert; no duplicate listeners; exact success/rejection/fallback behavior; provenance schema and digest verified on an unchanged protected head | **Open / active in #1006** | +| G-02 | `0 findings` can overstate assurance when detectors/tools/scope/provenance are incomplete. | PRD typed evidence contract; Draft #972 exact head `c488cfffe4dd95a9be8b8ed99e77a86cc8d5d81f` after non-force restack onto `develop@e71d37e`. Core module `appguardrail_core.scan_assurance` already encodes `clean`/`findings_present`/`incomplete`/`failed`/`untrusted`. Dashboard/SARIF/report/gate consumers remain #1005 / later slices. | keep the standalone contract on #972 through current-head checks; then consume it from report/dashboard without copying scanner authority | dashboard/JSON/SARIF/report/gate agree; missing evidence never renders clean | **In progress / active in #972** | +| G-03 | A developer cannot safely transfer remediation/evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928 remains open; PR #1006 at exact head `35c28e22b5d50f1da943718cdb1984dcee098d62` after non-force restack onto `develop@e71d37e` is active-PR evidence for a transport-neutral, deterministic, redacted and digest-verified JSON contract, while the dashboard UI slice remains explicitly separate. | retain the standalone versioned bundle boundary; then add CSP-safe listener-based copy actions, accessible fallback/live-region behavior, focus handling and browser E2E after the design/Storybook gate | hostile text remains inert; no duplicate listeners; exact success/rejection/fallback behavior; provenance schema and digest verified on an unchanged protected head | **Open / active in #1006** | | G-04 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 review histories; #1088 current exact head `d9744331...` is a docs-only single-writer cleanup after RED `d50f49c...`, production `99bdf459...`, and docs `e63c342...`. Fresh exact-head Checks are queued, not GREEN. #1129 maps the family and must not Close #1087/#929. | implement a bounded structural GitHub Actions + shell control-flow/state analyzer first for #1087, preserving current detector IDs and corpus; use the same analyzer pattern for #1080 only after its provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **Proposed, now priority architecture Gap** | +| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 review histories; #1088 current exact head `d9744331...` remains the regex corpus owner. A successor branch `feat/actions-poll-structural-analyzer-1087` is being stacked on #1088 in an isolated worktree: additive stdlib analyzer, same detector IDs, no regex rewrite, no Close of #1087/#1088. #1129 maps the family and must not Close #1087/#929. | land RED→GREEN `classify_poll_loops` with helper-loop, reversed comparison, unreachable exit, quoted-text, and sibling-job timeout oracles; keep YAML rules as migration oracles | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / stacked successor of #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 05:13 UTC records #998/#983 Draft `948c5f8` with 15 SUCCESS and admission still queued, stacked #1129 `4a026d5` after LifeOS #247 skip-auth lock and Claude plugin receipts, #966 `f707289` BEHIND-resolved/BLOCKED, #1088 Draft `d9744331`, and #1036 Draft `fdb49c3` waiting authenticated OpenCode. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 05:40 UTC records #998/`948c5f8` with exact-branch-coverage and bootstrap SUCCESS while Strix/Semgrep/Noema remain pending, stacked #1129 `4a026d5`, #966 `f707289` BLOCKED, #1088 `d9744331`, #972 restacked `c488cff`, #1006 restacked `35c28e22`, and #1130 converted to Draft under #1107. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -151,9 +154,13 @@ re-fetch docs/issues/PRs/current heads 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. 9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. -10. Keep #998 Draft at `948c5f8` until current-head gates, including dedicated Python shell AST coverage and admission, are terminal-success. 15 SUCCESS checks at 05:13 UTC are not merge authority. Robot reviews are not GitHub `APPROVE`. Do not Close #983 from this snapshot. +10. Keep #998 Draft at `948c5f8` until remaining current-head Strix/Semgrep/Noema/security gates are terminal-success and a qualifying independent non-author approval exists. Dedicated Python shell AST coverage, bootstrap, and scan-pr-queue are now SUCCESS; that is not merge authority. Robot reviews are not GitHub `APPROVE`. Do not Close #983 from this snapshot. 11. Keep #966 at `f707289` as the canonical orphan-detector owner. BEHIND is resolved; BLOCKED remains on predecessor OpenCode `CHANGES_REQUESTED` / recorded Noema 502. Relates to #929 and must not Close it. 12. Keep #1129 Draft stacked on #998 at `4a026d5`. Unique delta remains #1099 Claude plugin detector plus scan receipts/symlink fail-closed, #1106 LifeOS skip-auth/test-context lock, and ADR-0007 Status Proposed. Do not Close #1087, #929, #983, or #1106. +13. Keep #972 Draft at restacked `c488cff` as the G-02 assurance-envelope owner. Fresh exact-head checks after the non-force restack do not inherit predecessor GREEN. Do not Close #927. +14. Keep #1006 at restacked `35c28e22` as the G-03 bundle owner. The dashboard/CSP/Storybook slice stays a later successor. Do not Close #928. +15. Keep #1130 Draft. Canonical webhook storage-boundary owner is #1107; this Jules slice is not merge-ready. +16. Continue the G-06 structural analyzer as a stacked successor of #1088. Preserve regex rule IDs and corpus. Do not Close #1087. ## Standards and acceptance basis From b5811777c73fe3983d535231668b19cf296092ce Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 15:03:39 +0900 Subject: [PATCH 063/192] docs: record #1129 duplicate-JSON MCP and license admission Refresh the 2026-09-07 05:57 UTC exact-head snapshot for stacked #1129 dd04cd3. #998 stays Draft pending Strix/Semgrep/Noema. --- docs/product-technical-gap-baseline.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 37b1c9aa..0c3c9548 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 05:40 UTC +**Snapshot:** 2026-09-07 05:57 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,12 +68,12 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 05:40 UTC snapshot +## Security-defect corpus — live 2026-09-07 05:57 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `4a026d5f2938685844efab95f7dd52e98564883d` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `4a026d5...` is a non-force descendant of `3f645f378411a292ec04cb79bdbca61c8720ff99`. REST mergeability is versus the #998 branch, not protected `develop`. Unique delta is Issue #1099 Claude plugin/marketplace SAST plus a secret-free deterministic scan receipt and symlink-escape fail-closed; Issue #1106 password-indirection precision lock including LifeOS #247 test-title/authority wording and `*.integration.test.*` context; ADR-0007 Status Proposed. Local evidence: 54 related tests passed and `claude_plugin_detector.py` statement coverage 424/424. Competing poll-loop and orphan production modules remain absent. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. This successor maps #1087/#929 without replacing those writers. Incidental `author`/`authority` wording in explicit test files is not a deploy-blocking skip-auth finding. | keep canonical owners #1088 (poll bounds) and #966 (orphans). Do not Close #1087, #929, #983, or #1106. Do not treat stack-clean mergeability onto #998 as protected `develop` behavior. | +| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `dd04cd303f0b1183bd761038fc8cb047f80a87b9` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `dd04cd3...` is a non-force descendant of `4a026d5...`. REST mergeability is versus the #998 branch, not protected `develop`. Unique delta now includes #1099 duplicate-JSON, unbounded-MCP, and missing-LICENSE admission plus earlier receipts/symlink/LifeOS #1106 lock. Local evidence: 38 focused tests passed and `claude_plugin_detector.py` statement coverage 497/497. Competing poll-loop and orphan production modules remain absent. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. Duplicate JSON members and unbounded MCP are hostile identity, not last-key-wins or silent inventory. | keep canonical owners #1088 (poll bounds) and #966 (orphans). Do not Close #1087, #929, #983, or #1106. Do not treat stack-clean mergeability onto #998 as protected `develop` behavior. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | | AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`. Exact head is unchanged. Live 05:40 UTC: Tests 3.11/3.13, exact-coverage, `exact-branch-coverage`, `required-workflow-bootstrap`, `scan-pr-queue`, Admit current pull request head, appguardrail-scan, CodeQL, and Trivy are terminal success. Remaining queued/pending: Strix, Semgrep, Noema, scorecard, osv-scan, dependency-review, one `admit-current-head` rerun, and `trivy-fs`. Stale OpenCode `CHANGES_REQUESTED` on `e2b0637` is not current-head. CodeRabbit/Devin `success` on this Draft are skipped robot reviews, not GitHub `APPROVE`. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head quality/security/SAST/semantic-review gates are terminal-success and a qualifying independent non-author approval exists. Dedicated coverage and bootstrap are no longer the blocker. Do not Close #983 from this snapshot. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | @@ -120,7 +120,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 review histories; #1088 current exact head `d9744331...` remains the regex corpus owner. A successor branch `feat/actions-poll-structural-analyzer-1087` is being stacked on #1088 in an isolated worktree: additive stdlib analyzer, same detector IDs, no regex rewrite, no Close of #1087/#1088. #1129 maps the family and must not Close #1087/#929. | land RED→GREEN `classify_poll_loops` with helper-loop, reversed comparison, unreachable exit, quoted-text, and sibling-job timeout oracles; keep YAML rules as migration oracles | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / stacked successor of #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 05:40 UTC records #998/`948c5f8` with exact-branch-coverage and bootstrap SUCCESS while Strix/Semgrep/Noema remain pending, stacked #1129 `4a026d5`, #966 `f707289` BLOCKED, #1088 `d9744331`, #972 restacked `c488cff`, #1006 restacked `35c28e22`, and #1130 converted to Draft under #1107. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 05:57 UTC records #998/`948c5f8` with exact-branch-coverage SUCCESS while Strix/Semgrep/Noema remain pending, stacked #1129 `dd04cd3` after duplicate-JSON/MCP/license admission, #966 `f707289` BLOCKED, #1088 `d9744331`, and G-06 structural analyzer stacked separately on #1088. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -156,7 +156,7 @@ re-fetch docs/issues/PRs/current heads 9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. 10. Keep #998 Draft at `948c5f8` until remaining current-head Strix/Semgrep/Noema/security gates are terminal-success and a qualifying independent non-author approval exists. Dedicated Python shell AST coverage, bootstrap, and scan-pr-queue are now SUCCESS; that is not merge authority. Robot reviews are not GitHub `APPROVE`. Do not Close #983 from this snapshot. 11. Keep #966 at `f707289` as the canonical orphan-detector owner. BEHIND is resolved; BLOCKED remains on predecessor OpenCode `CHANGES_REQUESTED` / recorded Noema 502. Relates to #929 and must not Close it. -12. Keep #1129 Draft stacked on #998 at `4a026d5`. Unique delta remains #1099 Claude plugin detector plus scan receipts/symlink fail-closed, #1106 LifeOS skip-auth/test-context lock, and ADR-0007 Status Proposed. Do not Close #1087, #929, #983, or #1106. +12. Keep #1129 Draft stacked on #998 at `dd04cd3`. Unique delta remains #1099 Claude plugin detector plus receipts, symlink, duplicate JSON, unbounded MCP, missing LICENSE, #1106 LifeOS skip-auth/test-context lock, and ADR-0007 Status Proposed. Do not Close #1087, #929, #983, or #1106. 13. Keep #972 Draft at restacked `c488cff` as the G-02 assurance-envelope owner. Fresh exact-head checks after the non-force restack do not inherit predecessor GREEN. Do not Close #927. 14. Keep #1006 at restacked `35c28e22` as the G-03 bundle owner. The dashboard/CSP/Storybook slice stays a later successor. Do not Close #928. 15. Keep #1130 Draft. Canonical webhook storage-boundary owner is #1107; this Jules slice is not merge-ready. From 46a69a133c7d6147d7a9b26592d63cfdf5784ee3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 15:05:36 +0900 Subject: [PATCH 064/192] docs: record G-06 structural analyzer successor #1133 Summary: - Snapshot 06:01 UTC records Draft #1133 `529ecb0` stacked on #1088. - ADR-0009 remains Proposed; regex detector IDs stay migration oracles. Rationale: - #999 is the single writer of the product-technical gap baseline. - Analyzer-only slice is not protected scanner emission. Tests: - documentation-only; analyzer evidence lives on #1133 --- docs/product-technical-gap-baseline.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0c3c9548..cca10131 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 05:57 UTC +**Snapshot:** 2026-09-07 06:01 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,10 +68,11 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 05:57 UTC snapshot +## Security-defect corpus — live 2026-09-07 06:01 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | +| AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `529ecb0c5970878fda2075c772fd0e1c8b73834f` | open/Draft successor stacked on #1088 (`d9744331...`). REST `mergeable_state=clean` versus the #1088 branch, not protected `develop`. RED `3a02f16` → GREEN `17fbeef` → docs `529ecb0`. Focused suite 57 passed; `actions_poll_analyzer.py` 399 statements / 186 branches / 0 missing. ADR-0009 Status Proposed. No `_scan_file` hook; production findings still come from the #1088 regex rules. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `dd04cd303f0b1183bd761038fc8cb047f80a87b9` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `dd04cd3...` is a non-force descendant of `4a026d5...`. REST mergeability is versus the #998 branch, not protected `develop`. Unique delta now includes #1099 duplicate-JSON, unbounded-MCP, and missing-LICENSE admission plus earlier receipts/symlink/LifeOS #1106 lock. Local evidence: 38 focused tests passed and `claude_plugin_detector.py` statement coverage 497/497. Competing poll-loop and orphan production modules remain absent. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. Duplicate JSON members and unbounded MCP are hostile identity, not last-key-wins or silent inventory. | keep canonical owners #1088 (poll bounds) and #966 (orphans). Do not Close #1087, #929, #983, or #1106. Do not treat stack-clean mergeability onto #998 as protected `develop` behavior. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | @@ -118,9 +119,9 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-03 | A developer cannot safely transfer remediation/evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928 remains open; PR #1006 at exact head `35c28e22b5d50f1da943718cdb1984dcee098d62` after non-force restack onto `develop@e71d37e` is active-PR evidence for a transport-neutral, deterministic, redacted and digest-verified JSON contract, while the dashboard UI slice remains explicitly separate. | retain the standalone versioned bundle boundary; then add CSP-safe listener-based copy actions, accessible fallback/live-region behavior, focus handling and browser E2E after the design/Storybook gate | hostile text remains inert; no duplicate listeners; exact success/rejection/fallback behavior; provenance schema and digest verified on an unchanged protected head | **Open / active in #1006** | | G-04 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1080 and #1088 review histories; #1088 current exact head `d9744331...` remains the regex corpus owner. A successor branch `feat/actions-poll-structural-analyzer-1087` is being stacked on #1088 in an isolated worktree: additive stdlib analyzer, same detector IDs, no regex rewrite, no Close of #1087/#1088. #1129 maps the family and must not Close #1087/#929. | land RED→GREEN `classify_poll_loops` with helper-loop, reversed comparison, unreachable exit, quoted-text, and sibling-job timeout oracles; keep YAML rules as migration oracles | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / stacked successor of #1088** | +| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `529ecb0` stacks `classify_poll_loops` plus ADR-0009 Proposed. Focused tests 57 passed with 100% statement and branch coverage on the new module. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head Checks/review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 05:57 UTC records #998/`948c5f8` with exact-branch-coverage SUCCESS while Strix/Semgrep/Noema remain pending, stacked #1129 `dd04cd3` after duplicate-JSON/MCP/license admission, #966 `f707289` BLOCKED, #1088 `d9744331`, and G-06 structural analyzer stacked separately on #1088. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 06:01 UTC records Draft #1133 `529ecb0` stacked on #1088, #998/`948c5f8` coverage/bootstrap SUCCESS with Strix/Semgrep/Noema pending, stacked #1129 `dd04cd3`, #966 `f707289` BLOCKED, #972 restacked `c488cff`, #1006 restacked `35c28e22`, and #1130 Draft under #1107. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -160,7 +161,7 @@ re-fetch docs/issues/PRs/current heads 13. Keep #972 Draft at restacked `c488cff` as the G-02 assurance-envelope owner. Fresh exact-head checks after the non-force restack do not inherit predecessor GREEN. Do not Close #927. 14. Keep #1006 at restacked `35c28e22` as the G-03 bundle owner. The dashboard/CSP/Storybook slice stays a later successor. Do not Close #928. 15. Keep #1130 Draft. Canonical webhook storage-boundary owner is #1107; this Jules slice is not merge-ready. -16. Continue the G-06 structural analyzer as a stacked successor of #1088. Preserve regex rule IDs and corpus. Do not Close #1087. +16. Keep #1133 Draft stacked on #1088 at `529ecb0`. ADR-0009 is Proposed. Preserve regex rule IDs and corpus. Do not hook `_scan_file` on this slice. Do not Close #1087 or #1088. ## Standards and acceptance basis From 44501eda44e0f81949756f219bd877b1adef4073 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 15:20:17 +0900 Subject: [PATCH 065/192] docs: record #1133 exact-head coverage workflow Summary: - Snapshot 06:16 UTC records #1133 `5baeab9` with actions-poll-analyzer-coverage and a queued exact-head job. - Hosted coverage is queued, not claimed GREEN. Rationale: - Stacked PRs targeting #1088 do not inherit develop-only coverage workflows. The PR-number-bound job is the exact-head evidence path. Tests: - documentation-only; analyzer coverage evidence lives on #1133 --- docs/product-technical-gap-baseline.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cca10131..b85987d9 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 06:01 UTC +**Snapshot:** 2026-09-07 06:16 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,11 +68,11 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 06:01 UTC snapshot +## Security-defect corpus — live 2026-09-07 06:16 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | -| AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `529ecb0c5970878fda2075c772fd0e1c8b73834f` | open/Draft successor stacked on #1088 (`d9744331...`). REST `mergeable_state=clean` versus the #1088 branch, not protected `develop`. RED `3a02f16` → GREEN `17fbeef` → docs `529ecb0`. Focused suite 57 passed; `actions_poll_analyzer.py` 399 statements / 186 branches / 0 missing. ADR-0009 Status Proposed. No `_scan_file` hook; production findings still come from the #1088 regex rules. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | +| AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `dd04cd303f0b1183bd761038fc8cb047f80a87b9` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `dd04cd3...` is a non-force descendant of `4a026d5...`. REST mergeability is versus the #998 branch, not protected `develop`. Unique delta now includes #1099 duplicate-JSON, unbounded-MCP, and missing-LICENSE admission plus earlier receipts/symlink/LifeOS #1106 lock. Local evidence: 38 focused tests passed and `claude_plugin_detector.py` statement coverage 497/497. Competing poll-loop and orphan production modules remain absent. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. Duplicate JSON members and unbounded MCP are hostile identity, not last-key-wins or silent inventory. | keep canonical owners #1088 (poll bounds) and #966 (orphans). Do not Close #1087, #929, #983, or #1106. Do not treat stack-clean mergeability onto #998 as protected `develop` behavior. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | @@ -119,9 +119,9 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-03 | A developer cannot safely transfer remediation/evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928 remains open; PR #1006 at exact head `35c28e22b5d50f1da943718cdb1984dcee098d62` after non-force restack onto `develop@e71d37e` is active-PR evidence for a transport-neutral, deterministic, redacted and digest-verified JSON contract, while the dashboard UI slice remains explicitly separate. | retain the standalone versioned bundle boundary; then add CSP-safe listener-based copy actions, accessible fallback/live-region behavior, focus handling and browser E2E after the design/Storybook gate | hostile text remains inert; no duplicate listeners; exact success/rejection/fallback behavior; provenance schema and digest verified on an unchanged protected head | **Open / active in #1006** | | G-04 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `529ecb0` stacks `classify_poll_loops` plus ADR-0009 Proposed. Focused tests 57 passed with 100% statement and branch coverage on the new module. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head Checks/review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | +| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 06:01 UTC records Draft #1133 `529ecb0` stacked on #1088, #998/`948c5f8` coverage/bootstrap SUCCESS with Strix/Semgrep/Noema pending, stacked #1129 `dd04cd3`, #966 `f707289` BLOCKED, #972 restacked `c488cff`, #1006 restacked `35c28e22`, and #1130 Draft under #1107. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 06:16 UTC records Draft #1133 `5baeab9` (coverage workflow + queued exact-head job) stacked on #1088, #998/`948c5f8` coverage/bootstrap SUCCESS with Strix/Semgrep/Noema pending, stacked #1129 `dd04cd3`, #966 `f707289` BLOCKED, #972 restacked `c488cff`, #1006 restacked `35c28e22`, and #1130 Draft under #1107. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -161,7 +161,7 @@ re-fetch docs/issues/PRs/current heads 13. Keep #972 Draft at restacked `c488cff` as the G-02 assurance-envelope owner. Fresh exact-head checks after the non-force restack do not inherit predecessor GREEN. Do not Close #927. 14. Keep #1006 at restacked `35c28e22` as the G-03 bundle owner. The dashboard/CSP/Storybook slice stays a later successor. Do not Close #928. 15. Keep #1130 Draft. Canonical webhook storage-boundary owner is #1107; this Jules slice is not merge-ready. -16. Keep #1133 Draft stacked on #1088 at `529ecb0`. ADR-0009 is Proposed. Preserve regex rule IDs and corpus. Do not hook `_scan_file` on this slice. Do not Close #1087 or #1088. +16. Keep #1133 Draft stacked on #1088 at `5baeab9`. Wait for `actions-poll-analyzer-coverage` exact-head GREEN. ADR-0009 is Proposed. Preserve regex rule IDs and corpus. Do not hook `_scan_file` on this slice. Do not Close #1087 or #1088. ## Standards and acceptance basis From da8a7c503be6a635971106f2e55b3eb1a719a5cf Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 16:02:43 +0900 Subject: [PATCH 066/192] docs: record #1129 concealed-identity and #998 pending-handoff Refresh the 2026-09-07 06:58 UTC snapshot: #1129 cfd5ae6 unique bidi/oversized admission; #998 Semgrep/Noema SUCCESS with CodeQL compatibility pending-handoff classified as G-07, not source RED. --- docs/product-technical-gap-baseline.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b85987d9..12b0d060 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 06:16 UTC +**Snapshot:** 2026-09-07 06:58 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,15 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 06:16 UTC snapshot +## Security-defect corpus — live 2026-09-07 06:58 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `dd04cd303f0b1183bd761038fc8cb047f80a87b9` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `dd04cd3...` is a non-force descendant of `4a026d5...`. REST mergeability is versus the #998 branch, not protected `develop`. Unique delta now includes #1099 duplicate-JSON, unbounded-MCP, and missing-LICENSE admission plus earlier receipts/symlink/LifeOS #1106 lock. Local evidence: 38 focused tests passed and `claude_plugin_detector.py` statement coverage 497/497. Competing poll-loop and orphan production modules remain absent. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. Duplicate JSON members and unbounded MCP are hostile identity, not last-key-wins or silent inventory. | keep canonical owners #1088 (poll bounds) and #966 (orphans). Do not Close #1087, #929, #983, or #1106. Do not treat stack-clean mergeability onto #998 as protected `develop` behavior. | +| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `cfd5ae6267dfa026db860c1e8c235b5708dacbbf` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `cfd5ae6...` is a non-force descendant of `dd04cd3...`. REST mergeability is versus the #998 branch, not protected `develop`. Unique delta now includes #1099 concealed-bidi/control identity and oversized-package admission plus earlier receipts/symlink/duplicate-JSON/MCP/LICENSE/LifeOS #1106 lock. Local evidence: 31 focused tests passed and `claude_plugin_detector.py` statement coverage 525/525. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. Raw bidi/control characters are concealed identity; snippets emit codepoints, not the raw characters. | keep canonical owners #1088 (poll bounds), #966 (orphans), and #1133 (G-06 analyzer). Do not Close #1087, #929, #983, or #1106. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | -| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`. Exact head is unchanged. Live 05:40 UTC: Tests 3.11/3.13, exact-coverage, `exact-branch-coverage`, `required-workflow-bootstrap`, `scan-pr-queue`, Admit current pull request head, appguardrail-scan, CodeQL, and Trivy are terminal success. Remaining queued/pending: Strix, Semgrep, Noema, scorecard, osv-scan, dependency-review, one `admit-current-head` rerun, and `trivy-fs`. Stale OpenCode `CHANGES_REQUESTED` on `e2b0637` is not current-head. CodeRabbit/Devin `success` on this Draft are skipped robot reviews, not GitHub `APPROVE`. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head quality/security/SAST/semantic-review gates are terminal-success and a qualifying independent non-author approval exists. Dedicated coverage and bootstrap are no longer the blocker. Do not Close #983 from this snapshot. | +| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; GitHub `reviewDecision` remains stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. Live 06:58 UTC: 34 SUCCESS including Tests 3.11/3.13, exact-branch-coverage, Semgrep, Noema, Admit, Analyze (python/actions), osv-scan, Trivy. CodeQL compatibility analysis (python/actions) FAILED only as designed pending-handoff (`VERDICT_STATE=pending` after successful central dispatch; not a source finding). Strix in progress; OpenCode/coverage-evidence queued. Regular CodeQL Analyze jobs succeeded. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head Strix/OpenCode/CodeQL-verdict rerun and a qualifying independent non-author approval exist. Do not treat pending-handoff CodeQL compatibility failure as source RED. Do not Close #983. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | @@ -121,7 +121,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 06:16 UTC records Draft #1133 `5baeab9` (coverage workflow + queued exact-head job) stacked on #1088, #998/`948c5f8` coverage/bootstrap SUCCESS with Strix/Semgrep/Noema pending, stacked #1129 `dd04cd3`, #966 `f707289` BLOCKED, #972 restacked `c488cff`, #1006 restacked `35c28e22`, and #1130 Draft under #1107. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 06:58 UTC records #998/`948c5f8` with Semgrep/Noema SUCCESS, CodeQL compatibility pending-handoff, Strix/OpenCode still open; stacked #1129 `cfd5ae6` after concealed-identity/oversized admission; G-06 active in #1133 on #1088. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -155,9 +155,9 @@ re-fetch docs/issues/PRs/current heads 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. 9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. -10. Keep #998 Draft at `948c5f8` until remaining current-head Strix/Semgrep/Noema/security gates are terminal-success and a qualifying independent non-author approval exists. Dedicated Python shell AST coverage, bootstrap, and scan-pr-queue are now SUCCESS; that is not merge authority. Robot reviews are not GitHub `APPROVE`. Do not Close #983 from this snapshot. +10. Keep #998 Draft at `948c5f8` until current-head Strix, OpenCode, and CodeQL dispatch-verdict reruns are terminal-success and a qualifying independent non-author approval exists. Semgrep and Noema are now SUCCESS; CodeQL compatibility pending-handoff is G-07, not source RED. Robot reviews are not GitHub `APPROVE`. Do not Close #983. 11. Keep #966 at `f707289` as the canonical orphan-detector owner. BEHIND is resolved; BLOCKED remains on predecessor OpenCode `CHANGES_REQUESTED` / recorded Noema 502. Relates to #929 and must not Close it. -12. Keep #1129 Draft stacked on #998 at `dd04cd3`. Unique delta remains #1099 Claude plugin detector plus receipts, symlink, duplicate JSON, unbounded MCP, missing LICENSE, #1106 LifeOS skip-auth/test-context lock, and ADR-0007 Status Proposed. Do not Close #1087, #929, #983, or #1106. +12. Keep #1129 Draft stacked on #998 at `cfd5ae6`. Unique delta remains #1099 Claude plugin detector plus receipts, symlink, duplicate JSON, unbounded MCP, missing LICENSE, concealed identity, oversized packages, #1106 LifeOS skip-auth lock, and ADR-0007 Status Proposed. Do not Close #1087, #929, #983, or #1106. 13. Keep #972 Draft at restacked `c488cff` as the G-02 assurance-envelope owner. Fresh exact-head checks after the non-force restack do not inherit predecessor GREEN. Do not Close #927. 14. Keep #1006 at restacked `35c28e22` as the G-03 bundle owner. The dashboard/CSP/Storybook slice stays a later successor. Do not Close #928. 15. Keep #1130 Draft. Canonical webhook storage-boundary owner is #1107; this Jules slice is not merge-ready. From 74a947c1d4fcd80199ba3a08184b16d990b39957 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 16:21:20 +0900 Subject: [PATCH 067/192] docs: record #1134 capability inventory successor Summary: - Snapshot 07:21 UTC records Draft #1134 `4404840` stacked on #1129. - Inventory is evidence, not permission; undeclared executables fail admission. Hosted #1133 coverage remains queued, not GREEN. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1134 (638/638) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 12b0d060..29eb5f7a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 06:58 UTC +**Snapshot:** 2026-09-07 07:21 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,13 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 06:58 UTC snapshot +## Security-defect corpus — live 2026-09-07 07:21 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `cfd5ae6267dfa026db860c1e8c235b5708dacbbf` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `cfd5ae6...` is a non-force descendant of `dd04cd3...`. REST mergeability is versus the #998 branch, not protected `develop`. Unique delta now includes #1099 concealed-bidi/control identity and oversized-package admission plus earlier receipts/symlink/duplicate-JSON/MCP/LICENSE/LifeOS #1106 lock. Local evidence: 31 focused tests passed and `claude_plugin_detector.py` statement coverage 525/525. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. Raw bidi/control characters are concealed identity; snippets emit codepoints, not the raw characters. | keep canonical owners #1088 (poll bounds), #966 (orphans), and #1133 (G-06 analyzer). Do not Close #1087, #929, #983, or #1106. | +| AppGuardrail #1134, branch `feat/claude-plugin-capability-inventory-1099`, exact head `4404840afa6fd73c87ba564a840231a323f359be` | open/Draft successor stacked on #1129 (`cfd5ae6...`). REST `mergeable_state=clean` versus the #1129 branch, not protected `develop`. RED `1ebde11` → GREEN `4404840`. Focused plugin tests 29 passed; `claude_plugin_detector.py` statement coverage 638/638. | inventory is evidence, not permission. Undeclared executables after manifest inventory fail admission (`claude-plugin-undeclared-executable`). Receipt `capability_inventory_sha256` is a sorted-key digest; identical trees share it and a declared-hook `curl` changes it. | keep Draft stacked on #1129. Do not Close #1099, #1129, or #1036. Do not reimplement #1036 homoglyph/injection/exfil detectors. | +| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `cfd5ae6267dfa026db860c1e8c235b5708dacbbf` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `cfd5ae6...` is a non-force descendant of `dd04cd3...`. REST mergeability is versus the #998 branch, not protected `develop`. Unique delta now includes #1099 concealed-bidi/control identity and oversized-package admission plus earlier receipts/symlink/duplicate-JSON/MCP/LICENSE/LifeOS #1106 lock. Local evidence: 31 focused tests passed and `claude_plugin_detector.py` statement coverage 525/525. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. Raw bidi/control characters are concealed identity; snippets emit codepoints, not the raw characters. | keep canonical owners #1088 (poll bounds), #966 (orphans), and #1133 (G-06 analyzer). Capability inventory successor is #1134. Do not Close #1087, #929, #983, or #1106. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | | AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; GitHub `reviewDecision` remains stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. Live 06:58 UTC: 34 SUCCESS including Tests 3.11/3.13, exact-branch-coverage, Semgrep, Noema, Admit, Analyze (python/actions), osv-scan, Trivy. CodeQL compatibility analysis (python/actions) FAILED only as designed pending-handoff (`VERDICT_STATE=pending` after successful central dispatch; not a source finding). Strix in progress; OpenCode/coverage-evidence queued. Regular CodeQL Analyze jobs succeeded. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head Strix/OpenCode/CodeQL-verdict rerun and a qualifying independent non-author approval exist. Do not treat pending-handoff CodeQL compatibility failure as source RED. Do not Close #983. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | @@ -121,7 +122,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 06:58 UTC records #998/`948c5f8` with Semgrep/Noema SUCCESS, CodeQL compatibility pending-handoff, Strix/OpenCode still open; stacked #1129 `cfd5ae6` after concealed-identity/oversized admission; G-06 active in #1133 on #1088. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 07:21 UTC records Draft #1134 `4404840` stacked on #1129 `cfd5ae6`, G-06 #1133 `5baeab9` with coverage still queued, #998/`948c5f8` Semgrep/Noema SUCCESS and CodeQL pending-handoff. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -162,6 +163,7 @@ re-fetch docs/issues/PRs/current heads 14. Keep #1006 at restacked `35c28e22` as the G-03 bundle owner. The dashboard/CSP/Storybook slice stays a later successor. Do not Close #928. 15. Keep #1130 Draft. Canonical webhook storage-boundary owner is #1107; this Jules slice is not merge-ready. 16. Keep #1133 Draft stacked on #1088 at `5baeab9`. Wait for `actions-poll-analyzer-coverage` exact-head GREEN. ADR-0009 is Proposed. Preserve regex rule IDs and corpus. Do not hook `_scan_file` on this slice. Do not Close #1087 or #1088. +17. Keep #1134 Draft stacked on #1129 at `4404840`. Capability inventory is evidence, not permission. Do not Close #1099 or #1129. Do not reimplement #1036. ## Standards and acceptance basis From e8d29e6aabaef2f8fd7201b361f5869bcb067b36 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 17:03:32 +0900 Subject: [PATCH 068/192] docs: record #1129 source-mismatch and #1134 restack Refresh the 2026-09-07 07:58 UTC snapshot: #1129 24c6dda unique catalog/artifact identity admission; #1134 restacked at 0cd4329; #998 stays Draft pending Strix/OpenCode. --- docs/product-technical-gap-baseline.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 29eb5f7a..f6e39832 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 07:21 UTC +**Snapshot:** 2026-09-07 07:58 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,16 +68,16 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 07:21 UTC snapshot +## Security-defect corpus — live 2026-09-07 07:58 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1134, branch `feat/claude-plugin-capability-inventory-1099`, exact head `4404840afa6fd73c87ba564a840231a323f359be` | open/Draft successor stacked on #1129 (`cfd5ae6...`). REST `mergeable_state=clean` versus the #1129 branch, not protected `develop`. RED `1ebde11` → GREEN `4404840`. Focused plugin tests 29 passed; `claude_plugin_detector.py` statement coverage 638/638. | inventory is evidence, not permission. Undeclared executables after manifest inventory fail admission (`claude-plugin-undeclared-executable`). Receipt `capability_inventory_sha256` is a sorted-key digest; identical trees share it and a declared-hook `curl` changes it. | keep Draft stacked on #1129. Do not Close #1099, #1129, or #1036. Do not reimplement #1036 homoglyph/injection/exfil detectors. | -| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `cfd5ae6267dfa026db860c1e8c235b5708dacbbf` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `cfd5ae6...` is a non-force descendant of `dd04cd3...`. REST mergeability is versus the #998 branch, not protected `develop`. Unique delta now includes #1099 concealed-bidi/control identity and oversized-package admission plus earlier receipts/symlink/duplicate-JSON/MCP/LICENSE/LifeOS #1106 lock. Local evidence: 31 focused tests passed and `claude_plugin_detector.py` statement coverage 525/525. | frozen CWL security issues cluster into SAST/DAST families rather than one detector per ticket. Raw bidi/control characters are concealed identity; snippets emit codepoints, not the raw characters. | keep canonical owners #1088 (poll bounds), #966 (orphans), and #1133 (G-06 analyzer). Capability inventory successor is #1134. Do not Close #1087, #929, #983, or #1106. | +| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `24c6dda1c70f86628823086fcc2cff641fbb41df` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `24c6dda...` is a non-force descendant of `cfd5ae6...`. REST mergeability is versus the #998 branch. Unique delta now includes marketplace vs retrieved artifact source/ref/path mismatch plus earlier concealed-identity, oversized, receipts, symlink, duplicate-JSON, MCP, LICENSE, and LifeOS #1106 lock. Local evidence: 34 focused tests passed and `claude_plugin_detector.py` statement coverage 576/576. Capability inventory successor remains #1134. | frozen CWL security issues cluster into SAST/DAST families. Catalog SHA/repo/path must bind to the retrieved tree; missing or escaping `source.path` fails admission. | keep canonical owners #1088, #966, #1133, and #1134. Do not Close #1087, #929, #983, or #1106. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | -| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; GitHub `reviewDecision` remains stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. Live 06:58 UTC: 34 SUCCESS including Tests 3.11/3.13, exact-branch-coverage, Semgrep, Noema, Admit, Analyze (python/actions), osv-scan, Trivy. CodeQL compatibility analysis (python/actions) FAILED only as designed pending-handoff (`VERDICT_STATE=pending` after successful central dispatch; not a source finding). Strix in progress; OpenCode/coverage-evidence queued. Regular CodeQL Analyze jobs succeeded. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings and treated comments/strings as executable calls. | stay Draft until current-head Strix/OpenCode/CodeQL-verdict rerun and a qualifying independent non-author approval exist. Do not treat pending-handoff CodeQL compatibility failure as source RED. Do not Close #983. | +| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. Live 07:58 UTC: 34 SUCCESS including Tests, Semgrep, Noema, Admit, Analyze, osv-scan, Trivy. CodeQL compatibility still pending-handoff (`VERDICT_STATE=pending`). Strix IN_PROGRESS; OpenCode/coverage-evidence QUEUED. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings. | stay Draft until Strix/OpenCode/CodeQL-verdict rerun and independent non-author approval exist. Do not Close #983. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | @@ -122,7 +122,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 07:21 UTC records Draft #1134 `4404840` stacked on #1129 `cfd5ae6`, G-06 #1133 `5baeab9` with coverage still queued, #998/`948c5f8` Semgrep/Noema SUCCESS and CodeQL pending-handoff. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 07:58 UTC records #1129 `24c6dda` after source-mismatch admission, #1134 restacked at `0cd4329` onto that head, #1133 G-06 coverage queued, #998/`948c5f8` Semgrep/Noema SUCCESS with Strix/OpenCode still open. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -156,9 +156,9 @@ re-fetch docs/issues/PRs/current heads 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. 9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. -10. Keep #998 Draft at `948c5f8` until current-head Strix, OpenCode, and CodeQL dispatch-verdict reruns are terminal-success and a qualifying independent non-author approval exists. Semgrep and Noema are now SUCCESS; CodeQL compatibility pending-handoff is G-07, not source RED. Robot reviews are not GitHub `APPROVE`. Do not Close #983. +10. Keep #998 Draft at `948c5f8` until current-head Strix, OpenCode, and CodeQL dispatch-verdict reruns are terminal-success and a qualifying independent non-author approval exists. Semgrep and Noema remain SUCCESS; CodeQL compatibility pending-handoff is G-07. Do not Close #983. 11. Keep #966 at `f707289` as the canonical orphan-detector owner. BEHIND is resolved; BLOCKED remains on predecessor OpenCode `CHANGES_REQUESTED` / recorded Noema 502. Relates to #929 and must not Close it. -12. Keep #1129 Draft stacked on #998 at `cfd5ae6`. Unique delta remains #1099 Claude plugin detector plus receipts, symlink, duplicate JSON, unbounded MCP, missing LICENSE, concealed identity, oversized packages, #1106 LifeOS skip-auth lock, and ADR-0007 Status Proposed. Do not Close #1087, #929, #983, or #1106. +12. Keep #1129 Draft stacked on #998 at `24c6dda`. Unique delta remains #1099 including source/ref/path mismatch, plus #1106 LifeOS skip-auth lock. #1134 is restacked at `0cd4329` onto that head without force. Do not Close #1087, #929, #983, or #1106. 13. Keep #972 Draft at restacked `c488cff` as the G-02 assurance-envelope owner. Fresh exact-head checks after the non-force restack do not inherit predecessor GREEN. Do not Close #927. 14. Keep #1006 at restacked `35c28e22` as the G-03 bundle owner. The dashboard/CSP/Storybook slice stays a later successor. Do not Close #928. 15. Keep #1130 Draft. Canonical webhook storage-boundary owner is #1107; this Jules slice is not merge-ready. From bc0941e481b7f4b02e570df1c3775875d25c0067 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 17:25:23 +0900 Subject: [PATCH 069/192] docs: record #1135 archive and submodule admission Summary: - Snapshot 08:25 UTC records Draft #1135 `81e83f4` stacked on #1134. - Archive path traversal and unadmitted submodules fail closed. - #1134 restack head is `0cd4329`; #1133 coverage remains queued. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1135 (997/997) --- docs/product-technical-gap-baseline.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f6e39832..cbebcb16 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 07:58 UTC +**Snapshot:** 2026-09-07 08:25 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,13 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 07:58 UTC snapshot +## Security-defect corpus — live 2026-09-07 08:25 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1134, branch `feat/claude-plugin-capability-inventory-1099`, exact head `4404840afa6fd73c87ba564a840231a323f359be` | open/Draft successor stacked on #1129 (`cfd5ae6...`). REST `mergeable_state=clean` versus the #1129 branch, not protected `develop`. RED `1ebde11` → GREEN `4404840`. Focused plugin tests 29 passed; `claude_plugin_detector.py` statement coverage 638/638. | inventory is evidence, not permission. Undeclared executables after manifest inventory fail admission (`claude-plugin-undeclared-executable`). Receipt `capability_inventory_sha256` is a sorted-key digest; identical trees share it and a declared-hook `curl` changes it. | keep Draft stacked on #1129. Do not Close #1099, #1129, or #1036. Do not reimplement #1036 homoglyph/injection/exfil detectors. | +| AppGuardrail #1135, branch `feat/claude-plugin-archive-submodule-1099`, exact head `81e83f47235ebdf19d5d13c5b90a43bb3989dac2` | open/Draft successor stacked on #1134 (`0cd4329...`). RED `a5636ec` → GREEN `81e83f4`. Focused plugin tests 43 passed; `claude_plugin_detector.py` statement coverage 997/997. | zip/tar members that escape the extract root are not followed (`claude-plugin-archive-path-traversal`). Nested `.gitmodules`/gitlink without a recursively admitted 40-character SHA fail admission (`claude-plugin-unadmitted-submodule`). | keep Draft stacked on #1134. Do not Close #1099, #1134, or #1129. Do not extract outside the bounded root. | +| AppGuardrail #1134, branch `feat/claude-plugin-capability-inventory-1099`, exact head `0cd4329cf21aed37831863ad91350d0c39d0b689` | open/Draft successor stacked on #1129 (`24c6dda...`) after non-force restack from `4404840`. REST mergeability is versus the #1129 branch. Inventory tests plus restack coverage 689/689 on that head; #1135 extends the module further. | inventory is evidence, not permission. Undeclared executables after manifest inventory fail admission (`claude-plugin-undeclared-executable`). Receipt `capability_inventory_sha256` is a sorted-key digest. | keep Draft stacked on #1129. Archive/submodule successor is #1135. Do not Close #1099, #1129, or #1036. | | AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `24c6dda1c70f86628823086fcc2cff641fbb41df` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `24c6dda...` is a non-force descendant of `cfd5ae6...`. REST mergeability is versus the #998 branch. Unique delta now includes marketplace vs retrieved artifact source/ref/path mismatch plus earlier concealed-identity, oversized, receipts, symlink, duplicate-JSON, MCP, LICENSE, and LifeOS #1106 lock. Local evidence: 34 focused tests passed and `claude_plugin_detector.py` statement coverage 576/576. Capability inventory successor remains #1134. | frozen CWL security issues cluster into SAST/DAST families. Catalog SHA/repo/path must bind to the retrieved tree; missing or escaping `source.path` fails admission. | keep canonical owners #1088, #966, #1133, and #1134. Do not Close #1087, #929, #983, or #1106. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | | AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. Live 07:58 UTC: 34 SUCCESS including Tests, Semgrep, Noema, Admit, Analyze, osv-scan, Trivy. CodeQL compatibility still pending-handoff (`VERDICT_STATE=pending`). Strix IN_PROGRESS; OpenCode/coverage-evidence QUEUED. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings. | stay Draft until Strix/OpenCode/CodeQL-verdict rerun and independent non-author approval exist. Do not Close #983. | @@ -122,7 +123,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 07:58 UTC records #1129 `24c6dda` after source-mismatch admission, #1134 restacked at `0cd4329` onto that head, #1133 G-06 coverage queued, #998/`948c5f8` Semgrep/Noema SUCCESS with Strix/OpenCode still open. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 08:25 UTC records Draft #1135 `81e83f4` stacked on #1134 `0cd4329` on #1129 `24c6dda`; G-06 #1133 coverage still queued; #998/`948c5f8` Semgrep/Noema SUCCESS with Strix/OpenCode still open. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -163,7 +164,8 @@ re-fetch docs/issues/PRs/current heads 14. Keep #1006 at restacked `35c28e22` as the G-03 bundle owner. The dashboard/CSP/Storybook slice stays a later successor. Do not Close #928. 15. Keep #1130 Draft. Canonical webhook storage-boundary owner is #1107; this Jules slice is not merge-ready. 16. Keep #1133 Draft stacked on #1088 at `5baeab9`. Wait for `actions-poll-analyzer-coverage` exact-head GREEN. ADR-0009 is Proposed. Preserve regex rule IDs and corpus. Do not hook `_scan_file` on this slice. Do not Close #1087 or #1088. -17. Keep #1134 Draft stacked on #1129 at `4404840`. Capability inventory is evidence, not permission. Do not Close #1099 or #1129. Do not reimplement #1036. +17. Keep #1134 Draft stacked on #1129 at `0cd4329`. Capability inventory is evidence, not permission. Do not Close #1099 or #1129. Do not reimplement #1036. +18. Keep #1135 Draft stacked on #1134 at `81e83f4`. Archive traversal and unadmitted submodules fail closed. Do not Close #1099, #1134, or #1129. ## Standards and acceptance basis From ab2f5118431a7baa905b029a02835135c5f93cfe Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 18:08:00 +0900 Subject: [PATCH 070/192] docs: record #998 getoutput FN repair and stacked restacks Refresh the 2026-09-07 08:59 UTC snapshot: #998 60cdd3f after Strix VULN-0001 implicit-shell repair; #1129 e53d408, #1134 cdf79fb, and #1135 68a4c95 restacked without force. Predecessor Strix GREEN does not transfer. --- docs/product-technical-gap-baseline.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cbebcb16..887b64c7 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 08:25 UTC +**Snapshot:** 2026-09-07 08:59 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,7 +68,7 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 08:25 UTC snapshot +## Security-defect corpus — live 2026-09-07 08:59 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | @@ -76,9 +76,9 @@ Responsibility boundaries: | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1135, branch `feat/claude-plugin-archive-submodule-1099`, exact head `81e83f47235ebdf19d5d13c5b90a43bb3989dac2` | open/Draft successor stacked on #1134 (`0cd4329...`). RED `a5636ec` → GREEN `81e83f4`. Focused plugin tests 43 passed; `claude_plugin_detector.py` statement coverage 997/997. | zip/tar members that escape the extract root are not followed (`claude-plugin-archive-path-traversal`). Nested `.gitmodules`/gitlink without a recursively admitted 40-character SHA fail admission (`claude-plugin-unadmitted-submodule`). | keep Draft stacked on #1134. Do not Close #1099, #1134, or #1129. Do not extract outside the bounded root. | | AppGuardrail #1134, branch `feat/claude-plugin-capability-inventory-1099`, exact head `0cd4329cf21aed37831863ad91350d0c39d0b689` | open/Draft successor stacked on #1129 (`24c6dda...`) after non-force restack from `4404840`. REST mergeability is versus the #1129 branch. Inventory tests plus restack coverage 689/689 on that head; #1135 extends the module further. | inventory is evidence, not permission. Undeclared executables after manifest inventory fail admission (`claude-plugin-undeclared-executable`). Receipt `capability_inventory_sha256` is a sorted-key digest. | keep Draft stacked on #1129. Archive/submodule successor is #1135. Do not Close #1099, #1129, or #1036. | -| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `24c6dda1c70f86628823086fcc2cff641fbb41df` | open/Draft successor stacked on #998. Base exact head remains `948c5f8ebee02dcb621bced98adb8a9b462bd880`. Unique head `24c6dda...` is a non-force descendant of `cfd5ae6...`. REST mergeability is versus the #998 branch. Unique delta now includes marketplace vs retrieved artifact source/ref/path mismatch plus earlier concealed-identity, oversized, receipts, symlink, duplicate-JSON, MCP, LICENSE, and LifeOS #1106 lock. Local evidence: 34 focused tests passed and `claude_plugin_detector.py` statement coverage 576/576. Capability inventory successor remains #1134. | frozen CWL security issues cluster into SAST/DAST families. Catalog SHA/repo/path must bind to the retrieved tree; missing or escaping `source.path` fails admission. | keep canonical owners #1088, #966, #1133, and #1134. Do not Close #1087, #929, #983, or #1106. | +| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `e53d408` | open/Draft successor stacked on #998 `60cdd3f`. Unique head is a non-force merge of the getoutput implicit-shell fix onto `24c6dda`. Capability inventory successor #1134 is at `cdf79fb`; archive/submodule successor #1135 is restacked at `68a4c95`. | frozen CWL security issues cluster into SAST/DAST families. Catalog SHA/repo/path must bind to the retrieved tree. | keep canonical owners #1088, #966, #1133, #1134, and #1135. Do not Close #1087, #929, #983, or #1106. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | -| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `948c5f8ebee02dcb621bced98adb8a9b462bd880` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. Live 07:58 UTC: 34 SUCCESS including Tests, Semgrep, Noema, Admit, Analyze, osv-scan, Trivy. CodeQL compatibility still pending-handoff (`VERDICT_STATE=pending`). Strix IN_PROGRESS; OpenCode/coverage-evidence QUEUED. | regex-only `python-command-injection` could not resolve aliased, nested, or dotted `os`/`subprocess` shell bindings. | stay Draft until Strix/OpenCode/CodeQL-verdict rerun and independent non-author approval exist. Do not Close #983. | +| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `60cdd3fdaf2ac9fe5e108da90ff29e38d46a1f89` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. Predecessor `948c5f8` had 34 SUCCESS plus Strix FAILURE on job `101632589275`: VULN-0001 was a real FN (`subprocess.getoutput`/`getstatusoutput` always-shell APIs), repaired on `60cdd3f` with 394/394 coverage; the same job also failed closed after 6948s `orchestrator/free` exhaustion (G-07). Fresh exact-head Checks are required; predecessor Strix/Noema/Semgrep do not transfer. | regex-only `python-command-injection` missed aliased/nested/dotted bindings; AST still omitted implicit-shell `getoutput`/`getstatusoutput` until `60cdd3f`. | stay Draft until current-head Tests/Strix/OpenCode/CodeQL-verdict and independent non-author approval exist. Do not Close #983. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | @@ -123,7 +123,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 08:25 UTC records Draft #1135 `81e83f4` stacked on #1134 `0cd4329` on #1129 `24c6dda`; G-06 #1133 coverage still queued; #998/`948c5f8` Semgrep/Noema SUCCESS with Strix/OpenCode still open. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 08:59 UTC records #998 `60cdd3f` after Strix FN repair, stacked #1129 `e53d408`, #1134 `cdf79fb`, #1135 `68a4c95`; G-06 remains #1133. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -157,9 +157,9 @@ re-fetch docs/issues/PRs/current heads 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. 9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. -10. Keep #998 Draft at `948c5f8` until current-head Strix, OpenCode, and CodeQL dispatch-verdict reruns are terminal-success and a qualifying independent non-author approval exists. Semgrep and Noema remain SUCCESS; CodeQL compatibility pending-handoff is G-07. Do not Close #983. +10. Keep #998 Draft at `60cdd3f` until current-head Tests/Strix/OpenCode/CodeQL-verdict are terminal-success. Predecessor Strix FAILURE mixed a real getoutput FN (repaired) with G-07 provider exhaustion; do not transfer predecessor GREEN. Do not Close #983. 11. Keep #966 at `f707289` as the canonical orphan-detector owner. BEHIND is resolved; BLOCKED remains on predecessor OpenCode `CHANGES_REQUESTED` / recorded Noema 502. Relates to #929 and must not Close it. -12. Keep #1129 Draft stacked on #998 at `24c6dda`. Unique delta remains #1099 including source/ref/path mismatch, plus #1106 LifeOS skip-auth lock. #1134 is restacked at `0cd4329` onto that head without force. Do not Close #1087, #929, #983, or #1106. +12. Keep #1129 Draft stacked on #998 at `e53d408`. Unique delta remains #1099/#1106. #1134 is at `cdf79fb` and #1135 at `68a4c95` after non-force restack. Do not Close #1087, #929, #983, or #1106. 13. Keep #972 Draft at restacked `c488cff` as the G-02 assurance-envelope owner. Fresh exact-head checks after the non-force restack do not inherit predecessor GREEN. Do not Close #927. 14. Keep #1006 at restacked `35c28e22` as the G-03 bundle owner. The dashboard/CSP/Storybook slice stays a later successor. Do not Close #928. 15. Keep #1130 Draft. Canonical webhook storage-boundary owner is #1107; this Jules slice is not merge-ready. From c1c1a958c608738b86cf930adf5bd20379d22610 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 18:21:33 +0900 Subject: [PATCH 071/192] docs: record #1136 receipt-replay successor Summary: - Snapshot 09:12 UTC records Draft #1136 `2fe93a1` stacked on #1135. - Restacked #1135/#1134/#1129/#998 heads are aligned. - A pass receipt is not admission; replay against mutated trees fails. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1136 (1039/1039) --- docs/product-technical-gap-baseline.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 887b64c7..e414440e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 08:59 UTC +**Snapshot:** 2026-09-07 09:12 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 08:59 UTC snapshot +## Security-defect corpus — live 2026-09-07 09:12 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1135, branch `feat/claude-plugin-archive-submodule-1099`, exact head `81e83f47235ebdf19d5d13c5b90a43bb3989dac2` | open/Draft successor stacked on #1134 (`0cd4329...`). RED `a5636ec` → GREEN `81e83f4`. Focused plugin tests 43 passed; `claude_plugin_detector.py` statement coverage 997/997. | zip/tar members that escape the extract root are not followed (`claude-plugin-archive-path-traversal`). Nested `.gitmodules`/gitlink without a recursively admitted 40-character SHA fail admission (`claude-plugin-unadmitted-submodule`). | keep Draft stacked on #1134. Do not Close #1099, #1134, or #1129. Do not extract outside the bounded root. | -| AppGuardrail #1134, branch `feat/claude-plugin-capability-inventory-1099`, exact head `0cd4329cf21aed37831863ad91350d0c39d0b689` | open/Draft successor stacked on #1129 (`24c6dda...`) after non-force restack from `4404840`. REST mergeability is versus the #1129 branch. Inventory tests plus restack coverage 689/689 on that head; #1135 extends the module further. | inventory is evidence, not permission. Undeclared executables after manifest inventory fail admission (`claude-plugin-undeclared-executable`). Receipt `capability_inventory_sha256` is a sorted-key digest. | keep Draft stacked on #1129. Archive/submodule successor is #1135. Do not Close #1099, #1129, or #1036. | +| AppGuardrail #1136, branch `feat/claude-plugin-receipt-replay-1099`, exact head `2fe93a15ab890bbd943d01e6fc7399ef247c2098` | open/Draft successor stacked on #1135 (`68a4c95...`). Focused plugin tests 52 passed; `claude_plugin_detector.py` statement coverage 1039/1039. | a pass receipt is not Noema admission. `verify_plugin_scan_receipt` fails closed on artifact/policy/catalog/source/marketplace digest mismatch and on replay against mutated trees. | keep Draft stacked on #1135. Do not Close #1099 or #1135. | +| AppGuardrail #1135, branch `feat/claude-plugin-archive-submodule-1099`, exact head `68a4c957abc48e68861e9ceb29f8915efc634637` | open/Draft successor stacked on #1134 after non-force restack onto #998 `60cdd3f`. Receipt-replay successor is #1136. | zip/tar members that escape the extract root are not followed (`claude-plugin-archive-path-traversal`). Nested `.gitmodules`/gitlink without a recursively admitted 40-character SHA fail admission (`claude-plugin-unadmitted-submodule`). | keep Draft stacked on #1134. Do not Close #1099, #1134, or #1129. Do not extract outside the bounded root. | +| AppGuardrail #1134, branch `feat/claude-plugin-capability-inventory-1099`, exact head `cdf79fb3396bba522eb72d3cad16c6f4ae40ef0b` | open/Draft successor stacked on #1129 `e53d408` after non-force restack. Archive successor #1135 is at `68a4c95`. | inventory is evidence, not permission. Undeclared executables after manifest inventory fail admission (`claude-plugin-undeclared-executable`). Receipt `capability_inventory_sha256` is a sorted-key digest. | keep Draft stacked on #1129. Do not Close #1099, #1129, or #1036. | | AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `e53d408` | open/Draft successor stacked on #998 `60cdd3f`. Unique head is a non-force merge of the getoutput implicit-shell fix onto `24c6dda`. Capability inventory successor #1134 is at `cdf79fb`; archive/submodule successor #1135 is restacked at `68a4c95`. | frozen CWL security issues cluster into SAST/DAST families. Catalog SHA/repo/path must bind to the retrieved tree. | keep canonical owners #1088, #966, #1133, #1134, and #1135. Do not Close #1087, #929, #983, or #1106. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | | AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `60cdd3fdaf2ac9fe5e108da90ff29e38d46a1f89` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. Predecessor `948c5f8` had 34 SUCCESS plus Strix FAILURE on job `101632589275`: VULN-0001 was a real FN (`subprocess.getoutput`/`getstatusoutput` always-shell APIs), repaired on `60cdd3f` with 394/394 coverage; the same job also failed closed after 6948s `orchestrator/free` exhaustion (G-07). Fresh exact-head Checks are required; predecessor Strix/Noema/Semgrep do not transfer. | regex-only `python-command-injection` missed aliased/nested/dotted bindings; AST still omitted implicit-shell `getoutput`/`getstatusoutput` until `60cdd3f`. | stay Draft until current-head Tests/Strix/OpenCode/CodeQL-verdict and independent non-author approval exist. Do not Close #983. | @@ -123,7 +124,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 08:59 UTC records #998 `60cdd3f` after Strix FN repair, stacked #1129 `e53d408`, #1134 `cdf79fb`, #1135 `68a4c95`; G-06 remains #1133. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 09:12 UTC records Draft #1136 `2fe93a1` stacked on #1135 `68a4c95` on #1134 `cdf79fb` on #1129 `e53d408` on #998 `60cdd3f`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -164,8 +165,9 @@ re-fetch docs/issues/PRs/current heads 14. Keep #1006 at restacked `35c28e22` as the G-03 bundle owner. The dashboard/CSP/Storybook slice stays a later successor. Do not Close #928. 15. Keep #1130 Draft. Canonical webhook storage-boundary owner is #1107; this Jules slice is not merge-ready. 16. Keep #1133 Draft stacked on #1088 at `5baeab9`. Wait for `actions-poll-analyzer-coverage` exact-head GREEN. ADR-0009 is Proposed. Preserve regex rule IDs and corpus. Do not hook `_scan_file` on this slice. Do not Close #1087 or #1088. -17. Keep #1134 Draft stacked on #1129 at `0cd4329`. Capability inventory is evidence, not permission. Do not Close #1099 or #1129. Do not reimplement #1036. -18. Keep #1135 Draft stacked on #1134 at `81e83f4`. Archive traversal and unadmitted submodules fail closed. Do not Close #1099, #1134, or #1129. +17. Keep #1134 Draft stacked on #1129 at `cdf79fb`. Capability inventory is evidence, not permission. Do not Close #1099 or #1129. Do not reimplement #1036. +18. Keep #1135 Draft stacked on #1134 at `68a4c95`. Archive traversal and unadmitted submodules fail closed. Do not Close #1099, #1134, or #1129. +19. Keep #1136 Draft stacked on #1135 at `2fe93a1`. Stale/mismatched receipt replay fails closed. Do not Close #1099 or #1135. `scan_result=pass` is not Noema admission. ## Standards and acceptance basis From 0c9162df865fa9141dc79fbe216abcdeba17af68 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 19:14:10 +0900 Subject: [PATCH 072/192] docs: record #998 message-contract repair and #1137 successor Snapshot 2026-09-07 10:12 UTC: #998 8b95c2b Tests GREEN; stack restacked #1129 c5be73c / #1134 36e8f37 / #1135 ef28b05 / #1136 32dc0fc; unique #1137 GitHub-write/Docker on #1136. Do not Close #983, #1099, or #1036. --- docs/product-technical-gap-baseline.md | 28 ++++++++++++++------------ 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e414440e..3e1e5b9d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 09:12 UTC +**Snapshot:** 2026-09-07 10:12 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,18 +68,19 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 09:12 UTC snapshot +## Security-defect corpus — live 2026-09-07 10:12 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1136, branch `feat/claude-plugin-receipt-replay-1099`, exact head `2fe93a15ab890bbd943d01e6fc7399ef247c2098` | open/Draft successor stacked on #1135 (`68a4c95...`). Focused plugin tests 52 passed; `claude_plugin_detector.py` statement coverage 1039/1039. | a pass receipt is not Noema admission. `verify_plugin_scan_receipt` fails closed on artifact/policy/catalog/source/marketplace digest mismatch and on replay against mutated trees. | keep Draft stacked on #1135. Do not Close #1099 or #1135. | -| AppGuardrail #1135, branch `feat/claude-plugin-archive-submodule-1099`, exact head `68a4c957abc48e68861e9ceb29f8915efc634637` | open/Draft successor stacked on #1134 after non-force restack onto #998 `60cdd3f`. Receipt-replay successor is #1136. | zip/tar members that escape the extract root are not followed (`claude-plugin-archive-path-traversal`). Nested `.gitmodules`/gitlink without a recursively admitted 40-character SHA fail admission (`claude-plugin-unadmitted-submodule`). | keep Draft stacked on #1134. Do not Close #1099, #1134, or #1129. Do not extract outside the bounded root. | -| AppGuardrail #1134, branch `feat/claude-plugin-capability-inventory-1099`, exact head `cdf79fb3396bba522eb72d3cad16c6f4ae40ef0b` | open/Draft successor stacked on #1129 `e53d408` after non-force restack. Archive successor #1135 is at `68a4c95`. | inventory is evidence, not permission. Undeclared executables after manifest inventory fail admission (`claude-plugin-undeclared-executable`). Receipt `capability_inventory_sha256` is a sorted-key digest. | keep Draft stacked on #1129. Do not Close #1099, #1129, or #1036. | -| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `e53d408` | open/Draft successor stacked on #998 `60cdd3f`. Unique head is a non-force merge of the getoutput implicit-shell fix onto `24c6dda`. Capability inventory successor #1134 is at `cdf79fb`; archive/submodule successor #1135 is restacked at `68a4c95`. | frozen CWL security issues cluster into SAST/DAST families. Catalog SHA/repo/path must bind to the retrieved tree. | keep canonical owners #1088, #966, #1133, #1134, and #1135. Do not Close #1087, #929, #983, or #1106. | +| AppGuardrail #1137, branch `feat/claude-plugin-github-docker-authority-1099`, exact head `78c486f4a87c0af19cfa0012d21b5dc27df81f43` | open/Draft successor stacked on restacked #1136 (`32dc0fc...`). Unique TDD item 7: GitHub write tokens, Docker sockets, secret-to-network. Local 61 plugin tests; statement coverage 804/804. REST mergeable CLEAN versus #1136, not protected `develop`. | hardcoded `ghp_`/`github_pat_` tokens, `/var/run/docker.sock` / `unix://...docker.sock`, and named secrets copied into curl/wget/fetch fail admission. `gh issue create` and `docker push` remain inventory evidence. Detector snippets keep prefixes/env names; CLI redacts token/secret rule snippets. | keep Draft stacked on #1136. Do not Close #1099, #1036, or #1136. Do not reimplement #1036. | +| AppGuardrail #1136, branch `feat/claude-plugin-receipt-replay-1099`, exact head `32dc0fc81a900c0d829ecfe1fd0a064a32401b95` | open/Draft successor restacked non-force onto live #1135 (`ef28b05...`) after the #998 public-message restack. Unique stale/mismatched receipt replay is preserved. Focused plugin + public-message tests 53 passed on the merge. | a pass receipt is not Noema admission. `verify_plugin_scan_receipt` fails closed on artifact/policy/catalog/source/marketplace digest mismatch and on replay against mutated trees. | keep Draft stacked on #1135. Unique GitHub-write/Docker successor is #1137. Do not Close #1099 or #1135. | +| AppGuardrail #1135, branch `feat/claude-plugin-archive-submodule-1099`, exact head `ef28b05343739aa94ee2f2b942d363de52a1fdec` | open/Draft successor stacked on #1134 after non-force restack onto #998 `8b95c2b`. Receipt-replay successor is #1136 at `32dc0fc`. | zip/tar members that escape the extract root are not followed (`claude-plugin-archive-path-traversal`). Nested `.gitmodules`/gitlink without a recursively admitted 40-character SHA fail admission (`claude-plugin-unadmitted-submodule`). | keep Draft stacked on #1134. Do not Close #1099, #1134, or #1129. Do not extract outside the bounded root. | +| AppGuardrail #1134, branch `feat/claude-plugin-capability-inventory-1099`, exact head `36e8f37bc67392dd04ace4df8dbcdceed371e097` | open/Draft successor stacked on #1129 `c5be73c` after non-force restack. Archive successor #1135 is at `ef28b05`. | inventory is evidence, not permission. Undeclared executables after manifest inventory fail admission (`claude-plugin-undeclared-executable`). Receipt `capability_inventory_sha256` is a sorted-key digest. | keep Draft stacked on #1129. Do not Close #1099, #1129, or #1036. | +| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `c5be73c52a78a1c63c6ddf212de7d6281b9bd96b` | open/Draft successor stacked on #998 `8b95c2b`. Unique head is a non-force merge of the public-message contract repair onto `24c6dda` lineage. Capability inventory successor #1134 is at `36e8f37`; archive/submodule successor #1135 is restacked at `ef28b05`. | frozen CWL security issues cluster into SAST/DAST families. Catalog SHA/repo/path must bind to the retrieved tree. | keep canonical owners #1088, #966, #1133, #1134, #1135, #1136, and #1137. Do not Close #1087, #929, #983, or #1106. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | -| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `60cdd3fdaf2ac9fe5e108da90ff29e38d46a1f89` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. Predecessor `948c5f8` had 34 SUCCESS plus Strix FAILURE on job `101632589275`: VULN-0001 was a real FN (`subprocess.getoutput`/`getstatusoutput` always-shell APIs), repaired on `60cdd3f` with 394/394 coverage; the same job also failed closed after 6948s `orchestrator/free` exhaustion (G-07). Fresh exact-head Checks are required; predecessor Strix/Noema/Semgrep do not transfer. | regex-only `python-command-injection` missed aliased/nested/dotted bindings; AST still omitted implicit-shell `getoutput`/`getstatusoutput` until `60cdd3f`. | stay Draft until current-head Tests/Strix/OpenCode/CodeQL-verdict and independent non-author approval exist. Do not Close #983. | +| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `8b95c2bee24567ab3200a96da807259e023eee73` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. `60cdd3f` repaired the getoutput FN (394/394). Current head `8b95c2b` repairs the public taxonomy message contract after that wording change: Tests 3.11/3.13 SUCCESS; CodeQL Analyze python/actions, Security Process, coverage gates, CodeRabbit SUCCESS. Queued on this SHA: Strix, OpenCode, Noema, Semgrep, Security Scan, CodeQL PR, Python shell AST coverage. Predecessor Strix/Noema/Semgrep do not transfer. | regex-only `python-command-injection` missed aliased/nested/dotted bindings; AST omitted implicit-shell `getoutput`/`getstatusoutput` until `60cdd3f`; public message must name both implicit-shell families and `subprocess shell=True` distinctly. | stay Draft until current-head Tests/Strix/OpenCode/CodeQL-verdict and independent non-author approval exist. Do not Close #983. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | @@ -124,7 +125,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 09:12 UTC records Draft #1136 `2fe93a1` stacked on #1135 `68a4c95` on #1134 `cdf79fb` on #1129 `e53d408` on #998 `60cdd3f`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 10:12 UTC records Draft #1137 `78c486f` stacked on restacked #1136 `32dc0fc` on #1135 `ef28b05` on #1134 `36e8f37` on #1129 `c5be73c` on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -158,16 +159,17 @@ re-fetch docs/issues/PRs/current heads 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. 9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. -10. Keep #998 Draft at `60cdd3f` until current-head Tests/Strix/OpenCode/CodeQL-verdict are terminal-success. Predecessor Strix FAILURE mixed a real getoutput FN (repaired) with G-07 provider exhaustion; do not transfer predecessor GREEN. Do not Close #983. +10. Keep #998 Draft at `8b95c2b` until current-head Tests/Strix/OpenCode/CodeQL-verdict are terminal-success. Tests 3.11/3.13 are SUCCESS on this SHA; Strix/OpenCode/Noema/Semgrep/Security Scan/CodeQL PR remain queued. Predecessor Strix FAILURE mixed a real getoutput FN (repaired on `60cdd3f`) with G-07 provider exhaustion; do not transfer predecessor GREEN. Do not Close #983. 11. Keep #966 at `f707289` as the canonical orphan-detector owner. BEHIND is resolved; BLOCKED remains on predecessor OpenCode `CHANGES_REQUESTED` / recorded Noema 502. Relates to #929 and must not Close it. -12. Keep #1129 Draft stacked on #998 at `e53d408`. Unique delta remains #1099/#1106. #1134 is at `cdf79fb` and #1135 at `68a4c95` after non-force restack. Do not Close #1087, #929, #983, or #1106. +12. Keep #1129 Draft stacked on #998 at `c5be73c`. Unique delta remains #1099/#1106. #1134 is at `36e8f37` and #1135 at `ef28b05` after non-force restack. Do not Close #1087, #929, #983, or #1106. 13. Keep #972 Draft at restacked `c488cff` as the G-02 assurance-envelope owner. Fresh exact-head checks after the non-force restack do not inherit predecessor GREEN. Do not Close #927. 14. Keep #1006 at restacked `35c28e22` as the G-03 bundle owner. The dashboard/CSP/Storybook slice stays a later successor. Do not Close #928. 15. Keep #1130 Draft. Canonical webhook storage-boundary owner is #1107; this Jules slice is not merge-ready. 16. Keep #1133 Draft stacked on #1088 at `5baeab9`. Wait for `actions-poll-analyzer-coverage` exact-head GREEN. ADR-0009 is Proposed. Preserve regex rule IDs and corpus. Do not hook `_scan_file` on this slice. Do not Close #1087 or #1088. -17. Keep #1134 Draft stacked on #1129 at `cdf79fb`. Capability inventory is evidence, not permission. Do not Close #1099 or #1129. Do not reimplement #1036. -18. Keep #1135 Draft stacked on #1134 at `68a4c95`. Archive traversal and unadmitted submodules fail closed. Do not Close #1099, #1134, or #1129. -19. Keep #1136 Draft stacked on #1135 at `2fe93a1`. Stale/mismatched receipt replay fails closed. Do not Close #1099 or #1135. `scan_result=pass` is not Noema admission. +17. Keep #1134 Draft stacked on #1129 at `36e8f37`. Capability inventory is evidence, not permission. Do not Close #1099 or #1129. Do not reimplement #1036. +18. Keep #1135 Draft stacked on #1134 at `ef28b05`. Archive traversal and unadmitted submodules fail closed. Do not Close #1099, #1134, or #1129. +19. Keep #1136 Draft stacked on #1135 at `32dc0fc`. Stale/mismatched receipt replay fails closed. Do not Close #1099 or #1135. `scan_result=pass` is not Noema admission. +20. Keep #1137 Draft stacked on #1136 at `78c486f`. GitHub write tokens, Docker sockets, and secret-to-network flows fail admission; `gh issue create` and `docker push` stay inventory. Do not Close #1099, #1036, or #1136. ## Standards and acceptance basis From f63ece9afab1d9ce672551b961d6fb4b18ac6d2a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 19:32:20 +0900 Subject: [PATCH 073/192] docs: record #1138 unsigned-download successor Summary: - Snapshot 10:28 UTC records Draft #1138 `bdb3809` stacked on #1137. - Unsigned executable downloads and unpinned URL installs fail closed. - Lockfile-only package trees stay package_install inventory. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1138 (1150/1150) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3e1e5b9d..d29386c5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 10:12 UTC +**Snapshot:** 2026-09-07 10:28 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,13 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 10:12 UTC snapshot +## Security-defect corpus — live 2026-09-07 10:28 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1137, branch `feat/claude-plugin-github-docker-authority-1099`, exact head `78c486f4a87c0af19cfa0012d21b5dc27df81f43` | open/Draft successor stacked on restacked #1136 (`32dc0fc...`). Unique TDD item 7: GitHub write tokens, Docker sockets, secret-to-network. Local 61 plugin tests; statement coverage 804/804. REST mergeable CLEAN versus #1136, not protected `develop`. | hardcoded `ghp_`/`github_pat_` tokens, `/var/run/docker.sock` / `unix://...docker.sock`, and named secrets copied into curl/wget/fetch fail admission. `gh issue create` and `docker push` remain inventory evidence. Detector snippets keep prefixes/env names; CLI redacts token/secret rule snippets. | keep Draft stacked on #1136. Do not Close #1099, #1036, or #1136. Do not reimplement #1036. | +| AppGuardrail #1138, branch `feat/claude-plugin-unsigned-download-1099`, exact head `bdb380938b33bd9918eafc433ff3081964bd36a4` | open/Draft successor stacked on #1137 (`78c486f...`). RED `e4efb66` → GREEN `bdb3809`. Focused plugin tests 67 passed; `claude_plugin_detector.py` statement coverage 1150/1150. | mutable runtime download then execute, and unpinned `https://`/`git+` package installs, fail admission (`claude-plugin-unsigned-executable-download`, `claude-plugin-unpinned-package-install`). Lockfile-backed package trees without postinstall download stay `package_install` inventory. | keep Draft stacked on #1137. Do not Close #1099 or #1137. Do not treat every shell command as malicious. | +| AppGuardrail #1137, branch `feat/claude-plugin-github-docker-authority-1099`, exact head `78c486f4a87c0af19cfa0012d21b5dc27df81f43` | open/Draft successor stacked on restacked #1136 (`32dc0fc...`). Unique TDD item 7: GitHub write tokens, Docker sockets, secret-to-network. Local 61 plugin tests; statement coverage 804/804. REST mergeable CLEAN versus #1136, not protected `develop`. Unsigned-download successor is #1138. | hardcoded `ghp_`/`github_pat_` tokens, `/var/run/docker.sock` / `unix://...docker.sock`, and named secrets copied into curl/wget/fetch fail admission. `gh issue create` and `docker push` remain inventory evidence. Detector snippets keep prefixes/env names; CLI redacts token/secret rule snippets. | keep Draft stacked on #1136. Do not Close #1099, #1036, or #1136. Do not reimplement #1036. | | AppGuardrail #1136, branch `feat/claude-plugin-receipt-replay-1099`, exact head `32dc0fc81a900c0d829ecfe1fd0a064a32401b95` | open/Draft successor restacked non-force onto live #1135 (`ef28b05...`) after the #998 public-message restack. Unique stale/mismatched receipt replay is preserved. Focused plugin + public-message tests 53 passed on the merge. | a pass receipt is not Noema admission. `verify_plugin_scan_receipt` fails closed on artifact/policy/catalog/source/marketplace digest mismatch and on replay against mutated trees. | keep Draft stacked on #1135. Unique GitHub-write/Docker successor is #1137. Do not Close #1099 or #1135. | | AppGuardrail #1135, branch `feat/claude-plugin-archive-submodule-1099`, exact head `ef28b05343739aa94ee2f2b942d363de52a1fdec` | open/Draft successor stacked on #1134 after non-force restack onto #998 `8b95c2b`. Receipt-replay successor is #1136 at `32dc0fc`. | zip/tar members that escape the extract root are not followed (`claude-plugin-archive-path-traversal`). Nested `.gitmodules`/gitlink without a recursively admitted 40-character SHA fail admission (`claude-plugin-unadmitted-submodule`). | keep Draft stacked on #1134. Do not Close #1099, #1134, or #1129. Do not extract outside the bounded root. | | AppGuardrail #1134, branch `feat/claude-plugin-capability-inventory-1099`, exact head `36e8f37bc67392dd04ace4df8dbcdceed371e097` | open/Draft successor stacked on #1129 `c5be73c` after non-force restack. Archive successor #1135 is at `ef28b05`. | inventory is evidence, not permission. Undeclared executables after manifest inventory fail admission (`claude-plugin-undeclared-executable`). Receipt `capability_inventory_sha256` is a sorted-key digest. | keep Draft stacked on #1129. Do not Close #1099, #1129, or #1036. | @@ -125,7 +126,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 10:12 UTC records Draft #1137 `78c486f` stacked on restacked #1136 `32dc0fc` on #1135 `ef28b05` on #1134 `36e8f37` on #1129 `c5be73c` on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 10:28 UTC records Draft #1138 `bdb3809` stacked on #1137 `78c486f` on #1136 `32dc0fc` on #1135 `ef28b05` on #1134 `36e8f37` on #1129 `c5be73c` on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -170,6 +171,7 @@ re-fetch docs/issues/PRs/current heads 18. Keep #1135 Draft stacked on #1134 at `ef28b05`. Archive traversal and unadmitted submodules fail closed. Do not Close #1099, #1134, or #1129. 19. Keep #1136 Draft stacked on #1135 at `32dc0fc`. Stale/mismatched receipt replay fails closed. Do not Close #1099 or #1135. `scan_result=pass` is not Noema admission. 20. Keep #1137 Draft stacked on #1136 at `78c486f`. GitHub write tokens, Docker sockets, and secret-to-network flows fail admission; `gh issue create` and `docker push` stay inventory. Do not Close #1099, #1036, or #1136. +21. Keep #1138 Draft stacked on #1137 at `bdb3809`. Unsigned executable downloads and unpinned URL installs fail admission; lockfile-only package trees stay inventory. Do not Close #1099 or #1137. ## Standards and acceptance basis From 1dbb523f5398a4892367c0241d99fca6ff5651ef Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 20:06:31 +0900 Subject: [PATCH 074/192] docs: record #1139 skill-rule reuse and #998 AST coverage Snapshot 2026-09-07 10:57 UTC: #998 8b95c2b Tests and Python shell AST coverage GREEN, Strix/OpenCode still queued; #1139 6cd54b3 reuses #1036 identities on plugin receipts. Do not Close #983, #1036, or #1099. --- docs/product-technical-gap-baseline.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d29386c5..10c91079 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 10:28 UTC +**Snapshot:** 2026-09-07 10:57 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,20 +68,21 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 10:28 UTC snapshot +## Security-defect corpus — live 2026-09-07 10:57 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1138, branch `feat/claude-plugin-unsigned-download-1099`, exact head `bdb380938b33bd9918eafc433ff3081964bd36a4` | open/Draft successor stacked on #1137 (`78c486f...`). RED `e4efb66` → GREEN `bdb3809`. Focused plugin tests 67 passed; `claude_plugin_detector.py` statement coverage 1150/1150. | mutable runtime download then execute, and unpinned `https://`/`git+` package installs, fail admission (`claude-plugin-unsigned-executable-download`, `claude-plugin-unpinned-package-install`). Lockfile-backed package trees without postinstall download stay `package_install` inventory. | keep Draft stacked on #1137. Do not Close #1099 or #1137. Do not treat every shell command as malicious. | +| AppGuardrail #1139, branch `feat/claude-plugin-skill-rule-reuse-1099`, exact head `6cd54b3ec49b085cfd8d3584746f600162d0e1d5` | open/Draft successor stacked on #1138 (`bdb3809...`). Non-destructive merge of #1036 `fdb49c3` plus adapter. Local 74 plugin tests; statement coverage 872/872. REST mergeable CLEAN versus #1138. | plugin skill/agent surfaces reuse released #1036 identities (`skill-name-homoglyph-confusable`, `skill-manifest-prompt-injection-payload`, `skill-doc-exfiltration-endpoint-directive`, `skill-placeholder-template-unresolved`). The adapter calls the packaged YAML engine and does not copy those regular expressions. ASCII skills still pass; README homoglyphs and skill symlinks are not surfaces. | keep Draft stacked on #1138. Do not Close #1036, #1099, or #1138. | +| AppGuardrail #1138, branch `feat/claude-plugin-unsigned-download-1099`, exact head `bdb380938b33bd9918eafc433ff3081964bd36a4` | open/Draft successor stacked on #1137 (`78c486f...`). RED `e4efb66` → GREEN `bdb3809`. Focused plugin tests 67 passed; `claude_plugin_detector.py` statement coverage 1150/1150. Skill-rule-reuse successor is #1139. | mutable runtime download then execute, and unpinned `https://`/`git+` package installs, fail admission (`claude-plugin-unsigned-executable-download`, `claude-plugin-unpinned-package-install`). Lockfile-backed package trees without postinstall download stay `package_install` inventory. | keep Draft stacked on #1137. Do not Close #1099 or #1137. Do not treat every shell command as malicious. | | AppGuardrail #1137, branch `feat/claude-plugin-github-docker-authority-1099`, exact head `78c486f4a87c0af19cfa0012d21b5dc27df81f43` | open/Draft successor stacked on restacked #1136 (`32dc0fc...`). Unique TDD item 7: GitHub write tokens, Docker sockets, secret-to-network. Local 61 plugin tests; statement coverage 804/804. REST mergeable CLEAN versus #1136, not protected `develop`. Unsigned-download successor is #1138. | hardcoded `ghp_`/`github_pat_` tokens, `/var/run/docker.sock` / `unix://...docker.sock`, and named secrets copied into curl/wget/fetch fail admission. `gh issue create` and `docker push` remain inventory evidence. Detector snippets keep prefixes/env names; CLI redacts token/secret rule snippets. | keep Draft stacked on #1136. Do not Close #1099, #1036, or #1136. Do not reimplement #1036. | | AppGuardrail #1136, branch `feat/claude-plugin-receipt-replay-1099`, exact head `32dc0fc81a900c0d829ecfe1fd0a064a32401b95` | open/Draft successor restacked non-force onto live #1135 (`ef28b05...`) after the #998 public-message restack. Unique stale/mismatched receipt replay is preserved. Focused plugin + public-message tests 53 passed on the merge. | a pass receipt is not Noema admission. `verify_plugin_scan_receipt` fails closed on artifact/policy/catalog/source/marketplace digest mismatch and on replay against mutated trees. | keep Draft stacked on #1135. Unique GitHub-write/Docker successor is #1137. Do not Close #1099 or #1135. | | AppGuardrail #1135, branch `feat/claude-plugin-archive-submodule-1099`, exact head `ef28b05343739aa94ee2f2b942d363de52a1fdec` | open/Draft successor stacked on #1134 after non-force restack onto #998 `8b95c2b`. Receipt-replay successor is #1136 at `32dc0fc`. | zip/tar members that escape the extract root are not followed (`claude-plugin-archive-path-traversal`). Nested `.gitmodules`/gitlink without a recursively admitted 40-character SHA fail admission (`claude-plugin-unadmitted-submodule`). | keep Draft stacked on #1134. Do not Close #1099, #1134, or #1129. Do not extract outside the bounded root. | | AppGuardrail #1134, branch `feat/claude-plugin-capability-inventory-1099`, exact head `36e8f37bc67392dd04ace4df8dbcdceed371e097` | open/Draft successor stacked on #1129 `c5be73c` after non-force restack. Archive successor #1135 is at `ef28b05`. | inventory is evidence, not permission. Undeclared executables after manifest inventory fail admission (`claude-plugin-undeclared-executable`). Receipt `capability_inventory_sha256` is a sorted-key digest. | keep Draft stacked on #1129. Do not Close #1099, #1129, or #1036. | -| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `c5be73c52a78a1c63c6ddf212de7d6281b9bd96b` | open/Draft successor stacked on #998 `8b95c2b`. Unique head is a non-force merge of the public-message contract repair onto `24c6dda` lineage. Capability inventory successor #1134 is at `36e8f37`; archive/submodule successor #1135 is restacked at `ef28b05`. | frozen CWL security issues cluster into SAST/DAST families. Catalog SHA/repo/path must bind to the retrieved tree. | keep canonical owners #1088, #966, #1133, #1134, #1135, #1136, and #1137. Do not Close #1087, #929, #983, or #1106. | +| AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `c5be73c52a78a1c63c6ddf212de7d6281b9bd96b` | open/Draft successor stacked on #998 `8b95c2b`. Unique head is a non-force merge of the public-message contract repair onto `24c6dda` lineage. Capability inventory successor #1134 is at `36e8f37`; archive/submodule successor #1135 is restacked at `ef28b05`. | frozen CWL security issues cluster into SAST/DAST families. Catalog SHA/repo/path must bind to the retrieved tree. | keep canonical owners #1088, #966, #1133, #1134, #1135, #1136, #1137, #1138, and #1139. Do not Close #1087, #929, #983, or #1106. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | -| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `8b95c2bee24567ab3200a96da807259e023eee73` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. `60cdd3f` repaired the getoutput FN (394/394). Current head `8b95c2b` repairs the public taxonomy message contract after that wording change: Tests 3.11/3.13 SUCCESS; CodeQL Analyze python/actions, Security Process, coverage gates, CodeRabbit SUCCESS. Queued on this SHA: Strix, OpenCode, Noema, Semgrep, Security Scan, CodeQL PR, Python shell AST coverage. Predecessor Strix/Noema/Semgrep do not transfer. | regex-only `python-command-injection` missed aliased/nested/dotted bindings; AST omitted implicit-shell `getoutput`/`getstatusoutput` until `60cdd3f`; public message must name both implicit-shell families and `subprocess shell=True` distinctly. | stay Draft until current-head Tests/Strix/OpenCode/CodeQL-verdict and independent non-author approval exist. Do not Close #983. | +| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `8b95c2bee24567ab3200a96da807259e023eee73` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. `60cdd3f` repaired the getoutput FN (394/394). Current head `8b95c2b` repairs the public taxonomy message contract: Tests 3.11/3.13 SUCCESS; Python shell AST coverage `exact-branch-coverage` SUCCESS; CodeQL Analyze python/actions, Security Process, coverage gates, CodeRabbit, Strix/Noema admit-current-head SUCCESS. Still queued on this SHA: Strix `strix` job, OpenCode `admit-current-head`, Noema review, Semgrep, Security Scan (osv/scorecard/trivy-fs/dependency-review), CodeQL compatibility analysis. Predecessor Strix/Noema/Semgrep do not transfer. | regex-only `python-command-injection` missed aliased/nested/dotted bindings; AST omitted implicit-shell `getoutput`/`getstatusoutput` until `60cdd3f`; public message must name both implicit-shell families and `subprocess shell=True` distinctly. | stay Draft until current-head Tests/Strix/OpenCode/CodeQL-verdict and independent non-author approval exist. Do not Close #983. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | @@ -126,7 +127,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 10:28 UTC records Draft #1138 `bdb3809` stacked on #1137 `78c486f` on #1136 `32dc0fc` on #1135 `ef28b05` on #1134 `36e8f37` on #1129 `c5be73c` on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 10:57 UTC records Draft #1139 `6cd54b3` stacked on #1138 `bdb3809` on #1137 `78c486f` on #1136 `32dc0fc` on #1135 `ef28b05` on #1134 `36e8f37` on #1129 `c5be73c` on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -160,7 +161,7 @@ re-fetch docs/issues/PRs/current heads 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. 9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. -10. Keep #998 Draft at `8b95c2b` until current-head Tests/Strix/OpenCode/CodeQL-verdict are terminal-success. Tests 3.11/3.13 are SUCCESS on this SHA; Strix/OpenCode/Noema/Semgrep/Security Scan/CodeQL PR remain queued. Predecessor Strix FAILURE mixed a real getoutput FN (repaired on `60cdd3f`) with G-07 provider exhaustion; do not transfer predecessor GREEN. Do not Close #983. +10. Keep #998 Draft at `8b95c2b` until current-head Tests/Strix/OpenCode/CodeQL-verdict are terminal-success. Tests 3.11/3.13 and Python shell AST coverage are SUCCESS on this SHA; Strix/OpenCode/Noema/Semgrep/Security Scan/CodeQL-compat remain queued after admit SUCCESS. Predecessor Strix FAILURE mixed a real getoutput FN (repaired on `60cdd3f`) with G-07 provider exhaustion; do not transfer predecessor GREEN. Do not Close #983. 11. Keep #966 at `f707289` as the canonical orphan-detector owner. BEHIND is resolved; BLOCKED remains on predecessor OpenCode `CHANGES_REQUESTED` / recorded Noema 502. Relates to #929 and must not Close it. 12. Keep #1129 Draft stacked on #998 at `c5be73c`. Unique delta remains #1099/#1106. #1134 is at `36e8f37` and #1135 at `ef28b05` after non-force restack. Do not Close #1087, #929, #983, or #1106. 13. Keep #972 Draft at restacked `c488cff` as the G-02 assurance-envelope owner. Fresh exact-head checks after the non-force restack do not inherit predecessor GREEN. Do not Close #927. @@ -172,6 +173,7 @@ re-fetch docs/issues/PRs/current heads 19. Keep #1136 Draft stacked on #1135 at `32dc0fc`. Stale/mismatched receipt replay fails closed. Do not Close #1099 or #1135. `scan_result=pass` is not Noema admission. 20. Keep #1137 Draft stacked on #1136 at `78c486f`. GitHub write tokens, Docker sockets, and secret-to-network flows fail admission; `gh issue create` and `docker push` stay inventory. Do not Close #1099, #1036, or #1136. 21. Keep #1138 Draft stacked on #1137 at `bdb3809`. Unsigned executable downloads and unpinned URL installs fail admission; lockfile-only package trees stay inventory. Do not Close #1099 or #1137. +22. Keep #1139 Draft stacked on #1138 at `6cd54b3`. Reuse released #1036 skill-supply-chain identities on plugin skill/agent receipts. Do not Close #1036, #1099, or #1138. Do not copy those regular expressions. ## Standards and acceptance basis From e897f95619b3dbf6985be60c69aaaef5ca940fdd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 20:26:51 +0900 Subject: [PATCH 075/192] docs: record #1140 plugin scan CLI successor Summary: - Snapshot 11:16 UTC records Draft #1140 `bfa61c9` stacked on #1139. - `scan-plugin` writes the existing receipt and exits nonzero unless pass. - Pass is not Noema admission. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; CLI evidence lives on #1140 (79/79) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 10c91079..b51dabee 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 10:57 UTC +**Snapshot:** 2026-09-07 11:16 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,13 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 10:57 UTC snapshot +## Security-defect corpus — live 2026-09-07 11:16 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1139, branch `feat/claude-plugin-skill-rule-reuse-1099`, exact head `6cd54b3ec49b085cfd8d3584746f600162d0e1d5` | open/Draft successor stacked on #1138 (`bdb3809...`). Non-destructive merge of #1036 `fdb49c3` plus adapter. Local 74 plugin tests; statement coverage 872/872. REST mergeable CLEAN versus #1138. | plugin skill/agent surfaces reuse released #1036 identities (`skill-name-homoglyph-confusable`, `skill-manifest-prompt-injection-payload`, `skill-doc-exfiltration-endpoint-directive`, `skill-placeholder-template-unresolved`). The adapter calls the packaged YAML engine and does not copy those regular expressions. ASCII skills still pass; README homoglyphs and skill symlinks are not surfaces. | keep Draft stacked on #1138. Do not Close #1036, #1099, or #1138. | +| AppGuardrail #1140, branch `feat/claude-plugin-scan-cli-1099`, exact head `bfa61c95f8b7126cea316ecc95d558dbcc875e8d` | open/Draft successor stacked on #1139 (`6cd54b3...`). RED `192ae4f` → GREEN `bfa61c9`. CLI tests plus plugin suite 88 passed; new `claude_plugin_scan_cli.py` 79/79; detector gate 1194/1194. | `appguardrail scan-plugin --plugin-root` writes the existing deterministic receipt. Exit 0 only when `scan_result` is pass. Missing root fails closed. Pass is not Noema admission. | keep Draft stacked on #1139. Do not Close #1099 or #1139. Do not fork the receipt schema. | +| AppGuardrail #1139, branch `feat/claude-plugin-skill-rule-reuse-1099`, exact head `6cd54b3ec49b085cfd8d3584746f600162d0e1d5` | open/Draft successor stacked on #1138 (`bdb3809...`). Non-destructive merge of #1036 `fdb49c3` plus adapter. Local 74 plugin tests; statement coverage 872/872. REST mergeable CLEAN versus #1138. CLI successor is #1140. | plugin skill/agent surfaces reuse released #1036 identities (`skill-name-homoglyph-confusable`, `skill-manifest-prompt-injection-payload`, `skill-doc-exfiltration-endpoint-directive`, `skill-placeholder-template-unresolved`). The adapter calls the packaged YAML engine and does not copy those regular expressions. ASCII skills still pass; README homoglyphs and skill symlinks are not surfaces. | keep Draft stacked on #1138. Do not Close #1036, #1099, or #1138. | | AppGuardrail #1138, branch `feat/claude-plugin-unsigned-download-1099`, exact head `bdb380938b33bd9918eafc433ff3081964bd36a4` | open/Draft successor stacked on #1137 (`78c486f...`). RED `e4efb66` → GREEN `bdb3809`. Focused plugin tests 67 passed; `claude_plugin_detector.py` statement coverage 1150/1150. Skill-rule-reuse successor is #1139. | mutable runtime download then execute, and unpinned `https://`/`git+` package installs, fail admission (`claude-plugin-unsigned-executable-download`, `claude-plugin-unpinned-package-install`). Lockfile-backed package trees without postinstall download stay `package_install` inventory. | keep Draft stacked on #1137. Do not Close #1099 or #1137. Do not treat every shell command as malicious. | | AppGuardrail #1137, branch `feat/claude-plugin-github-docker-authority-1099`, exact head `78c486f4a87c0af19cfa0012d21b5dc27df81f43` | open/Draft successor stacked on restacked #1136 (`32dc0fc...`). Unique TDD item 7: GitHub write tokens, Docker sockets, secret-to-network. Local 61 plugin tests; statement coverage 804/804. REST mergeable CLEAN versus #1136, not protected `develop`. Unsigned-download successor is #1138. | hardcoded `ghp_`/`github_pat_` tokens, `/var/run/docker.sock` / `unix://...docker.sock`, and named secrets copied into curl/wget/fetch fail admission. `gh issue create` and `docker push` remain inventory evidence. Detector snippets keep prefixes/env names; CLI redacts token/secret rule snippets. | keep Draft stacked on #1136. Do not Close #1099, #1036, or #1136. Do not reimplement #1036. | | AppGuardrail #1136, branch `feat/claude-plugin-receipt-replay-1099`, exact head `32dc0fc81a900c0d829ecfe1fd0a064a32401b95` | open/Draft successor restacked non-force onto live #1135 (`ef28b05...`) after the #998 public-message restack. Unique stale/mismatched receipt replay is preserved. Focused plugin + public-message tests 53 passed on the merge. | a pass receipt is not Noema admission. `verify_plugin_scan_receipt` fails closed on artifact/policy/catalog/source/marketplace digest mismatch and on replay against mutated trees. | keep Draft stacked on #1135. Unique GitHub-write/Docker successor is #1137. Do not Close #1099 or #1135. | @@ -127,7 +128,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 10:57 UTC records Draft #1139 `6cd54b3` stacked on #1138 `bdb3809` on #1137 `78c486f` on #1136 `32dc0fc` on #1135 `ef28b05` on #1134 `36e8f37` on #1129 `c5be73c` on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 11:16 UTC records Draft #1140 `bfa61c9` stacked on #1139 `6cd54b3` on #1138 `bdb3809` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -174,6 +175,7 @@ re-fetch docs/issues/PRs/current heads 20. Keep #1137 Draft stacked on #1136 at `78c486f`. GitHub write tokens, Docker sockets, and secret-to-network flows fail admission; `gh issue create` and `docker push` stay inventory. Do not Close #1099, #1036, or #1136. 21. Keep #1138 Draft stacked on #1137 at `bdb3809`. Unsigned executable downloads and unpinned URL installs fail admission; lockfile-only package trees stay inventory. Do not Close #1099 or #1137. 22. Keep #1139 Draft stacked on #1138 at `6cd54b3`. Reuse released #1036 skill-supply-chain identities on plugin skill/agent receipts. Do not Close #1036, #1099, or #1138. Do not copy those regular expressions. +23. Keep #1140 Draft stacked on #1139 at `bfa61c9`. `scan-plugin` writes the existing receipt and fails closed when `scan_result` is not pass. Do not Close #1099 or #1139. Pass is not Noema admission. ## Standards and acceptance basis From c9bb7e4a6cbf1d90d17c5315a78613088e47e850 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 21:04:06 +0900 Subject: [PATCH 076/192] docs: record #1141 catalog bind and #998 queued gates Snapshot 2026-09-07 11:57 UTC: #998 8b95c2b Tests/AST coverage GREEN, Strix/OpenCode still queued; #1141 80f56b0 binds marketplace catalog identity onto plugin receipts. Do not Close #983 or #1099. --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b51dabee..21492d01 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 11:16 UTC +**Snapshot:** 2026-09-07 11:57 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,13 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 11:16 UTC snapshot +## Security-defect corpus — live 2026-09-07 11:57 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1140, branch `feat/claude-plugin-scan-cli-1099`, exact head `bfa61c95f8b7126cea316ecc95d558dbcc875e8d` | open/Draft successor stacked on #1139 (`6cd54b3...`). RED `192ae4f` → GREEN `bfa61c9`. CLI tests plus plugin suite 88 passed; new `claude_plugin_scan_cli.py` 79/79; detector gate 1194/1194. | `appguardrail scan-plugin --plugin-root` writes the existing deterministic receipt. Exit 0 only when `scan_result` is pass. Missing root fails closed. Pass is not Noema admission. | keep Draft stacked on #1139. Do not Close #1099 or #1139. Do not fork the receipt schema. | +| AppGuardrail #1141, branch `feat/claude-plugin-catalog-bind-1099`, exact head `80f56b0fabde73ec66d38b2cd260d4a9a2ed2e00` | open/Draft successor stacked on #1140 (`bfa61c9...`). RED then GREEN CLI tests; `claude_plugin_scan_cli.py` 72/72 statement/branch. REST mergeable CLEAN versus #1140. | an external marketplace catalog binds `catalog_repository`, `catalog_commit_sha`, and `marketplace_blob_sha`. A floating catalog commit reuses `claude-plugin-floating-git-ref`. Catalog plugin name/repo/ref that disagrees with the retrieved artifact reuses `claude-plugin-source-mismatch`. | keep Draft stacked on #1140. Do not Close #1099 or #1140. Do not fork the receipt schema. | +| AppGuardrail #1140, branch `feat/claude-plugin-scan-cli-1099`, exact head `bfa61c95f8b7126cea316ecc95d558dbcc875e8d` | open/Draft successor stacked on #1139 (`6cd54b3...`). RED `192ae4f` → GREEN `bfa61c9`. CLI tests plus plugin suite 88 passed; new `claude_plugin_scan_cli.py` 79/79; detector gate 1194/1194. Catalog-bind successor is #1141. | `appguardrail scan-plugin --plugin-root` writes the existing deterministic receipt. Exit 0 only when `scan_result` is pass. Missing root fails closed. Pass is not Noema admission. | keep Draft stacked on #1139. Do not Close #1099 or #1139. Do not fork the receipt schema. | | AppGuardrail #1139, branch `feat/claude-plugin-skill-rule-reuse-1099`, exact head `6cd54b3ec49b085cfd8d3584746f600162d0e1d5` | open/Draft successor stacked on #1138 (`bdb3809...`). Non-destructive merge of #1036 `fdb49c3` plus adapter. Local 74 plugin tests; statement coverage 872/872. REST mergeable CLEAN versus #1138. CLI successor is #1140. | plugin skill/agent surfaces reuse released #1036 identities (`skill-name-homoglyph-confusable`, `skill-manifest-prompt-injection-payload`, `skill-doc-exfiltration-endpoint-directive`, `skill-placeholder-template-unresolved`). The adapter calls the packaged YAML engine and does not copy those regular expressions. ASCII skills still pass; README homoglyphs and skill symlinks are not surfaces. | keep Draft stacked on #1138. Do not Close #1036, #1099, or #1138. | | AppGuardrail #1138, branch `feat/claude-plugin-unsigned-download-1099`, exact head `bdb380938b33bd9918eafc433ff3081964bd36a4` | open/Draft successor stacked on #1137 (`78c486f...`). RED `e4efb66` → GREEN `bdb3809`. Focused plugin tests 67 passed; `claude_plugin_detector.py` statement coverage 1150/1150. Skill-rule-reuse successor is #1139. | mutable runtime download then execute, and unpinned `https://`/`git+` package installs, fail admission (`claude-plugin-unsigned-executable-download`, `claude-plugin-unpinned-package-install`). Lockfile-backed package trees without postinstall download stay `package_install` inventory. | keep Draft stacked on #1137. Do not Close #1099 or #1137. Do not treat every shell command as malicious. | | AppGuardrail #1137, branch `feat/claude-plugin-github-docker-authority-1099`, exact head `78c486f4a87c0af19cfa0012d21b5dc27df81f43` | open/Draft successor stacked on restacked #1136 (`32dc0fc...`). Unique TDD item 7: GitHub write tokens, Docker sockets, secret-to-network. Local 61 plugin tests; statement coverage 804/804. REST mergeable CLEAN versus #1136, not protected `develop`. Unsigned-download successor is #1138. | hardcoded `ghp_`/`github_pat_` tokens, `/var/run/docker.sock` / `unix://...docker.sock`, and named secrets copied into curl/wget/fetch fail admission. `gh issue create` and `docker push` remain inventory evidence. Detector snippets keep prefixes/env names; CLI redacts token/secret rule snippets. | keep Draft stacked on #1136. Do not Close #1099, #1036, or #1136. Do not reimplement #1036. | @@ -128,7 +129,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 11:16 UTC records Draft #1140 `bfa61c9` stacked on #1139 `6cd54b3` on #1138 `bdb3809` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 11:57 UTC records Draft #1141 `80f56b0` stacked on #1140 `bfa61c9` on #1139 `6cd54b3` on #1138 `bdb3809` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -176,6 +177,7 @@ re-fetch docs/issues/PRs/current heads 21. Keep #1138 Draft stacked on #1137 at `bdb3809`. Unsigned executable downloads and unpinned URL installs fail admission; lockfile-only package trees stay inventory. Do not Close #1099 or #1137. 22. Keep #1139 Draft stacked on #1138 at `6cd54b3`. Reuse released #1036 skill-supply-chain identities on plugin skill/agent receipts. Do not Close #1036, #1099, or #1138. Do not copy those regular expressions. 23. Keep #1140 Draft stacked on #1139 at `bfa61c9`. `scan-plugin` writes the existing receipt and fails closed when `scan_result` is not pass. Do not Close #1099 or #1139. Pass is not Noema admission. +24. Keep #1141 Draft stacked on #1140 at `80f56b0`. External marketplace catalogs bind catalog repository/SHA/blob digest; floating commits and source mismatches fail closed. Do not Close #1099 or #1140. ## Standards and acceptance basis From 65d4a93f73a2b5440aca01e2a682ee558eccb1dd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 21:19:20 +0900 Subject: [PATCH 077/192] docs: record #1142 SARIF receipt successor Summary: - Snapshot 12:10 UTC records Draft #1142 `d5df6c7` stacked on #1141. - Receipt sarif_sha256 matches finding_summary rule IDs. - Pass is not Noema admission. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; SARIF adapter evidence lives on #1142 (50/50) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 21492d01..a24d556d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 11:57 UTC +**Snapshot:** 2026-09-07 12:10 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,13 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 11:57 UTC snapshot +## Security-defect corpus — live 2026-09-07 12:10 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1141, branch `feat/claude-plugin-catalog-bind-1099`, exact head `80f56b0fabde73ec66d38b2cd260d4a9a2ed2e00` | open/Draft successor stacked on #1140 (`bfa61c9...`). RED then GREEN CLI tests; `claude_plugin_scan_cli.py` 72/72 statement/branch. REST mergeable CLEAN versus #1140. | an external marketplace catalog binds `catalog_repository`, `catalog_commit_sha`, and `marketplace_blob_sha`. A floating catalog commit reuses `claude-plugin-floating-git-ref`. Catalog plugin name/repo/ref that disagrees with the retrieved artifact reuses `claude-plugin-source-mismatch`. | keep Draft stacked on #1140. Do not Close #1099 or #1140. Do not fork the receipt schema. | +| AppGuardrail #1142, branch `feat/claude-plugin-sarif-receipt-1099`, exact head `d5df6c75f97eac677527e44b9b91df41c3825dfc` | open/Draft successor stacked on #1141 (`80f56b0...`). RED `854a21b` → GREEN `d5df6c7`. Full suite 1180 passed; `claude_plugin_sarif.py` 50/50; detector 1243/1243; CLI 91/91. | receipt `sarif_sha256` is SHA-256 of a SARIF 2.1.0 document whose rule IDs match `finding_summary`. Mutating the tree changes both. | keep Draft stacked on #1141. Do not Close #1099 or #1141. Do not invent a second SARIF dialect. | +| AppGuardrail #1141, branch `feat/claude-plugin-catalog-bind-1099`, exact head `80f56b0fabde73ec66d38b2cd260d4a9a2ed2e00` | open/Draft successor stacked on #1140 (`bfa61c9...`). RED then GREEN CLI tests; `claude_plugin_scan_cli.py` 72/72 statement/branch. REST mergeable CLEAN versus #1140. SARIF-receipt successor is #1142. | an external marketplace catalog binds `catalog_repository`, `catalog_commit_sha`, and `marketplace_blob_sha`. A floating catalog commit reuses `claude-plugin-floating-git-ref`. Catalog plugin name/repo/ref that disagrees with the retrieved artifact reuses `claude-plugin-source-mismatch`. | keep Draft stacked on #1140. Do not Close #1099 or #1140. Do not fork the receipt schema. | | AppGuardrail #1140, branch `feat/claude-plugin-scan-cli-1099`, exact head `bfa61c95f8b7126cea316ecc95d558dbcc875e8d` | open/Draft successor stacked on #1139 (`6cd54b3...`). RED `192ae4f` → GREEN `bfa61c9`. CLI tests plus plugin suite 88 passed; new `claude_plugin_scan_cli.py` 79/79; detector gate 1194/1194. Catalog-bind successor is #1141. | `appguardrail scan-plugin --plugin-root` writes the existing deterministic receipt. Exit 0 only when `scan_result` is pass. Missing root fails closed. Pass is not Noema admission. | keep Draft stacked on #1139. Do not Close #1099 or #1139. Do not fork the receipt schema. | | AppGuardrail #1139, branch `feat/claude-plugin-skill-rule-reuse-1099`, exact head `6cd54b3ec49b085cfd8d3584746f600162d0e1d5` | open/Draft successor stacked on #1138 (`bdb3809...`). Non-destructive merge of #1036 `fdb49c3` plus adapter. Local 74 plugin tests; statement coverage 872/872. REST mergeable CLEAN versus #1138. CLI successor is #1140. | plugin skill/agent surfaces reuse released #1036 identities (`skill-name-homoglyph-confusable`, `skill-manifest-prompt-injection-payload`, `skill-doc-exfiltration-endpoint-directive`, `skill-placeholder-template-unresolved`). The adapter calls the packaged YAML engine and does not copy those regular expressions. ASCII skills still pass; README homoglyphs and skill symlinks are not surfaces. | keep Draft stacked on #1138. Do not Close #1036, #1099, or #1138. | | AppGuardrail #1138, branch `feat/claude-plugin-unsigned-download-1099`, exact head `bdb380938b33bd9918eafc433ff3081964bd36a4` | open/Draft successor stacked on #1137 (`78c486f...`). RED `e4efb66` → GREEN `bdb3809`. Focused plugin tests 67 passed; `claude_plugin_detector.py` statement coverage 1150/1150. Skill-rule-reuse successor is #1139. | mutable runtime download then execute, and unpinned `https://`/`git+` package installs, fail admission (`claude-plugin-unsigned-executable-download`, `claude-plugin-unpinned-package-install`). Lockfile-backed package trees without postinstall download stay `package_install` inventory. | keep Draft stacked on #1137. Do not Close #1099 or #1137. Do not treat every shell command as malicious. | @@ -129,7 +130,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 11:57 UTC records Draft #1141 `80f56b0` stacked on #1140 `bfa61c9` on #1139 `6cd54b3` on #1138 `bdb3809` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 12:10 UTC records Draft #1142 `d5df6c7` stacked on #1141 `80f56b0` on #1140 `bfa61c9` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -178,6 +179,7 @@ re-fetch docs/issues/PRs/current heads 22. Keep #1139 Draft stacked on #1138 at `6cd54b3`. Reuse released #1036 skill-supply-chain identities on plugin skill/agent receipts. Do not Close #1036, #1099, or #1138. Do not copy those regular expressions. 23. Keep #1140 Draft stacked on #1139 at `bfa61c9`. `scan-plugin` writes the existing receipt and fails closed when `scan_result` is not pass. Do not Close #1099 or #1139. Pass is not Noema admission. 24. Keep #1141 Draft stacked on #1140 at `80f56b0`. External marketplace catalogs bind catalog repository/SHA/blob digest; floating commits and source mismatches fail closed. Do not Close #1099 or #1140. +25. Keep #1142 Draft stacked on #1141 at `d5df6c7`. Receipt `sarif_sha256` must match `finding_summary` rule IDs. Do not Close #1099 or #1141. ## Standards and acceptance basis From cbcaf43c3b6ad527bc23ccc27f0ca187d80cccdc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 22:04:09 +0900 Subject: [PATCH 078/192] docs: record #1143 license mismatch and #998 Noema SUCCESS Snapshot 2026-09-07 12:58 UTC: #998 8b95c2b Tests/AST/Noema GREEN, Strix in progress, CodeQL-compat pending-handoff; #1141 e9852bd; #1143 e5051ea LICENSE/NOTICE SPDX mismatch. Do not Close #983 or #1099. --- docs/product-technical-gap-baseline.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a24d556d..b4b4040d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 12:10 UTC +**Snapshot:** 2026-09-07 12:58 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 12:10 UTC snapshot +## Security-defect corpus — live 2026-09-07 12:58 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1142, branch `feat/claude-plugin-sarif-receipt-1099`, exact head `d5df6c75f97eac677527e44b9b91df41c3825dfc` | open/Draft successor stacked on #1141 (`80f56b0...`). RED `854a21b` → GREEN `d5df6c7`. Full suite 1180 passed; `claude_plugin_sarif.py` 50/50; detector 1243/1243; CLI 91/91. | receipt `sarif_sha256` is SHA-256 of a SARIF 2.1.0 document whose rule IDs match `finding_summary`. Mutating the tree changes both. | keep Draft stacked on #1141. Do not Close #1099 or #1141. Do not invent a second SARIF dialect. | -| AppGuardrail #1141, branch `feat/claude-plugin-catalog-bind-1099`, exact head `80f56b0fabde73ec66d38b2cd260d4a9a2ed2e00` | open/Draft successor stacked on #1140 (`bfa61c9...`). RED then GREEN CLI tests; `claude_plugin_scan_cli.py` 72/72 statement/branch. REST mergeable CLEAN versus #1140. SARIF-receipt successor is #1142. | an external marketplace catalog binds `catalog_repository`, `catalog_commit_sha`, and `marketplace_blob_sha`. A floating catalog commit reuses `claude-plugin-floating-git-ref`. Catalog plugin name/repo/ref that disagrees with the retrieved artifact reuses `claude-plugin-source-mismatch`. | keep Draft stacked on #1140. Do not Close #1099 or #1140. Do not fork the receipt schema. | +| AppGuardrail #1143, branch `feat/claude-plugin-license-mismatch-1099`, exact head `e5051ea32eeedb708e3f7e04c1f25c395fc4bbbd` | open/Draft successor stacked on #1142 (`d5df6c7...`). RED then GREEN license tests; detector statement coverage 935/935 with plugin suites. REST mergeable CLEAN versus #1142. | NOTICE files count as license evidence. Conflicting SPDX identifiers across the declared license field, LICENSE, and NOTICE fail as `claude-plugin-license-mismatch` without inventing legal approval. | keep Draft stacked on #1142. Do not Close #1099 or #1142. | +| AppGuardrail #1142, branch `feat/claude-plugin-sarif-receipt-1099`, exact head `d5df6c75f97eac677527e44b9b91df41c3825dfc` | open/Draft successor stacked on live #1141 (`e9852bd...`). RED `854a21b` → GREEN `d5df6c7`. Full suite 1180 passed; `claude_plugin_sarif.py` 50/50. License-mismatch successor is #1143. | receipt `sarif_sha256` is SHA-256 of a SARIF 2.1.0 document whose rule IDs match `finding_summary`. Mutating the tree changes both. | keep Draft stacked on #1141. Do not Close #1099 or #1141. Do not invent a second SARIF dialect. | +| AppGuardrail #1141, branch `feat/claude-plugin-catalog-bind-1099`, exact head `e9852bdb9025f3873dbafed9e0381a1798a41b5a` | open/Draft successor stacked on #1140 (`bfa61c9...`). Live head adds canonical marketplace entry selection by plugin name after `80f56b0`. REST mergeable CLEAN versus #1140. SARIF-receipt successor is #1142. | an external marketplace catalog binds `catalog_repository`, `catalog_commit_sha`, and `marketplace_blob_sha`. A floating catalog commit reuses `claude-plugin-floating-git-ref`. Catalog plugin name/repo/ref that disagrees with the retrieved artifact reuses `claude-plugin-source-mismatch`. | keep Draft stacked on #1140. Do not Close #1099 or #1140. Do not fork the receipt schema. | | AppGuardrail #1140, branch `feat/claude-plugin-scan-cli-1099`, exact head `bfa61c95f8b7126cea316ecc95d558dbcc875e8d` | open/Draft successor stacked on #1139 (`6cd54b3...`). RED `192ae4f` → GREEN `bfa61c9`. CLI tests plus plugin suite 88 passed; new `claude_plugin_scan_cli.py` 79/79; detector gate 1194/1194. Catalog-bind successor is #1141. | `appguardrail scan-plugin --plugin-root` writes the existing deterministic receipt. Exit 0 only when `scan_result` is pass. Missing root fails closed. Pass is not Noema admission. | keep Draft stacked on #1139. Do not Close #1099 or #1139. Do not fork the receipt schema. | | AppGuardrail #1139, branch `feat/claude-plugin-skill-rule-reuse-1099`, exact head `6cd54b3ec49b085cfd8d3584746f600162d0e1d5` | open/Draft successor stacked on #1138 (`bdb3809...`). Non-destructive merge of #1036 `fdb49c3` plus adapter. Local 74 plugin tests; statement coverage 872/872. REST mergeable CLEAN versus #1138. CLI successor is #1140. | plugin skill/agent surfaces reuse released #1036 identities (`skill-name-homoglyph-confusable`, `skill-manifest-prompt-injection-payload`, `skill-doc-exfiltration-endpoint-directive`, `skill-placeholder-template-unresolved`). The adapter calls the packaged YAML engine and does not copy those regular expressions. ASCII skills still pass; README homoglyphs and skill symlinks are not surfaces. | keep Draft stacked on #1138. Do not Close #1036, #1099, or #1138. | | AppGuardrail #1138, branch `feat/claude-plugin-unsigned-download-1099`, exact head `bdb380938b33bd9918eafc433ff3081964bd36a4` | open/Draft successor stacked on #1137 (`78c486f...`). RED `e4efb66` → GREEN `bdb3809`. Focused plugin tests 67 passed; `claude_plugin_detector.py` statement coverage 1150/1150. Skill-rule-reuse successor is #1139. | mutable runtime download then execute, and unpinned `https://`/`git+` package installs, fail admission (`claude-plugin-unsigned-executable-download`, `claude-plugin-unpinned-package-install`). Lockfile-backed package trees without postinstall download stay `package_install` inventory. | keep Draft stacked on #1137. Do not Close #1099 or #1137. Do not treat every shell command as malicious. | @@ -85,7 +86,7 @@ Responsibility boundaries: | AppGuardrail #1134, branch `feat/claude-plugin-capability-inventory-1099`, exact head `36e8f37bc67392dd04ace4df8dbcdceed371e097` | open/Draft successor stacked on #1129 `c5be73c` after non-force restack. Archive successor #1135 is at `ef28b05`. | inventory is evidence, not permission. Undeclared executables after manifest inventory fail admission (`claude-plugin-undeclared-executable`). Receipt `capability_inventory_sha256` is a sorted-key digest. | keep Draft stacked on #1129. Do not Close #1099, #1129, or #1036. | | AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `c5be73c52a78a1c63c6ddf212de7d6281b9bd96b` | open/Draft successor stacked on #998 `8b95c2b`. Unique head is a non-force merge of the public-message contract repair onto `24c6dda` lineage. Capability inventory successor #1134 is at `36e8f37`; archive/submodule successor #1135 is restacked at `ef28b05`. | frozen CWL security issues cluster into SAST/DAST families. Catalog SHA/repo/path must bind to the retrieved tree. | keep canonical owners #1088, #966, #1133, #1134, #1135, #1136, #1137, #1138, and #1139. Do not Close #1087, #929, #983, or #1106. | | AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | -| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `8b95c2bee24567ab3200a96da807259e023eee73` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. `60cdd3f` repaired the getoutput FN (394/394). Current head `8b95c2b` repairs the public taxonomy message contract: Tests 3.11/3.13 SUCCESS; Python shell AST coverage `exact-branch-coverage` SUCCESS; CodeQL Analyze python/actions, Security Process, coverage gates, CodeRabbit, Strix/Noema admit-current-head SUCCESS. Still queued on this SHA: Strix `strix` job, OpenCode `admit-current-head`, Noema review, Semgrep, Security Scan (osv/scorecard/trivy-fs/dependency-review), CodeQL compatibility analysis. Predecessor Strix/Noema/Semgrep do not transfer. | regex-only `python-command-injection` missed aliased/nested/dotted bindings; AST omitted implicit-shell `getoutput`/`getstatusoutput` until `60cdd3f`; public message must name both implicit-shell families and `subprocess shell=True` distinctly. | stay Draft until current-head Tests/Strix/OpenCode/CodeQL-verdict and independent non-author approval exist. Do not Close #983. | +| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `8b95c2bee24567ab3200a96da807259e023eee73` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. Current-head Tests 3.11/3.13 SUCCESS; Python shell AST coverage SUCCESS; Semgrep, osv-scan, Security Process, coverage gates, CodeRabbit SUCCESS; current-head Noema review SUCCESS at 12:40 UTC. Strix `strix` is in progress. OpenCode `opencode-review` remains queued. CodeQL compatibility analysis python/actions FAILURE is the designed pending-handoff after dispatch (`CodeQL scan dispatched... rerun this exact failed CodeQL job after publishing its terminal verdict`), not a source RED (G-07). Dispatch current-head CodeQL scan remains queued. Predecessor Strix/Noema do not transfer. | regex-only `python-command-injection` missed aliased/nested/dotted bindings; AST omitted implicit-shell `getoutput`/`getstatusoutput` until `60cdd3f`; public message must name both implicit-shell families and `subprocess shell=True` distinctly. | stay Draft until current-head Tests/Strix/OpenCode/CodeQL-verdict and independent non-author approval exist. Do not Close #983. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | @@ -130,7 +131,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 12:10 UTC records Draft #1142 `d5df6c7` stacked on #1141 `80f56b0` on #1140 `bfa61c9` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 12:58 UTC records Draft #1143 `e5051ea` stacked on #1142 `d5df6c7` on #1141 `e9852bd` on #1140 `bfa61c9` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -164,7 +165,7 @@ re-fetch docs/issues/PRs/current heads 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. 9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. -10. Keep #998 Draft at `8b95c2b` until current-head Tests/Strix/OpenCode/CodeQL-verdict are terminal-success. Tests 3.11/3.13 and Python shell AST coverage are SUCCESS on this SHA; Strix/OpenCode/Noema/Semgrep/Security Scan/CodeQL-compat remain queued after admit SUCCESS. Predecessor Strix FAILURE mixed a real getoutput FN (repaired on `60cdd3f`) with G-07 provider exhaustion; do not transfer predecessor GREEN. Do not Close #983. +10. Keep #998 Draft at `8b95c2b` until current-head Tests/Strix/OpenCode/CodeQL-verdict are terminal-success. Tests, AST coverage, Semgrep, and current-head Noema are SUCCESS; Strix is in progress; OpenCode remains queued. CodeQL compatibility FAILURE is G-07 pending-handoff after dispatch, not a source RED. Do not Close #983. 11. Keep #966 at `f707289` as the canonical orphan-detector owner. BEHIND is resolved; BLOCKED remains on predecessor OpenCode `CHANGES_REQUESTED` / recorded Noema 502. Relates to #929 and must not Close it. 12. Keep #1129 Draft stacked on #998 at `c5be73c`. Unique delta remains #1099/#1106. #1134 is at `36e8f37` and #1135 at `ef28b05` after non-force restack. Do not Close #1087, #929, #983, or #1106. 13. Keep #972 Draft at restacked `c488cff` as the G-02 assurance-envelope owner. Fresh exact-head checks after the non-force restack do not inherit predecessor GREEN. Do not Close #927. @@ -178,8 +179,9 @@ re-fetch docs/issues/PRs/current heads 21. Keep #1138 Draft stacked on #1137 at `bdb3809`. Unsigned executable downloads and unpinned URL installs fail admission; lockfile-only package trees stay inventory. Do not Close #1099 or #1137. 22. Keep #1139 Draft stacked on #1138 at `6cd54b3`. Reuse released #1036 skill-supply-chain identities on plugin skill/agent receipts. Do not Close #1036, #1099, or #1138. Do not copy those regular expressions. 23. Keep #1140 Draft stacked on #1139 at `bfa61c9`. `scan-plugin` writes the existing receipt and fails closed when `scan_result` is not pass. Do not Close #1099 or #1139. Pass is not Noema admission. -24. Keep #1141 Draft stacked on #1140 at `80f56b0`. External marketplace catalogs bind catalog repository/SHA/blob digest; floating commits and source mismatches fail closed. Do not Close #1099 or #1140. +24. Keep #1141 Draft stacked on #1140 at `e9852bd`. External marketplace catalogs bind catalog repository/SHA/blob digest; floating commits and source mismatches fail closed. Do not Close #1099 or #1140. 25. Keep #1142 Draft stacked on #1141 at `d5df6c7`. Receipt `sarif_sha256` must match `finding_summary` rule IDs. Do not Close #1099 or #1141. +26. Keep #1143 Draft stacked on #1142 at `e5051ea`. LICENSE/NOTICE SPDX mismatches fail closed; NOTICE-only is not absence. Do not Close #1099 or #1142. ## Standards and acceptance basis From b7d6cb8d5a62a56cace155ef0d0f673fc5e8245e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 22:17:34 +0900 Subject: [PATCH 079/192] docs: record #1144 postinstall-download successor Summary: - Snapshot 13:10 UTC records Draft #1144 `c66dfaf` stacked on #1143. - package.json install lifecycle downloads fail closed. - Lockfile-only trees stay package_install inventory. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1144 (1359/1359) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b4b4040d..79c166f0 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 12:58 UTC +**Snapshot:** 2026-09-07 13:10 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,13 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 12:58 UTC snapshot +## Security-defect corpus — live 2026-09-07 13:10 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1143, branch `feat/claude-plugin-license-mismatch-1099`, exact head `e5051ea32eeedb708e3f7e04c1f25c395fc4bbbd` | open/Draft successor stacked on #1142 (`d5df6c7...`). RED then GREEN license tests; detector statement coverage 935/935 with plugin suites. REST mergeable CLEAN versus #1142. | NOTICE files count as license evidence. Conflicting SPDX identifiers across the declared license field, LICENSE, and NOTICE fail as `claude-plugin-license-mismatch` without inventing legal approval. | keep Draft stacked on #1142. Do not Close #1099 or #1142. | +| AppGuardrail #1144, branch `feat/claude-plugin-postinstall-download-1099`, exact head `c66dfaf88b29ae478431c2fd1a0d325d91da4bc2` | open/Draft successor stacked on #1143 (`e5051ea...`). RED `8019b14` → GREEN `c66dfaf`. Plugin suites 109 passed; detector statement coverage 1359/1359. | `package.json` install lifecycle scripts that fetch unsigned payloads fail closed, reusing unsigned-download / pipe-to-shell / unpinned-install identities. Lockfile-only trees without those scripts stay `package_install` inventory. | keep Draft stacked on #1143. Do not Close #1099, #1143, or #1138. Do not invent a second download regex family. | +| AppGuardrail #1143, branch `feat/claude-plugin-license-mismatch-1099`, exact head `e5051ea32eeedb708e3f7e04c1f25c395fc4bbbd` | open/Draft successor stacked on #1142 (`d5df6c7...`). RED then GREEN license tests; detector statement coverage 935/935 with plugin suites. REST mergeable CLEAN versus #1142. Postinstall successor is #1144. | NOTICE files count as license evidence. Conflicting SPDX identifiers across the declared license field, LICENSE, and NOTICE fail as `claude-plugin-license-mismatch` without inventing legal approval. | keep Draft stacked on #1142. Do not Close #1099 or #1142. | | AppGuardrail #1142, branch `feat/claude-plugin-sarif-receipt-1099`, exact head `d5df6c75f97eac677527e44b9b91df41c3825dfc` | open/Draft successor stacked on live #1141 (`e9852bd...`). RED `854a21b` → GREEN `d5df6c7`. Full suite 1180 passed; `claude_plugin_sarif.py` 50/50. License-mismatch successor is #1143. | receipt `sarif_sha256` is SHA-256 of a SARIF 2.1.0 document whose rule IDs match `finding_summary`. Mutating the tree changes both. | keep Draft stacked on #1141. Do not Close #1099 or #1141. Do not invent a second SARIF dialect. | | AppGuardrail #1141, branch `feat/claude-plugin-catalog-bind-1099`, exact head `e9852bdb9025f3873dbafed9e0381a1798a41b5a` | open/Draft successor stacked on #1140 (`bfa61c9...`). Live head adds canonical marketplace entry selection by plugin name after `80f56b0`. REST mergeable CLEAN versus #1140. SARIF-receipt successor is #1142. | an external marketplace catalog binds `catalog_repository`, `catalog_commit_sha`, and `marketplace_blob_sha`. A floating catalog commit reuses `claude-plugin-floating-git-ref`. Catalog plugin name/repo/ref that disagrees with the retrieved artifact reuses `claude-plugin-source-mismatch`. | keep Draft stacked on #1140. Do not Close #1099 or #1140. Do not fork the receipt schema. | | AppGuardrail #1140, branch `feat/claude-plugin-scan-cli-1099`, exact head `bfa61c95f8b7126cea316ecc95d558dbcc875e8d` | open/Draft successor stacked on #1139 (`6cd54b3...`). RED `192ae4f` → GREEN `bfa61c9`. CLI tests plus plugin suite 88 passed; new `claude_plugin_scan_cli.py` 79/79; detector gate 1194/1194. Catalog-bind successor is #1141. | `appguardrail scan-plugin --plugin-root` writes the existing deterministic receipt. Exit 0 only when `scan_result` is pass. Missing root fails closed. Pass is not Noema admission. | keep Draft stacked on #1139. Do not Close #1099 or #1139. Do not fork the receipt schema. | @@ -131,7 +132,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 12:58 UTC records Draft #1143 `e5051ea` stacked on #1142 `d5df6c7` on #1141 `e9852bd` on #1140 `bfa61c9` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 13:10 UTC records Draft #1144 `c66dfaf` stacked on #1143 `e5051ea` on #1142 `d5df6c7` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -182,6 +183,7 @@ re-fetch docs/issues/PRs/current heads 24. Keep #1141 Draft stacked on #1140 at `e9852bd`. External marketplace catalogs bind catalog repository/SHA/blob digest; floating commits and source mismatches fail closed. Do not Close #1099 or #1140. 25. Keep #1142 Draft stacked on #1141 at `d5df6c7`. Receipt `sarif_sha256` must match `finding_summary` rule IDs. Do not Close #1099 or #1141. 26. Keep #1143 Draft stacked on #1142 at `e5051ea`. LICENSE/NOTICE SPDX mismatches fail closed; NOTICE-only is not absence. Do not Close #1099 or #1142. +27. Keep #1144 Draft stacked on #1143 at `c66dfaf`. Install lifecycle scripts that download unsigned payloads fail closed; lockfile-only trees stay inventory. Do not Close #1099, #1143, or #1138. ## Standards and acceptance basis From 0e67d9678a04303bf47d504212bcdbe686578906 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 23:03:30 +0900 Subject: [PATCH 080/192] docs: record #1145 dynamic eval and #998 OpenCode SUCCESS Snapshot 2026-09-07 13:58 UTC: #998 8b95c2b Tests/AST/Noema/OpenCode GREEN; Strix FAILURE is STRIX_PROVIDER_UNAVAILABLE (G-07). #1145 1d42ac5 rejects hook eval/exec. Do not Close #983 or #1099. --- docs/product-technical-gap-baseline.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 79c166f0..bb3a19ac 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 13:10 UTC +**Snapshot:** 2026-09-07 13:58 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,13 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 13:10 UTC snapshot +## Security-defect corpus — live 2026-09-07 13:58 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1144, branch `feat/claude-plugin-postinstall-download-1099`, exact head `c66dfaf88b29ae478431c2fd1a0d325d91da4bc2` | open/Draft successor stacked on #1143 (`e5051ea...`). RED `8019b14` → GREEN `c66dfaf`. Plugin suites 109 passed; detector statement coverage 1359/1359. | `package.json` install lifecycle scripts that fetch unsigned payloads fail closed, reusing unsigned-download / pipe-to-shell / unpinned-install identities. Lockfile-only trees without those scripts stay `package_install` inventory. | keep Draft stacked on #1143. Do not Close #1099, #1143, or #1138. Do not invent a second download regex family. | +| AppGuardrail #1145, branch `feat/claude-plugin-dynamic-eval-1099`, exact head `1d42ac55df6b576a61e693e5dca57e238ec8d388` | open/Draft successor stacked on #1144 (`c66dfaf...`). RED then GREEN dynamic-eval tests; detector statement coverage 1006/1006. REST mergeable CLEAN versus #1144. | hook `eval`/`exec`/`compile`/`Function` and shell `eval` fail as `claude-plugin-dynamic-eval`. `print()` and `evaluate()` stay negative. | keep Draft stacked on #1144. Do not Close #1099 or #1144. | +| AppGuardrail #1144, branch `feat/claude-plugin-postinstall-download-1099`, exact head `c66dfaf88b29ae478431c2fd1a0d325d91da4bc2` | open/Draft successor stacked on #1143 (`e5051ea...`). RED `8019b14` → GREEN `c66dfaf`. Plugin suites 109 passed; detector statement coverage 1359/1359. Dynamic-eval successor is #1145. | `package.json` install lifecycle scripts that fetch unsigned payloads fail closed, reusing unsigned-download / pipe-to-shell / unpinned-install identities. Lockfile-only trees without those scripts stay `package_install` inventory. | keep Draft stacked on #1143. Do not Close #1099, #1143, or #1138. Do not invent a second download regex family. | | AppGuardrail #1143, branch `feat/claude-plugin-license-mismatch-1099`, exact head `e5051ea32eeedb708e3f7e04c1f25c395fc4bbbd` | open/Draft successor stacked on #1142 (`d5df6c7...`). RED then GREEN license tests; detector statement coverage 935/935 with plugin suites. REST mergeable CLEAN versus #1142. Postinstall successor is #1144. | NOTICE files count as license evidence. Conflicting SPDX identifiers across the declared license field, LICENSE, and NOTICE fail as `claude-plugin-license-mismatch` without inventing legal approval. | keep Draft stacked on #1142. Do not Close #1099 or #1142. | | AppGuardrail #1142, branch `feat/claude-plugin-sarif-receipt-1099`, exact head `d5df6c75f97eac677527e44b9b91df41c3825dfc` | open/Draft successor stacked on live #1141 (`e9852bd...`). RED `854a21b` → GREEN `d5df6c7`. Full suite 1180 passed; `claude_plugin_sarif.py` 50/50. License-mismatch successor is #1143. | receipt `sarif_sha256` is SHA-256 of a SARIF 2.1.0 document whose rule IDs match `finding_summary`. Mutating the tree changes both. | keep Draft stacked on #1141. Do not Close #1099 or #1141. Do not invent a second SARIF dialect. | | AppGuardrail #1141, branch `feat/claude-plugin-catalog-bind-1099`, exact head `e9852bdb9025f3873dbafed9e0381a1798a41b5a` | open/Draft successor stacked on #1140 (`bfa61c9...`). Live head adds canonical marketplace entry selection by plugin name after `80f56b0`. REST mergeable CLEAN versus #1140. SARIF-receipt successor is #1142. | an external marketplace catalog binds `catalog_repository`, `catalog_commit_sha`, and `marketplace_blob_sha`. A floating catalog commit reuses `claude-plugin-floating-git-ref`. Catalog plugin name/repo/ref that disagrees with the retrieved artifact reuses `claude-plugin-source-mismatch`. | keep Draft stacked on #1140. Do not Close #1099 or #1140. Do not fork the receipt schema. | @@ -86,8 +87,8 @@ Responsibility boundaries: | AppGuardrail #1135, branch `feat/claude-plugin-archive-submodule-1099`, exact head `ef28b05343739aa94ee2f2b942d363de52a1fdec` | open/Draft successor stacked on #1134 after non-force restack onto #998 `8b95c2b`. Receipt-replay successor is #1136 at `32dc0fc`. | zip/tar members that escape the extract root are not followed (`claude-plugin-archive-path-traversal`). Nested `.gitmodules`/gitlink without a recursively admitted 40-character SHA fail admission (`claude-plugin-unadmitted-submodule`). | keep Draft stacked on #1134. Do not Close #1099, #1134, or #1129. Do not extract outside the bounded root. | | AppGuardrail #1134, branch `feat/claude-plugin-capability-inventory-1099`, exact head `36e8f37bc67392dd04ace4df8dbcdceed371e097` | open/Draft successor stacked on #1129 `c5be73c` after non-force restack. Archive successor #1135 is at `ef28b05`. | inventory is evidence, not permission. Undeclared executables after manifest inventory fail admission (`claude-plugin-undeclared-executable`). Receipt `capability_inventory_sha256` is a sorted-key digest. | keep Draft stacked on #1129. Do not Close #1099, #1129, or #1036. | | AppGuardrail #1129, branch `security/cwl-issue-detector-families`, exact head `c5be73c52a78a1c63c6ddf212de7d6281b9bd96b` | open/Draft successor stacked on #998 `8b95c2b`. Unique head is a non-force merge of the public-message contract repair onto `24c6dda` lineage. Capability inventory successor #1134 is at `36e8f37`; archive/submodule successor #1135 is restacked at `ef28b05`. | frozen CWL security issues cluster into SAST/DAST families. Catalog SHA/repo/path must bind to the retrieved tree. | keep canonical owners #1088, #966, #1133, #1134, #1135, #1136, #1137, #1138, and #1139. Do not Close #1087, #929, #983, or #1106. | -| AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`, so BEHIND is resolved. REST `mergeable_state=blocked`. GitHub `reviewDecision` remains `CHANGES_REQUESTED` from predecessor OpenCode reviews on `b3f10addb8450107f2425de01ae3ac4f9a3a9423` and `5db368604107c8c9bef2996ce36d1e4fa6ac9ddc`. The recorded origin of that predecessor blockage is Noema HTTP 502; current-head Required Noema run `34081194967` and OpenCode run `34081194977` remain queued, so there is no current-head 502 conclusion. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | repair the predecessor OpenCode `CHANGES_REQUESTED` / Noema 502 blockage; do not Close #929. Trusted-operator disablement of confirmed orphans remains a post-integration operational exit condition. | -| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `8b95c2bee24567ab3200a96da807259e023eee73` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. Current-head Tests 3.11/3.13 SUCCESS; Python shell AST coverage SUCCESS; Semgrep, osv-scan, Security Process, coverage gates, CodeRabbit SUCCESS; current-head Noema review SUCCESS at 12:40 UTC. Strix `strix` is in progress. OpenCode `opencode-review` remains queued. CodeQL compatibility analysis python/actions FAILURE is the designed pending-handoff after dispatch (`CodeQL scan dispatched... rerun this exact failed CodeQL job after publishing its terminal verdict`), not a source RED (G-07). Dispatch current-head CodeQL scan remains queued. Predecessor Strix/Noema do not transfer. | regex-only `python-command-injection` missed aliased/nested/dotted bindings; AST omitted implicit-shell `getoutput`/`getstatusoutput` until `60cdd3f`; public message must name both implicit-shell families and `subprocess shell=True` distinctly. | stay Draft until current-head Tests/Strix/OpenCode/CodeQL-verdict and independent non-author approval exist. Do not Close #983. | +| AppGuardrail #966, branch `feat/actions-orphan-workflow-evidence-929`, exact head `f70728908df37302a186923cf2a5bf6414a1fbb0` | open/non-Draft. Compare to `develop@e71d37e` is `ahead 16` / `behind 0`. REST `mergeable_state=blocked`. Current-head OpenCode `CHANGES_REQUESTED` at 13:43 UTC on `f707289` is not a detector defect: it refuses approval because same-head CodeQL-compat/Noema/Strix checks failed. Those failures are G-07 pending-handoff / provider-unavailable, not a remaining orphan-detector bug. Relates to #929 and does not auto-close it. | read-only source-bound detector for Actions workflow registry identities that are active in GitHub but absent from the exact default-branch tree. Name hints never substitute for source-path evidence. | keep the source; rerun current-head Noema/Strix/CodeQL-verdict. Do not Close #929. | +| AppGuardrail #998 / Issue #983, branch `security/python-shell-ast-983`, exact head `8b95c2bee24567ab3200a96da807259e023eee73` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; stale OpenCode `CHANGES_REQUESTED` on `e2b0637`. Current-head Tests, AST coverage, Semgrep, osv-scan, Security Process, coverage gates, CodeRabbit, Noema, and `opencode-review` SUCCESS. Strix `strix` FAILURE at 13:12 UTC is `STRIX_PROVIDER_UNAVAILABLE` after 45 minutes, not a new detector FN (G-07). CodeQL compatibility python/actions FAILURE remains the designed pending-handoff; `Dispatch current-head CodeQL scan` is SUCCESS. Predecessor Strix does not transfer. | regex-only `python-command-injection` missed aliased/nested/dotted bindings; AST omitted implicit-shell `getoutput`/`getstatusoutput` until `60cdd3f`; public message must name both implicit-shell families and `subprocess shell=True` distinctly. | stay Draft until current-head Strix/CodeQL-verdict succeed. OpenCode success is robot-review evidence, not GitHub APPROVE. Do not Close #983. | | `ContextualWisdomLab/.github` protected wall-clock owner repair | protected repair `e29302c05eade7da7b0bdbb453e53980bc9d577b` | adds a 10,800-second total deadline to the original polling owner and fails closed | retain as prevention/control-plane evidence and pinned fixed oracle; it does not by itself satisfy AppGuardrail scanner coverage. | | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | @@ -132,7 +133,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 13:10 UTC records Draft #1144 `c66dfaf` stacked on #1143 `e5051ea` on #1142 `d5df6c7` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 13:58 UTC records Draft #1145 `1d42ac5` stacked on #1144 `c66dfaf` on #1143 `e5051ea` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -166,8 +167,8 @@ re-fetch docs/issues/PRs/current heads 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. 9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. -10. Keep #998 Draft at `8b95c2b` until current-head Tests/Strix/OpenCode/CodeQL-verdict are terminal-success. Tests, AST coverage, Semgrep, and current-head Noema are SUCCESS; Strix is in progress; OpenCode remains queued. CodeQL compatibility FAILURE is G-07 pending-handoff after dispatch, not a source RED. Do not Close #983. -11. Keep #966 at `f707289` as the canonical orphan-detector owner. BEHIND is resolved; BLOCKED remains on predecessor OpenCode `CHANGES_REQUESTED` / recorded Noema 502. Relates to #929 and must not Close it. +10. Keep #998 Draft at `8b95c2b` until current-head Strix/CodeQL-verdict are terminal-success. Tests, AST coverage, Semgrep, Noema, and `opencode-review` are SUCCESS. Strix FAILURE is `STRIX_PROVIDER_UNAVAILABLE` (G-07), not a new FN. CodeQL compatibility FAILURE remains pending-handoff after a successful dispatch. OpenCode success is robot-review evidence, not GitHub APPROVE. Do not Close #983. +11. Keep #966 at `f707289` as the canonical orphan-detector owner. Current-head OpenCode `CHANGES_REQUESTED` is check-rollup (CodeQL-compat/Noema/Strix), not a remaining detector bug. Relates to #929 and must not Close it. 12. Keep #1129 Draft stacked on #998 at `c5be73c`. Unique delta remains #1099/#1106. #1134 is at `36e8f37` and #1135 at `ef28b05` after non-force restack. Do not Close #1087, #929, #983, or #1106. 13. Keep #972 Draft at restacked `c488cff` as the G-02 assurance-envelope owner. Fresh exact-head checks after the non-force restack do not inherit predecessor GREEN. Do not Close #927. 14. Keep #1006 at restacked `35c28e22` as the G-03 bundle owner. The dashboard/CSP/Storybook slice stays a later successor. Do not Close #928. @@ -184,6 +185,7 @@ re-fetch docs/issues/PRs/current heads 25. Keep #1142 Draft stacked on #1141 at `d5df6c7`. Receipt `sarif_sha256` must match `finding_summary` rule IDs. Do not Close #1099 or #1141. 26. Keep #1143 Draft stacked on #1142 at `e5051ea`. LICENSE/NOTICE SPDX mismatches fail closed; NOTICE-only is not absence. Do not Close #1099 or #1142. 27. Keep #1144 Draft stacked on #1143 at `c66dfaf`. Install lifecycle scripts that download unsigned payloads fail closed; lockfile-only trees stay inventory. Do not Close #1099, #1143, or #1138. +28. Keep #1145 Draft stacked on #1144 at `1d42ac5`. Hook `eval`/`exec`/`compile`/`Function` fail closed. Do not Close #1099 or #1144. ## Standards and acceptance basis From 2b817cae5633e506c7d99416385a4648e1133499 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 23:16:26 +0900 Subject: [PATCH 081/192] docs: record #1146 hidden-executable successor Summary: - Snapshot 14:09 UTC records Draft #1146 `94946c7` stacked on #1145. - Hidden undeclared executable/config surfaces fail closed. - `.git/` and `.gitignore` stay outside that class. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1146 (1428/1428) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index bb3a19ac..c8675a2a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 13:58 UTC +**Snapshot:** 2026-09-07 14:09 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,13 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 13:58 UTC snapshot +## Security-defect corpus — live 2026-09-07 14:09 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1145, branch `feat/claude-plugin-dynamic-eval-1099`, exact head `1d42ac55df6b576a61e693e5dca57e238ec8d388` | open/Draft successor stacked on #1144 (`c66dfaf...`). RED then GREEN dynamic-eval tests; detector statement coverage 1006/1006. REST mergeable CLEAN versus #1144. | hook `eval`/`exec`/`compile`/`Function` and shell `eval` fail as `claude-plugin-dynamic-eval`. `print()` and `evaluate()` stay negative. | keep Draft stacked on #1144. Do not Close #1099 or #1144. | +| AppGuardrail #1146, branch `feat/claude-plugin-hidden-executable-1099`, exact head `94946c7014d743484dd6ff2d40f8a67cc3065128` | open/Draft successor stacked on #1145 (`1d42ac5...`). RED `21deb12` → GREEN `94946c7`. Plugin tests 120 passed; detector statement coverage 1428/1428. | hidden undeclared executable/config surfaces fail as `claude-plugin-hidden-undeclared-executable`. `.git/`, `.gitignore`, LICENSE, `.mcp.json`, and declared `hooks/pre.sh` stay negative for this rule. | keep Draft stacked on #1145. Do not Close #1099 or #1145. | +| AppGuardrail #1145, branch `feat/claude-plugin-dynamic-eval-1099`, exact head `1d42ac55df6b576a61e693e5dca57e238ec8d388` | open/Draft successor stacked on #1144 (`c66dfaf...`). RED then GREEN dynamic-eval tests; detector statement coverage 1006/1006. REST mergeable CLEAN versus #1144. Hidden-executable successor is #1146. | hook `eval`/`exec`/`compile`/`Function` and shell `eval` fail as `claude-plugin-dynamic-eval`. `print()` and `evaluate()` stay negative. | keep Draft stacked on #1144. Do not Close #1099 or #1144. | | AppGuardrail #1144, branch `feat/claude-plugin-postinstall-download-1099`, exact head `c66dfaf88b29ae478431c2fd1a0d325d91da4bc2` | open/Draft successor stacked on #1143 (`e5051ea...`). RED `8019b14` → GREEN `c66dfaf`. Plugin suites 109 passed; detector statement coverage 1359/1359. Dynamic-eval successor is #1145. | `package.json` install lifecycle scripts that fetch unsigned payloads fail closed, reusing unsigned-download / pipe-to-shell / unpinned-install identities. Lockfile-only trees without those scripts stay `package_install` inventory. | keep Draft stacked on #1143. Do not Close #1099, #1143, or #1138. Do not invent a second download regex family. | | AppGuardrail #1143, branch `feat/claude-plugin-license-mismatch-1099`, exact head `e5051ea32eeedb708e3f7e04c1f25c395fc4bbbd` | open/Draft successor stacked on #1142 (`d5df6c7...`). RED then GREEN license tests; detector statement coverage 935/935 with plugin suites. REST mergeable CLEAN versus #1142. Postinstall successor is #1144. | NOTICE files count as license evidence. Conflicting SPDX identifiers across the declared license field, LICENSE, and NOTICE fail as `claude-plugin-license-mismatch` without inventing legal approval. | keep Draft stacked on #1142. Do not Close #1099 or #1142. | | AppGuardrail #1142, branch `feat/claude-plugin-sarif-receipt-1099`, exact head `d5df6c75f97eac677527e44b9b91df41c3825dfc` | open/Draft successor stacked on live #1141 (`e9852bd...`). RED `854a21b` → GREEN `d5df6c7`. Full suite 1180 passed; `claude_plugin_sarif.py` 50/50. License-mismatch successor is #1143. | receipt `sarif_sha256` is SHA-256 of a SARIF 2.1.0 document whose rule IDs match `finding_summary`. Mutating the tree changes both. | keep Draft stacked on #1141. Do not Close #1099 or #1141. Do not invent a second SARIF dialect. | @@ -133,7 +134,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 13:58 UTC records Draft #1145 `1d42ac5` stacked on #1144 `c66dfaf` on #1143 `e5051ea` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 14:09 UTC records Draft #1146 `94946c7` stacked on #1145 `1d42ac5` on #1144 `c66dfaf` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -186,6 +187,7 @@ re-fetch docs/issues/PRs/current heads 26. Keep #1143 Draft stacked on #1142 at `e5051ea`. LICENSE/NOTICE SPDX mismatches fail closed; NOTICE-only is not absence. Do not Close #1099 or #1142. 27. Keep #1144 Draft stacked on #1143 at `c66dfaf`. Install lifecycle scripts that download unsigned payloads fail closed; lockfile-only trees stay inventory. Do not Close #1099, #1143, or #1138. 28. Keep #1145 Draft stacked on #1144 at `1d42ac5`. Hook `eval`/`exec`/`compile`/`Function` fail closed. Do not Close #1099 or #1144. +29. Keep #1146 Draft stacked on #1145 at `94946c7`. Hidden undeclared executables fail closed; `.git/` and `.gitignore` are not that class. Do not Close #1099 or #1145. ## Standards and acceptance basis From 672d6dcb09b70e9164121ffbff680c06b01e9c06 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 00:11:52 +0900 Subject: [PATCH 082/192] docs: record #1150 browser-profile successor Refresh the single-writer gap baseline from live exact-head evidence: Draft #1150 on #1146, concurrent #1148 sentinel, and G-06 #1133 exact-head coverage SUCCESS. Relates to #1099. --- docs/product-technical-gap-baseline.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c8675a2a..8a6b43a8 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 14:09 UTC +**Snapshot:** 2026-09-07 15:10 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,13 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 14:09 UTC snapshot +## Security-defect corpus — live 2026-09-07 15:10 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | -| AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Dedicated coverage run was queued on this head. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Require the new exact-head coverage job to be terminal-success before treating this slice as check-complete. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | +| AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1146, branch `feat/claude-plugin-hidden-executable-1099`, exact head `94946c7014d743484dd6ff2d40f8a67cc3065128` | open/Draft successor stacked on #1145 (`1d42ac5...`). RED `21deb12` → GREEN `94946c7`. Plugin tests 120 passed; detector statement coverage 1428/1428. | hidden undeclared executable/config surfaces fail as `claude-plugin-hidden-undeclared-executable`. `.git/`, `.gitignore`, LICENSE, `.mcp.json`, and declared `hooks/pre.sh` stay negative for this rule. | keep Draft stacked on #1145. Do not Close #1099 or #1145. | +| AppGuardrail #1150, branch `feat/claude-plugin-browser-profile-1099`, exact head `8a360d2b82e21999b2a0515a5ecb7641971da3af` | open/Draft successor stacked on #1146 (`94946c7...`). RED `b369d5f` → GREEN `8a360d2`. Plugin suites 128 passed; detector statement coverage 1444/1444 on Python 3.13. REST mergeable CLEAN versus #1146. | host Chrome/Chromium/Firefox profile stores on hook or manifest surfaces fail as `claude-plugin-browser-profile-access`. README path mentions and a bare `Firefox` product name stay `browser_profile_access` inventory. Docker sockets stay `claude-plugin-docker-socket`. | keep Draft stacked on #1146. Do not Close #1099 or #1146. Do not steal #1146 hidden-executable or #1137 Docker unique delta. | +| AppGuardrail #1148, branch `sentinel/fix-dom-xss-console-2387223574376446424`, exact head `a666eef82d6caaa73163241e358c44fbe8172f70` | open/Draft concurrent sentinel on `develop@e71d37e`. Body cites authority `b209e8c` while live head is `a666eef`; `.jules/sentinel.md` remains in the compare. Checks were still admitting at 14:55 UTC. | untrusted finding severity was used as a normal-object key before `innerHTML`; a null-prototype palette plus one normalized/escaped label is the intended repair. This is an inherited-property lookup boundary, not prototype mutation. | keep as concurrent sentinel owner. Do not race the branch. Do not treat robot review as GitHub APPROVE. | +| AppGuardrail #1146, branch `feat/claude-plugin-hidden-executable-1099`, exact head `94946c7014d743484dd6ff2d40f8a67cc3065128` | open/Draft successor stacked on #1145 (`1d42ac5...`). RED `21deb12` → GREEN `94946c7`. Plugin tests 120 passed; detector statement coverage 1428/1428. Browser-profile successor is #1150. | hidden undeclared executable/config surfaces fail as `claude-plugin-hidden-undeclared-executable`. `.git/`, `.gitignore`, LICENSE, `.mcp.json`, and declared `hooks/pre.sh` stay negative for this rule. | keep Draft stacked on #1145. Do not Close #1099 or #1145. | | AppGuardrail #1145, branch `feat/claude-plugin-dynamic-eval-1099`, exact head `1d42ac55df6b576a61e693e5dca57e238ec8d388` | open/Draft successor stacked on #1144 (`c66dfaf...`). RED then GREEN dynamic-eval tests; detector statement coverage 1006/1006. REST mergeable CLEAN versus #1144. Hidden-executable successor is #1146. | hook `eval`/`exec`/`compile`/`Function` and shell `eval` fail as `claude-plugin-dynamic-eval`. `print()` and `evaluate()` stay negative. | keep Draft stacked on #1144. Do not Close #1099 or #1144. | | AppGuardrail #1144, branch `feat/claude-plugin-postinstall-download-1099`, exact head `c66dfaf88b29ae478431c2fd1a0d325d91da4bc2` | open/Draft successor stacked on #1143 (`e5051ea...`). RED `8019b14` → GREEN `c66dfaf`. Plugin suites 109 passed; detector statement coverage 1359/1359. Dynamic-eval successor is #1145. | `package.json` install lifecycle scripts that fetch unsigned payloads fail closed, reusing unsigned-download / pipe-to-shell / unpinned-install identities. Lockfile-only trees without those scripts stay `package_install` inventory. | keep Draft stacked on #1143. Do not Close #1099, #1143, or #1138. Do not invent a second download regex family. | | AppGuardrail #1143, branch `feat/claude-plugin-license-mismatch-1099`, exact head `e5051ea32eeedb708e3f7e04c1f25c395fc4bbbd` | open/Draft successor stacked on #1142 (`d5df6c7...`). RED then GREEN license tests; detector statement coverage 935/935 with plugin suites. REST mergeable CLEAN versus #1142. Postinstall successor is #1144. | NOTICE files count as license evidence. Conflicting SPDX identifiers across the declared license field, LICENSE, and NOTICE fail as `claude-plugin-license-mismatch` without inventing legal approval. | keep Draft stacked on #1142. Do not Close #1099 or #1142. | @@ -132,9 +134,9 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-03 | A developer cannot safely transfer remediation/evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928 remains open; PR #1006 at exact head `35c28e22b5d50f1da943718cdb1984dcee098d62` after non-force restack onto `develop@e71d37e` is active-PR evidence for a transport-neutral, deterministic, redacted and digest-verified JSON contract, while the dashboard UI slice remains explicitly separate. | retain the standalone versioned bundle boundary; then add CSP-safe listener-based copy actions, accessible fallback/live-region behavior, focus handling and browser E2E after the design/Storybook gate | hostile text remains inert; no duplicate listeners; exact success/rejection/fallback behavior; provenance schema and digest verified on an unchanged protected head | **Open / active in #1006** | | G-04 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted exact-head coverage was queued, not yet GREEN. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through exact-head coverage GREEN and review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | +| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted `exact-head-coverage` on this head is SUCCESS. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 14:09 UTC records Draft #1146 `94946c7` stacked on #1145 `1d42ac5` on #1144 `c66dfaf` … on #998 `8b95c2b`; G-06 remains #1133 with coverage queued. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 15:10 UTC records Draft #1150 `8a360d2` stacked on #1146 `94946c7` on #1145 `1d42ac5` … on #998 `8b95c2b`; concurrent #1148 console severity repair remains sentinel-owned; G-06 remains #1133 with exact-head coverage GREEN and `_scan_file` unhooked. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -174,7 +176,7 @@ re-fetch docs/issues/PRs/current heads 13. Keep #972 Draft at restacked `c488cff` as the G-02 assurance-envelope owner. Fresh exact-head checks after the non-force restack do not inherit predecessor GREEN. Do not Close #927. 14. Keep #1006 at restacked `35c28e22` as the G-03 bundle owner. The dashboard/CSP/Storybook slice stays a later successor. Do not Close #928. 15. Keep #1130 Draft. Canonical webhook storage-boundary owner is #1107; this Jules slice is not merge-ready. -16. Keep #1133 Draft stacked on #1088 at `5baeab9`. Wait for `actions-poll-analyzer-coverage` exact-head GREEN. ADR-0009 is Proposed. Preserve regex rule IDs and corpus. Do not hook `_scan_file` on this slice. Do not Close #1087 or #1088. +16. Keep #1133 Draft stacked on #1088 at `5baeab9`. Hosted `exact-head-coverage` is SUCCESS. ADR-0009 is Proposed. Preserve regex rule IDs and corpus. Do not hook `_scan_file` until a later slice proves it will not double-count the regex corpus. Do not Close #1087 or #1088. 17. Keep #1134 Draft stacked on #1129 at `36e8f37`. Capability inventory is evidence, not permission. Do not Close #1099 or #1129. Do not reimplement #1036. 18. Keep #1135 Draft stacked on #1134 at `ef28b05`. Archive traversal and unadmitted submodules fail closed. Do not Close #1099, #1134, or #1129. 19. Keep #1136 Draft stacked on #1135 at `32dc0fc`. Stale/mismatched receipt replay fails closed. Do not Close #1099 or #1135. `scan_result=pass` is not Noema admission. @@ -188,6 +190,8 @@ re-fetch docs/issues/PRs/current heads 27. Keep #1144 Draft stacked on #1143 at `c66dfaf`. Install lifecycle scripts that download unsigned payloads fail closed; lockfile-only trees stay inventory. Do not Close #1099, #1143, or #1138. 28. Keep #1145 Draft stacked on #1144 at `1d42ac5`. Hook `eval`/`exec`/`compile`/`Function` fail closed. Do not Close #1099 or #1144. 29. Keep #1146 Draft stacked on #1145 at `94946c7`. Hidden undeclared executables fail closed; `.git/` and `.gitignore` are not that class. Do not Close #1099 or #1145. +30. Keep #1150 Draft stacked on #1146 at `8a360d2`. Host browser-profile stores fail closed; a bare Firefox product name stays inventory. Do not Close #1099 or #1146. Do not steal #1137 Docker or #1146 hidden-executable unique delta. +31. Keep #1148 Draft at `a666eef` as the concurrent console severity-palette owner. Do not race that sentinel branch or treat predecessor `b209e8c` evidence as current-head. ## Standards and acceptance basis From edfeea9b6e4b0273a138a4d497df5d0d832f0d52 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 00:33:36 +0900 Subject: [PATCH 083/192] docs: record #1151 deceptive-description and #1152 poll emit Summary: - Snapshot 15:28 UTC records Draft #1151 `822ca12` on #1150 and Draft #1152 `255cfd8` on #1133. - `_scan_file` emits poll analyzer findings once per (rule_id, file). - Deceptive read-only descriptions fail closed when inventory shows write or egress. Rationale: - #999 is the single writer of the product-technical gap baseline. - G-06 emission waited on #1133 exact-head coverage SUCCESS. Tests: - documentation-only; evidence lives on #1151 (1560/1560) and #1152 (417/417 analyzer statements) --- docs/product-technical-gap-baseline.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8a6b43a8..d75cfd09 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 15:10 UTC +**Snapshot:** 2026-09-07 15:28 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,13 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 15:10 UTC snapshot +## Security-defect corpus — live 2026-09-07 15:28 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | -| AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml` with concurrency `actions-poll-analyzer-coverage-{repository}-{PR number}`, fail-closed missing PR number, Coverage.py pin `4c0e7ff` (7.15.4), and exact-head checkout. Local focused+corpus suite 162 passed; analyzer 399/186 statement/branch 100.00%. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. No `_scan_file` hook. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. Do not emit through `_scan_file` until a later slice proves it will not double-count the regex corpus. | +| AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | +| AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1150, branch `feat/claude-plugin-browser-profile-1099`, exact head `8a360d2b82e21999b2a0515a5ecb7641971da3af` | open/Draft successor stacked on #1146 (`94946c7...`). RED `b369d5f` → GREEN `8a360d2`. Plugin suites 128 passed; detector statement coverage 1444/1444 on Python 3.13. REST mergeable CLEAN versus #1146. | host Chrome/Chromium/Firefox profile stores on hook or manifest surfaces fail as `claude-plugin-browser-profile-access`. README path mentions and a bare `Firefox` product name stay `browser_profile_access` inventory. Docker sockets stay `claude-plugin-docker-socket`. | keep Draft stacked on #1146. Do not Close #1099 or #1146. Do not steal #1146 hidden-executable or #1137 Docker unique delta. | +| AppGuardrail #1151, branch `feat/claude-plugin-deceptive-description-1099`, exact head `822ca12f1d8b55ae81f7feb882cc6f3073587256` | open/Draft successor stacked on #1150 (`8a360d2...`). RED `278dab8` → GREEN `822ca12`. Detector statement coverage 1560/1560. | descriptions that claim read-only/local-only while inventory shows write, network, github_write, credential, remote MCP, or shell_execution fail as `claude-plugin-deceptive-description`. Honest network descriptions and empty descriptions are not this class. Bare Firefox stays inventory. | keep Draft stacked on #1150. Do not Close #1099 or #1150. Inventory is evidence, not permission. | +| AppGuardrail #1150, branch `feat/claude-plugin-browser-profile-1099`, exact head `8a360d2b82e21999b2a0515a5ecb7641971da3af` | open/Draft successor stacked on #1146 (`94946c7...`). RED `b369d5f` → GREEN `8a360d2`. Plugin suites 128 passed; detector statement coverage 1444/1444 on Python 3.13. REST mergeable CLEAN versus #1146. Deceptive-description successor is #1151. | host Chrome/Chromium/Firefox profile stores on hook or manifest surfaces fail as `claude-plugin-browser-profile-access`. README path mentions and a bare `Firefox` product name stay `browser_profile_access` inventory. Docker sockets stay `claude-plugin-docker-socket`. | keep Draft stacked on #1146. Do not Close #1099 or #1146. Do not steal #1146 hidden-executable or #1137 Docker unique delta. | | AppGuardrail #1148, branch `sentinel/fix-dom-xss-console-2387223574376446424`, exact head `a666eef82d6caaa73163241e358c44fbe8172f70` | open/Draft concurrent sentinel on `develop@e71d37e`. Body cites authority `b209e8c` while live head is `a666eef`; `.jules/sentinel.md` remains in the compare. Checks were still admitting at 14:55 UTC. | untrusted finding severity was used as a normal-object key before `innerHTML`; a null-prototype palette plus one normalized/escaped label is the intended repair. This is an inherited-property lookup boundary, not prototype mutation. | keep as concurrent sentinel owner. Do not race the branch. Do not treat robot review as GitHub APPROVE. | | AppGuardrail #1146, branch `feat/claude-plugin-hidden-executable-1099`, exact head `94946c7014d743484dd6ff2d40f8a67cc3065128` | open/Draft successor stacked on #1145 (`1d42ac5...`). RED `21deb12` → GREEN `94946c7`. Plugin tests 120 passed; detector statement coverage 1428/1428. Browser-profile successor is #1150. | hidden undeclared executable/config surfaces fail as `claude-plugin-hidden-undeclared-executable`. `.git/`, `.gitignore`, LICENSE, `.mcp.json`, and declared `hooks/pre.sh` stay negative for this rule. | keep Draft stacked on #1145. Do not Close #1099 or #1145. | | AppGuardrail #1145, branch `feat/claude-plugin-dynamic-eval-1099`, exact head `1d42ac55df6b576a61e693e5dca57e238ec8d388` | open/Draft successor stacked on #1144 (`c66dfaf...`). RED then GREEN dynamic-eval tests; detector statement coverage 1006/1006. REST mergeable CLEAN versus #1144. Hidden-executable successor is #1146. | hook `eval`/`exec`/`compile`/`Function` and shell `eval` fail as `claude-plugin-dynamic-eval`. `print()` and `evaluate()` stay negative. | keep Draft stacked on #1144. Do not Close #1099 or #1144. | @@ -134,9 +136,9 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-03 | A developer cannot safely transfer remediation/evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928 remains open; PR #1006 at exact head `35c28e22b5d50f1da943718cdb1984dcee098d62` after non-force restack onto `develop@e71d37e` is active-PR evidence for a transport-neutral, deterministic, redacted and digest-verified JSON contract, while the dashboard UI slice remains explicitly separate. | retain the standalone versioned bundle boundary; then add CSP-safe listener-based copy actions, accessible fallback/live-region behavior, focus handling and browser E2E after the design/Storybook gate | hostile text remains inert; no duplicate listeners; exact success/rejection/fallback behavior; provenance schema and digest verified on an unchanged protected head | **Open / active in #1006** | | G-04 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft successor #1133 `5baeab9` stacks `classify_poll_loops`, ADR-0009 Proposed, and a dedicated PR-number-bound coverage workflow. Local 162 tests / 100% analyzer coverage; hosted `exact-head-coverage` on this head is SUCCESS. Production `_scan_file` is intentionally unhooked. #1129 maps the family and must not Close #1087/#929. | keep the analyzer additive through review on #1133; add an emission hook only after it is proven not to double-count regex findings; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1133 stacked on #1088** | +| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1. Regex YAML unchanged. | keep #1152 Draft through exact-head Checks/review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 15:10 UTC records Draft #1150 `8a360d2` stacked on #1146 `94946c7` on #1145 `1d42ac5` … on #998 `8b95c2b`; concurrent #1148 console severity repair remains sentinel-owned; G-06 remains #1133 with exact-head coverage GREEN and `_scan_file` unhooked. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 15:28 UTC records Draft #1152 `255cfd8` on #1133 and Draft #1151 `822ca12` on #1150 `8a360d2` … on #998 `8b95c2b`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -192,6 +194,8 @@ re-fetch docs/issues/PRs/current heads 29. Keep #1146 Draft stacked on #1145 at `94946c7`. Hidden undeclared executables fail closed; `.git/` and `.gitignore` are not that class. Do not Close #1099 or #1145. 30. Keep #1150 Draft stacked on #1146 at `8a360d2`. Host browser-profile stores fail closed; a bare Firefox product name stays inventory. Do not Close #1099 or #1146. Do not steal #1137 Docker or #1146 hidden-executable unique delta. 31. Keep #1148 Draft at `a666eef` as the concurrent console severity-palette owner. Do not race that sentinel branch or treat predecessor `b209e8c` evidence as current-head. +32. Keep #1151 Draft stacked on #1150 at `822ca12`. Deceptive read-only/local-only descriptions fail closed when inventory shows write or egress. Do not Close #1099 or #1150. +33. Keep #1152 Draft stacked on #1133 at `255cfd8`. `_scan_file` emits poll analyzer findings without double-count. Do not Close #1087, #1088, or #1133. ## Standards and acceptance basis From c9bd96f0f763c8ae7b709e606719e2dbea053376 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 01:02:23 +0900 Subject: [PATCH 084/192] docs: record #1153 non-standard JSON successor Refresh the single-writer gap baseline from live exact-head evidence: Draft #1153 on #1151. Relates to #1099. --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d75cfd09..f675cdef 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 15:28 UTC +**Snapshot:** 2026-09-07 16:01 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 15:28 UTC snapshot +## Security-defect corpus — live 2026-09-07 16:01 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1151, branch `feat/claude-plugin-deceptive-description-1099`, exact head `822ca12f1d8b55ae81f7feb882cc6f3073587256` | open/Draft successor stacked on #1150 (`8a360d2...`). RED `278dab8` → GREEN `822ca12`. Detector statement coverage 1560/1560. | descriptions that claim read-only/local-only while inventory shows write, network, github_write, credential, remote MCP, or shell_execution fail as `claude-plugin-deceptive-description`. Honest network descriptions and empty descriptions are not this class. Bare Firefox stays inventory. | keep Draft stacked on #1150. Do not Close #1099 or #1150. Inventory is evidence, not permission. | +| AppGuardrail #1153, branch `feat/claude-plugin-nonstandard-json-1099`, exact head `3f709b0caf1252393f73dfef3ba95e732ab13360` | open/Draft successor stacked on #1151 (`822ca12...`). RED `705a7e0` → GREEN `3f709b0`. Plugin suites 148 passed; detector statement coverage 1576/1576 on Python 3.13. | manifest `NaN`, `Infinity`, and `-Infinity` fail as `claude-plugin-nonstandard-json-constant`. Duplicate members stay `claude-plugin-duplicate-json-member`. A finite JSON number is not this class. | keep Draft stacked on #1151. Do not Close #1099 or #1151. Do not steal #1151 deceptive-description unique delta. | +| AppGuardrail #1151, branch `feat/claude-plugin-deceptive-description-1099`, exact head `822ca12f1d8b55ae81f7feb882cc6f3073587256` | open/Draft successor stacked on #1150 (`8a360d2...`). RED `278dab8` → GREEN `822ca12`. Detector statement coverage 1560/1560. Non-standard JSON successor is #1153. | descriptions that claim read-only/local-only while inventory shows write, network, github_write, credential, remote MCP, or shell_execution fail as `claude-plugin-deceptive-description`. Honest network descriptions and empty descriptions are not this class. Bare Firefox stays inventory. | keep Draft stacked on #1150. Do not Close #1099 or #1150. Inventory is evidence, not permission. | | AppGuardrail #1150, branch `feat/claude-plugin-browser-profile-1099`, exact head `8a360d2b82e21999b2a0515a5ecb7641971da3af` | open/Draft successor stacked on #1146 (`94946c7...`). RED `b369d5f` → GREEN `8a360d2`. Plugin suites 128 passed; detector statement coverage 1444/1444 on Python 3.13. REST mergeable CLEAN versus #1146. Deceptive-description successor is #1151. | host Chrome/Chromium/Firefox profile stores on hook or manifest surfaces fail as `claude-plugin-browser-profile-access`. README path mentions and a bare `Firefox` product name stay `browser_profile_access` inventory. Docker sockets stay `claude-plugin-docker-socket`. | keep Draft stacked on #1146. Do not Close #1099 or #1146. Do not steal #1146 hidden-executable or #1137 Docker unique delta. | | AppGuardrail #1148, branch `sentinel/fix-dom-xss-console-2387223574376446424`, exact head `a666eef82d6caaa73163241e358c44fbe8172f70` | open/Draft concurrent sentinel on `develop@e71d37e`. Body cites authority `b209e8c` while live head is `a666eef`; `.jules/sentinel.md` remains in the compare. Checks were still admitting at 14:55 UTC. | untrusted finding severity was used as a normal-object key before `innerHTML`; a null-prototype palette plus one normalized/escaped label is the intended repair. This is an inherited-property lookup boundary, not prototype mutation. | keep as concurrent sentinel owner. Do not race the branch. Do not treat robot review as GitHub APPROVE. | | AppGuardrail #1146, branch `feat/claude-plugin-hidden-executable-1099`, exact head `94946c7014d743484dd6ff2d40f8a67cc3065128` | open/Draft successor stacked on #1145 (`1d42ac5...`). RED `21deb12` → GREEN `94946c7`. Plugin tests 120 passed; detector statement coverage 1428/1428. Browser-profile successor is #1150. | hidden undeclared executable/config surfaces fail as `claude-plugin-hidden-undeclared-executable`. `.git/`, `.gitignore`, LICENSE, `.mcp.json`, and declared `hooks/pre.sh` stay negative for this rule. | keep Draft stacked on #1145. Do not Close #1099 or #1145. | @@ -138,7 +139,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1. Regex YAML unchanged. | keep #1152 Draft through exact-head Checks/review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 15:28 UTC records Draft #1152 `255cfd8` on #1133 and Draft #1151 `822ca12` on #1150 `8a360d2` … on #998 `8b95c2b`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 16:01 UTC records Draft #1153 `3f709b0` on #1151 `822ca12` on #1150 … on #998 `8b95c2b`; G-06 remains #1152 `255cfd8` on #1133 with `_scan_file` emit; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -196,6 +197,7 @@ re-fetch docs/issues/PRs/current heads 31. Keep #1148 Draft at `a666eef` as the concurrent console severity-palette owner. Do not race that sentinel branch or treat predecessor `b209e8c` evidence as current-head. 32. Keep #1151 Draft stacked on #1150 at `822ca12`. Deceptive read-only/local-only descriptions fail closed when inventory shows write or egress. Do not Close #1099 or #1150. 33. Keep #1152 Draft stacked on #1133 at `255cfd8`. `_scan_file` emits poll analyzer findings without double-count. Do not Close #1087, #1088, or #1133. +34. Keep #1153 Draft stacked on #1151 at `3f709b0`. Manifest `NaN`/`Infinity`/`-Infinity` fail closed; duplicate members stay their own class. Do not Close #1099 or #1151. ## Standards and acceptance basis From 494dc36d8fc506042ed323f96909747f08cbfdde Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 01:18:17 +0900 Subject: [PATCH 085/192] docs: record #1154 malformed-UTF-8 successor Summary: - Snapshot 16:14 UTC records Draft #1154 `ee43e7d` stacked on #1153. - Invalid UTF-8 plugin/MCP JSON fails closed with label-only snippets. - Valid CJK, bidi concealment, and Infinity stay their own classes. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1154 (1614/1614) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f675cdef..65e2ad9c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 16:01 UTC +**Snapshot:** 2026-09-07 16:14 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 16:01 UTC snapshot +## Security-defect corpus — live 2026-09-07 16:14 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1153, branch `feat/claude-plugin-nonstandard-json-1099`, exact head `3f709b0caf1252393f73dfef3ba95e732ab13360` | open/Draft successor stacked on #1151 (`822ca12...`). RED `705a7e0` → GREEN `3f709b0`. Plugin suites 148 passed; detector statement coverage 1576/1576 on Python 3.13. | manifest `NaN`, `Infinity`, and `-Infinity` fail as `claude-plugin-nonstandard-json-constant`. Duplicate members stay `claude-plugin-duplicate-json-member`. A finite JSON number is not this class. | keep Draft stacked on #1151. Do not Close #1099 or #1151. Do not steal #1151 deceptive-description unique delta. | +| AppGuardrail #1154, branch `feat/claude-plugin-malformed-utf8-1099`, exact head `ee43e7d9006261522b854e159d94ca4d84b2aa8c` | open/Draft successor stacked on #1153 (`3f709b0...`). RED `4c930ce` → GREEN `ee43e7d`. Plugin suites 168 passed; detector statement coverage 1614/1614. | marketplace/plugin/MCP JSON that is not valid UTF-8 fails as `claude-plugin-malformed-utf8`. Snippets are labels only. Valid CJK is not this class. Bidi stays concealed-identity. `Infinity` stays nonstandard-json-constant. | keep Draft stacked on #1153. Do not Close #1099 or #1153. | +| AppGuardrail #1153, branch `feat/claude-plugin-nonstandard-json-1099`, exact head `3f709b0caf1252393f73dfef3ba95e732ab13360` | open/Draft successor stacked on #1151 (`822ca12...`). RED `705a7e0` → GREEN `3f709b0`. Plugin suites 148 passed; detector statement coverage 1576/1576 on Python 3.13. Malformed-UTF-8 successor is #1154. | manifest `NaN`, `Infinity`, and `-Infinity` fail as `claude-plugin-nonstandard-json-constant`. Duplicate members stay `claude-plugin-duplicate-json-member`. A finite JSON number is not this class. | keep Draft stacked on #1151. Do not Close #1099 or #1151. Do not steal #1151 deceptive-description unique delta. | | AppGuardrail #1151, branch `feat/claude-plugin-deceptive-description-1099`, exact head `822ca12f1d8b55ae81f7feb882cc6f3073587256` | open/Draft successor stacked on #1150 (`8a360d2...`). RED `278dab8` → GREEN `822ca12`. Detector statement coverage 1560/1560. Non-standard JSON successor is #1153. | descriptions that claim read-only/local-only while inventory shows write, network, github_write, credential, remote MCP, or shell_execution fail as `claude-plugin-deceptive-description`. Honest network descriptions and empty descriptions are not this class. Bare Firefox stays inventory. | keep Draft stacked on #1150. Do not Close #1099 or #1150. Inventory is evidence, not permission. | | AppGuardrail #1150, branch `feat/claude-plugin-browser-profile-1099`, exact head `8a360d2b82e21999b2a0515a5ecb7641971da3af` | open/Draft successor stacked on #1146 (`94946c7...`). RED `b369d5f` → GREEN `8a360d2`. Plugin suites 128 passed; detector statement coverage 1444/1444 on Python 3.13. REST mergeable CLEAN versus #1146. Deceptive-description successor is #1151. | host Chrome/Chromium/Firefox profile stores on hook or manifest surfaces fail as `claude-plugin-browser-profile-access`. README path mentions and a bare `Firefox` product name stay `browser_profile_access` inventory. Docker sockets stay `claude-plugin-docker-socket`. | keep Draft stacked on #1146. Do not Close #1099 or #1146. Do not steal #1146 hidden-executable or #1137 Docker unique delta. | | AppGuardrail #1148, branch `sentinel/fix-dom-xss-console-2387223574376446424`, exact head `a666eef82d6caaa73163241e358c44fbe8172f70` | open/Draft concurrent sentinel on `develop@e71d37e`. Body cites authority `b209e8c` while live head is `a666eef`; `.jules/sentinel.md` remains in the compare. Checks were still admitting at 14:55 UTC. | untrusted finding severity was used as a normal-object key before `innerHTML`; a null-prototype palette plus one normalized/escaped label is the intended repair. This is an inherited-property lookup boundary, not prototype mutation. | keep as concurrent sentinel owner. Do not race the branch. Do not treat robot review as GitHub APPROVE. | @@ -139,7 +140,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1. Regex YAML unchanged. | keep #1152 Draft through exact-head Checks/review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 16:01 UTC records Draft #1153 `3f709b0` on #1151 `822ca12` on #1150 … on #998 `8b95c2b`; G-06 remains #1152 `255cfd8` on #1133 with `_scan_file` emit; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 16:14 UTC records Draft #1154 `ee43e7d` on #1153 `3f709b0` on #1151 `822ca12` … on #998 `8b95c2b`; G-06 remains #1152 `255cfd8` on #1133; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -198,6 +199,7 @@ re-fetch docs/issues/PRs/current heads 32. Keep #1151 Draft stacked on #1150 at `822ca12`. Deceptive read-only/local-only descriptions fail closed when inventory shows write or egress. Do not Close #1099 or #1150. 33. Keep #1152 Draft stacked on #1133 at `255cfd8`. `_scan_file` emits poll analyzer findings without double-count. Do not Close #1087, #1088, or #1133. 34. Keep #1153 Draft stacked on #1151 at `3f709b0`. Manifest `NaN`/`Infinity`/`-Infinity` fail closed; duplicate members stay their own class. Do not Close #1099 or #1151. +35. Keep #1154 Draft stacked on #1153 at `ee43e7d`. Invalid UTF-8 manifests fail closed; snippets are labels only. Do not Close #1099 or #1153. ## Standards and acceptance basis From 12aebfa72c27990be7dc902eb71fff5d57b01086 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 02:03:33 +0900 Subject: [PATCH 086/192] docs: record #1155 NFC identity-name successor Refresh the single-writer gap baseline from live exact-head evidence: Draft #1155 on #1154, and G-06 #1152 hosted coverage SUCCESS. Relates to #1099. --- docs/product-technical-gap-baseline.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 65e2ad9c..7ae6544b 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 16:14 UTC +**Snapshot:** 2026-09-07 17:02 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 16:14 UTC snapshot +## Security-defect corpus — live 2026-09-07 17:02 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | -| AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | +| AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1154, branch `feat/claude-plugin-malformed-utf8-1099`, exact head `ee43e7d9006261522b854e159d94ca4d84b2aa8c` | open/Draft successor stacked on #1153 (`3f709b0...`). RED `4c930ce` → GREEN `ee43e7d`. Plugin suites 168 passed; detector statement coverage 1614/1614. | marketplace/plugin/MCP JSON that is not valid UTF-8 fails as `claude-plugin-malformed-utf8`. Snippets are labels only. Valid CJK is not this class. Bidi stays concealed-identity. `Infinity` stays nonstandard-json-constant. | keep Draft stacked on #1153. Do not Close #1099 or #1153. | +| AppGuardrail #1155, branch `feat/claude-plugin-normalized-name-1099`, exact head `b85b936f04558f66af23a3b65d8ea38df9397d6b` | open/Draft successor stacked on #1154 (`ee43e7d...`). RED `13b97b4` → GREEN `b85b936`. Plugin suites 167 passed; detector statement coverage 1633/1633 on Python 3.13. | plugin or marketplace identity names that are not Unicode NFC fail as `claude-plugin-inconsistent-normalized-name`. Precomposed Latin and Hangul stay admitted. Combining marks do not appear in snippets. | keep Draft stacked on #1154. Do not Close #1099 or #1154. Do not steal #1154 malformed-UTF-8 unique delta. | +| AppGuardrail #1154, branch `feat/claude-plugin-malformed-utf8-1099`, exact head `ee43e7d9006261522b854e159d94ca4d84b2aa8c` | open/Draft successor stacked on #1153 (`3f709b0...`). RED `4c930ce` → GREEN `ee43e7d`. Plugin suites 168 passed; detector statement coverage 1614/1614. NFC-name successor is #1155. | marketplace/plugin/MCP JSON that is not valid UTF-8 fails as `claude-plugin-malformed-utf8`. Snippets are labels only. Valid CJK is not this class. Bidi stays concealed-identity. `Infinity` stays nonstandard-json-constant. | keep Draft stacked on #1153. Do not Close #1099 or #1153. | | AppGuardrail #1153, branch `feat/claude-plugin-nonstandard-json-1099`, exact head `3f709b0caf1252393f73dfef3ba95e732ab13360` | open/Draft successor stacked on #1151 (`822ca12...`). RED `705a7e0` → GREEN `3f709b0`. Plugin suites 148 passed; detector statement coverage 1576/1576 on Python 3.13. Malformed-UTF-8 successor is #1154. | manifest `NaN`, `Infinity`, and `-Infinity` fail as `claude-plugin-nonstandard-json-constant`. Duplicate members stay `claude-plugin-duplicate-json-member`. A finite JSON number is not this class. | keep Draft stacked on #1151. Do not Close #1099 or #1151. Do not steal #1151 deceptive-description unique delta. | | AppGuardrail #1151, branch `feat/claude-plugin-deceptive-description-1099`, exact head `822ca12f1d8b55ae81f7feb882cc6f3073587256` | open/Draft successor stacked on #1150 (`8a360d2...`). RED `278dab8` → GREEN `822ca12`. Detector statement coverage 1560/1560. Non-standard JSON successor is #1153. | descriptions that claim read-only/local-only while inventory shows write, network, github_write, credential, remote MCP, or shell_execution fail as `claude-plugin-deceptive-description`. Honest network descriptions and empty descriptions are not this class. Bare Firefox stays inventory. | keep Draft stacked on #1150. Do not Close #1099 or #1150. Inventory is evidence, not permission. | | AppGuardrail #1150, branch `feat/claude-plugin-browser-profile-1099`, exact head `8a360d2b82e21999b2a0515a5ecb7641971da3af` | open/Draft successor stacked on #1146 (`94946c7...`). RED `b369d5f` → GREEN `8a360d2`. Plugin suites 128 passed; detector statement coverage 1444/1444 on Python 3.13. REST mergeable CLEAN versus #1146. Deceptive-description successor is #1151. | host Chrome/Chromium/Firefox profile stores on hook or manifest surfaces fail as `claude-plugin-browser-profile-access`. README path mentions and a bare `Firefox` product name stay `browser_profile_access` inventory. Docker sockets stay `claude-plugin-docker-socket`. | keep Draft stacked on #1146. Do not Close #1099 or #1146. Do not steal #1146 hidden-executable or #1137 Docker unique delta. | @@ -138,9 +139,9 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-03 | A developer cannot safely transfer remediation/evidence into an agent workflow without CSP, clipboard, redaction, or provenance ambiguity. | Issue #928 remains open; PR #1006 at exact head `35c28e22b5d50f1da943718cdb1984dcee098d62` after non-force restack onto `develop@e71d37e` is active-PR evidence for a transport-neutral, deterministic, redacted and digest-verified JSON contract, while the dashboard UI slice remains explicitly separate. | retain the standalone versioned bundle boundary; then add CSP-safe listener-based copy actions, accessible fallback/live-region behavior, focus handling and browser E2E after the design/Storybook gate | hostile text remains inert; no duplicate listeners; exact success/rejection/fallback behavior; provenance schema and digest verified on an unchanged protected head | **Open / active in #1006** | | G-04 | Enterprise buyers need defensible retention/deletion/audit/recovery for scan evidence. | control-plane schema and retention/audit work | tenant-owned retention/audit policy integrated into live store/API | migration rollback, backup/restore, authorization, immutable audit and release evidence | **Open** | | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | -| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1. Regex YAML unchanged. | keep #1152 Draft through exact-head Checks/review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | +| G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 16:14 UTC records Draft #1154 `ee43e7d` on #1153 `3f709b0` on #1151 `822ca12` … on #998 `8b95c2b`; G-06 remains #1152 `255cfd8` on #1133; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 17:02 UTC records Draft #1155 `b85b936` on #1154 `ee43e7d` on #1153 … on #998 `8b95c2b`; G-06 remains #1152 `255cfd8` with hosted coverage SUCCESS; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -200,6 +201,7 @@ re-fetch docs/issues/PRs/current heads 33. Keep #1152 Draft stacked on #1133 at `255cfd8`. `_scan_file` emits poll analyzer findings without double-count. Do not Close #1087, #1088, or #1133. 34. Keep #1153 Draft stacked on #1151 at `3f709b0`. Manifest `NaN`/`Infinity`/`-Infinity` fail closed; duplicate members stay their own class. Do not Close #1099 or #1151. 35. Keep #1154 Draft stacked on #1153 at `ee43e7d`. Invalid UTF-8 manifests fail closed; snippets are labels only. Do not Close #1099 or #1153. +36. Keep #1155 Draft stacked on #1154 at `b85b936`. Non-NFC plugin/marketplace names fail closed; Hangul and precomposed Latin stay admitted. Do not Close #1099 or #1154. ## Standards and acceptance basis From c69ab2bfc8f02bc99f56c9862f545e125ef24c36 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 02:23:18 +0900 Subject: [PATCH 087/192] docs: record #1156 vendored-scope successor Summary: - Snapshot 17:18 UTC records Draft #1156 `a6f6a74` stacked on #1155. - Undeclared vendor/node_modules/dist copies fail as one scope finding. - Hook walks skip those trees so admission is not a per-file flood. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1156 (1709/1709) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 7ae6544b..952f833a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 17:02 UTC +**Snapshot:** 2026-09-07 17:18 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 17:02 UTC snapshot +## Security-defect corpus — live 2026-09-07 17:18 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1155, branch `feat/claude-plugin-normalized-name-1099`, exact head `b85b936f04558f66af23a3b65d8ea38df9397d6b` | open/Draft successor stacked on #1154 (`ee43e7d...`). RED `13b97b4` → GREEN `b85b936`. Plugin suites 167 passed; detector statement coverage 1633/1633 on Python 3.13. | plugin or marketplace identity names that are not Unicode NFC fail as `claude-plugin-inconsistent-normalized-name`. Precomposed Latin and Hangul stay admitted. Combining marks do not appear in snippets. | keep Draft stacked on #1154. Do not Close #1099 or #1154. Do not steal #1154 malformed-UTF-8 unique delta. | +| AppGuardrail #1156, branch `feat/claude-plugin-vendored-scope-1099`, exact head `a6f6a742701c263efcd83402da1815e065d69706` | open/Draft successor stacked on #1155 (`b85b936...`). Plugin suites 180 passed; detector statement coverage 1709/1709. | undeclared `vendor/`, `node_modules/`, `dist/`, or `*.min.js` copies fail as `claude-plugin-vendored-scope-undeclared` (one scope finding). Hook walks skip those trees. `files[]` can bind generated paths. | keep Draft stacked on #1155. Do not Close #1099 or #1155. Do not flood per-file findings from vendored trees. | +| AppGuardrail #1155, branch `feat/claude-plugin-normalized-name-1099`, exact head `b85b936f04558f66af23a3b65d8ea38df9397d6b` | open/Draft successor stacked on #1154 (`ee43e7d...`). RED `13b97b4` → GREEN `b85b936`. Plugin suites 167 passed; detector statement coverage 1633/1633 on Python 3.13. Vendored-scope successor is #1156. | plugin or marketplace identity names that are not Unicode NFC fail as `claude-plugin-inconsistent-normalized-name`. Precomposed Latin and Hangul stay admitted. Combining marks do not appear in snippets. | keep Draft stacked on #1154. Do not Close #1099 or #1154. Do not steal #1154 malformed-UTF-8 unique delta. | | AppGuardrail #1154, branch `feat/claude-plugin-malformed-utf8-1099`, exact head `ee43e7d9006261522b854e159d94ca4d84b2aa8c` | open/Draft successor stacked on #1153 (`3f709b0...`). RED `4c930ce` → GREEN `ee43e7d`. Plugin suites 168 passed; detector statement coverage 1614/1614. NFC-name successor is #1155. | marketplace/plugin/MCP JSON that is not valid UTF-8 fails as `claude-plugin-malformed-utf8`. Snippets are labels only. Valid CJK is not this class. Bidi stays concealed-identity. `Infinity` stays nonstandard-json-constant. | keep Draft stacked on #1153. Do not Close #1099 or #1153. | | AppGuardrail #1153, branch `feat/claude-plugin-nonstandard-json-1099`, exact head `3f709b0caf1252393f73dfef3ba95e732ab13360` | open/Draft successor stacked on #1151 (`822ca12...`). RED `705a7e0` → GREEN `3f709b0`. Plugin suites 148 passed; detector statement coverage 1576/1576 on Python 3.13. Malformed-UTF-8 successor is #1154. | manifest `NaN`, `Infinity`, and `-Infinity` fail as `claude-plugin-nonstandard-json-constant`. Duplicate members stay `claude-plugin-duplicate-json-member`. A finite JSON number is not this class. | keep Draft stacked on #1151. Do not Close #1099 or #1151. Do not steal #1151 deceptive-description unique delta. | | AppGuardrail #1151, branch `feat/claude-plugin-deceptive-description-1099`, exact head `822ca12f1d8b55ae81f7feb882cc6f3073587256` | open/Draft successor stacked on #1150 (`8a360d2...`). RED `278dab8` → GREEN `822ca12`. Detector statement coverage 1560/1560. Non-standard JSON successor is #1153. | descriptions that claim read-only/local-only while inventory shows write, network, github_write, credential, remote MCP, or shell_execution fail as `claude-plugin-deceptive-description`. Honest network descriptions and empty descriptions are not this class. Bare Firefox stays inventory. | keep Draft stacked on #1150. Do not Close #1099 or #1150. Inventory is evidence, not permission. | @@ -141,7 +142,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 17:02 UTC records Draft #1155 `b85b936` on #1154 `ee43e7d` on #1153 … on #998 `8b95c2b`; G-06 remains #1152 `255cfd8` with hosted coverage SUCCESS; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 17:18 UTC records Draft #1156 `a6f6a74` on #1155 `b85b936` on #1154 `ee43e7d` … on #998 `8b95c2b`; G-06 remains #1152 `255cfd8` with hosted coverage SUCCESS; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -202,6 +203,7 @@ re-fetch docs/issues/PRs/current heads 34. Keep #1153 Draft stacked on #1151 at `3f709b0`. Manifest `NaN`/`Infinity`/`-Infinity` fail closed; duplicate members stay their own class. Do not Close #1099 or #1151. 35. Keep #1154 Draft stacked on #1153 at `ee43e7d`. Invalid UTF-8 manifests fail closed; snippets are labels only. Do not Close #1099 or #1153. 36. Keep #1155 Draft stacked on #1154 at `b85b936`. Non-NFC plugin/marketplace names fail closed; Hangul and precomposed Latin stay admitted. Do not Close #1099 or #1154. +37. Keep #1156 Draft stacked on #1155 at `a6f6a74`. Undeclared vendored/generated copies fail as one scope finding. Do not Close #1099 or #1155. ## Standards and acceptance basis From 9827ef5c75865b6e9ffd2bb3873a3e7b0bc28752 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 03:04:47 +0900 Subject: [PATCH 088/192] docs: record #1157 conflicting-identity successor Refresh the single-writer gap baseline from live exact-head evidence: Draft #1157 on #1156. Relates to #1099. --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 952f833a..26770d46 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 17:18 UTC +**Snapshot:** 2026-09-07 18:03 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 17:18 UTC snapshot +## Security-defect corpus — live 2026-09-07 18:03 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1156, branch `feat/claude-plugin-vendored-scope-1099`, exact head `a6f6a742701c263efcd83402da1815e065d69706` | open/Draft successor stacked on #1155 (`b85b936...`). Plugin suites 180 passed; detector statement coverage 1709/1709. | undeclared `vendor/`, `node_modules/`, `dist/`, or `*.min.js` copies fail as `claude-plugin-vendored-scope-undeclared` (one scope finding). Hook walks skip those trees. `files[]` can bind generated paths. | keep Draft stacked on #1155. Do not Close #1099 or #1155. Do not flood per-file findings from vendored trees. | +| AppGuardrail #1157, branch `feat/claude-plugin-conflicting-identity-1099`, exact head `bd42da5a1f828d645f4455a0d64b7a42d7d1d708` | open/Draft successor stacked on #1156 (`a6f6a74...`). RED `9ca59f5` → GREEN `bd42da5`. Plugin suites 193 passed; detector statement coverage 1803/1803 on Python 3.13. | duplicate plugin, skill, or command NFC names fail as `claude-plugin-conflicting-identity`. Non-NFC names stay #1155. Vendored copies stay #1156. One collision emits one finding. | keep Draft stacked on #1156. Do not Close #1099 or #1156. Do not steal #1156 vendored-scope unique delta. | +| AppGuardrail #1156, branch `feat/claude-plugin-vendored-scope-1099`, exact head `a6f6a742701c263efcd83402da1815e065d69706` | open/Draft successor stacked on #1155 (`b85b936...`). Plugin suites 180 passed; detector statement coverage 1709/1709. Conflicting-identity successor is #1157. | undeclared `vendor/`, `node_modules/`, `dist/`, or `*.min.js` copies fail as `claude-plugin-vendored-scope-undeclared` (one scope finding). Hook walks skip those trees. `files[]` can bind generated paths. | keep Draft stacked on #1155. Do not Close #1099 or #1155. Do not flood per-file findings from vendored trees. | | AppGuardrail #1155, branch `feat/claude-plugin-normalized-name-1099`, exact head `b85b936f04558f66af23a3b65d8ea38df9397d6b` | open/Draft successor stacked on #1154 (`ee43e7d...`). RED `13b97b4` → GREEN `b85b936`. Plugin suites 167 passed; detector statement coverage 1633/1633 on Python 3.13. Vendored-scope successor is #1156. | plugin or marketplace identity names that are not Unicode NFC fail as `claude-plugin-inconsistent-normalized-name`. Precomposed Latin and Hangul stay admitted. Combining marks do not appear in snippets. | keep Draft stacked on #1154. Do not Close #1099 or #1154. Do not steal #1154 malformed-UTF-8 unique delta. | | AppGuardrail #1154, branch `feat/claude-plugin-malformed-utf8-1099`, exact head `ee43e7d9006261522b854e159d94ca4d84b2aa8c` | open/Draft successor stacked on #1153 (`3f709b0...`). RED `4c930ce` → GREEN `ee43e7d`. Plugin suites 168 passed; detector statement coverage 1614/1614. NFC-name successor is #1155. | marketplace/plugin/MCP JSON that is not valid UTF-8 fails as `claude-plugin-malformed-utf8`. Snippets are labels only. Valid CJK is not this class. Bidi stays concealed-identity. `Infinity` stays nonstandard-json-constant. | keep Draft stacked on #1153. Do not Close #1099 or #1153. | | AppGuardrail #1153, branch `feat/claude-plugin-nonstandard-json-1099`, exact head `3f709b0caf1252393f73dfef3ba95e732ab13360` | open/Draft successor stacked on #1151 (`822ca12...`). RED `705a7e0` → GREEN `3f709b0`. Plugin suites 148 passed; detector statement coverage 1576/1576 on Python 3.13. Malformed-UTF-8 successor is #1154. | manifest `NaN`, `Infinity`, and `-Infinity` fail as `claude-plugin-nonstandard-json-constant`. Duplicate members stay `claude-plugin-duplicate-json-member`. A finite JSON number is not this class. | keep Draft stacked on #1151. Do not Close #1099 or #1151. Do not steal #1151 deceptive-description unique delta. | @@ -142,7 +143,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 17:18 UTC records Draft #1156 `a6f6a74` on #1155 `b85b936` on #1154 `ee43e7d` … on #998 `8b95c2b`; G-06 remains #1152 `255cfd8` with hosted coverage SUCCESS; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 18:03 UTC records Draft #1157 `bd42da5` on #1156 `a6f6a74` on #1155 … on #998 `8b95c2b`; G-06 remains #1152 `255cfd8` with hosted coverage SUCCESS; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -204,6 +205,7 @@ re-fetch docs/issues/PRs/current heads 35. Keep #1154 Draft stacked on #1153 at `ee43e7d`. Invalid UTF-8 manifests fail closed; snippets are labels only. Do not Close #1099 or #1153. 36. Keep #1155 Draft stacked on #1154 at `b85b936`. Non-NFC plugin/marketplace names fail closed; Hangul and precomposed Latin stay admitted. Do not Close #1099 or #1154. 37. Keep #1156 Draft stacked on #1155 at `a6f6a74`. Undeclared vendored/generated copies fail as one scope finding. Do not Close #1099 or #1155. +38. Keep #1157 Draft stacked on #1156 at `bd42da5`. Duplicate plugin/skill/command NFC names fail closed. Do not Close #1099 or #1156. ## Standards and acceptance basis From b34d0342e9e6cf43cef1c5f4b8ce85fc572c5d16 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 03:20:08 +0900 Subject: [PATCH 089/192] docs: record #1158 secret-to-prompt successor Summary: - Snapshot 18:16 UTC records Draft #1158 `8c9f2d6` stacked on #1157. - Named env secrets copied into prompts, logs, or child env fail closed. - Curl/wget stays the secret-to-network class. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1158 (1878/1878) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 26770d46..00228751 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 18:03 UTC +**Snapshot:** 2026-09-07 18:16 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 18:03 UTC snapshot +## Security-defect corpus — live 2026-09-07 18:16 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1157, branch `feat/claude-plugin-conflicting-identity-1099`, exact head `bd42da5a1f828d645f4455a0d64b7a42d7d1d708` | open/Draft successor stacked on #1156 (`a6f6a74...`). RED `9ca59f5` → GREEN `bd42da5`. Plugin suites 193 passed; detector statement coverage 1803/1803 on Python 3.13. | duplicate plugin, skill, or command NFC names fail as `claude-plugin-conflicting-identity`. Non-NFC names stay #1155. Vendored copies stay #1156. One collision emits one finding. | keep Draft stacked on #1156. Do not Close #1099 or #1156. Do not steal #1156 vendored-scope unique delta. | +| AppGuardrail #1158, branch `feat/claude-plugin-secret-to-prompt-1099`, exact head `8c9f2d61236eb6e8cc1b27402d73fcef37128085` | open/Draft successor stacked on #1157 (`bd42da5...`). RED `09a6c2f` → GREEN `8c9f2d6`. Plugin suites 211 passed; detector statement coverage 1878/1878. | named env secrets copied into prompts, logs, or child `env=` fail as `claude-plugin-secret-to-prompt`. Curl/wget stays #1137 secret-to-network. Hardcoded `sk-` stays provider-secret. Snippets are sink plus env name. | keep Draft stacked on #1157. Do not Close #1099, #1157, or #1137. | +| AppGuardrail #1157, branch `feat/claude-plugin-conflicting-identity-1099`, exact head `bd42da5a1f828d645f4455a0d64b7a42d7d1d708` | open/Draft successor stacked on #1156 (`a6f6a74...`). RED `9ca59f5` → GREEN `bd42da5`. Plugin suites 193 passed; detector statement coverage 1803/1803 on Python 3.13. Secret-to-prompt successor is #1158. | duplicate plugin, skill, or command NFC names fail as `claude-plugin-conflicting-identity`. Non-NFC names stay #1155. Vendored copies stay #1156. One collision emits one finding. | keep Draft stacked on #1156. Do not Close #1099 or #1156. Do not steal #1156 vendored-scope unique delta. | | AppGuardrail #1156, branch `feat/claude-plugin-vendored-scope-1099`, exact head `a6f6a742701c263efcd83402da1815e065d69706` | open/Draft successor stacked on #1155 (`b85b936...`). Plugin suites 180 passed; detector statement coverage 1709/1709. Conflicting-identity successor is #1157. | undeclared `vendor/`, `node_modules/`, `dist/`, or `*.min.js` copies fail as `claude-plugin-vendored-scope-undeclared` (one scope finding). Hook walks skip those trees. `files[]` can bind generated paths. | keep Draft stacked on #1155. Do not Close #1099 or #1155. Do not flood per-file findings from vendored trees. | | AppGuardrail #1155, branch `feat/claude-plugin-normalized-name-1099`, exact head `b85b936f04558f66af23a3b65d8ea38df9397d6b` | open/Draft successor stacked on #1154 (`ee43e7d...`). RED `13b97b4` → GREEN `b85b936`. Plugin suites 167 passed; detector statement coverage 1633/1633 on Python 3.13. Vendored-scope successor is #1156. | plugin or marketplace identity names that are not Unicode NFC fail as `claude-plugin-inconsistent-normalized-name`. Precomposed Latin and Hangul stay admitted. Combining marks do not appear in snippets. | keep Draft stacked on #1154. Do not Close #1099 or #1154. Do not steal #1154 malformed-UTF-8 unique delta. | | AppGuardrail #1154, branch `feat/claude-plugin-malformed-utf8-1099`, exact head `ee43e7d9006261522b854e159d94ca4d84b2aa8c` | open/Draft successor stacked on #1153 (`3f709b0...`). RED `4c930ce` → GREEN `ee43e7d`. Plugin suites 168 passed; detector statement coverage 1614/1614. NFC-name successor is #1155. | marketplace/plugin/MCP JSON that is not valid UTF-8 fails as `claude-plugin-malformed-utf8`. Snippets are labels only. Valid CJK is not this class. Bidi stays concealed-identity. `Infinity` stays nonstandard-json-constant. | keep Draft stacked on #1153. Do not Close #1099 or #1153. | @@ -143,7 +144,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 18:03 UTC records Draft #1157 `bd42da5` on #1156 `a6f6a74` on #1155 … on #998 `8b95c2b`; G-06 remains #1152 `255cfd8` with hosted coverage SUCCESS; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 18:16 UTC records Draft #1158 `8c9f2d6` on #1157 `bd42da5` on #1156 `a6f6a74` … on #998 `8b95c2b`; G-06 remains #1152 `255cfd8` with hosted coverage SUCCESS; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -206,6 +207,7 @@ re-fetch docs/issues/PRs/current heads 36. Keep #1155 Draft stacked on #1154 at `b85b936`. Non-NFC plugin/marketplace names fail closed; Hangul and precomposed Latin stay admitted. Do not Close #1099 or #1154. 37. Keep #1156 Draft stacked on #1155 at `a6f6a74`. Undeclared vendored/generated copies fail as one scope finding. Do not Close #1099 or #1155. 38. Keep #1157 Draft stacked on #1156 at `bd42da5`. Duplicate plugin/skill/command NFC names fail closed. Do not Close #1099 or #1156. +39. Keep #1158 Draft stacked on #1157 at `8c9f2d6`. Secret-to-prompt/log/child-env copies fail closed; curl stays #1137. Do not Close #1099, #1157, or #1137. ## Standards and acceptance basis From 00661d49923ea008536779054f02a0ace3662587 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 04:10:56 +0900 Subject: [PATCH 090/192] docs: record #1161 secret-to-MCP successor Summary: - Snapshot 19:03 UTC records Draft #1161 `a92e936` stacked on #1158. - Named secrets in MCP env/args/command fail closed. - Jules #1159 empty-host SSRF stays Draft under #1068. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1161 (1929/1929) --- docs/product-technical-gap-baseline.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 00228751..8004a910 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 18:16 UTC +**Snapshot:** 2026-09-07 19:03 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,15 +68,17 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 18:16 UTC snapshot +## Security-defect corpus — live 2026-09-07 19:03 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1158, branch `feat/claude-plugin-secret-to-prompt-1099`, exact head `8c9f2d61236eb6e8cc1b27402d73fcef37128085` | open/Draft successor stacked on #1157 (`bd42da5...`). RED `09a6c2f` → GREEN `8c9f2d6`. Plugin suites 211 passed; detector statement coverage 1878/1878. | named env secrets copied into prompts, logs, or child `env=` fail as `claude-plugin-secret-to-prompt`. Curl/wget stays #1137 secret-to-network. Hardcoded `sk-` stays provider-secret. Snippets are sink plus env name. | keep Draft stacked on #1157. Do not Close #1099, #1157, or #1137. | -| AppGuardrail #1157, branch `feat/claude-plugin-conflicting-identity-1099`, exact head `bd42da5a1f828d645f4455a0d64b7a42d7d1d708` | open/Draft successor stacked on #1156 (`a6f6a74...`). RED `9ca59f5` → GREEN `bd42da5`. Plugin suites 193 passed; detector statement coverage 1803/1803 on Python 3.13. Secret-to-prompt successor is #1158. | duplicate plugin, skill, or command NFC names fail as `claude-plugin-conflicting-identity`. Non-NFC names stay #1155. Vendored copies stay #1156. One collision emits one finding. | keep Draft stacked on #1156. Do not Close #1099 or #1156. Do not steal #1156 vendored-scope unique delta. | +| AppGuardrail #1161, branch `feat/claude-plugin-secret-to-mcp-1099`, exact head `a92e936fac322d600c6bf7c7a1aa91be25eb3975` | open/Draft successor stacked on #1158 (`8c9f2d6...`). RED `a3a80f3` → GREEN `a92e936`. Plugin suites 220 passed; detector statement coverage 1929/1929 on Python 3.13. | named secrets in MCP `env`/`args`/`command` fail as `claude-plugin-secret-to-mcp`. Curl stays #1137. Prompt/log stays #1158. Bounded MCP without secrets is not this class. | keep Draft stacked on #1158. Do not Close #1099, #1158, or #1137. | +| AppGuardrail #1159, branch `fix-ssrf-empty-hostname-7666453064051931080`, exact head `9587261978f4ebb26ac293685d4d223a787a36dc` | converted to Draft at 18:59 UTC. Effective delta is `if not raw: return False` in `_is_safe_url` plus `.jules/sentinel.md`. No new tests. Canonical owner remains #1068. | same empty-host SSRF class as #1068, implemented as a weaker Jules slice without the validator/corpus/API regressions | keep Draft. Do not Close until complete carryover onto #1068 is verified. Do not race #1068 to `develop`. | +| AppGuardrail #1158, branch `feat/claude-plugin-secret-to-prompt-1099`, exact head `8c9f2d61236eb6e8cc1b27402d73fcef37128085` | open/Draft successor stacked on live #1157 (`6f0eb44...`). RED `09a6c2f` → GREEN `8c9f2d6`. Plugin suites 211 passed; detector statement coverage 1878/1878. Secret-to-MCP successor is #1161. | named env secrets copied into prompts, logs, or child `env=` fail as `claude-plugin-secret-to-prompt`. Curl/wget stays #1137 secret-to-network. Hardcoded `sk-` stays provider-secret. Snippets are sink plus env name. | keep Draft stacked on #1157. Do not Close #1099, #1157, or #1137. | +| AppGuardrail #1157, branch `feat/claude-plugin-conflicting-identity-1099`, exact head `6f0eb445ecc0d48dfafd2c3d2525eb7cc1e462f7` | open/Draft successor stacked on #1156 (`a6f6a74...`). Live head narrows collision domains after RED `6f0eb44`: marketplace plugin identifiers still collide; Skills and legacy Commands collide on local invocation names; plugin namespace may equal a local skill name; custom agents stay a separate surface. Secret-to-prompt successor is #1158. | duplicate invocation identities fail as `claude-plugin-conflicting-identity`. Plugin namespace vs `/plugin:skill` is not that class. Non-NFC names stay #1155. Vendored copies stay #1156. | keep Draft stacked on #1156. Do not Close #1099 or #1156. Do not restore the over-broad global `seen` set. | | AppGuardrail #1156, branch `feat/claude-plugin-vendored-scope-1099`, exact head `a6f6a742701c263efcd83402da1815e065d69706` | open/Draft successor stacked on #1155 (`b85b936...`). Plugin suites 180 passed; detector statement coverage 1709/1709. Conflicting-identity successor is #1157. | undeclared `vendor/`, `node_modules/`, `dist/`, or `*.min.js` copies fail as `claude-plugin-vendored-scope-undeclared` (one scope finding). Hook walks skip those trees. `files[]` can bind generated paths. | keep Draft stacked on #1155. Do not Close #1099 or #1155. Do not flood per-file findings from vendored trees. | | AppGuardrail #1155, branch `feat/claude-plugin-normalized-name-1099`, exact head `b85b936f04558f66af23a3b65d8ea38df9397d6b` | open/Draft successor stacked on #1154 (`ee43e7d...`). RED `13b97b4` → GREEN `b85b936`. Plugin suites 167 passed; detector statement coverage 1633/1633 on Python 3.13. Vendored-scope successor is #1156. | plugin or marketplace identity names that are not Unicode NFC fail as `claude-plugin-inconsistent-normalized-name`. Precomposed Latin and Hangul stay admitted. Combining marks do not appear in snippets. | keep Draft stacked on #1154. Do not Close #1099 or #1154. Do not steal #1154 malformed-UTF-8 unique delta. | | AppGuardrail #1154, branch `feat/claude-plugin-malformed-utf8-1099`, exact head `ee43e7d9006261522b854e159d94ca4d84b2aa8c` | open/Draft successor stacked on #1153 (`3f709b0...`). RED `4c930ce` → GREEN `ee43e7d`. Plugin suites 168 passed; detector statement coverage 1614/1614. NFC-name successor is #1155. | marketplace/plugin/MCP JSON that is not valid UTF-8 fails as `claude-plugin-malformed-utf8`. Snippets are labels only. Valid CJK is not this class. Bidi stays concealed-identity. `Infinity` stays nonstandard-json-constant. | keep Draft stacked on #1153. Do not Close #1099 or #1153. | @@ -144,7 +146,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 18:16 UTC records Draft #1158 `8c9f2d6` on #1157 `bd42da5` on #1156 `a6f6a74` … on #998 `8b95c2b`; G-06 remains #1152 `255cfd8` with hosted coverage SUCCESS; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 19:03 UTC records Draft #1161 `a92e936` on #1158 `8c9f2d6` on #1157 `6f0eb44` … on #998 `8b95c2b`; Jules #1159 empty-host SSRF is Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -206,8 +208,10 @@ re-fetch docs/issues/PRs/current heads 35. Keep #1154 Draft stacked on #1153 at `ee43e7d`. Invalid UTF-8 manifests fail closed; snippets are labels only. Do not Close #1099 or #1153. 36. Keep #1155 Draft stacked on #1154 at `b85b936`. Non-NFC plugin/marketplace names fail closed; Hangul and precomposed Latin stay admitted. Do not Close #1099 or #1154. 37. Keep #1156 Draft stacked on #1155 at `a6f6a74`. Undeclared vendored/generated copies fail as one scope finding. Do not Close #1099 or #1155. -38. Keep #1157 Draft stacked on #1156 at `bd42da5`. Duplicate plugin/skill/command NFC names fail closed. Do not Close #1099 or #1156. +38. Keep #1157 Draft stacked on #1156 at `6f0eb44`. Duplicate marketplace plugin identifiers and duplicate local skill/command invocation names fail closed; plugin namespace vs `/plugin:skill` is allowed. Do not Close #1099 or #1156. 39. Keep #1158 Draft stacked on #1157 at `8c9f2d6`. Secret-to-prompt/log/child-env copies fail closed; curl stays #1137. Do not Close #1099, #1157, or #1137. +40. Keep #1161 Draft stacked on #1158 at `a92e936`. Named secrets in MCP env/args/command fail closed. Do not Close #1099, #1158, or #1137. +41. Keep #1159 Draft. Canonical empty-host SSRF owner is #1068; this Jules slice is not merge-ready. Do not Close until complete carryover onto #1068 is verified. ## Standards and acceptance basis From f2789ba97bda66d5d3d7f8a5b7690c4cedc993a2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 04:15:52 +0900 Subject: [PATCH 091/192] docs: record #1163 command-markdown #1036 reuse Summary: - Snapshot 19:15 UTC records Draft #1163 `cd5560e` stacked on #1161. - commands/*.md and named agents/*.md reuse released injection/exfil identities. - README and root AGENTS.md stay repository guidance. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1163 (1934/1934) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8004a910..8e5b0007 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 19:03 UTC +**Snapshot:** 2026-09-07 19:15 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 19:03 UTC snapshot +## Security-defect corpus — live 2026-09-07 19:15 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1161, branch `feat/claude-plugin-secret-to-mcp-1099`, exact head `a92e936fac322d600c6bf7c7a1aa91be25eb3975` | open/Draft successor stacked on #1158 (`8c9f2d6...`). RED `a3a80f3` → GREEN `a92e936`. Plugin suites 220 passed; detector statement coverage 1929/1929 on Python 3.13. | named secrets in MCP `env`/`args`/`command` fail as `claude-plugin-secret-to-mcp`. Curl stays #1137. Prompt/log stays #1158. Bounded MCP without secrets is not this class. | keep Draft stacked on #1158. Do not Close #1099, #1158, or #1137. | +| AppGuardrail #1163, branch `feat/claude-plugin-command-skill-reuse-1099`, exact head `cd5560ead4e0f01de0a7e0c97e43bc8f8280fc39` | open/Draft successor stacked on #1161 (`a92e936...`). RED `3505579` → GREEN `cd5560e`. Plugin suites 229 passed; detector statement coverage 1934/1934 on Python 3.13. | `commands/*.md` and named `agents/*.md` reuse released #1036 injection/exfil identities. `SKILL.md`/`agent.md` stay #1139. Homoglyph/placeholder stay skill-identifier rules. README and root `AGENTS.md` stay guidance. | keep Draft stacked on #1161. Do not Close #1099, #1036, #1161, or #1139. | +| AppGuardrail #1161, branch `feat/claude-plugin-secret-to-mcp-1099`, exact head `a92e936fac322d600c6bf7c7a1aa91be25eb3975` | open/Draft successor stacked on #1158 (`8c9f2d6...`). RED `a3a80f3` → GREEN `a92e936`. Plugin suites 220 passed; detector statement coverage 1929/1929 on Python 3.13. Command-markdown successor is #1163. | named secrets in MCP `env`/`args`/`command` fail as `claude-plugin-secret-to-mcp`. Curl stays #1137. Prompt/log stays #1158. Bounded MCP without secrets is not this class. | keep Draft stacked on #1158. Do not Close #1099, #1158, or #1137. | | AppGuardrail #1159, branch `fix-ssrf-empty-hostname-7666453064051931080`, exact head `9587261978f4ebb26ac293685d4d223a787a36dc` | converted to Draft at 18:59 UTC. Effective delta is `if not raw: return False` in `_is_safe_url` plus `.jules/sentinel.md`. No new tests. Canonical owner remains #1068. | same empty-host SSRF class as #1068, implemented as a weaker Jules slice without the validator/corpus/API regressions | keep Draft. Do not Close until complete carryover onto #1068 is verified. Do not race #1068 to `develop`. | | AppGuardrail #1158, branch `feat/claude-plugin-secret-to-prompt-1099`, exact head `8c9f2d61236eb6e8cc1b27402d73fcef37128085` | open/Draft successor stacked on live #1157 (`6f0eb44...`). RED `09a6c2f` → GREEN `8c9f2d6`. Plugin suites 211 passed; detector statement coverage 1878/1878. Secret-to-MCP successor is #1161. | named env secrets copied into prompts, logs, or child `env=` fail as `claude-plugin-secret-to-prompt`. Curl/wget stays #1137 secret-to-network. Hardcoded `sk-` stays provider-secret. Snippets are sink plus env name. | keep Draft stacked on #1157. Do not Close #1099, #1157, or #1137. | | AppGuardrail #1157, branch `feat/claude-plugin-conflicting-identity-1099`, exact head `6f0eb445ecc0d48dfafd2c3d2525eb7cc1e462f7` | open/Draft successor stacked on #1156 (`a6f6a74...`). Live head narrows collision domains after RED `6f0eb44`: marketplace plugin identifiers still collide; Skills and legacy Commands collide on local invocation names; plugin namespace may equal a local skill name; custom agents stay a separate surface. Secret-to-prompt successor is #1158. | duplicate invocation identities fail as `claude-plugin-conflicting-identity`. Plugin namespace vs `/plugin:skill` is not that class. Non-NFC names stay #1155. Vendored copies stay #1156. | keep Draft stacked on #1156. Do not Close #1099 or #1156. Do not restore the over-broad global `seen` set. | @@ -146,7 +147,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 19:03 UTC records Draft #1161 `a92e936` on #1158 `8c9f2d6` on #1157 `6f0eb44` … on #998 `8b95c2b`; Jules #1159 empty-host SSRF is Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 19:15 UTC records Draft #1163 `cd5560e` on #1161 `a92e936` on #1158 `8c9f2d6` on #1157 `6f0eb44` … on #998 `8b95c2b`; Jules #1159 empty-host SSRF is Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -212,6 +213,7 @@ re-fetch docs/issues/PRs/current heads 39. Keep #1158 Draft stacked on #1157 at `8c9f2d6`. Secret-to-prompt/log/child-env copies fail closed; curl stays #1137. Do not Close #1099, #1157, or #1137. 40. Keep #1161 Draft stacked on #1158 at `a92e936`. Named secrets in MCP env/args/command fail closed. Do not Close #1099, #1158, or #1137. 41. Keep #1159 Draft. Canonical empty-host SSRF owner is #1068; this Jules slice is not merge-ready. Do not Close until complete carryover onto #1068 is verified. +42. Keep #1163 Draft stacked on #1161 at `cd5560e`. Command and named-agent markdown reuse #1036 injection/exfil identities. Do not Close #1099, #1036, #1161, or #1139. ## Standards and acceptance basis From d0c5a53b8ae790a17e492ef756e7a19f9bf9b8ba Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 04:29:27 +0900 Subject: [PATCH 092/192] docs: record #1164 hide-actions successor Summary: - Snapshot 19:26 UTC records Draft #1164 `9ef3193` stacked on #1163. - Hide-actions, self-modify, and goal-escalation wording fail closed. - Command-markdown #1036 injection/exfil identities stay on #1163. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1164 (1988/1988) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8e5b0007..461a5d48 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 19:15 UTC +**Snapshot:** 2026-09-07 19:26 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 19:15 UTC snapshot +## Security-defect corpus — live 2026-09-07 19:26 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1163, branch `feat/claude-plugin-command-skill-reuse-1099`, exact head `cd5560ead4e0f01de0a7e0c97e43bc8f8280fc39` | open/Draft successor stacked on #1161 (`a92e936...`). RED `3505579` → GREEN `cd5560e`. Plugin suites 229 passed; detector statement coverage 1934/1934 on Python 3.13. | `commands/*.md` and named `agents/*.md` reuse released #1036 injection/exfil identities. `SKILL.md`/`agent.md` stay #1139. Homoglyph/placeholder stay skill-identifier rules. README and root `AGENTS.md` stay guidance. | keep Draft stacked on #1161. Do not Close #1099, #1036, #1161, or #1139. | +| AppGuardrail #1164, branch `feat/claude-plugin-hide-actions-1099`, exact head `9ef3193fb6e05dcdc2000772a53cf2dbbd97dab8` | open/Draft successor stacked on #1163 (`cd5560e...`). RED `f1d9ce7` → GREEN `9ef3193`. Plugin suites 239 passed; detector statement coverage 1988/1988. | SKILL/command/agent markdown that hides tool use, rewrites policy, or expands goals fail as `claude-plugin-hide-actions-directive`, `claude-plugin-self-modify-directive`, and `claude-plugin-goal-escalation-directive`. Honest “report each tool call” is not this class. #1163 exfil stays the released #1036 identity. | keep Draft stacked on #1163. Do not Close #1099, #1163, or #1036. Do not copy #1036 YAML regexes. | +| AppGuardrail #1163, branch `feat/claude-plugin-command-skill-reuse-1099`, exact head `cd5560ead4e0f01de0a7e0c97e43bc8f8280fc39` | open/Draft successor stacked on #1161 (`a92e936...`). RED `3505579` → GREEN `cd5560e`. Plugin suites 229 passed; detector statement coverage 1934/1934 on Python 3.13. Hide-actions successor is #1164. | `commands/*.md` and named `agents/*.md` reuse released #1036 injection/exfil identities. `SKILL.md`/`agent.md` stay #1139. Homoglyph/placeholder stay skill-identifier rules. README and root `AGENTS.md` stay guidance. | keep Draft stacked on #1161. Do not Close #1099, #1036, #1161, or #1139. | | AppGuardrail #1161, branch `feat/claude-plugin-secret-to-mcp-1099`, exact head `a92e936fac322d600c6bf7c7a1aa91be25eb3975` | open/Draft successor stacked on #1158 (`8c9f2d6...`). RED `a3a80f3` → GREEN `a92e936`. Plugin suites 220 passed; detector statement coverage 1929/1929 on Python 3.13. Command-markdown successor is #1163. | named secrets in MCP `env`/`args`/`command` fail as `claude-plugin-secret-to-mcp`. Curl stays #1137. Prompt/log stays #1158. Bounded MCP without secrets is not this class. | keep Draft stacked on #1158. Do not Close #1099, #1158, or #1137. | | AppGuardrail #1159, branch `fix-ssrf-empty-hostname-7666453064051931080`, exact head `9587261978f4ebb26ac293685d4d223a787a36dc` | converted to Draft at 18:59 UTC. Effective delta is `if not raw: return False` in `_is_safe_url` plus `.jules/sentinel.md`. No new tests. Canonical owner remains #1068. | same empty-host SSRF class as #1068, implemented as a weaker Jules slice without the validator/corpus/API regressions | keep Draft. Do not Close until complete carryover onto #1068 is verified. Do not race #1068 to `develop`. | | AppGuardrail #1158, branch `feat/claude-plugin-secret-to-prompt-1099`, exact head `8c9f2d61236eb6e8cc1b27402d73fcef37128085` | open/Draft successor stacked on live #1157 (`6f0eb44...`). RED `09a6c2f` → GREEN `8c9f2d6`. Plugin suites 211 passed; detector statement coverage 1878/1878. Secret-to-MCP successor is #1161. | named env secrets copied into prompts, logs, or child `env=` fail as `claude-plugin-secret-to-prompt`. Curl/wget stays #1137 secret-to-network. Hardcoded `sk-` stays provider-secret. Snippets are sink plus env name. | keep Draft stacked on #1157. Do not Close #1099, #1157, or #1137. | @@ -147,7 +148,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 19:15 UTC records Draft #1163 `cd5560e` on #1161 `a92e936` on #1158 `8c9f2d6` on #1157 `6f0eb44` … on #998 `8b95c2b`; Jules #1159 empty-host SSRF is Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 19:26 UTC records Draft #1164 `9ef3193` on #1163 `cd5560e` on #1161 `a92e936` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -214,6 +215,7 @@ re-fetch docs/issues/PRs/current heads 40. Keep #1161 Draft stacked on #1158 at `a92e936`. Named secrets in MCP env/args/command fail closed. Do not Close #1099, #1158, or #1137. 41. Keep #1159 Draft. Canonical empty-host SSRF owner is #1068; this Jules slice is not merge-ready. Do not Close until complete carryover onto #1068 is verified. 42. Keep #1163 Draft stacked on #1161 at `cd5560e`. Command and named-agent markdown reuse #1036 injection/exfil identities. Do not Close #1099, #1036, #1161, or #1139. +43. Keep #1164 Draft stacked on #1163 at `9ef3193`. Hide-actions, self-modify, and goal-escalation wording fail closed. Do not Close #1099, #1163, or #1036. Do not copy #1036 YAML regexes. ## Standards and acceptance basis From 4e0253f53a004284be3b0fff9fcacb289b00feb4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 05:05:11 +0900 Subject: [PATCH 093/192] docs: record #1165 insecure file-mode successor Summary: - Snapshot 20:04 UTC records Draft #1165 `5790559` stacked on #1164. - Setuid/setgid and world-writable executable/hook modes fail closed. - #1068 live head `2379b37` is another empty Strix retrigger. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1165 (2035/2035) --- docs/product-technical-gap-baseline.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 461a5d48..4d3f1d44 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 19:26 UTC +**Snapshot:** 2026-09-07 20:04 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 19:26 UTC snapshot +## Security-defect corpus — live 2026-09-07 20:04 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1164, branch `feat/claude-plugin-hide-actions-1099`, exact head `9ef3193fb6e05dcdc2000772a53cf2dbbd97dab8` | open/Draft successor stacked on #1163 (`cd5560e...`). RED `f1d9ce7` → GREEN `9ef3193`. Plugin suites 239 passed; detector statement coverage 1988/1988. | SKILL/command/agent markdown that hides tool use, rewrites policy, or expands goals fail as `claude-plugin-hide-actions-directive`, `claude-plugin-self-modify-directive`, and `claude-plugin-goal-escalation-directive`. Honest “report each tool call” is not this class. #1163 exfil stays the released #1036 identity. | keep Draft stacked on #1163. Do not Close #1099, #1163, or #1036. Do not copy #1036 YAML regexes. | +| AppGuardrail #1165, branch `feat/claude-plugin-insecure-file-mode-1099`, exact head `57905590731b5fb5cb7bf8b5e9bed43241bd5605` | open/Draft successor stacked on #1164 (`9ef3193...`). RED `6b2a476` → GREEN `5790559`. Plugin suites 251 passed; detector statement coverage 2035/2035 on Python 3.13. | setuid/setgid executable and hook files fail as `claude-plugin-setuid-executable`. World-writable executable and hook files fail as `claude-plugin-world-writable-executable`. Declared `0755` hooks, LICENSE, Git metadata, `.mcp.json`, vendored copies, and symlink hooks are not this class. `chmod +x` of a download stays unsigned-download. | keep Draft stacked on #1164. Do not Close #1099 or #1164. | +| AppGuardrail #1164, branch `feat/claude-plugin-hide-actions-1099`, exact head `9ef3193fb6e05dcdc2000772a53cf2dbbd97dab8` | open/Draft successor stacked on #1163 (`cd5560e...`). RED `f1d9ce7` → GREEN `9ef3193`. Plugin suites 239 passed; detector statement coverage 1988/1988. File-mode successor is #1165. | SKILL/command/agent markdown that hides tool use, rewrites policy, or expands goals fail as `claude-plugin-hide-actions-directive`, `claude-plugin-self-modify-directive`, and `claude-plugin-goal-escalation-directive`. Honest “report each tool call” is not this class. #1163 exfil stays the released #1036 identity. | keep Draft stacked on #1163. Do not Close #1099, #1163, or #1036. Do not copy #1036 YAML regexes. | | AppGuardrail #1163, branch `feat/claude-plugin-command-skill-reuse-1099`, exact head `cd5560ead4e0f01de0a7e0c97e43bc8f8280fc39` | open/Draft successor stacked on #1161 (`a92e936...`). RED `3505579` → GREEN `cd5560e`. Plugin suites 229 passed; detector statement coverage 1934/1934 on Python 3.13. Hide-actions successor is #1164. | `commands/*.md` and named `agents/*.md` reuse released #1036 injection/exfil identities. `SKILL.md`/`agent.md` stay #1139. Homoglyph/placeholder stay skill-identifier rules. README and root `AGENTS.md` stay guidance. | keep Draft stacked on #1161. Do not Close #1099, #1036, #1161, or #1139. | | AppGuardrail #1161, branch `feat/claude-plugin-secret-to-mcp-1099`, exact head `a92e936fac322d600c6bf7c7a1aa91be25eb3975` | open/Draft successor stacked on #1158 (`8c9f2d6...`). RED `a3a80f3` → GREEN `a92e936`. Plugin suites 220 passed; detector statement coverage 1929/1929 on Python 3.13. Command-markdown successor is #1163. | named secrets in MCP `env`/`args`/`command` fail as `claude-plugin-secret-to-mcp`. Curl stays #1137. Prompt/log stays #1158. Bounded MCP without secrets is not this class. | keep Draft stacked on #1158. Do not Close #1099, #1158, or #1137. | | AppGuardrail #1159, branch `fix-ssrf-empty-hostname-7666453064051931080`, exact head `9587261978f4ebb26ac293685d4d223a787a36dc` | converted to Draft at 18:59 UTC. Effective delta is `if not raw: return False` in `_is_safe_url` plus `.jules/sentinel.md`. No new tests. Canonical owner remains #1068. | same empty-host SSRF class as #1068, implemented as a weaker Jules slice without the validator/corpus/API regressions | keep Draft. Do not Close until complete carryover onto #1068 is verified. Do not race #1068 to `develop`. | @@ -108,7 +109,7 @@ Responsibility boundaries: | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | | AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. All nine repository workflows except CodeQL PR are terminal success. CodeQL PR `34068384347` failed closed only after authenticated dispatch with `VERDICT_STATE=pending`; central exact-head scan runs `34072930847` and `34072932500` are queued. No qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | -| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `325d48e0249b715bd33d48e45c597240dfb80a77` | open/mergeable/Draft; REST `mergeable_state=blocked`. Exact head `325d48e...` is a source-neutral empty-file descendant of `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` (`ahead 1` / zero changed files; commit message is a Strix timeout CI retrigger) and does not add a security delta. On this retrigger, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success, while Strix, SAST Semgrep, Noema, CodeQL compatibility analysis, and some Security Scan jobs remain pending. Predecessor CodeQL pending-handoff evidence does not transfer. No qualifying independent `APPROVED` review exists. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for current-head Strix/SAST/Noema/CodeQL and qualifying independent approval; never reuse predecessor results or recreate a duplicate hostless lane. | +| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `2379b37f05b12af8e22990965d42da2e69b9c611` | open/mergeable/Draft; REST `mergeable_state=blocked`. Exact head `2379b37...` is a source-neutral empty-file descendant of `325d48e0249b715bd33d48e45c597240dfb80a77` / `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` (`ahead 1` / zero changed files; commit message is a Strix timeout CI retrigger) and does not add a security delta. On this retrigger, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success, while Strix, SAST Semgrep, Noema, CodeQL compatibility analysis, and some Security Scan jobs remain pending. Predecessor CodeQL pending-handoff evidence does not transfer. No qualifying independent `APPROVED` review exists. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for current-head Strix/SAST/Noema/CodeQL and qualifying independent approval; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1107, webhook storage admission and detector precision, exact head `f10795e294df5b0d9797fc50b201126c998a3632` | open/mergeable/Draft. Exact-head Security Process `34077096473` exposed the local-sink detector false positive; the repaired head has nine fresh hosted workflows queued/pending. Local GREEN is 27/27 stored-SSRF tests, 37/37 SSRF/documentation tests, 1,009/1,009 repository tests, and zero deploy-blocking findings in the real repository scan. CodeGraph was unavailable locally. | the HTTP route and directly callable persistence function had duplicated validation, rejecting the documented empty-string clear value. The runtime repair makes `set_webhook` the single validation/persistence boundary. The existing `python-stored-ssrf-webhook-url` regex then reported the safe delegated route because it did not inspect the local sink body. RED `ead954ad...` fixes the FP/FN contract: one unique top-level, non-rebound sink with unconditional unsafe rejection before SQLite use is negative; unrelated conditional validation and symbol rebinding remain positive. GREEN `f18fec7c...` adds the bounded stdlib AST proof and `f10795e...` records traceability. | keep Draft; require fresh exact-head hosted checks/current review, then integrate #1068 non-destructively after its unresolved-DNS validator reaches protected `develop`. Do not treat persistence validation as delivery-time DNS pinning or weaken the #1068 prerequisite. | | AppGuardrail #1130, Jules webhook SSRF subset, exact head `0243a1a5a1cef758b14ae85f87b2ea1dd86e9e82` | converted to Draft at 05:37 UTC. Effective delta is `set_webhook`/route plumbing, a regex `try`/`except ValueError` lookaround, and `.jules/sentinel.md`. No runtime tests and no AST FP/FN contract. Canonical owner remains #1107. | same storage-boundary SSRF class as #1107, implemented as a weaker regex-only slice | keep Draft. Do not Close until complete carryover onto #1107 is verified. Do not race #1107 to `develop`. | | AppGuardrail #972 / Issue #927, branch `feat/scan-assurance-927`, exact head `c488cfffe4dd95a9be8b8ed99e77a86cc8d5d81f` | open/Draft. Non-force restack onto protected `develop@e71d37e` completed 05:37 UTC (`ahead` of predecessor `4ba738a...` by the merge commit only). REST `mergeable=MERGEABLE`, `mergeStateStatus=BLOCKED`. Fresh exact-head checks are in flight and do not inherit predecessor GREEN. | `0 findings` must not render as `clean` unless repository/commit identity, findings digest, detector completion, requested engines, scope, freshness, and gate accounting all verify. Ambiguous evidence is `untrusted`/`failed`/`incomplete`. | keep Draft through current-head Tests/security/SAST/CodeQL/dedicated assurance coverage and independent review. #1005 remains the report-consumer successor and must restack after this head is stable. Do not Close #927. | @@ -148,7 +149,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 19:26 UTC records Draft #1164 `9ef3193` on #1163 `cd5560e` on #1161 `a92e936` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 20:04 UTC records Draft #1165 `5790559` on #1164 `9ef3193` on #1163 `cd5560e` … on #998 `8b95c2b`; #1068 live head `2379b37` is another empty Strix-retrigger descendant; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -175,7 +176,7 @@ re-fetch docs/issues/PRs/current heads 1. Continue #1088 from exact head `d9744331...`, a docs-only single-writer cleanup after `99bdf459...` repaired strict `-gt` bounds and constant timeout expressions. Six repository workflows are terminal success while Security Scan, SAST Semgrep and CodeQL PR remain queued; stay Draft and do not transfer `e63c342...` evidence. Keep `docs/product-technical-gap-baseline.md` solely on #999. Do not Close #1087. 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. -3. Keep #1068 on source-neutral exact head `325d48e0249b715bd33d48e45c597240dfb80a77` as the single Draft hostless/unresolved-DNS lane. The head is an empty-file descendant of `a06a96fc...`; repository Tests/coverage/Security Process are GREEN on this retrigger while Strix/SAST/Noema/CodeQL-compat remain pending; no independent approval exists; #1128 is retired only by verified complete carryover. +3. Keep #1068 on source-neutral exact head `2379b37f05b12af8e22990965d42da2e69b9c611` as the single Draft hostless/unresolved-DNS lane. The head is an empty-file Strix-retrigger descendant of `325d48e...` / `a06a96fc...` and adds no security delta; predecessor Checks do not transfer; no independent approval exists; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. 5. Keep #1036 Draft on exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99`. Auto-merge is absent; `reviewDecision=REVIEW_REQUIRED`. Wait authenticated current-head OpenCode/Strix/Noema; do not Close and do not transfer predecessor approval. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. @@ -216,6 +217,7 @@ re-fetch docs/issues/PRs/current heads 41. Keep #1159 Draft. Canonical empty-host SSRF owner is #1068; this Jules slice is not merge-ready. Do not Close until complete carryover onto #1068 is verified. 42. Keep #1163 Draft stacked on #1161 at `cd5560e`. Command and named-agent markdown reuse #1036 injection/exfil identities. Do not Close #1099, #1036, #1161, or #1139. 43. Keep #1164 Draft stacked on #1163 at `9ef3193`. Hide-actions, self-modify, and goal-escalation wording fail closed. Do not Close #1099, #1163, or #1036. Do not copy #1036 YAML regexes. +44. Keep #1165 Draft stacked on #1164 at `5790559`. Setuid/setgid and world-writable executable/hook modes fail closed. Do not Close #1099 or #1164. ## Standards and acceptance basis From 6067d53a4dfeb503ef64a61a6f06028f05dd9792 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 05:28:47 +0900 Subject: [PATCH 094/192] docs: record #1166 decompression-bomb successor Summary: - Snapshot 20:26 UTC records Draft #1166 `90cd031` stacked on #1165. - Archive ratio >100 or nesting deeper than 1 fail closed. - Bomb members are not extracted; zip-slip stays #1135. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1166 (2201/2201) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4d3f1d44..2b307851 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 20:04 UTC +**Snapshot:** 2026-09-07 20:26 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 20:04 UTC snapshot +## Security-defect corpus — live 2026-09-07 20:26 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1165, branch `feat/claude-plugin-insecure-file-mode-1099`, exact head `57905590731b5fb5cb7bf8b5e9bed43241bd5605` | open/Draft successor stacked on #1164 (`9ef3193...`). RED `6b2a476` → GREEN `5790559`. Plugin suites 251 passed; detector statement coverage 2035/2035 on Python 3.13. | setuid/setgid executable and hook files fail as `claude-plugin-setuid-executable`. World-writable executable and hook files fail as `claude-plugin-world-writable-executable`. Declared `0755` hooks, LICENSE, Git metadata, `.mcp.json`, vendored copies, and symlink hooks are not this class. `chmod +x` of a download stays unsigned-download. | keep Draft stacked on #1164. Do not Close #1099 or #1164. | +| AppGuardrail #1166, branch `feat/claude-plugin-decompression-bomb-1099`, exact head `90cd031da4feb6538f0853883cd8dbbafd752c1d` | open/Draft successor stacked on #1165 (`5790559...`). RED `f19c037` → GREEN `90cd031`. Plugin suites 268 passed; detector statement coverage 2201/2201. | zip/tar members whose uncompressed/compressed ratio exceeds 100, or nested archives deeper than 1, fail as `claude-plugin-decompression-bomb` without extracting the payload. Zip-slip stays #1135. Oversized byte/file caps stay oversized-package. | keep Draft stacked on #1165. Do not Close #1099 or #1165. Do not extract bomb members. | +| AppGuardrail #1165, branch `feat/claude-plugin-insecure-file-mode-1099`, exact head `57905590731b5fb5cb7bf8b5e9bed43241bd5605` | open/Draft successor stacked on #1164 (`9ef3193...`). RED `6b2a476` → GREEN `5790559`. Plugin suites 251 passed; detector statement coverage 2035/2035 on Python 3.13. Decompression-bomb successor is #1166. | setuid/setgid executable and hook files fail as `claude-plugin-setuid-executable`. World-writable executable and hook files fail as `claude-plugin-world-writable-executable`. Declared `0755` hooks, LICENSE, Git metadata, `.mcp.json`, vendored copies, and symlink hooks are not this class. `chmod +x` of a download stays unsigned-download. | keep Draft stacked on #1164. Do not Close #1099 or #1164. | | AppGuardrail #1164, branch `feat/claude-plugin-hide-actions-1099`, exact head `9ef3193fb6e05dcdc2000772a53cf2dbbd97dab8` | open/Draft successor stacked on #1163 (`cd5560e...`). RED `f1d9ce7` → GREEN `9ef3193`. Plugin suites 239 passed; detector statement coverage 1988/1988. File-mode successor is #1165. | SKILL/command/agent markdown that hides tool use, rewrites policy, or expands goals fail as `claude-plugin-hide-actions-directive`, `claude-plugin-self-modify-directive`, and `claude-plugin-goal-escalation-directive`. Honest “report each tool call” is not this class. #1163 exfil stays the released #1036 identity. | keep Draft stacked on #1163. Do not Close #1099, #1163, or #1036. Do not copy #1036 YAML regexes. | | AppGuardrail #1163, branch `feat/claude-plugin-command-skill-reuse-1099`, exact head `cd5560ead4e0f01de0a7e0c97e43bc8f8280fc39` | open/Draft successor stacked on #1161 (`a92e936...`). RED `3505579` → GREEN `cd5560e`. Plugin suites 229 passed; detector statement coverage 1934/1934 on Python 3.13. Hide-actions successor is #1164. | `commands/*.md` and named `agents/*.md` reuse released #1036 injection/exfil identities. `SKILL.md`/`agent.md` stay #1139. Homoglyph/placeholder stay skill-identifier rules. README and root `AGENTS.md` stay guidance. | keep Draft stacked on #1161. Do not Close #1099, #1036, #1161, or #1139. | | AppGuardrail #1161, branch `feat/claude-plugin-secret-to-mcp-1099`, exact head `a92e936fac322d600c6bf7c7a1aa91be25eb3975` | open/Draft successor stacked on #1158 (`8c9f2d6...`). RED `a3a80f3` → GREEN `a92e936`. Plugin suites 220 passed; detector statement coverage 1929/1929 on Python 3.13. Command-markdown successor is #1163. | named secrets in MCP `env`/`args`/`command` fail as `claude-plugin-secret-to-mcp`. Curl stays #1137. Prompt/log stays #1158. Bounded MCP without secrets is not this class. | keep Draft stacked on #1158. Do not Close #1099, #1158, or #1137. | @@ -149,7 +150,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 20:04 UTC records Draft #1165 `5790559` on #1164 `9ef3193` on #1163 `cd5560e` … on #998 `8b95c2b`; #1068 live head `2379b37` is another empty Strix-retrigger descendant; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 20:26 UTC records Draft #1166 `90cd031` on #1165 `5790559` on #1164 `9ef3193` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -218,6 +219,7 @@ re-fetch docs/issues/PRs/current heads 42. Keep #1163 Draft stacked on #1161 at `cd5560e`. Command and named-agent markdown reuse #1036 injection/exfil identities. Do not Close #1099, #1036, #1161, or #1139. 43. Keep #1164 Draft stacked on #1163 at `9ef3193`. Hide-actions, self-modify, and goal-escalation wording fail closed. Do not Close #1099, #1163, or #1036. Do not copy #1036 YAML regexes. 44. Keep #1165 Draft stacked on #1164 at `5790559`. Setuid/setgid and world-writable executable/hook modes fail closed. Do not Close #1099 or #1164. +45. Keep #1166 Draft stacked on #1165 at `90cd031`. Archive ratio >100 or nesting depth >1 fail closed without extracting the payload. Do not Close #1099 or #1165. Zip-slip stays #1135. ## Standards and acceptance basis From 273d3495747e02c4b0c87c6b15846c111e00b89e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 06:03:35 +0900 Subject: [PATCH 095/192] docs: record #1166 aggregate archive-budget GREEN Summary: - Snapshot 21:03 UTC records Draft #1166 `0ef0f7d` stacked on #1165. - Aggregate in-root uncompressed bytes fail closed before extract. - Ratio/depth bombs and zip-slip stay their existing classes. Rationale: - #999 is the single writer of the product-technical gap baseline. - RED `e1b3f39` on the canonical writer is not Close; it is GREEN. Tests: - documentation-only; detector evidence lives on #1166 (2238/2238) --- docs/product-technical-gap-baseline.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2b307851..cf77d030 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 20:26 UTC +**Snapshot:** 2026-09-07 21:03 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 20:26 UTC snapshot +## Security-defect corpus — live 2026-09-07 21:03 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1166, branch `feat/claude-plugin-decompression-bomb-1099`, exact head `90cd031da4feb6538f0853883cd8dbbafd752c1d` | open/Draft successor stacked on #1165 (`5790559...`). RED `f19c037` → GREEN `90cd031`. Plugin suites 268 passed; detector statement coverage 2201/2201. | zip/tar members whose uncompressed/compressed ratio exceeds 100, or nested archives deeper than 1, fail as `claude-plugin-decompression-bomb` without extracting the payload. Zip-slip stays #1135. Oversized byte/file caps stay oversized-package. | keep Draft stacked on #1165. Do not Close #1099 or #1165. Do not extract bomb members. | +| AppGuardrail #1166, branch `feat/claude-plugin-decompression-bomb-1099`, exact head `0ef0f7d7f3c63faa822a8cff5a20e76514285da2` | open/Draft successor stacked on #1165 (`5790559...`). Ratio/depth GREEN `90cd031`; aggregate-budget RED `e1b3f39` → GREEN `0ef0f7d`. Plugin suites 275 passed; detector statement coverage 2238/2238 on Python 3.13. | zip/tar members whose uncompressed/compressed ratio exceeds 100, nested archives deeper than 1, or regular in-root members summing above `_MAX_PACKAGE_BYTES` fail as `claude-plugin-decompression-bomb` without extracting. Zip-slip stays #1135. Oversized tree caps stay oversized-package. | keep Draft stacked on #1165. Do not Close #1099 or #1165. Do not extract bomb members. | | AppGuardrail #1165, branch `feat/claude-plugin-insecure-file-mode-1099`, exact head `57905590731b5fb5cb7bf8b5e9bed43241bd5605` | open/Draft successor stacked on #1164 (`9ef3193...`). RED `6b2a476` → GREEN `5790559`. Plugin suites 251 passed; detector statement coverage 2035/2035 on Python 3.13. Decompression-bomb successor is #1166. | setuid/setgid executable and hook files fail as `claude-plugin-setuid-executable`. World-writable executable and hook files fail as `claude-plugin-world-writable-executable`. Declared `0755` hooks, LICENSE, Git metadata, `.mcp.json`, vendored copies, and symlink hooks are not this class. `chmod +x` of a download stays unsigned-download. | keep Draft stacked on #1164. Do not Close #1099 or #1164. | | AppGuardrail #1164, branch `feat/claude-plugin-hide-actions-1099`, exact head `9ef3193fb6e05dcdc2000772a53cf2dbbd97dab8` | open/Draft successor stacked on #1163 (`cd5560e...`). RED `f1d9ce7` → GREEN `9ef3193`. Plugin suites 239 passed; detector statement coverage 1988/1988. File-mode successor is #1165. | SKILL/command/agent markdown that hides tool use, rewrites policy, or expands goals fail as `claude-plugin-hide-actions-directive`, `claude-plugin-self-modify-directive`, and `claude-plugin-goal-escalation-directive`. Honest “report each tool call” is not this class. #1163 exfil stays the released #1036 identity. | keep Draft stacked on #1163. Do not Close #1099, #1163, or #1036. Do not copy #1036 YAML regexes. | | AppGuardrail #1163, branch `feat/claude-plugin-command-skill-reuse-1099`, exact head `cd5560ead4e0f01de0a7e0c97e43bc8f8280fc39` | open/Draft successor stacked on #1161 (`a92e936...`). RED `3505579` → GREEN `cd5560e`. Plugin suites 229 passed; detector statement coverage 1934/1934 on Python 3.13. Hide-actions successor is #1164. | `commands/*.md` and named `agents/*.md` reuse released #1036 injection/exfil identities. `SKILL.md`/`agent.md` stay #1139. Homoglyph/placeholder stay skill-identifier rules. README and root `AGENTS.md` stay guidance. | keep Draft stacked on #1161. Do not Close #1099, #1036, #1161, or #1139. | @@ -150,7 +150,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 20:26 UTC records Draft #1166 `90cd031` on #1165 `5790559` on #1164 `9ef3193` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 21:03 UTC records Draft #1166 `0ef0f7d` on #1165 `5790559` on #1164 `9ef3193` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -219,7 +219,7 @@ re-fetch docs/issues/PRs/current heads 42. Keep #1163 Draft stacked on #1161 at `cd5560e`. Command and named-agent markdown reuse #1036 injection/exfil identities. Do not Close #1099, #1036, #1161, or #1139. 43. Keep #1164 Draft stacked on #1163 at `9ef3193`. Hide-actions, self-modify, and goal-escalation wording fail closed. Do not Close #1099, #1163, or #1036. Do not copy #1036 YAML regexes. 44. Keep #1165 Draft stacked on #1164 at `5790559`. Setuid/setgid and world-writable executable/hook modes fail closed. Do not Close #1099 or #1164. -45. Keep #1166 Draft stacked on #1165 at `90cd031`. Archive ratio >100 or nesting depth >1 fail closed without extracting the payload. Do not Close #1099 or #1165. Zip-slip stays #1135. +45. Keep #1166 Draft stacked on #1165 at `0ef0f7d`. Archive ratio >100, nesting depth >1, or aggregate in-root uncompressed bytes above the package budget fail closed without extracting. Do not Close #1099 or #1165. Zip-slip stays #1135. ## Standards and acceptance basis From fe0e9135fe524b5adda11bef55177a2c76bf1d13 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 06:17:50 +0900 Subject: [PATCH 096/192] docs: record #1167 policy-provenance successor Summary: - Snapshot 21:14 UTC records Draft #1167 `18bb1a0` stacked on #1166. - Receipt policy_provenance binds scanner release version and policy digest. - Verify fails closed when those disagree with the running scanner. Rationale: - #999 is the single writer of the product-technical gap baseline. - Noema/macos_utility_packs canaries are not this lane. Tests: - documentation-only; detector evidence lives on #1167 (2272/2272) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cf77d030..ff314e6a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 21:03 UTC +**Snapshot:** 2026-09-07 21:14 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 21:03 UTC snapshot +## Security-defect corpus — live 2026-09-07 21:14 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1166, branch `feat/claude-plugin-decompression-bomb-1099`, exact head `0ef0f7d7f3c63faa822a8cff5a20e76514285da2` | open/Draft successor stacked on #1165 (`5790559...`). Ratio/depth GREEN `90cd031`; aggregate-budget RED `e1b3f39` → GREEN `0ef0f7d`. Plugin suites 275 passed; detector statement coverage 2238/2238 on Python 3.13. | zip/tar members whose uncompressed/compressed ratio exceeds 100, nested archives deeper than 1, or regular in-root members summing above `_MAX_PACKAGE_BYTES` fail as `claude-plugin-decompression-bomb` without extracting. Zip-slip stays #1135. Oversized tree caps stay oversized-package. | keep Draft stacked on #1165. Do not Close #1099 or #1165. Do not extract bomb members. | +| AppGuardrail #1167, branch `feat/claude-plugin-policy-provenance-1099`, exact head `18bb1a0a87f912989ea3f3328cc7692fda1a9c0c` | open/Draft successor stacked on #1166 (`0ef0f7d...`). RED `bba5b6a` → GREEN `18bb1a0`. Plugin suites 287 passed; detector statement coverage 2272/2272. | receipt `policy_provenance` binds `scanner_release_version` (`_SCANNER_VERSION`) and `scanner_policy_sha256` to this scan. Verify fails closed when version or provenance disagrees with the running scanner. Pass is not Noema admission. | keep Draft stacked on #1166. Do not Close #1099 or #1166. Do not duplicate the policy digest under a second field name. | +| AppGuardrail #1166, branch `feat/claude-plugin-decompression-bomb-1099`, exact head `0ef0f7d7f3c63faa822a8cff5a20e76514285da2` | open/Draft successor stacked on #1165 (`5790559...`). Ratio/depth GREEN `90cd031`; aggregate-budget RED `e1b3f39` → GREEN `0ef0f7d`. Plugin suites 275 passed; detector statement coverage 2238/2238 on Python 3.13. Policy-provenance successor is #1167. | zip/tar members whose uncompressed/compressed ratio exceeds 100, nested archives deeper than 1, or regular in-root members summing above `_MAX_PACKAGE_BYTES` fail as `claude-plugin-decompression-bomb` without extracting. Zip-slip stays #1135. Oversized tree caps stay oversized-package. | keep Draft stacked on #1165. Do not Close #1099 or #1165. Do not extract bomb members. | | AppGuardrail #1165, branch `feat/claude-plugin-insecure-file-mode-1099`, exact head `57905590731b5fb5cb7bf8b5e9bed43241bd5605` | open/Draft successor stacked on #1164 (`9ef3193...`). RED `6b2a476` → GREEN `5790559`. Plugin suites 251 passed; detector statement coverage 2035/2035 on Python 3.13. Decompression-bomb successor is #1166. | setuid/setgid executable and hook files fail as `claude-plugin-setuid-executable`. World-writable executable and hook files fail as `claude-plugin-world-writable-executable`. Declared `0755` hooks, LICENSE, Git metadata, `.mcp.json`, vendored copies, and symlink hooks are not this class. `chmod +x` of a download stays unsigned-download. | keep Draft stacked on #1164. Do not Close #1099 or #1164. | | AppGuardrail #1164, branch `feat/claude-plugin-hide-actions-1099`, exact head `9ef3193fb6e05dcdc2000772a53cf2dbbd97dab8` | open/Draft successor stacked on #1163 (`cd5560e...`). RED `f1d9ce7` → GREEN `9ef3193`. Plugin suites 239 passed; detector statement coverage 1988/1988. File-mode successor is #1165. | SKILL/command/agent markdown that hides tool use, rewrites policy, or expands goals fail as `claude-plugin-hide-actions-directive`, `claude-plugin-self-modify-directive`, and `claude-plugin-goal-escalation-directive`. Honest “report each tool call” is not this class. #1163 exfil stays the released #1036 identity. | keep Draft stacked on #1163. Do not Close #1099, #1163, or #1036. Do not copy #1036 YAML regexes. | | AppGuardrail #1163, branch `feat/claude-plugin-command-skill-reuse-1099`, exact head `cd5560ead4e0f01de0a7e0c97e43bc8f8280fc39` | open/Draft successor stacked on #1161 (`a92e936...`). RED `3505579` → GREEN `cd5560e`. Plugin suites 229 passed; detector statement coverage 1934/1934 on Python 3.13. Hide-actions successor is #1164. | `commands/*.md` and named `agents/*.md` reuse released #1036 injection/exfil identities. `SKILL.md`/`agent.md` stay #1139. Homoglyph/placeholder stay skill-identifier rules. README and root `AGENTS.md` stay guidance. | keep Draft stacked on #1161. Do not Close #1099, #1036, #1161, or #1139. | @@ -150,7 +151,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 21:03 UTC records Draft #1166 `0ef0f7d` on #1165 `5790559` on #1164 `9ef3193` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 21:14 UTC records Draft #1167 `18bb1a0` on #1166 `0ef0f7d` on #1165 `5790559` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -220,6 +221,7 @@ re-fetch docs/issues/PRs/current heads 43. Keep #1164 Draft stacked on #1163 at `9ef3193`. Hide-actions, self-modify, and goal-escalation wording fail closed. Do not Close #1099, #1163, or #1036. Do not copy #1036 YAML regexes. 44. Keep #1165 Draft stacked on #1164 at `5790559`. Setuid/setgid and world-writable executable/hook modes fail closed. Do not Close #1099 or #1164. 45. Keep #1166 Draft stacked on #1165 at `0ef0f7d`. Archive ratio >100, nesting depth >1, or aggregate in-root uncompressed bytes above the package budget fail closed without extracting. Do not Close #1099 or #1165. Zip-slip stays #1135. +46. Keep #1167 Draft stacked on #1166 at `18bb1a0`. Receipt policy provenance must match the running scanner version and policy digest. Do not Close #1099 or #1166. Pass is not Noema admission. ## Standards and acceptance basis From feaa23a7116bdb81aaec5657423caf44735c7200 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 07:03:25 +0900 Subject: [PATCH 097/192] docs: record #1168 CycloneDX SBOM receipt successor Summary: - Snapshot 22:05 UTC records Draft #1168 `4b9bcc6` stacked on #1167. - Receipt sbom_sha256 is a CycloneDX digest, not a second policy hash. - Malformed manifests stay empty-component SBOMs. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1168 (2301/2301) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ff314e6a..dfb17a97 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 21:14 UTC +**Snapshot:** 2026-09-07 22:05 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 21:14 UTC snapshot +## Security-defect corpus — live 2026-09-07 22:05 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1167, branch `feat/claude-plugin-policy-provenance-1099`, exact head `18bb1a0a87f912989ea3f3328cc7692fda1a9c0c` | open/Draft successor stacked on #1166 (`0ef0f7d...`). RED `bba5b6a` → GREEN `18bb1a0`. Plugin suites 287 passed; detector statement coverage 2272/2272. | receipt `policy_provenance` binds `scanner_release_version` (`_SCANNER_VERSION`) and `scanner_policy_sha256` to this scan. Verify fails closed when version or provenance disagrees with the running scanner. Pass is not Noema admission. | keep Draft stacked on #1166. Do not Close #1099 or #1166. Do not duplicate the policy digest under a second field name. | +| AppGuardrail #1168, branch `feat/claude-plugin-sbom-receipt-1099`, exact head `4b9bcc6eac49c4edb117f28ffa03c9e25c58a320` | open/Draft successor stacked on #1167 (`18bb1a0...`). RED `1461fb5` → GREEN `4b9bcc6`. Coverage suite 287 passed; detector statement coverage 2301/2301 on Python 3.13. | receipt `sbom_sha256` is SHA-256 of a deterministic CycloneDX 1.5 document from existing SBOM parsers. Verify fails closed on a swapped digest. This is not a second policy hash. Malformed manifests yield an empty-component SBOM. | keep Draft stacked on #1167. Do not Close #1099 or #1167. | +| AppGuardrail #1167, branch `feat/claude-plugin-policy-provenance-1099`, exact head `18bb1a0a87f912989ea3f3328cc7692fda1a9c0c` | open/Draft successor stacked on #1166 (`0ef0f7d...`). RED `bba5b6a` → GREEN `18bb1a0`. Plugin suites 287 passed; detector statement coverage 2272/2272. SBOM-receipt successor is #1168. | receipt `policy_provenance` binds `scanner_release_version` (`_SCANNER_VERSION`) and `scanner_policy_sha256` to this scan. Verify fails closed when version or provenance disagrees with the running scanner. Pass is not Noema admission. | keep Draft stacked on #1166. Do not Close #1099 or #1166. Do not duplicate the policy digest under a second field name. | | AppGuardrail #1166, branch `feat/claude-plugin-decompression-bomb-1099`, exact head `0ef0f7d7f3c63faa822a8cff5a20e76514285da2` | open/Draft successor stacked on #1165 (`5790559...`). Ratio/depth GREEN `90cd031`; aggregate-budget RED `e1b3f39` → GREEN `0ef0f7d`. Plugin suites 275 passed; detector statement coverage 2238/2238 on Python 3.13. Policy-provenance successor is #1167. | zip/tar members whose uncompressed/compressed ratio exceeds 100, nested archives deeper than 1, or regular in-root members summing above `_MAX_PACKAGE_BYTES` fail as `claude-plugin-decompression-bomb` without extracting. Zip-slip stays #1135. Oversized tree caps stay oversized-package. | keep Draft stacked on #1165. Do not Close #1099 or #1165. Do not extract bomb members. | | AppGuardrail #1165, branch `feat/claude-plugin-insecure-file-mode-1099`, exact head `57905590731b5fb5cb7bf8b5e9bed43241bd5605` | open/Draft successor stacked on #1164 (`9ef3193...`). RED `6b2a476` → GREEN `5790559`. Plugin suites 251 passed; detector statement coverage 2035/2035 on Python 3.13. Decompression-bomb successor is #1166. | setuid/setgid executable and hook files fail as `claude-plugin-setuid-executable`. World-writable executable and hook files fail as `claude-plugin-world-writable-executable`. Declared `0755` hooks, LICENSE, Git metadata, `.mcp.json`, vendored copies, and symlink hooks are not this class. `chmod +x` of a download stays unsigned-download. | keep Draft stacked on #1164. Do not Close #1099 or #1164. | | AppGuardrail #1164, branch `feat/claude-plugin-hide-actions-1099`, exact head `9ef3193fb6e05dcdc2000772a53cf2dbbd97dab8` | open/Draft successor stacked on #1163 (`cd5560e...`). RED `f1d9ce7` → GREEN `9ef3193`. Plugin suites 239 passed; detector statement coverage 1988/1988. File-mode successor is #1165. | SKILL/command/agent markdown that hides tool use, rewrites policy, or expands goals fail as `claude-plugin-hide-actions-directive`, `claude-plugin-self-modify-directive`, and `claude-plugin-goal-escalation-directive`. Honest “report each tool call” is not this class. #1163 exfil stays the released #1036 identity. | keep Draft stacked on #1163. Do not Close #1099, #1163, or #1036. Do not copy #1036 YAML regexes. | @@ -151,7 +152,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 21:14 UTC records Draft #1167 `18bb1a0` on #1166 `0ef0f7d` on #1165 `5790559` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 22:05 UTC records Draft #1168 `4b9bcc6` on #1167 `18bb1a0` on #1166 `0ef0f7d` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -222,6 +223,7 @@ re-fetch docs/issues/PRs/current heads 44. Keep #1165 Draft stacked on #1164 at `5790559`. Setuid/setgid and world-writable executable/hook modes fail closed. Do not Close #1099 or #1164. 45. Keep #1166 Draft stacked on #1165 at `0ef0f7d`. Archive ratio >100, nesting depth >1, or aggregate in-root uncompressed bytes above the package budget fail closed without extracting. Do not Close #1099 or #1165. Zip-slip stays #1135. 46. Keep #1167 Draft stacked on #1166 at `18bb1a0`. Receipt policy provenance must match the running scanner version and policy digest. Do not Close #1099 or #1166. Pass is not Noema admission. +47. Keep #1168 Draft stacked on #1167 at `4b9bcc6`. Receipt `sbom_sha256` is a CycloneDX digest, not a second policy hash. Do not Close #1099 or #1167. ## Standards and acceptance basis From 34e5d7ebc841a5962401dcb7e7b862233f9898b1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 07:18:36 +0900 Subject: [PATCH 098/192] docs: record #1169 checksum-mismatch successor Summary: - Snapshot 22:18 UTC records Draft #1169 `226ca73` stacked on #1168. - First-party SHA256SUMS that disagree with disk bytes fail closed. - Matching checksums and a missing checksum file are not this class. Rationale: - #999 is the single writer of the product-technical gap baseline. - Cosign/GPG network is not required for this slice. Tests: - documentation-only; detector evidence lives on #1169 (2424/2424) --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index dfb17a97..b264f471 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 22:05 UTC +**Snapshot:** 2026-09-07 22:18 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 22:05 UTC snapshot +## Security-defect corpus — live 2026-09-07 22:18 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1168, branch `feat/claude-plugin-sbom-receipt-1099`, exact head `4b9bcc6eac49c4edb117f28ffa03c9e25c58a320` | open/Draft successor stacked on #1167 (`18bb1a0...`). RED `1461fb5` → GREEN `4b9bcc6`. Coverage suite 287 passed; detector statement coverage 2301/2301 on Python 3.13. | receipt `sbom_sha256` is SHA-256 of a deterministic CycloneDX 1.5 document from existing SBOM parsers. Verify fails closed on a swapped digest. This is not a second policy hash. Malformed manifests yield an empty-component SBOM. | keep Draft stacked on #1167. Do not Close #1099 or #1167. | +| AppGuardrail #1169, branch `feat/claude-plugin-checksum-mismatch-1099`, exact head `226ca7356e5ed32c3ac85bba9cc38868e7fda8ae` | open/Draft successor stacked on #1168 (`4b9bcc6...`). RED `c23c4cb` → GREEN `226ca73`. Focused checksum tests 27 passed; detector statement coverage 2424/2424. | first-party `SHA256SUMS` / `*.sha256` files that disagree with bytes on disk fail as `claude-plugin-checksum-mismatch`. Matching checksums, `#` comments, and a missing checksum file are not this class. Cosign/GPG network is not required. | keep Draft stacked on #1168. Do not Close #1099 or #1168. Do not steal `sbom_sha256`. | +| AppGuardrail #1168, branch `feat/claude-plugin-sbom-receipt-1099`, exact head `4b9bcc6eac49c4edb117f28ffa03c9e25c58a320` | open/Draft successor stacked on #1167 (`18bb1a0...`). RED `1461fb5` → GREEN `4b9bcc6`. Coverage suite 287 passed; detector statement coverage 2301/2301 on Python 3.13. Checksum-mismatch successor is #1169. | receipt `sbom_sha256` is SHA-256 of a deterministic CycloneDX 1.5 document from existing SBOM parsers. Verify fails closed on a swapped digest. This is not a second policy hash. Malformed manifests yield an empty-component SBOM. | keep Draft stacked on #1167. Do not Close #1099 or #1167. | | AppGuardrail #1167, branch `feat/claude-plugin-policy-provenance-1099`, exact head `18bb1a0a87f912989ea3f3328cc7692fda1a9c0c` | open/Draft successor stacked on #1166 (`0ef0f7d...`). RED `bba5b6a` → GREEN `18bb1a0`. Plugin suites 287 passed; detector statement coverage 2272/2272. SBOM-receipt successor is #1168. | receipt `policy_provenance` binds `scanner_release_version` (`_SCANNER_VERSION`) and `scanner_policy_sha256` to this scan. Verify fails closed when version or provenance disagrees with the running scanner. Pass is not Noema admission. | keep Draft stacked on #1166. Do not Close #1099 or #1166. Do not duplicate the policy digest under a second field name. | | AppGuardrail #1166, branch `feat/claude-plugin-decompression-bomb-1099`, exact head `0ef0f7d7f3c63faa822a8cff5a20e76514285da2` | open/Draft successor stacked on #1165 (`5790559...`). Ratio/depth GREEN `90cd031`; aggregate-budget RED `e1b3f39` → GREEN `0ef0f7d`. Plugin suites 275 passed; detector statement coverage 2238/2238 on Python 3.13. Policy-provenance successor is #1167. | zip/tar members whose uncompressed/compressed ratio exceeds 100, nested archives deeper than 1, or regular in-root members summing above `_MAX_PACKAGE_BYTES` fail as `claude-plugin-decompression-bomb` without extracting. Zip-slip stays #1135. Oversized tree caps stay oversized-package. | keep Draft stacked on #1165. Do not Close #1099 or #1165. Do not extract bomb members. | | AppGuardrail #1165, branch `feat/claude-plugin-insecure-file-mode-1099`, exact head `57905590731b5fb5cb7bf8b5e9bed43241bd5605` | open/Draft successor stacked on #1164 (`9ef3193...`). RED `6b2a476` → GREEN `5790559`. Plugin suites 251 passed; detector statement coverage 2035/2035 on Python 3.13. Decompression-bomb successor is #1166. | setuid/setgid executable and hook files fail as `claude-plugin-setuid-executable`. World-writable executable and hook files fail as `claude-plugin-world-writable-executable`. Declared `0755` hooks, LICENSE, Git metadata, `.mcp.json`, vendored copies, and symlink hooks are not this class. `chmod +x` of a download stays unsigned-download. | keep Draft stacked on #1164. Do not Close #1099 or #1164. | @@ -152,7 +153,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 22:05 UTC records Draft #1168 `4b9bcc6` on #1167 `18bb1a0` on #1166 `0ef0f7d` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 22:18 UTC records Draft #1169 `226ca73` on #1168 `4b9bcc6` on #1167 `18bb1a0` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -224,6 +225,7 @@ re-fetch docs/issues/PRs/current heads 45. Keep #1166 Draft stacked on #1165 at `0ef0f7d`. Archive ratio >100, nesting depth >1, or aggregate in-root uncompressed bytes above the package budget fail closed without extracting. Do not Close #1099 or #1165. Zip-slip stays #1135. 46. Keep #1167 Draft stacked on #1166 at `18bb1a0`. Receipt policy provenance must match the running scanner version and policy digest. Do not Close #1099 or #1166. Pass is not Noema admission. 47. Keep #1168 Draft stacked on #1167 at `4b9bcc6`. Receipt `sbom_sha256` is a CycloneDX digest, not a second policy hash. Do not Close #1099 or #1167. +48. Keep #1169 Draft stacked on #1168 at `226ca73`. First-party checksum files that disagree with disk bytes fail closed. Do not Close #1099 or #1168. Cosign/GPG network is not required. ## Standards and acceptance basis From 687ebee91bccc713eca55b7303c01c919ff58ea8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 08:12:35 +0900 Subject: [PATCH 099/192] docs: record #1170 GitHub merge/release successor Live snapshot 2026-09-07 23:11 UTC. Draft #1170 b506b82 stacked on #1169 226ca73. Do not Close #1099 or #1169. --- docs/product-technical-gap-baseline.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b264f471..f4a7570c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 22:18 UTC +**Snapshot:** 2026-09-07 23:11 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 22:18 UTC snapshot +## Security-defect corpus — live 2026-09-07 23:11 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1169, branch `feat/claude-plugin-checksum-mismatch-1099`, exact head `226ca7356e5ed32c3ac85bba9cc38868e7fda8ae` | open/Draft successor stacked on #1168 (`4b9bcc6...`). RED `c23c4cb` → GREEN `226ca73`. Focused checksum tests 27 passed; detector statement coverage 2424/2424. | first-party `SHA256SUMS` / `*.sha256` files that disagree with bytes on disk fail as `claude-plugin-checksum-mismatch`. Matching checksums, `#` comments, and a missing checksum file are not this class. Cosign/GPG network is not required. | keep Draft stacked on #1168. Do not Close #1099 or #1168. Do not steal `sbom_sha256`. | +| AppGuardrail #1170, branch `feat/claude-plugin-github-merge-release-1099`, exact head `b506b824987326bd82f5fb5f8d037194a21163b6` | open/Draft successor stacked on #1169 (`226ca73...`). RED `527edb5` → GREEN `b506b82`. Focused merge/release tests 16 passed plus inventory lock; detector statement coverage 2455/2455 on Python 3.13. | hook or manifest `gh pr merge` fails as `claude-plugin-github-merge-command`. `gh release` create, upload, delete, or edit fails as `claude-plugin-github-release-command`. `gh issue create`, `gh pr review`, `gh release list`, `kubectl apply`, and `docker push` stay inventory. Hardcoded PATs stay `claude-plugin-github-write-token`. Snippets are command labels. | keep Draft stacked on #1169. Do not Close #1099 or #1169. Do not steal checksum-mismatch or github-write-token. | +| AppGuardrail #1169, branch `feat/claude-plugin-checksum-mismatch-1099`, exact head `226ca7356e5ed32c3ac85bba9cc38868e7fda8ae` | open/Draft successor stacked on #1168 (`4b9bcc6...`). RED `c23c4cb` → GREEN `226ca73`. Focused checksum tests 27 passed; detector statement coverage 2424/2424. Merge/release successor is #1170. | first-party `SHA256SUMS` / `*.sha256` files that disagree with bytes on disk fail as `claude-plugin-checksum-mismatch`. Matching checksums, `#` comments, and a missing checksum file are not this class. Cosign/GPG network is not required. | keep Draft stacked on #1168. Do not Close #1099 or #1168. Do not steal `sbom_sha256`. | | AppGuardrail #1168, branch `feat/claude-plugin-sbom-receipt-1099`, exact head `4b9bcc6eac49c4edb117f28ffa03c9e25c58a320` | open/Draft successor stacked on #1167 (`18bb1a0...`). RED `1461fb5` → GREEN `4b9bcc6`. Coverage suite 287 passed; detector statement coverage 2301/2301 on Python 3.13. Checksum-mismatch successor is #1169. | receipt `sbom_sha256` is SHA-256 of a deterministic CycloneDX 1.5 document from existing SBOM parsers. Verify fails closed on a swapped digest. This is not a second policy hash. Malformed manifests yield an empty-component SBOM. | keep Draft stacked on #1167. Do not Close #1099 or #1167. | | AppGuardrail #1167, branch `feat/claude-plugin-policy-provenance-1099`, exact head `18bb1a0a87f912989ea3f3328cc7692fda1a9c0c` | open/Draft successor stacked on #1166 (`0ef0f7d...`). RED `bba5b6a` → GREEN `18bb1a0`. Plugin suites 287 passed; detector statement coverage 2272/2272. SBOM-receipt successor is #1168. | receipt `policy_provenance` binds `scanner_release_version` (`_SCANNER_VERSION`) and `scanner_policy_sha256` to this scan. Verify fails closed when version or provenance disagrees with the running scanner. Pass is not Noema admission. | keep Draft stacked on #1166. Do not Close #1099 or #1166. Do not duplicate the policy digest under a second field name. | | AppGuardrail #1166, branch `feat/claude-plugin-decompression-bomb-1099`, exact head `0ef0f7d7f3c63faa822a8cff5a20e76514285da2` | open/Draft successor stacked on #1165 (`5790559...`). Ratio/depth GREEN `90cd031`; aggregate-budget RED `e1b3f39` → GREEN `0ef0f7d`. Plugin suites 275 passed; detector statement coverage 2238/2238 on Python 3.13. Policy-provenance successor is #1167. | zip/tar members whose uncompressed/compressed ratio exceeds 100, nested archives deeper than 1, or regular in-root members summing above `_MAX_PACKAGE_BYTES` fail as `claude-plugin-decompression-bomb` without extracting. Zip-slip stays #1135. Oversized tree caps stay oversized-package. | keep Draft stacked on #1165. Do not Close #1099 or #1165. Do not extract bomb members. | @@ -153,7 +154,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 22:18 UTC records Draft #1169 `226ca73` on #1168 `4b9bcc6` on #1167 `18bb1a0` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 23:11 UTC records Draft #1170 `b506b82` on #1169 `226ca73` on #1168 `4b9bcc6` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -226,6 +227,7 @@ re-fetch docs/issues/PRs/current heads 46. Keep #1167 Draft stacked on #1166 at `18bb1a0`. Receipt policy provenance must match the running scanner version and policy digest. Do not Close #1099 or #1166. Pass is not Noema admission. 47. Keep #1168 Draft stacked on #1167 at `4b9bcc6`. Receipt `sbom_sha256` is a CycloneDX digest, not a second policy hash. Do not Close #1099 or #1167. 48. Keep #1169 Draft stacked on #1168 at `226ca73`. First-party checksum files that disagree with disk bytes fail closed. Do not Close #1099 or #1168. Cosign/GPG network is not required. +49. Keep #1170 Draft stacked on #1169 at `b506b82`. Hook/manifest `gh pr merge` and `gh release` write verbs fail closed. Issue create, PR review, release list, kubectl apply, and docker push stay inventory. Do not Close #1099 or #1169. Remaining unique leftover after this slice: cookie/token stores beyond browser-profile, deep directory recursion, Cosign/GPG when a checksum file exists, and deployment-write fail-closed. ## Standards and acceptance basis From c1f80b8b6b4d9d419c3722a3636bb86cc457ce60 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 08:30:15 +0900 Subject: [PATCH 100/192] docs: record #1171 credential-store successor Summary: - Snapshot 2026-09-07 23:23 UTC records Draft #1171 `9370a0d` stacked on #1170. - Host cookie/token stores beyond browser profiles fail closed. - Remaining leftover: deep directory recursion, Cosign/GPG, deployment-write. Rationale: - #999 is the single writer of the product-technical gap baseline. - Do not Close #1099, #1170, #1150, or #1137. Tests: - documentation-only; detector evidence lives on #1171 (2505/2505) --- docs/product-technical-gap-baseline.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f4a7570c..dac15ef5 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 23:11 UTC +**Snapshot:** 2026-09-07 23:23 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 23:11 UTC snapshot +## Security-defect corpus — live 2026-09-07 23:23 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1170, branch `feat/claude-plugin-github-merge-release-1099`, exact head `b506b824987326bd82f5fb5f8d037194a21163b6` | open/Draft successor stacked on #1169 (`226ca73...`). RED `527edb5` → GREEN `b506b82`. Focused merge/release tests 16 passed plus inventory lock; detector statement coverage 2455/2455 on Python 3.13. | hook or manifest `gh pr merge` fails as `claude-plugin-github-merge-command`. `gh release` create, upload, delete, or edit fails as `claude-plugin-github-release-command`. `gh issue create`, `gh pr review`, `gh release list`, `kubectl apply`, and `docker push` stay inventory. Hardcoded PATs stay `claude-plugin-github-write-token`. Snippets are command labels. | keep Draft stacked on #1169. Do not Close #1099 or #1169. Do not steal checksum-mismatch or github-write-token. | +| AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | +| AppGuardrail #1170, branch `feat/claude-plugin-github-merge-release-1099`, exact head `b506b824987326bd82f5fb5f8d037194a21163b6` | open/Draft successor stacked on #1169 (`226ca73...`). RED `527edb5` → GREEN `b506b82`. Focused merge/release tests 16 passed plus inventory lock; detector statement coverage 2455/2455 on Python 3.13. Credential-store successor is #1171. | hook or manifest `gh pr merge` fails as `claude-plugin-github-merge-command`. `gh release` create, upload, delete, or edit fails as `claude-plugin-github-release-command`. `gh issue create`, `gh pr review`, `gh release list`, `kubectl apply`, and `docker push` stay inventory. Hardcoded PATs stay `claude-plugin-github-write-token`. Snippets are command labels. | keep Draft stacked on #1169. Do not Close #1099 or #1169. Do not steal checksum-mismatch or github-write-token. | | AppGuardrail #1169, branch `feat/claude-plugin-checksum-mismatch-1099`, exact head `226ca7356e5ed32c3ac85bba9cc38868e7fda8ae` | open/Draft successor stacked on #1168 (`4b9bcc6...`). RED `c23c4cb` → GREEN `226ca73`. Focused checksum tests 27 passed; detector statement coverage 2424/2424. Merge/release successor is #1170. | first-party `SHA256SUMS` / `*.sha256` files that disagree with bytes on disk fail as `claude-plugin-checksum-mismatch`. Matching checksums, `#` comments, and a missing checksum file are not this class. Cosign/GPG network is not required. | keep Draft stacked on #1168. Do not Close #1099 or #1168. Do not steal `sbom_sha256`. | | AppGuardrail #1168, branch `feat/claude-plugin-sbom-receipt-1099`, exact head `4b9bcc6eac49c4edb117f28ffa03c9e25c58a320` | open/Draft successor stacked on #1167 (`18bb1a0...`). RED `1461fb5` → GREEN `4b9bcc6`. Coverage suite 287 passed; detector statement coverage 2301/2301 on Python 3.13. Checksum-mismatch successor is #1169. | receipt `sbom_sha256` is SHA-256 of a deterministic CycloneDX 1.5 document from existing SBOM parsers. Verify fails closed on a swapped digest. This is not a second policy hash. Malformed manifests yield an empty-component SBOM. | keep Draft stacked on #1167. Do not Close #1099 or #1167. | | AppGuardrail #1167, branch `feat/claude-plugin-policy-provenance-1099`, exact head `18bb1a0a87f912989ea3f3328cc7692fda1a9c0c` | open/Draft successor stacked on #1166 (`0ef0f7d...`). RED `bba5b6a` → GREEN `18bb1a0`. Plugin suites 287 passed; detector statement coverage 2272/2272. SBOM-receipt successor is #1168. | receipt `policy_provenance` binds `scanner_release_version` (`_SCANNER_VERSION`) and `scanner_policy_sha256` to this scan. Verify fails closed when version or provenance disagrees with the running scanner. Pass is not Noema admission. | keep Draft stacked on #1166. Do not Close #1099 or #1166. Do not duplicate the policy digest under a second field name. | @@ -154,7 +155,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 23:11 UTC records Draft #1170 `b506b82` on #1169 `226ca73` on #1168 `4b9bcc6` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 23:23 UTC records Draft #1171 `9370a0d` on #1170 `b506b82` on #1169 `226ca73` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -227,7 +228,8 @@ re-fetch docs/issues/PRs/current heads 46. Keep #1167 Draft stacked on #1166 at `18bb1a0`. Receipt policy provenance must match the running scanner version and policy digest. Do not Close #1099 or #1166. Pass is not Noema admission. 47. Keep #1168 Draft stacked on #1167 at `4b9bcc6`. Receipt `sbom_sha256` is a CycloneDX digest, not a second policy hash. Do not Close #1099 or #1167. 48. Keep #1169 Draft stacked on #1168 at `226ca73`. First-party checksum files that disagree with disk bytes fail closed. Do not Close #1099 or #1168. Cosign/GPG network is not required. -49. Keep #1170 Draft stacked on #1169 at `b506b82`. Hook/manifest `gh pr merge` and `gh release` write verbs fail closed. Issue create, PR review, release list, kubectl apply, and docker push stay inventory. Do not Close #1099 or #1169. Remaining unique leftover after this slice: cookie/token stores beyond browser-profile, deep directory recursion, Cosign/GPG when a checksum file exists, and deployment-write fail-closed. +49. Keep #1170 Draft stacked on #1169 at `b506b82`. Hook/manifest `gh pr merge` and `gh release` write verbs fail closed. Issue create, PR review, release list, kubectl apply, and docker push stay inventory. Do not Close #1099 or #1169. +50. Keep #1171 Draft stacked on #1170 at `9370a0d`. Host cookie/token stores beyond browser profiles fail closed. Do not Close #1099, #1170, #1150, or #1137. Remaining unique leftover: deep directory recursion, Cosign/GPG when a checksum file exists, and deployment-write fail-closed. ## Standards and acceptance basis From 03de394d1b64bfa2db1f96ceb9115f2a5c2fc710 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 08:38:18 +0900 Subject: [PATCH 101/192] docs: record #1172 deployment-write successor Summary: - Snapshot 2026-09-07 23:37 UTC records Draft #1172 `936311c` stacked on #1171. - Hook kubectl apply and docker push fail closed. - Remaining leftover: deep directory recursion, Cosign/GPG, terraform/helm. Rationale: - #999 is the single writer of the product-technical gap baseline. - Do not Close #1099, #1171, or #1170. Tests: - documentation-only; detector evidence lives on #1172 (1813/1813) --- docs/product-technical-gap-baseline.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index dac15ef5..e916a4d3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 23:23 UTC +**Snapshot:** 2026-09-07 23:37 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,15 +68,16 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 23:23 UTC snapshot +## Security-defect corpus — live 2026-09-07 23:37 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | -| AppGuardrail #1170, branch `feat/claude-plugin-github-merge-release-1099`, exact head `b506b824987326bd82f5fb5f8d037194a21163b6` | open/Draft successor stacked on #1169 (`226ca73...`). RED `527edb5` → GREEN `b506b82`. Focused merge/release tests 16 passed plus inventory lock; detector statement coverage 2455/2455 on Python 3.13. Credential-store successor is #1171. | hook or manifest `gh pr merge` fails as `claude-plugin-github-merge-command`. `gh release` create, upload, delete, or edit fails as `claude-plugin-github-release-command`. `gh issue create`, `gh pr review`, `gh release list`, `kubectl apply`, and `docker push` stay inventory. Hardcoded PATs stay `claude-plugin-github-write-token`. Snippets are command labels. | keep Draft stacked on #1169. Do not Close #1099 or #1169. Do not steal checksum-mismatch or github-write-token. | +| AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | +| AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. Deployment-write successor is #1172. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | +| AppGuardrail #1170, branch `feat/claude-plugin-github-merge-release-1099`, exact head `b506b824987326bd82f5fb5f8d037194a21163b6` | open/Draft successor stacked on #1169 (`226ca73...`). RED `527edb5` → GREEN `b506b82`. Focused merge/release tests 16 passed plus inventory lock; detector statement coverage 2455/2455 on Python 3.13. Credential-store successor is #1171. | hook or manifest `gh pr merge` fails as `claude-plugin-github-merge-command`. `gh release` create, upload, delete, or edit fails as `claude-plugin-github-release-command`. On this slice `gh issue create`, `gh pr review`, `gh release list`, `kubectl apply`, and `docker push` stay inventory; kubectl/docker-push successor is #1172. Hardcoded PATs stay `claude-plugin-github-write-token`. Snippets are command labels. | keep Draft stacked on #1169. Do not Close #1099 or #1169. Do not steal checksum-mismatch or github-write-token. | | AppGuardrail #1169, branch `feat/claude-plugin-checksum-mismatch-1099`, exact head `226ca7356e5ed32c3ac85bba9cc38868e7fda8ae` | open/Draft successor stacked on #1168 (`4b9bcc6...`). RED `c23c4cb` → GREEN `226ca73`. Focused checksum tests 27 passed; detector statement coverage 2424/2424. Merge/release successor is #1170. | first-party `SHA256SUMS` / `*.sha256` files that disagree with bytes on disk fail as `claude-plugin-checksum-mismatch`. Matching checksums, `#` comments, and a missing checksum file are not this class. Cosign/GPG network is not required. | keep Draft stacked on #1168. Do not Close #1099 or #1168. Do not steal `sbom_sha256`. | | AppGuardrail #1168, branch `feat/claude-plugin-sbom-receipt-1099`, exact head `4b9bcc6eac49c4edb117f28ffa03c9e25c58a320` | open/Draft successor stacked on #1167 (`18bb1a0...`). RED `1461fb5` → GREEN `4b9bcc6`. Coverage suite 287 passed; detector statement coverage 2301/2301 on Python 3.13. Checksum-mismatch successor is #1169. | receipt `sbom_sha256` is SHA-256 of a deterministic CycloneDX 1.5 document from existing SBOM parsers. Verify fails closed on a swapped digest. This is not a second policy hash. Malformed manifests yield an empty-component SBOM. | keep Draft stacked on #1167. Do not Close #1099 or #1167. | | AppGuardrail #1167, branch `feat/claude-plugin-policy-provenance-1099`, exact head `18bb1a0a87f912989ea3f3328cc7692fda1a9c0c` | open/Draft successor stacked on #1166 (`0ef0f7d...`). RED `bba5b6a` → GREEN `18bb1a0`. Plugin suites 287 passed; detector statement coverage 2272/2272. SBOM-receipt successor is #1168. | receipt `policy_provenance` binds `scanner_release_version` (`_SCANNER_VERSION`) and `scanner_policy_sha256` to this scan. Verify fails closed when version or provenance disagrees with the running scanner. Pass is not Noema admission. | keep Draft stacked on #1166. Do not Close #1099 or #1166. Do not duplicate the policy digest under a second field name. | @@ -155,7 +156,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 23:23 UTC records Draft #1171 `9370a0d` on #1170 `b506b82` on #1169 `226ca73` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 23:37 UTC records Draft #1172 `936311c` on #1171 `9370a0d` on #1170 `b506b82` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -228,8 +229,9 @@ re-fetch docs/issues/PRs/current heads 46. Keep #1167 Draft stacked on #1166 at `18bb1a0`. Receipt policy provenance must match the running scanner version and policy digest. Do not Close #1099 or #1166. Pass is not Noema admission. 47. Keep #1168 Draft stacked on #1167 at `4b9bcc6`. Receipt `sbom_sha256` is a CycloneDX digest, not a second policy hash. Do not Close #1099 or #1167. 48. Keep #1169 Draft stacked on #1168 at `226ca73`. First-party checksum files that disagree with disk bytes fail closed. Do not Close #1099 or #1168. Cosign/GPG network is not required. -49. Keep #1170 Draft stacked on #1169 at `b506b82`. Hook/manifest `gh pr merge` and `gh release` write verbs fail closed. Issue create, PR review, release list, kubectl apply, and docker push stay inventory. Do not Close #1099 or #1169. -50. Keep #1171 Draft stacked on #1170 at `9370a0d`. Host cookie/token stores beyond browser profiles fail closed. Do not Close #1099, #1170, #1150, or #1137. Remaining unique leftover: deep directory recursion, Cosign/GPG when a checksum file exists, and deployment-write fail-closed. +49. Keep #1170 Draft stacked on #1169 at `b506b82`. Hook/manifest `gh pr merge` and `gh release` write verbs fail closed. Issue create, PR review, and release list stay inventory on this slice. Do not Close #1099 or #1169. +50. Keep #1171 Draft stacked on #1170 at `9370a0d`. Host cookie/token stores beyond browser profiles fail closed. Do not Close #1099, #1170, #1150, or #1137. +51. Keep #1172 Draft stacked on #1171 at `936311c`. Hook/manifest `kubectl apply` and `docker push` fail closed. `terraform apply` and `helm install` stay inventory. Do not Close #1099, #1171, or #1170. Remaining unique leftover: deep directory recursion, Cosign/GPG when a checksum file exists, and terraform/helm deployment writes. ## Standards and acceptance basis From c0aa83b8cedb2d555c84a4edcdd8a4f4eef87f4a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 09:03:51 +0900 Subject: [PATCH 102/192] docs: record #1173 terraform/helm successor Live snapshot 2026-09-08 00:02 UTC. Draft #1173 e465cd7 stacked on #1172 936311c. Do not Close #1099 or #1172. --- docs/product-technical-gap-baseline.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e916a4d3..85972e26 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-07 23:37 UTC +**Snapshot:** 2026-09-08 00:02 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-07 23:37 UTC snapshot +## Security-defect corpus — live 2026-09-08 00:02 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | +| AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `e465cd71b495215e6ab7bc1ce298b588c0edfd75` | open/Draft successor stacked on #1172 (`936311c...`). RED `0e1f365` → GREEN `e465cd7`. Plugin coverage suite 375 passed; detector statements 2563/2563 on Python 3.13. | hook or manifest `terraform apply` fails as `claude-plugin-terraform-apply-command`. `helm install` fails as `claude-plugin-helm-install-command`. `terraform plan`, `helm list`, `vercel deploy`, and `fly deploy` stay inventory. kubectl/docker-push stay #1172. README terraform wording is not a hook. Snippets are command labels. | keep Draft stacked on #1172. Do not Close #1099 or #1172. | +| AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. Terraform/helm successor is #1173. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. On this slice `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory; terraform/helm successor is #1173. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | | AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. Deployment-write successor is #1172. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | | AppGuardrail #1170, branch `feat/claude-plugin-github-merge-release-1099`, exact head `b506b824987326bd82f5fb5f8d037194a21163b6` | open/Draft successor stacked on #1169 (`226ca73...`). RED `527edb5` → GREEN `b506b82`. Focused merge/release tests 16 passed plus inventory lock; detector statement coverage 2455/2455 on Python 3.13. Credential-store successor is #1171. | hook or manifest `gh pr merge` fails as `claude-plugin-github-merge-command`. `gh release` create, upload, delete, or edit fails as `claude-plugin-github-release-command`. On this slice `gh issue create`, `gh pr review`, `gh release list`, `kubectl apply`, and `docker push` stay inventory; kubectl/docker-push successor is #1172. Hardcoded PATs stay `claude-plugin-github-write-token`. Snippets are command labels. | keep Draft stacked on #1169. Do not Close #1099 or #1169. Do not steal checksum-mismatch or github-write-token. | | AppGuardrail #1169, branch `feat/claude-plugin-checksum-mismatch-1099`, exact head `226ca7356e5ed32c3ac85bba9cc38868e7fda8ae` | open/Draft successor stacked on #1168 (`4b9bcc6...`). RED `c23c4cb` → GREEN `226ca73`. Focused checksum tests 27 passed; detector statement coverage 2424/2424. Merge/release successor is #1170. | first-party `SHA256SUMS` / `*.sha256` files that disagree with bytes on disk fail as `claude-plugin-checksum-mismatch`. Matching checksums, `#` comments, and a missing checksum file are not this class. Cosign/GPG network is not required. | keep Draft stacked on #1168. Do not Close #1099 or #1168. Do not steal `sbom_sha256`. | @@ -156,7 +157,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-07 23:37 UTC records Draft #1172 `936311c` on #1171 `9370a0d` on #1170 `b506b82` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 00:02 UTC records Draft #1173 `e465cd7` on #1172 `936311c` on #1171 `9370a0d` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -231,7 +232,8 @@ re-fetch docs/issues/PRs/current heads 48. Keep #1169 Draft stacked on #1168 at `226ca73`. First-party checksum files that disagree with disk bytes fail closed. Do not Close #1099 or #1168. Cosign/GPG network is not required. 49. Keep #1170 Draft stacked on #1169 at `b506b82`. Hook/manifest `gh pr merge` and `gh release` write verbs fail closed. Issue create, PR review, and release list stay inventory on this slice. Do not Close #1099 or #1169. 50. Keep #1171 Draft stacked on #1170 at `9370a0d`. Host cookie/token stores beyond browser profiles fail closed. Do not Close #1099, #1170, #1150, or #1137. -51. Keep #1172 Draft stacked on #1171 at `936311c`. Hook/manifest `kubectl apply` and `docker push` fail closed. `terraform apply` and `helm install` stay inventory. Do not Close #1099, #1171, or #1170. Remaining unique leftover: deep directory recursion, Cosign/GPG when a checksum file exists, and terraform/helm deployment writes. +51. Keep #1172 Draft stacked on #1171 at `936311c`. Hook/manifest `kubectl apply` and `docker push` fail closed. Do not Close #1099, #1171, or #1170. +52. Keep #1173 Draft stacked on #1172 at `e465cd7`. Hook/manifest `terraform apply` and `helm install` fail closed. `terraform plan`, `helm list`, `vercel deploy`, and `fly deploy` stay inventory. Do not Close #1099 or #1172. Remaining unique leftover: deep directory recursion, Cosign/GPG when a checksum file exists, and vercel/fly hosted deploy writes. ## Standards and acceptance basis From 973730991e713361d401940d30fc9b142fbbe1f4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 09:09:13 +0900 Subject: [PATCH 103/192] docs: record #1174 hosted-deploy successor Summary: - Snapshot 2026-09-08 00:08 UTC records Draft #1174 `af6b2ec` stacked on #1173. - Hook vercel deploy and fly deploy fail closed. - Remaining leftover: deep directory recursion, Cosign/GPG. Rationale: - #999 is the single writer of the product-technical gap baseline. - Do not Close #1099 or #1173. Tests: - documentation-only; detector evidence lives on #1174 (1845/1845) --- docs/product-technical-gap-baseline.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 85972e26..82d46691 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 00:02 UTC +**Snapshot:** 2026-09-08 00:08 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 00:02 UTC snapshot +## Security-defect corpus — live 2026-09-08 00:08 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `e465cd71b495215e6ab7bc1ce298b588c0edfd75` | open/Draft successor stacked on #1172 (`936311c...`). RED `0e1f365` → GREEN `e465cd7`. Plugin coverage suite 375 passed; detector statements 2563/2563 on Python 3.13. | hook or manifest `terraform apply` fails as `claude-plugin-terraform-apply-command`. `helm install` fails as `claude-plugin-helm-install-command`. `terraform plan`, `helm list`, `vercel deploy`, and `fly deploy` stay inventory. kubectl/docker-push stay #1172. README terraform wording is not a hook. Snippets are command labels. | keep Draft stacked on #1172. Do not Close #1099 or #1172. | +| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `af6b2ecc2a9a90b4b134d079e23c70ca3b81c1f8` | open/Draft successor stacked on #1173 (`e465cd7...`). RED `50b5551` → GREEN `af6b2ec`. Plugin coverage suite 393 passed; detector statements 1845/1845. | hook or manifest `vercel deploy` fails as `claude-plugin-vercel-deploy-command`. `fly deploy` and `flyctl deploy` fail as `claude-plugin-fly-deploy-command`. `vercel ls` and `fly status` stay inventory. terraform/helm stay #1173. README wording is not a hook. Snippets are command labels. | keep Draft stacked on #1173. Do not Close #1099 or #1173. | +| AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `e465cd71b495215e6ab7bc1ce298b588c0edfd75` | open/Draft successor stacked on #1172 (`936311c...`). RED `0e1f365` → GREEN `e465cd7`. Plugin coverage suite 375 passed; detector statements 2563/2563 on Python 3.13. Hosted-deploy successor is #1174. | hook or manifest `terraform apply` fails as `claude-plugin-terraform-apply-command`. `helm install` fails as `claude-plugin-helm-install-command`. On this slice `terraform plan`, `helm list`, `vercel deploy`, and `fly deploy` stay inventory; vercel/fly successor is #1174. kubectl/docker-push stay #1172. README terraform wording is not a hook. Snippets are command labels. | keep Draft stacked on #1172. Do not Close #1099 or #1172. | | AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. Terraform/helm successor is #1173. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. On this slice `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory; terraform/helm successor is #1173. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | | AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. Deployment-write successor is #1172. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | | AppGuardrail #1170, branch `feat/claude-plugin-github-merge-release-1099`, exact head `b506b824987326bd82f5fb5f8d037194a21163b6` | open/Draft successor stacked on #1169 (`226ca73...`). RED `527edb5` → GREEN `b506b82`. Focused merge/release tests 16 passed plus inventory lock; detector statement coverage 2455/2455 on Python 3.13. Credential-store successor is #1171. | hook or manifest `gh pr merge` fails as `claude-plugin-github-merge-command`. `gh release` create, upload, delete, or edit fails as `claude-plugin-github-release-command`. On this slice `gh issue create`, `gh pr review`, `gh release list`, `kubectl apply`, and `docker push` stay inventory; kubectl/docker-push successor is #1172. Hardcoded PATs stay `claude-plugin-github-write-token`. Snippets are command labels. | keep Draft stacked on #1169. Do not Close #1099 or #1169. Do not steal checksum-mismatch or github-write-token. | @@ -157,7 +158,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 00:02 UTC records Draft #1173 `e465cd7` on #1172 `936311c` on #1171 `9370a0d` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 00:08 UTC records Draft #1174 `af6b2ec` on #1173 `e465cd7` on #1172 `936311c` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -233,7 +234,8 @@ re-fetch docs/issues/PRs/current heads 49. Keep #1170 Draft stacked on #1169 at `b506b82`. Hook/manifest `gh pr merge` and `gh release` write verbs fail closed. Issue create, PR review, and release list stay inventory on this slice. Do not Close #1099 or #1169. 50. Keep #1171 Draft stacked on #1170 at `9370a0d`. Host cookie/token stores beyond browser profiles fail closed. Do not Close #1099, #1170, #1150, or #1137. 51. Keep #1172 Draft stacked on #1171 at `936311c`. Hook/manifest `kubectl apply` and `docker push` fail closed. Do not Close #1099, #1171, or #1170. -52. Keep #1173 Draft stacked on #1172 at `e465cd7`. Hook/manifest `terraform apply` and `helm install` fail closed. `terraform plan`, `helm list`, `vercel deploy`, and `fly deploy` stay inventory. Do not Close #1099 or #1172. Remaining unique leftover: deep directory recursion, Cosign/GPG when a checksum file exists, and vercel/fly hosted deploy writes. +52. Keep #1173 Draft stacked on #1172 at `e465cd7`. Hook/manifest `terraform apply` and `helm install` fail closed. `terraform plan` and `helm list` stay inventory on this slice. Do not Close #1099 or #1172. +53. Keep #1174 Draft stacked on #1173 at `af6b2ec`. Hook/manifest `vercel deploy` and `fly deploy` fail closed. Do not Close #1099 or #1173. Remaining unique leftover: deep directory recursion and Cosign/GPG when a checksum file exists. ## Standards and acceptance basis From 7462d693d35cb7d1f8d1472b66693ba09710e90a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 10:57:03 +0900 Subject: [PATCH 104/192] docs(gap): refresh exact-head review evidence --- docs/product-technical-gap-baseline.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 82d46691..8f082752 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 00:08 UTC +**Snapshot:** 2026-09-08 02:00 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -118,12 +118,12 @@ Responsibility boundaries: | `ContextualWisdomLab/.github` #1706, stronger event-driven runner release, latest observed head `21bf1f79a00555fe0f4be797ebac4a426a059094` | open/mergeable but Proposed/non-merge-ready; temporary source-fix work remains owner-side | stronger buyer-visible Gap: even bounded multi-hour waiting consumes required-review capacity | require durable one-shot/event reconciliation source, full-suite GREEN, temporary workflow/helper deletion and resulting exact-head central CI/security/current-head review before ordinary merge. | | AppGuardrail #1080 / Issue #892, Bearer DNS-rebinding TOCTOU, head `0a752c091489efd4dc7373230f1e242313e7cca6` | open/mergeable; current-head review remains authoritative | preflight URL/DNS validation can diverge from the later credential-bearing connection; family tracks destination/request/credential/reachability and mutation state | finish current-head provenance/control-flow repairs; no predecessor GREEN reuse. This family is also evidence for the structural-analyzer Gap below. | | AppGuardrail #1117, dashboard scan-history attribute injection, exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` | open/mergeable/Draft; zero unresolved review threads. All nine repository workflows except CodeQL PR are terminal success. CodeQL PR `34068384347` failed closed only after authenticated dispatch with `VERDICT_STATE=pending`; central exact-head scan runs `34072930847` and `34072932500` are queued. No qualifying independent `APPROVED` review exists. | `/api/v1/scans` history fields enter an `innerHTML` template. An unescaped scan id in a quoted `data-id` attribute could break attribute context; history and summary count fields also require numeric coercion before interpolation; #1091 proved the summary-count sink remained reachable until it was carried into #1117. The branch escapes the id, coerces counts, installs Chromium explicitly in CI, and uses a real browser regression that preserves the malicious dataset value while requiring zero injected `img` elements and zero dialogs. A concurrent update briefly removed the DOM-element oracle and restored a dead read; exact head `d3283a16...` preserves the CI delta, restores both reviewed test invariants, coerces latest/new/critical summary counts, and expands the Chromium fixture to hostile id/count/created-at/repository values. #1091 remains Draft until this successor coverage is exact-head GREEN and complete carryover is reverified. Its concurrent current head `ec9dcfb7ec6a93d5acbb093a8caa3c95b7be2b21` is ahead 2 from `25a8733d967021e275308351354280dfa18684ac`; the effective compare changes only `.jules/sentinel.md`, so no product/test XSS delta was added or removed. | keep production escaping and the realistic browser oracle unchanged. Require exact-head Tests/security/SAST/CodeQL and independent review; inspect normal/loading/empty/error/detail and keyboard/focus behavior before leaving Draft. | -| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `2379b37f05b12af8e22990965d42da2e69b9c611` | open/mergeable/Draft; REST `mergeable_state=blocked`. Exact head `2379b37...` is a source-neutral empty-file descendant of `325d48e0249b715bd33d48e45c597240dfb80a77` / `a06a96fc3f0790a3cc9ba8f73285ffe3b51fba9d` (`ahead 1` / zero changed files; commit message is a Strix timeout CI retrigger) and does not add a security delta. On this retrigger, Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are terminal success, while Strix, SAST Semgrep, Noema, CodeQL compatibility analysis, and some Security Scan jobs remain pending. Predecessor CodeQL pending-handoff evidence does not transfer. No qualifying independent `APPROVED` review exists. Generated duplicate #1128 at `4a76b955ecc6e767e137ac15e82b83a2af148386` was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved; its body-mentioned separate test file was absent from its current patch. | keep #1068 as the single Draft writer. Wait for current-head Strix/SAST/Noema/CodeQL and qualifying independent approval; never reuse predecessor results or recreate a duplicate hostless lane. | +| AppGuardrail #1068, empty-host / unresolved-DNS SSRF, exact head `2379b37f05b12af8e22990965d42da2e69b9c611` | open/mergeable/Draft; source-neutral descendant with no new security delta. All eight repository workflows are terminal success on this exact head. CodeQL PR run `34155024470` successfully dispatched exact-head Python/Actions analysis, then failed closed at `VERDICT_STATE=pending`; this is neither source failure nor GREEN. No qualifying current-head approval exists. One outdated detector thread remains open pending independent confirmation of the bounded truthy-return repair. Generated duplicate #1128 was closed only after exact patch comparison proved complete carryover. | malformed/unresolved destinations previously crossed fail-open validation. The canonical lane rejects missing hosts in both validators, fails closed on `socket.gaierror`, and retains the HIGH/CWE-918 detector, vulnerable/fixed corpus, API/direct validator regressions, and FP/FN traceability. #1128's valid `http://` and `http://user@` obligations are fully preserved. | keep #1068 as the single Draft writer. Wait for current-head CodeQL verdict, independent review and thread resolution; never reuse predecessor results or recreate a duplicate hostless lane. | | AppGuardrail #1107, webhook storage admission and detector precision, exact head `f10795e294df5b0d9797fc50b201126c998a3632` | open/mergeable/Draft. Exact-head Security Process `34077096473` exposed the local-sink detector false positive; the repaired head has nine fresh hosted workflows queued/pending. Local GREEN is 27/27 stored-SSRF tests, 37/37 SSRF/documentation tests, 1,009/1,009 repository tests, and zero deploy-blocking findings in the real repository scan. CodeGraph was unavailable locally. | the HTTP route and directly callable persistence function had duplicated validation, rejecting the documented empty-string clear value. The runtime repair makes `set_webhook` the single validation/persistence boundary. The existing `python-stored-ssrf-webhook-url` regex then reported the safe delegated route because it did not inspect the local sink body. RED `ead954ad...` fixes the FP/FN contract: one unique top-level, non-rebound sink with unconditional unsafe rejection before SQLite use is negative; unrelated conditional validation and symbol rebinding remain positive. GREEN `f18fec7c...` adds the bounded stdlib AST proof and `f10795e...` records traceability. | keep Draft; require fresh exact-head hosted checks/current review, then integrate #1068 non-destructively after its unresolved-DNS validator reaches protected `develop`. Do not treat persistence validation as delivery-time DNS pinning or weaken the #1068 prerequisite. | | AppGuardrail #1130, Jules webhook SSRF subset, exact head `0243a1a5a1cef758b14ae85f87b2ea1dd86e9e82` | converted to Draft at 05:37 UTC. Effective delta is `set_webhook`/route plumbing, a regex `try`/`except ValueError` lookaround, and `.jules/sentinel.md`. No runtime tests and no AST FP/FN contract. Canonical owner remains #1107. | same storage-boundary SSRF class as #1107, implemented as a weaker regex-only slice | keep Draft. Do not Close until complete carryover onto #1107 is verified. Do not race #1107 to `develop`. | | AppGuardrail #972 / Issue #927, branch `feat/scan-assurance-927`, exact head `c488cfffe4dd95a9be8b8ed99e77a86cc8d5d81f` | open/Draft. Non-force restack onto protected `develop@e71d37e` completed 05:37 UTC (`ahead` of predecessor `4ba738a...` by the merge commit only). REST `mergeable=MERGEABLE`, `mergeStateStatus=BLOCKED`. Fresh exact-head checks are in flight and do not inherit predecessor GREEN. | `0 findings` must not render as `clean` unless repository/commit identity, findings digest, detector completion, requested engines, scope, freshness, and gate accounting all verify. Ambiguous evidence is `untrusted`/`failed`/`incomplete`. | keep Draft through current-head Tests/security/SAST/CodeQL/dedicated assurance coverage and independent review. #1005 remains the report-consumer successor and must restack after this head is stable. Do not Close #927. | | AppGuardrail #1006 / Issue #928, branch `feat/issue-928-evidence-handoff`, exact head `35c28e22b5d50f1da943718cdb1984dcee098d62` | open/non-Draft. Non-force restack onto `develop@e71d37e` completed 05:37 UTC. REST `mergeable=MERGEABLE`, `mergeStateStatus=BLOCKED`. Dashboard clipboard/UI slice remains out of scope. | transport-neutral, redacted, digest-verified remediation bundle so an agent workflow cannot copy hostile or unbounded evidence | require fresh exact-head checks after restack; keep the UI/CSP/Storybook slice as a later G-03 successor. Do not Close #928. | -| AppGuardrail #1036, shared-skill supply-chain detection, exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99` | open/Draft; REST mergeable but `mergeStateStatus=BLOCKED`; `reviewDecision=REVIEW_REQUIRED`; `autoMergeRequest` is null. Central OpenCode run `34069453772` reached Python 3.14 coverage and failed `test_string_path_language_detection_matches_path_objects[src/....py]`; `fdb49c3...` applies the same name-based rule to both public input forms. Predecessor checks, Noema approval, and review receipts do not transfer. Wait authenticated current-head OpenCode; do not Close. | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; language-axis evidence must also remain identical for equivalent `str` and `Path` inputs across supported runtimes. | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; require fresh Python 3.14 Tests, security/SAST/CodeQL and current-head OpenCode/Strix/Noema review before ordinary merge. | +| AppGuardrail #1036, shared-skill supply-chain detection, exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99` | open/Ready/mergeable; all eight repository workflows are terminal success, including Python 3.14 Tests `34084946810`. CodeQL PR `34084946812` dispatched exact-head Python/Actions analysis and failed closed at `VERDICT_STATE=pending`; this is not source failure or GREEN. Unresolved threads are zero and no current-head independent approval exists. Ready status now admits the unchanged head to OpenCode/Noema/Strix; ordinary squash auto-merge is configured but remains protection-blocked. | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; language-axis evidence must remain identical for equivalent `str` and `Path` inputs across supported runtimes. | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; wait for current-head CodeQL verdict and qualifying independent review, then allow only ordinary protected auto-merge. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; Tests and Security Process are terminal success; Security Scan, SAST, CodeQL, Strix, Noema and OpenCode remain queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | @@ -158,7 +158,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 00:08 UTC records Draft #1174 `af6b2ec` on #1173 `e465cd7` on #1172 `936311c` … on #998 `8b95c2b`; Jules #1159 stays Draft under #1068; G-06 remains #1152 `255cfd8`; #1148 remains sentinel-owned. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 02:00 UTC records #1036 Ready at `fdb49c3` with exact-head repository GREEN and CodeQL pending handoff, #1068 Draft at `2379b37` with the same typed handoff boundary, Draft #1174 `af6b2ec` on the plugin-security stack, and G-06 #1152 `255cfd8`. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -187,7 +187,7 @@ re-fetch docs/issues/PRs/current heads 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. 3. Keep #1068 on source-neutral exact head `2379b37f05b12af8e22990965d42da2e69b9c611` as the single Draft hostless/unresolved-DNS lane. The head is an empty-file Strix-retrigger descendant of `325d48e...` / `a06a96fc...` and adds no security delta; predecessor Checks do not transfer; no independent approval exists; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. -5. Keep #1036 Draft on exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99`. Auto-merge is absent; `reviewDecision=REVIEW_REQUIRED`. Wait authenticated current-head OpenCode/Strix/Noema; do not Close and do not transfer predecessor approval. +5. Keep #1036 Ready on exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99`. All eight repository workflows are terminal success, including Python 3.14; CodeQL PR `34084946812` remains a fail-closed pending-handoff, unresolved threads are zero, and no current-head approval exists. Ordinary squash auto-merge is configured but must remain blocked until current-head CodeQL/OpenCode/Strix/Noema and protected review requirements pass. Do not Close or transfer predecessor approval. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. From df26c47136a15e07a183aea454de804bff775565 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 11:01:29 +0900 Subject: [PATCH 105/192] docs(gap): record hosted-deploy precision boundary --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 8f082752..99a6a2e4 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -75,7 +75,7 @@ Responsibility boundaries: | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `af6b2ecc2a9a90b4b134d079e23c70ca3b81c1f8` | open/Draft successor stacked on #1173 (`e465cd7...`). RED `50b5551` → GREEN `af6b2ec`. Plugin coverage suite 393 passed; detector statements 1845/1845. | hook or manifest `vercel deploy` fails as `claude-plugin-vercel-deploy-command`. `fly deploy` and `flyctl deploy` fail as `claude-plugin-fly-deploy-command`. `vercel ls` and `fly status` stay inventory. terraform/helm stay #1173. README wording is not a hook. Snippets are command labels. | keep Draft stacked on #1173. Do not Close #1099 or #1173. | +| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `af6b2ecc2a9a90b4b134d079e23c70ca3b81c1f8` | open/Draft successor stacked on #1173 (`e465cd7...`). RED `50b5551` → GREEN `af6b2ec`. Plugin coverage suite 393 passed; detector statements 1845/1845. Current-head review `5136517688` records an unresolved precision obligation; no hosted PR workflow run or independent review exists on this stacked head. | direct hook/manifest `vercel deploy`, `fly deploy`, and `flyctl deploy` are intended fail-closed command classes. The current raw whole-content regex also matches non-executable hook comments and `echo` text, so “runs deploy” is not yet proven without false positives. README wording is already negative; direct commands and manifest command values must remain positive. | keep Draft stacked on #1173. Add RED production-path comment/echo negatives, then the smallest bounded command-context repair; do not weaken executable deploy detection or Close #1099/#1173. | | AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `e465cd71b495215e6ab7bc1ce298b588c0edfd75` | open/Draft successor stacked on #1172 (`936311c...`). RED `0e1f365` → GREEN `e465cd7`. Plugin coverage suite 375 passed; detector statements 2563/2563 on Python 3.13. Hosted-deploy successor is #1174. | hook or manifest `terraform apply` fails as `claude-plugin-terraform-apply-command`. `helm install` fails as `claude-plugin-helm-install-command`. On this slice `terraform plan`, `helm list`, `vercel deploy`, and `fly deploy` stay inventory; vercel/fly successor is #1174. kubectl/docker-push stay #1172. README terraform wording is not a hook. Snippets are command labels. | keep Draft stacked on #1172. Do not Close #1099 or #1172. | | AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. Terraform/helm successor is #1173. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. On this slice `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory; terraform/helm successor is #1173. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | | AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. Deployment-write successor is #1172. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | From d46c6974e2558869c6ad75519e7841a143cf94ca Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 11:58:18 +0900 Subject: [PATCH 106/192] docs(gap): record placeholder detector repair --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 99a6a2e4..778fb839 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 02:00 UTC +**Snapshot:** 2026-09-08 03:00 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -123,7 +123,7 @@ Responsibility boundaries: | AppGuardrail #1130, Jules webhook SSRF subset, exact head `0243a1a5a1cef758b14ae85f87b2ea1dd86e9e82` | converted to Draft at 05:37 UTC. Effective delta is `set_webhook`/route plumbing, a regex `try`/`except ValueError` lookaround, and `.jules/sentinel.md`. No runtime tests and no AST FP/FN contract. Canonical owner remains #1107. | same storage-boundary SSRF class as #1107, implemented as a weaker regex-only slice | keep Draft. Do not Close until complete carryover onto #1107 is verified. Do not race #1107 to `develop`. | | AppGuardrail #972 / Issue #927, branch `feat/scan-assurance-927`, exact head `c488cfffe4dd95a9be8b8ed99e77a86cc8d5d81f` | open/Draft. Non-force restack onto protected `develop@e71d37e` completed 05:37 UTC (`ahead` of predecessor `4ba738a...` by the merge commit only). REST `mergeable=MERGEABLE`, `mergeStateStatus=BLOCKED`. Fresh exact-head checks are in flight and do not inherit predecessor GREEN. | `0 findings` must not render as `clean` unless repository/commit identity, findings digest, detector completion, requested engines, scope, freshness, and gate accounting all verify. Ambiguous evidence is `untrusted`/`failed`/`incomplete`. | keep Draft through current-head Tests/security/SAST/CodeQL/dedicated assurance coverage and independent review. #1005 remains the report-consumer successor and must restack after this head is stable. Do not Close #927. | | AppGuardrail #1006 / Issue #928, branch `feat/issue-928-evidence-handoff`, exact head `35c28e22b5d50f1da943718cdb1984dcee098d62` | open/non-Draft. Non-force restack onto `develop@e71d37e` completed 05:37 UTC. REST `mergeable=MERGEABLE`, `mergeStateStatus=BLOCKED`. Dashboard clipboard/UI slice remains out of scope. | transport-neutral, redacted, digest-verified remediation bundle so an agent workflow cannot copy hostile or unbounded evidence | require fresh exact-head checks after restack; keep the UI/CSP/Storybook slice as a later G-03 successor. Do not Close #928. | -| AppGuardrail #1036, shared-skill supply-chain detection, exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99` | open/Ready/mergeable; all eight repository workflows are terminal success, including Python 3.14 Tests `34084946810`. CodeQL PR `34084946812` dispatched exact-head Python/Actions analysis and failed closed at `VERDICT_STATE=pending`; this is not source failure or GREEN. Unresolved threads are zero and no current-head independent approval exists. Ready status now admits the unchanged head to OpenCode/Noema/Strix; ordinary squash auto-merge is configured but remains protection-blocked. | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; language-axis evidence must remain identical for equivalent `str` and `Path` inputs across supported runtimes. | retain structural-key, flow-YAML and defensive-prose FP/FN oracles; wait for current-head CodeQL verdict and qualifying independent review, then allow only ordinary protected auto-merge. | +| AppGuardrail #1036, shared-skill supply-chain detection, exact head `6453ed599b9127ac206806c60b1f0cb57cd74f29` | open/Ready/mergeable. Current-head CodeRabbit finding `3953701459` identified a real placeholder FN: block-YAML-only syntax and `SKILL.md`-only path scope admitted quoted JSON and flow-YAML placeholders in supported `skill.json` / `*.skill.md` surfaces. Regression `976e8f4...` adds production-path positives and rendered-name/description-prose negatives; implementation `6453ed5...` adds bounded structural forms and the two missing paths. Nine exact-head workflows are freshly queued, including Tests `34181802375` and CodeQL PR `34181802338`; predecessor GREEN/approval does not transfer. | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; placeholder evidence must cover every declared manifest path without treating prose as a structural name. | keep Ready for current-head review and ordinary auto-merge, but require exact-head Tests/security/CodeQL plus qualifying independent approval and evidence-backed thread resolution before protection may merge. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; Tests and Security Process are terminal success; Security Scan, SAST, CodeQL, Strix, Noema and OpenCode remain queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | @@ -158,7 +158,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 02:00 UTC records #1036 Ready at `fdb49c3` with exact-head repository GREEN and CodeQL pending handoff, #1068 Draft at `2379b37` with the same typed handoff boundary, Draft #1174 `af6b2ec` on the plugin-security stack, and G-06 #1152 `255cfd8`. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 03:00 UTC records #1036 Ready at `6453ed5` after JSON/flow-YAML placeholder RED→GREEN with fresh Checks queued, #1068 Draft at `2379b37`, #1174 Draft with its hosted-deploy comment/echo FP obligation, and G-06 #1152 `255cfd8`. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -187,7 +187,7 @@ re-fetch docs/issues/PRs/current heads 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. 3. Keep #1068 on source-neutral exact head `2379b37f05b12af8e22990965d42da2e69b9c611` as the single Draft hostless/unresolved-DNS lane. The head is an empty-file Strix-retrigger descendant of `325d48e...` / `a06a96fc...` and adds no security delta; predecessor Checks do not transfer; no independent approval exists; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. -5. Keep #1036 Ready on exact head `fdb49c346c2ae7d30b61f6f9a9b33bf8e9b0cf99`. All eight repository workflows are terminal success, including Python 3.14; CodeQL PR `34084946812` remains a fail-closed pending-handoff, unresolved threads are zero, and no current-head approval exists. Ordinary squash auto-merge is configured but must remain blocked until current-head CodeQL/OpenCode/Strix/Noema and protected review requirements pass. Do not Close or transfer predecessor approval. +5. Keep #1036 Ready on exact head `6453ed599b9127ac206806c60b1f0cb57cd74f29`. Regression `976e8f4...` and implementation `6453ed5...` repair supported JSON/flow-YAML placeholder formats and paths; nine exact-head workflows are freshly queued and the review thread remains open. Ordinary squash auto-merge is configured but must remain protection-blocked until current-head Checks, CodeQL/OpenCode/Strix/Noema and review requirements pass. Do not Close or transfer predecessor approval. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. From c921ef88620a33116635a29840af1a4b634ad268 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 11:59:08 +0900 Subject: [PATCH 107/192] docs: record #1174 executable hosted-deploy precision Exact head 590f477 repairs review 5136517688: hook comments and echo/printf lookalikes are not vercel/fly deploy. Relates to #1099. --- docs/product-technical-gap-baseline.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 99a6a2e4..360a26b1 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 02:00 UTC +**Snapshot:** 2026-09-08 02:57 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 00:08 UTC snapshot +## Security-defect corpus — live 2026-09-08 02:57 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `af6b2ecc2a9a90b4b134d079e23c70ca3b81c1f8` | open/Draft successor stacked on #1173 (`e465cd7...`). RED `50b5551` → GREEN `af6b2ec`. Plugin coverage suite 393 passed; detector statements 1845/1845. Current-head review `5136517688` records an unresolved precision obligation; no hosted PR workflow run or independent review exists on this stacked head. | direct hook/manifest `vercel deploy`, `fly deploy`, and `flyctl deploy` are intended fail-closed command classes. The current raw whole-content regex also matches non-executable hook comments and `echo` text, so “runs deploy” is not yet proven without false positives. README wording is already negative; direct commands and manifest command values must remain positive. | keep Draft stacked on #1173. Add RED production-path comment/echo negatives, then the smallest bounded command-context repair; do not weaken executable deploy detection or Close #1099/#1173. | +| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `590f4771e55600375902157e57863f43584225d5` | open/Draft successor stacked on #1173 (`e465cd7...`). Fail-closed RED `50b5551` → GREEN `af6b2ec`. Precision RED `8b1e262` → GREEN `590f477` after review `5136517688`. Plugin coverage suite 403 passed; new helper statements covered on Python 3.13. | hook or manifest executable `vercel deploy` fails as `claude-plugin-vercel-deploy-command`. `fly deploy` and `flyctl deploy` fail as `claude-plugin-fly-deploy-command`. Unquoted `#` comments and `echo`/`printf`/`print` lookalikes are not this class. `vercel ls` and `fly status` stay inventory. terraform/helm stay #1173. README wording is not a hook. Snippets are command labels. | keep Draft stacked on #1173. Do not Close #1099 or #1173. Remaining unique leftover: deep directory recursion and Cosign/GPG when a checksum file exists. | | AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `e465cd71b495215e6ab7bc1ce298b588c0edfd75` | open/Draft successor stacked on #1172 (`936311c...`). RED `0e1f365` → GREEN `e465cd7`. Plugin coverage suite 375 passed; detector statements 2563/2563 on Python 3.13. Hosted-deploy successor is #1174. | hook or manifest `terraform apply` fails as `claude-plugin-terraform-apply-command`. `helm install` fails as `claude-plugin-helm-install-command`. On this slice `terraform plan`, `helm list`, `vercel deploy`, and `fly deploy` stay inventory; vercel/fly successor is #1174. kubectl/docker-push stay #1172. README terraform wording is not a hook. Snippets are command labels. | keep Draft stacked on #1172. Do not Close #1099 or #1172. | | AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. Terraform/helm successor is #1173. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. On this slice `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory; terraform/helm successor is #1173. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | | AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. Deployment-write successor is #1172. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | @@ -158,7 +158,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 02:00 UTC records #1036 Ready at `fdb49c3` with exact-head repository GREEN and CodeQL pending handoff, #1068 Draft at `2379b37` with the same typed handoff boundary, Draft #1174 `af6b2ec` on the plugin-security stack, and G-06 #1152 `255cfd8`. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 02:57 UTC records Draft #1174 `590f477` executable-command precision on #1173 `e465cd7`, #998 Draft `8b95c2b` with Strix `STRIX_PROVIDER_UNAVAILABLE` / CodeQL-compat pending-handoff (G-07), G-06 #1152 `255cfd8`, and #1036 Ready at `fdb49c3` with CodeQL pending handoff. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -235,7 +235,7 @@ re-fetch docs/issues/PRs/current heads 50. Keep #1171 Draft stacked on #1170 at `9370a0d`. Host cookie/token stores beyond browser profiles fail closed. Do not Close #1099, #1170, #1150, or #1137. 51. Keep #1172 Draft stacked on #1171 at `936311c`. Hook/manifest `kubectl apply` and `docker push` fail closed. Do not Close #1099, #1171, or #1170. 52. Keep #1173 Draft stacked on #1172 at `e465cd7`. Hook/manifest `terraform apply` and `helm install` fail closed. `terraform plan` and `helm list` stay inventory on this slice. Do not Close #1099 or #1172. -53. Keep #1174 Draft stacked on #1173 at `af6b2ec`. Hook/manifest `vercel deploy` and `fly deploy` fail closed. Do not Close #1099 or #1173. Remaining unique leftover: deep directory recursion and Cosign/GPG when a checksum file exists. +53. Keep #1174 Draft stacked on #1173 at `590f477`. Hook/manifest executable `vercel deploy` and `fly deploy` fail closed; comments and echo/printf lookalikes are not that class. Do not Close #1099 or #1173. Remaining unique leftover: deep directory recursion and Cosign/GPG when a checksum file exists. ## Standards and acceptance basis From 5101f0055198c9fdeb710a95a70a5130084a4ed6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 12:10:36 +0900 Subject: [PATCH 108/192] docs: record #1175 unsigned-checksum successor Summary: - Snapshot 2026-09-08 03:09 UTC records Draft #1175 `eb2389e` stacked on #1174. - Checksum digest rows without a sibling signature fail closed. - Remaining leftover: deep directory recursion. Rationale: - #999 is the single writer of the product-technical gap baseline. - Do not Close #1099, #1174, or #1169. Tests: - documentation-only; detector evidence lives on #1175 (416 passed) --- docs/product-technical-gap-baseline.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e2da1fca..cbaa2501 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 03:00 UTC +**Snapshot:** 2026-09-08 03:09 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 03:00 UTC snapshot +## Security-defect corpus — live 2026-09-08 03:09 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `590f4771e55600375902157e57863f43584225d5` | open/Draft successor stacked on #1173 (`e465cd7...`). Fail-closed RED `50b5551` → GREEN `af6b2ec`. Precision RED `8b1e262` → GREEN `590f477` after review `5136517688`. Plugin coverage suite 403 passed; new helper statements covered on Python 3.13. | hook or manifest executable `vercel deploy` fails as `claude-plugin-vercel-deploy-command`. `fly deploy` and `flyctl deploy` fail as `claude-plugin-fly-deploy-command`. Unquoted `#` comments and `echo`/`printf`/`print` lookalikes are not this class. `vercel ls` and `fly status` stay inventory. terraform/helm stay #1173. README wording is not a hook. Snippets are command labels. | keep Draft stacked on #1173. Do not Close #1099 or #1173. Remaining unique leftover: deep directory recursion and Cosign/GPG when a checksum file exists. | +| AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `eb2389e616133c1497b7330d60d129e8cff5e9ac` | open/Draft successor stacked on #1174 (`590f477...`). RED `5a7abb3` → GREEN `eb2389e`. Plugin coverage suite 416 passed. | first-party checksum digest rows without a non-empty sibling `.sig` / `.asc` / `.gpg` / `.bundle` / `cosign.bundle` fail as `claude-plugin-unsigned-checksum`. Empty or symlink signatures are not signatures. Missing and comment-only checksum files are not this class. Digest mismatch stays #1169. Network Cosign/GPG verify is not performed. Snippets are checksum filenames. | keep Draft stacked on #1174. Do not Close #1099, #1174, or #1169. | +| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `590f4771e55600375902157e57863f43584225d5` | open/Draft successor stacked on #1173 (`e465cd7...`). Fail-closed RED `50b5551` → GREEN `af6b2ec`. Precision RED `8b1e262` → GREEN `590f477` after review `5136517688`. Plugin coverage suite 403 passed; new helper statements covered on Python 3.13. Unsigned-checksum successor is #1175. | hook or manifest executable `vercel deploy` fails as `claude-plugin-vercel-deploy-command`. `fly deploy` and `flyctl deploy` fail as `claude-plugin-fly-deploy-command`. Unquoted `#` comments and `echo`/`printf`/`print` lookalikes are not this class. `vercel ls` and `fly status` stay inventory. terraform/helm stay #1173. README wording is not a hook. Snippets are command labels. | keep Draft stacked on #1173. Do not Close #1099 or #1173. | | AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `e465cd71b495215e6ab7bc1ce298b588c0edfd75` | open/Draft successor stacked on #1172 (`936311c...`). RED `0e1f365` → GREEN `e465cd7`. Plugin coverage suite 375 passed; detector statements 2563/2563 on Python 3.13. Hosted-deploy successor is #1174. | hook or manifest `terraform apply` fails as `claude-plugin-terraform-apply-command`. `helm install` fails as `claude-plugin-helm-install-command`. On this slice `terraform plan`, `helm list`, `vercel deploy`, and `fly deploy` stay inventory; vercel/fly successor is #1174. kubectl/docker-push stay #1172. README terraform wording is not a hook. Snippets are command labels. | keep Draft stacked on #1172. Do not Close #1099 or #1172. | | AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. Terraform/helm successor is #1173. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. On this slice `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory; terraform/helm successor is #1173. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | | AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. Deployment-write successor is #1172. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | @@ -158,7 +159,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 03:00 UTC records Draft #1174 `590f477` executable-command precision on #1173 `e465cd7`, #1036 Ready at `6453ed5` after JSON/flow-YAML placeholder RED→GREEN with fresh Checks queued, #998 Draft `8b95c2b` with Strix `STRIX_PROVIDER_UNAVAILABLE` / CodeQL-compat pending-handoff (G-07), #1068 Draft at `2379b37`, and G-06 #1152 `255cfd8`. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 03:09 UTC records Draft #1175 `eb2389e` on #1174 `590f477` on #1173 `e465cd7`, #1036 Ready at `6453ed5`, #998 Draft `8b95c2b` with Strix `STRIX_PROVIDER_UNAVAILABLE` / CodeQL-compat pending-handoff (G-07), #1068 Draft at `2379b37`, and G-06 #1152 `255cfd8`. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -235,7 +236,8 @@ re-fetch docs/issues/PRs/current heads 50. Keep #1171 Draft stacked on #1170 at `9370a0d`. Host cookie/token stores beyond browser profiles fail closed. Do not Close #1099, #1170, #1150, or #1137. 51. Keep #1172 Draft stacked on #1171 at `936311c`. Hook/manifest `kubectl apply` and `docker push` fail closed. Do not Close #1099, #1171, or #1170. 52. Keep #1173 Draft stacked on #1172 at `e465cd7`. Hook/manifest `terraform apply` and `helm install` fail closed. `terraform plan` and `helm list` stay inventory on this slice. Do not Close #1099 or #1172. -53. Keep #1174 Draft stacked on #1173 at `590f477`. Hook/manifest executable `vercel deploy` and `fly deploy` fail closed; comments and echo/printf lookalikes are not that class. Do not Close #1099 or #1173. Remaining unique leftover: deep directory recursion and Cosign/GPG when a checksum file exists. +53. Keep #1174 Draft stacked on #1173 at `590f477`. Hook/manifest executable `vercel deploy` and `fly deploy` fail closed; comments and echo/printf lookalikes are not that class. Do not Close #1099 or #1173. +54. Keep #1175 Draft stacked on #1174 at `eb2389e`. Checksum digest rows without a sibling Cosign/GPG signature file fail closed. Network verify is not performed. Do not Close #1099, #1174, or #1169. Remaining unique leftover: deep directory recursion. ## Standards and acceptance basis From df1d12118a3a5441d8d611d137e84ef700e27a97 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 13:06:54 +0900 Subject: [PATCH 109/192] docs: record #1176 excessive path-depth successor Exact head 815e55d stacked on #1175 fails closed on plugin trees and archives nested past 32 path components. Relates to #1099. --- docs/product-technical-gap-baseline.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index cbaa2501..6f92c50e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 03:09 UTC +**Snapshot:** 2026-09-08 04:05 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 03:09 UTC snapshot +## Security-defect corpus — live 2026-09-08 04:05 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `eb2389e616133c1497b7330d60d129e8cff5e9ac` | open/Draft successor stacked on #1174 (`590f477...`). RED `5a7abb3` → GREEN `eb2389e`. Plugin coverage suite 416 passed. | first-party checksum digest rows without a non-empty sibling `.sig` / `.asc` / `.gpg` / `.bundle` / `cosign.bundle` fail as `claude-plugin-unsigned-checksum`. Empty or symlink signatures are not signatures. Missing and comment-only checksum files are not this class. Digest mismatch stays #1169. Network Cosign/GPG verify is not performed. Snippets are checksum filenames. | keep Draft stacked on #1174. Do not Close #1099, #1174, or #1169. | +| AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `815e55d935cd0982c67fd37c303bb1dcbdcab536` | open/Draft successor stacked on #1175 (`eb2389e...`). RED `7406d01` → GREEN `815e55d`. Plugin coverage suite 426 passed. | materialized files and zip/tar members with more than 32 path components fail as `claude-plugin-excessive-path-depth`. Bound-depth trees stay negative. Zip-slip stays #1135. Nested archives stay #1166. Oversized file-count/bytes stay oversized-package. One tree finding. Snippets are `nested-path`. Members are not extracted. | keep Draft stacked on #1175. Do not Close #1099, #1175, #1166, or #1135. | +| AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `eb2389e616133c1497b7330d60d129e8cff5e9ac` | open/Draft successor stacked on #1174 (`590f477...`). RED `5a7abb3` → GREEN `eb2389e`. Plugin coverage suite 416 passed. Path-depth successor is #1176. | first-party checksum digest rows without a non-empty sibling `.sig` / `.asc` / `.gpg` / `.bundle` / `cosign.bundle` fail as `claude-plugin-unsigned-checksum`. Empty or symlink signatures are not signatures. Missing and comment-only checksum files are not this class. Digest mismatch stays #1169. Network Cosign/GPG verify is not performed. Snippets are checksum filenames. | keep Draft stacked on #1174. Do not Close #1099, #1174, or #1169. | | AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `590f4771e55600375902157e57863f43584225d5` | open/Draft successor stacked on #1173 (`e465cd7...`). Fail-closed RED `50b5551` → GREEN `af6b2ec`. Precision RED `8b1e262` → GREEN `590f477` after review `5136517688`. Plugin coverage suite 403 passed; new helper statements covered on Python 3.13. Unsigned-checksum successor is #1175. | hook or manifest executable `vercel deploy` fails as `claude-plugin-vercel-deploy-command`. `fly deploy` and `flyctl deploy` fail as `claude-plugin-fly-deploy-command`. Unquoted `#` comments and `echo`/`printf`/`print` lookalikes are not this class. `vercel ls` and `fly status` stay inventory. terraform/helm stay #1173. README wording is not a hook. Snippets are command labels. | keep Draft stacked on #1173. Do not Close #1099 or #1173. | | AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `e465cd71b495215e6ab7bc1ce298b588c0edfd75` | open/Draft successor stacked on #1172 (`936311c...`). RED `0e1f365` → GREEN `e465cd7`. Plugin coverage suite 375 passed; detector statements 2563/2563 on Python 3.13. Hosted-deploy successor is #1174. | hook or manifest `terraform apply` fails as `claude-plugin-terraform-apply-command`. `helm install` fails as `claude-plugin-helm-install-command`. On this slice `terraform plan`, `helm list`, `vercel deploy`, and `fly deploy` stay inventory; vercel/fly successor is #1174. kubectl/docker-push stay #1172. README terraform wording is not a hook. Snippets are command labels. | keep Draft stacked on #1172. Do not Close #1099 or #1172. | | AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. Terraform/helm successor is #1173. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. On this slice `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory; terraform/helm successor is #1173. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | @@ -159,7 +160,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 03:09 UTC records Draft #1175 `eb2389e` on #1174 `590f477` on #1173 `e465cd7`, #1036 Ready at `6453ed5`, #998 Draft `8b95c2b` with Strix `STRIX_PROVIDER_UNAVAILABLE` / CodeQL-compat pending-handoff (G-07), #1068 Draft at `2379b37`, and G-06 #1152 `255cfd8`. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 04:05 UTC records Draft #1176 `815e55d` on #1175 `eb2389e` on #1174 `590f477`, #1036 Ready at `6453ed5`, #998 Draft `8b95c2b` with Strix `STRIX_PROVIDER_UNAVAILABLE` / CodeQL-compat pending-handoff (G-07), #1068 Draft at `2379b37`, and G-06 #1152 `255cfd8`. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -237,7 +238,8 @@ re-fetch docs/issues/PRs/current heads 51. Keep #1172 Draft stacked on #1171 at `936311c`. Hook/manifest `kubectl apply` and `docker push` fail closed. Do not Close #1099, #1171, or #1170. 52. Keep #1173 Draft stacked on #1172 at `e465cd7`. Hook/manifest `terraform apply` and `helm install` fail closed. `terraform plan` and `helm list` stay inventory on this slice. Do not Close #1099 or #1172. 53. Keep #1174 Draft stacked on #1173 at `590f477`. Hook/manifest executable `vercel deploy` and `fly deploy` fail closed; comments and echo/printf lookalikes are not that class. Do not Close #1099 or #1173. -54. Keep #1175 Draft stacked on #1174 at `eb2389e`. Checksum digest rows without a sibling Cosign/GPG signature file fail closed. Network verify is not performed. Do not Close #1099, #1174, or #1169. Remaining unique leftover: deep directory recursion. +54. Keep #1175 Draft stacked on #1174 at `eb2389e`. Checksum digest rows without a sibling Cosign/GPG signature file fail closed. Network verify is not performed. Do not Close #1099, #1174, or #1169. +55. Keep #1176 Draft stacked on #1175 at `815e55d`. Materialized files and archive members nested past 32 path components fail closed. Do not Close #1099, #1175, #1166, or #1135. Remaining unique leftover: cloud-provider deploy writes (`aws`/`gcloud`/`az`) still inventory. ## Standards and acceptance basis From eaca008e55cc9ea31c7d4d605ee0fc2de3f166f6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 13:14:17 +0900 Subject: [PATCH 110/192] docs: record #1177 cloud-deploy successor Summary: - Snapshot 2026-09-08 04:13 UTC records Draft #1177 `af6aa91` stacked on #1176. - Executable aws/gcloud/az deploy writes fail closed. - Remaining leftover: aws s3 sync/cp and az containerapp up. Rationale: - #999 is the single writer of the product-technical gap baseline. - Do not Close #1099, #1176, or #1174. Tests: - documentation-only; detector evidence lives on #1177 (438 passed) --- docs/product-technical-gap-baseline.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6f92c50e..a2feb633 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 04:05 UTC +**Snapshot:** 2026-09-08 04:13 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 04:05 UTC snapshot +## Security-defect corpus — live 2026-09-08 04:13 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `815e55d935cd0982c67fd37c303bb1dcbdcab536` | open/Draft successor stacked on #1175 (`eb2389e...`). RED `7406d01` → GREEN `815e55d`. Plugin coverage suite 426 passed. | materialized files and zip/tar members with more than 32 path components fail as `claude-plugin-excessive-path-depth`. Bound-depth trees stay negative. Zip-slip stays #1135. Nested archives stay #1166. Oversized file-count/bytes stay oversized-package. One tree finding. Snippets are `nested-path`. Members are not extracted. | keep Draft stacked on #1175. Do not Close #1099, #1175, #1166, or #1135. | +| AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `af6aa91a2e2eed8ddbb30677b5af780eff52e19b` | open/Draft successor stacked on #1176 (`815e55d...`). RED `ee554d2` → GREEN `af6aa91`. Plugin coverage suite 438 passed. | executable `aws cloudformation deploy` and `aws deploy create-deployment` fail as `claude-plugin-aws-deploy-command`. `gcloud run|app|functions deploy` fails as `claude-plugin-gcloud-deploy-command`. `az webapp deploy` fails as `claude-plugin-az-deploy-command`. Reads, comments, and echo lookalikes stay inventory. vercel/fly stay #1174. Snippets are command labels. | keep Draft stacked on #1176. Do not Close #1099, #1176, or #1174. | +| AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `815e55d935cd0982c67fd37c303bb1dcbdcab536` | open/Draft successor stacked on #1175 (`eb2389e...`). RED `7406d01` → GREEN `815e55d`. Plugin coverage suite 426 passed. Cloud-deploy successor is #1177. | materialized files and zip/tar members with more than 32 path components fail as `claude-plugin-excessive-path-depth`. Bound-depth trees stay negative. Zip-slip stays #1135. Nested archives stay #1166. Oversized file-count/bytes stay oversized-package. One tree finding. Snippets are `nested-path`. Members are not extracted. | keep Draft stacked on #1175. Do not Close #1099, #1175, #1166, or #1135. | | AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `eb2389e616133c1497b7330d60d129e8cff5e9ac` | open/Draft successor stacked on #1174 (`590f477...`). RED `5a7abb3` → GREEN `eb2389e`. Plugin coverage suite 416 passed. Path-depth successor is #1176. | first-party checksum digest rows without a non-empty sibling `.sig` / `.asc` / `.gpg` / `.bundle` / `cosign.bundle` fail as `claude-plugin-unsigned-checksum`. Empty or symlink signatures are not signatures. Missing and comment-only checksum files are not this class. Digest mismatch stays #1169. Network Cosign/GPG verify is not performed. Snippets are checksum filenames. | keep Draft stacked on #1174. Do not Close #1099, #1174, or #1169. | | AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `590f4771e55600375902157e57863f43584225d5` | open/Draft successor stacked on #1173 (`e465cd7...`). Fail-closed RED `50b5551` → GREEN `af6b2ec`. Precision RED `8b1e262` → GREEN `590f477` after review `5136517688`. Plugin coverage suite 403 passed; new helper statements covered on Python 3.13. Unsigned-checksum successor is #1175. | hook or manifest executable `vercel deploy` fails as `claude-plugin-vercel-deploy-command`. `fly deploy` and `flyctl deploy` fail as `claude-plugin-fly-deploy-command`. Unquoted `#` comments and `echo`/`printf`/`print` lookalikes are not this class. `vercel ls` and `fly status` stay inventory. terraform/helm stay #1173. README wording is not a hook. Snippets are command labels. | keep Draft stacked on #1173. Do not Close #1099 or #1173. | | AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `e465cd71b495215e6ab7bc1ce298b588c0edfd75` | open/Draft successor stacked on #1172 (`936311c...`). RED `0e1f365` → GREEN `e465cd7`. Plugin coverage suite 375 passed; detector statements 2563/2563 on Python 3.13. Hosted-deploy successor is #1174. | hook or manifest `terraform apply` fails as `claude-plugin-terraform-apply-command`. `helm install` fails as `claude-plugin-helm-install-command`. On this slice `terraform plan`, `helm list`, `vercel deploy`, and `fly deploy` stay inventory; vercel/fly successor is #1174. kubectl/docker-push stay #1172. README terraform wording is not a hook. Snippets are command labels. | keep Draft stacked on #1172. Do not Close #1099 or #1172. | @@ -160,7 +161,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 04:05 UTC records Draft #1176 `815e55d` on #1175 `eb2389e` on #1174 `590f477`, #1036 Ready at `6453ed5`, #998 Draft `8b95c2b` with Strix `STRIX_PROVIDER_UNAVAILABLE` / CodeQL-compat pending-handoff (G-07), #1068 Draft at `2379b37`, and G-06 #1152 `255cfd8`. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 04:13 UTC records Draft #1177 `af6aa91` on #1176 `815e55d` on #1175 `eb2389e`, #1036 Ready at `6453ed5`, #998 Draft `8b95c2b` with Strix `STRIX_PROVIDER_UNAVAILABLE` / CodeQL-compat pending-handoff (G-07), #1068 Draft at `2379b37`, and G-06 #1152 `255cfd8`. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -239,7 +240,8 @@ re-fetch docs/issues/PRs/current heads 52. Keep #1173 Draft stacked on #1172 at `e465cd7`. Hook/manifest `terraform apply` and `helm install` fail closed. `terraform plan` and `helm list` stay inventory on this slice. Do not Close #1099 or #1172. 53. Keep #1174 Draft stacked on #1173 at `590f477`. Hook/manifest executable `vercel deploy` and `fly deploy` fail closed; comments and echo/printf lookalikes are not that class. Do not Close #1099 or #1173. 54. Keep #1175 Draft stacked on #1174 at `eb2389e`. Checksum digest rows without a sibling Cosign/GPG signature file fail closed. Network verify is not performed. Do not Close #1099, #1174, or #1169. -55. Keep #1176 Draft stacked on #1175 at `815e55d`. Materialized files and archive members nested past 32 path components fail closed. Do not Close #1099, #1175, #1166, or #1135. Remaining unique leftover: cloud-provider deploy writes (`aws`/`gcloud`/`az`) still inventory. +55. Keep #1176 Draft stacked on #1175 at `815e55d`. Materialized files and archive members nested past 32 path components fail closed. Do not Close #1099, #1175, #1166, or #1135. +56. Keep #1177 Draft stacked on #1176 at `af6aa91`. Executable aws/gcloud/az deploy writes fail closed; reads and echo lookalikes stay inventory. Do not Close #1099, #1176, or #1174. Remaining unique leftover: `aws s3 sync`/`cp` object-store writes and `az containerapp up`. ## Standards and acceptance basis From 78812eb2cb566dd0fb9ea80f9dd29dfce1756629 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 13:15:45 +0900 Subject: [PATCH 111/192] docs: record detector RCA and non-force stack repair --- docs/product-technical-gap-baseline.md | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a2feb633..874d7bf7 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 04:13 UTC +**Snapshot:** 2026-09-08 04:17 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,7 +68,7 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 04:13 UTC snapshot +## Security-defect corpus — live 2026-09-08 04:17 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | @@ -76,9 +76,9 @@ Responsibility boundaries: | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `af6aa91a2e2eed8ddbb30677b5af780eff52e19b` | open/Draft successor stacked on #1176 (`815e55d...`). RED `ee554d2` → GREEN `af6aa91`. Plugin coverage suite 438 passed. | executable `aws cloudformation deploy` and `aws deploy create-deployment` fail as `claude-plugin-aws-deploy-command`. `gcloud run|app|functions deploy` fails as `claude-plugin-gcloud-deploy-command`. `az webapp deploy` fails as `claude-plugin-az-deploy-command`. Reads, comments, and echo lookalikes stay inventory. vercel/fly stay #1174. Snippets are command labels. | keep Draft stacked on #1176. Do not Close #1099, #1176, or #1174. | -| AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `815e55d935cd0982c67fd37c303bb1dcbdcab536` | open/Draft successor stacked on #1175 (`eb2389e...`). RED `7406d01` → GREEN `815e55d`. Plugin coverage suite 426 passed. Cloud-deploy successor is #1177. | materialized files and zip/tar members with more than 32 path components fail as `claude-plugin-excessive-path-depth`. Bound-depth trees stay negative. Zip-slip stays #1135. Nested archives stay #1166. Oversized file-count/bytes stay oversized-package. One tree finding. Snippets are `nested-path`. Members are not extracted. | keep Draft stacked on #1175. Do not Close #1099, #1175, #1166, or #1135. | -| AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `eb2389e616133c1497b7330d60d129e8cff5e9ac` | open/Draft successor stacked on #1174 (`590f477...`). RED `5a7abb3` → GREEN `eb2389e`. Plugin coverage suite 416 passed. Path-depth successor is #1176. | first-party checksum digest rows without a non-empty sibling `.sig` / `.asc` / `.gpg` / `.bundle` / `cosign.bundle` fail as `claude-plugin-unsigned-checksum`. Empty or symlink signatures are not signatures. Missing and comment-only checksum files are not this class. Digest mismatch stays #1169. Network Cosign/GPG verify is not performed. Snippets are checksum filenames. | keep Draft stacked on #1174. Do not Close #1099, #1174, or #1169. | -| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `590f4771e55600375902157e57863f43584225d5` | open/Draft successor stacked on #1173 (`e465cd7...`). Fail-closed RED `50b5551` → GREEN `af6b2ec`. Precision RED `8b1e262` → GREEN `590f477` after review `5136517688`. Plugin coverage suite 403 passed; new helper statements covered on Python 3.13. Unsigned-checksum successor is #1175. | hook or manifest executable `vercel deploy` fails as `claude-plugin-vercel-deploy-command`. `fly deploy` and `flyctl deploy` fail as `claude-plugin-fly-deploy-command`. Unquoted `#` comments and `echo`/`printf`/`print` lookalikes are not this class. `vercel ls` and `fly status` stay inventory. terraform/helm stay #1173. README wording is not a hook. Snippets are command labels. | keep Draft stacked on #1173. Do not Close #1099 or #1173. | +| AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `e85473a37832b6cb02fd8a03e6711c4039199e99` | open/Draft on current #1175 (`2399792...`). Path-depth RED/GREEN `7406d01`/`815e55d`; predecessor suite 426 passed. Two-parent merge `e85473a...` integrates current #1175 and inherited #1174 precision without changing the five-file delta; compare is 3 ahead / 0 behind and mergeable. | files/archive members deeper than 32 components fail as `claude-plugin-excessive-path-depth`; bound-depth and sibling archive classes remain distinct. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1175, #1166, or #1135. | +| AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `2399792f6cc4ced2652130aed93f3016d085a97a` | open/Draft on current #1174 (`746501e...`). Checksum RED/GREEN `5a7abb3`/`eb2389e`; predecessor suite 416 passed. Two-parent merge `2399792...` integrates #1174 precision without changing the six-file delta; compare is 3 ahead / 0 behind and mergeable. | unsigned first-party digest rows fail closed; empty/symlink signatures do not qualify, mismatch stays #1169, and network verification is not claimed. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1174, or #1169. | +| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `746501ec718cf248f69ca00f385c813531d6167a` | open/Draft successor stacked on #1173 (`e465cd7...`). Original RED/GREEN `50b5551`/`af6b2ec`; hook precision `8b1e262`/`590f477`. Follow-up RED `e257d90` proves raw whole-manifest scanning still classified description prose and reporting-only command values; GREEN `746501e` parses structural manifest `command` strings and preserves later real deploy commands. Python AST validation passed; no hosted workflow exists on the custom base. | executable hook or manifest `vercel deploy` / `fly(?:ctl)? deploy` fail closed, while comments, description prose, and `echo`/`printf`/`print` command values are not this class. | keep Draft stacked on #1173; obtain stacked integration evidence. Do not Close #1099 or #1173. | | AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `e465cd71b495215e6ab7bc1ce298b588c0edfd75` | open/Draft successor stacked on #1172 (`936311c...`). RED `0e1f365` → GREEN `e465cd7`. Plugin coverage suite 375 passed; detector statements 2563/2563 on Python 3.13. Hosted-deploy successor is #1174. | hook or manifest `terraform apply` fails as `claude-plugin-terraform-apply-command`. `helm install` fails as `claude-plugin-helm-install-command`. On this slice `terraform plan`, `helm list`, `vercel deploy`, and `fly deploy` stay inventory; vercel/fly successor is #1174. kubectl/docker-push stay #1172. README terraform wording is not a hook. Snippets are command labels. | keep Draft stacked on #1172. Do not Close #1099 or #1172. | | AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. Terraform/helm successor is #1173. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. On this slice `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory; terraform/helm successor is #1173. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | | AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. Deployment-write successor is #1172. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | @@ -126,7 +126,7 @@ Responsibility boundaries: | AppGuardrail #1130, Jules webhook SSRF subset, exact head `0243a1a5a1cef758b14ae85f87b2ea1dd86e9e82` | converted to Draft at 05:37 UTC. Effective delta is `set_webhook`/route plumbing, a regex `try`/`except ValueError` lookaround, and `.jules/sentinel.md`. No runtime tests and no AST FP/FN contract. Canonical owner remains #1107. | same storage-boundary SSRF class as #1107, implemented as a weaker regex-only slice | keep Draft. Do not Close until complete carryover onto #1107 is verified. Do not race #1107 to `develop`. | | AppGuardrail #972 / Issue #927, branch `feat/scan-assurance-927`, exact head `c488cfffe4dd95a9be8b8ed99e77a86cc8d5d81f` | open/Draft. Non-force restack onto protected `develop@e71d37e` completed 05:37 UTC (`ahead` of predecessor `4ba738a...` by the merge commit only). REST `mergeable=MERGEABLE`, `mergeStateStatus=BLOCKED`. Fresh exact-head checks are in flight and do not inherit predecessor GREEN. | `0 findings` must not render as `clean` unless repository/commit identity, findings digest, detector completion, requested engines, scope, freshness, and gate accounting all verify. Ambiguous evidence is `untrusted`/`failed`/`incomplete`. | keep Draft through current-head Tests/security/SAST/CodeQL/dedicated assurance coverage and independent review. #1005 remains the report-consumer successor and must restack after this head is stable. Do not Close #927. | | AppGuardrail #1006 / Issue #928, branch `feat/issue-928-evidence-handoff`, exact head `35c28e22b5d50f1da943718cdb1984dcee098d62` | open/non-Draft. Non-force restack onto `develop@e71d37e` completed 05:37 UTC. REST `mergeable=MERGEABLE`, `mergeStateStatus=BLOCKED`. Dashboard clipboard/UI slice remains out of scope. | transport-neutral, redacted, digest-verified remediation bundle so an agent workflow cannot copy hostile or unbounded evidence | require fresh exact-head checks after restack; keep the UI/CSP/Storybook slice as a later G-03 successor. Do not Close #928. | -| AppGuardrail #1036, shared-skill supply-chain detection, exact head `6453ed599b9127ac206806c60b1f0cb57cd74f29` | open/Ready/mergeable. Current-head CodeRabbit finding `3953701459` identified a real placeholder FN: block-YAML-only syntax and `SKILL.md`-only path scope admitted quoted JSON and flow-YAML placeholders in supported `skill.json` / `*.skill.md` surfaces. Regression `976e8f4...` adds production-path positives and rendered-name/description-prose negatives; implementation `6453ed5...` adds bounded structural forms and the two missing paths. Nine exact-head workflows are freshly queued, including Tests `34181802375` and CodeQL PR `34181802338`; predecessor GREEN/approval does not transfer. | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; placeholder evidence must cover every declared manifest path without treating prose as a structural name. | keep Ready for current-head review and ordinary auto-merge, but require exact-head Tests/security/CodeQL plus qualifying independent approval and evidence-backed thread resolution before protection may merge. | +| AppGuardrail #1036, shared-skill supply-chain detection, exact head `a3ebce93da53c85b239c55f4653bad9c06f6a89f` | open/Ready/mergeable. RED `976e8f4...` adds supported block/flow/JSON placeholder positives and rendered-name/description-prose negatives. Implementation `6453ed5...` added paths/forms, but exact-head Tests `34181802375` failed all 9 placeholder positives while 1,027 tests passed: doubled backslashes in a YAML single-quoted regex made `\\t`/`\\{` literal text. Review `3953964264` also exposed multi-property JSON. GREEN `a3ebce9...` normalizes escapes and allows bounded scalar siblings before/after structural `name`; nine fresh workflows including Tests `34185415928` and CodeQL `34185415933` are queued. | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; regex serialization is executable detector correctness, and evidence must cover every declared path without treating prose as a structural name. | keep Ready with ordinary auto-merge, but require unchanged-head Checks, qualifying independent approval/current-head review, and evidence-backed thread resolution before protection may merge. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; Tests and Security Process are terminal success; Security Scan, SAST, CodeQL, Strix, Noema and OpenCode remain queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | @@ -161,7 +161,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 04:13 UTC records Draft #1177 `af6aa91` on #1176 `815e55d` on #1175 `eb2389e`, #1036 Ready at `6453ed5`, #998 Draft `8b95c2b` with Strix `STRIX_PROVIDER_UNAVAILABLE` / CodeQL-compat pending-handoff (G-07), #1068 Draft at `2379b37`, and G-06 #1152 `255cfd8`. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 04:17 UTC records #1036 Ready at `a3ebce9` after exact-log regex-escape RCA and Draft #1176 `e85473a` on #1175 `2399792` on #1174 `746501e` after non-force restacks; newer independent rows in this same snapshot remain preserved. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -190,7 +190,7 @@ re-fetch docs/issues/PRs/current heads 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. 3. Keep #1068 on source-neutral exact head `2379b37f05b12af8e22990965d42da2e69b9c611` as the single Draft hostless/unresolved-DNS lane. The head is an empty-file Strix-retrigger descendant of `325d48e...` / `a06a96fc...` and adds no security delta; predecessor Checks do not transfer; no independent approval exists; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. -5. Keep #1036 Ready on exact head `6453ed599b9127ac206806c60b1f0cb57cd74f29`. Regression `976e8f4...` and implementation `6453ed5...` repair supported JSON/flow-YAML placeholder formats and paths; nine exact-head workflows are freshly queued and the review thread remains open. Ordinary squash auto-merge is configured but must remain protection-blocked until current-head Checks, CodeQL/OpenCode/Strix/Noema and review requirements pass. Do not Close or transfer predecessor approval. +5. Keep #1036 Ready on exact head `a3ebce93da53c85b239c55f4653bad9c06f6a89f`. Failed Tests `34181802375` prove the doubled-escape regression; GREEN `a3ebce9...` restores structural forms and bounded JSON siblings. Nine fresh workflows are queued; auto-merge remains protection-blocked until unchanged-head Checks and review pass. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. @@ -238,9 +238,9 @@ re-fetch docs/issues/PRs/current heads 50. Keep #1171 Draft stacked on #1170 at `9370a0d`. Host cookie/token stores beyond browser profiles fail closed. Do not Close #1099, #1170, #1150, or #1137. 51. Keep #1172 Draft stacked on #1171 at `936311c`. Hook/manifest `kubectl apply` and `docker push` fail closed. Do not Close #1099, #1171, or #1170. 52. Keep #1173 Draft stacked on #1172 at `e465cd7`. Hook/manifest `terraform apply` and `helm install` fail closed. `terraform plan` and `helm list` stay inventory on this slice. Do not Close #1099 or #1172. -53. Keep #1174 Draft stacked on #1173 at `590f477`. Hook/manifest executable `vercel deploy` and `fly deploy` fail closed; comments and echo/printf lookalikes are not that class. Do not Close #1099 or #1173. -54. Keep #1175 Draft stacked on #1174 at `eb2389e`. Checksum digest rows without a sibling Cosign/GPG signature file fail closed. Network verify is not performed. Do not Close #1099, #1174, or #1169. -55. Keep #1176 Draft stacked on #1175 at `815e55d`. Materialized files and archive members nested past 32 path components fail closed. Do not Close #1099, #1175, #1166, or #1135. +53. Keep #1174 Draft stacked on #1173 at `746501e`. Manifest prose/reporting-command RED `e257d90` → structural command-source GREEN `746501e`; AST passes but stacked integration evidence is absent. Do not Close #1099 or #1173. +54. Keep #1175 Draft at `2399792`, non-force-restacked on #1174 with six-file checksum delta unchanged and compare 3 ahead / 0 behind. Do not Close #1099, #1174, or #1169. +55. Keep #1176 Draft at `e85473a`, non-force-restacked on #1175 with five-file path-depth delta unchanged and compare 3 ahead / 0 behind. Do not Close #1099, #1175, #1166, or #1135. 56. Keep #1177 Draft stacked on #1176 at `af6aa91`. Executable aws/gcloud/az deploy writes fail closed; reads and echo lookalikes stay inventory. Do not Close #1099, #1176, or #1174. Remaining unique leftover: `aws s3 sync`/`cp` object-store writes and `az containerapp up`. ## Standards and acceptance basis From 97c1c6af819ea45693fbd434f057f561c642dee3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 13:22:08 +0900 Subject: [PATCH 112/192] docs: record cloud-deploy precision and restack --- docs/product-technical-gap-baseline.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 874d7bf7..1321ad30 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 04:17 UTC +**Snapshot:** 2026-09-08 04:22 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 04:17 UTC snapshot +## Security-defect corpus — live 2026-09-08 04:22 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `af6aa91a2e2eed8ddbb30677b5af780eff52e19b` | open/Draft successor stacked on #1176 (`815e55d...`). RED `ee554d2` → GREEN `af6aa91`. Plugin coverage suite 438 passed. | executable `aws cloudformation deploy` and `aws deploy create-deployment` fail as `claude-plugin-aws-deploy-command`. `gcloud run|app|functions deploy` fails as `claude-plugin-gcloud-deploy-command`. `az webapp deploy` fails as `claude-plugin-az-deploy-command`. Reads, comments, and echo lookalikes stay inventory. vercel/fly stay #1174. Snippets are command labels. | keep Draft stacked on #1176. Do not Close #1099, #1176, or #1174. | +| AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `a1ca31ff1fbc02c1d2af109b1b08030006b23da3` | open/Draft successor on current #1176 (`e85473a...`). Original RED/GREEN `ee554d2`/`af6aa91`; follow-up manifest prose/reporting RED `481e171` and structural command-source GREEN two-parent merge `a1ca31f`. Exact detector/test AST passed; compare is 4 ahead / 0 behind with the five-file cloud delta preserved and mergeable. No hosted workflow exists on the custom base. | actual AWS/gcloud/Azure deploy command values fail closed; description prose and `echo`/`printf`/`print` command values remain negative, while a later real command stays positive. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1176, or #1174. | | AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `e85473a37832b6cb02fd8a03e6711c4039199e99` | open/Draft on current #1175 (`2399792...`). Path-depth RED/GREEN `7406d01`/`815e55d`; predecessor suite 426 passed. Two-parent merge `e85473a...` integrates current #1175 and inherited #1174 precision without changing the five-file delta; compare is 3 ahead / 0 behind and mergeable. | files/archive members deeper than 32 components fail as `claude-plugin-excessive-path-depth`; bound-depth and sibling archive classes remain distinct. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1175, #1166, or #1135. | | AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `2399792f6cc4ced2652130aed93f3016d085a97a` | open/Draft on current #1174 (`746501e...`). Checksum RED/GREEN `5a7abb3`/`eb2389e`; predecessor suite 416 passed. Two-parent merge `2399792...` integrates #1174 precision without changing the six-file delta; compare is 3 ahead / 0 behind and mergeable. | unsigned first-party digest rows fail closed; empty/symlink signatures do not qualify, mismatch stays #1169, and network verification is not claimed. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1174, or #1169. | | AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `746501ec718cf248f69ca00f385c813531d6167a` | open/Draft successor stacked on #1173 (`e465cd7...`). Original RED/GREEN `50b5551`/`af6b2ec`; hook precision `8b1e262`/`590f477`. Follow-up RED `e257d90` proves raw whole-manifest scanning still classified description prose and reporting-only command values; GREEN `746501e` parses structural manifest `command` strings and preserves later real deploy commands. Python AST validation passed; no hosted workflow exists on the custom base. | executable hook or manifest `vercel deploy` / `fly(?:ctl)? deploy` fail closed, while comments, description prose, and `echo`/`printf`/`print` command values are not this class. | keep Draft stacked on #1173; obtain stacked integration evidence. Do not Close #1099 or #1173. | @@ -161,7 +161,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 04:17 UTC records #1036 Ready at `a3ebce9` after exact-log regex-escape RCA and Draft #1176 `e85473a` on #1175 `2399792` on #1174 `746501e` after non-force restacks; newer independent rows in this same snapshot remain preserved. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 04:22 UTC records #1036 Ready at `a3ebce9` and Draft stack #1177 `a1ca31f` → #1176 `e85473a` → #1175 `2399792` → #1174 `746501e`, all non-force-restacked with distinct deltas preserved; newer independent rows in this snapshot remain preserved. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -241,7 +241,7 @@ re-fetch docs/issues/PRs/current heads 53. Keep #1174 Draft stacked on #1173 at `746501e`. Manifest prose/reporting-command RED `e257d90` → structural command-source GREEN `746501e`; AST passes but stacked integration evidence is absent. Do not Close #1099 or #1173. 54. Keep #1175 Draft at `2399792`, non-force-restacked on #1174 with six-file checksum delta unchanged and compare 3 ahead / 0 behind. Do not Close #1099, #1174, or #1169. 55. Keep #1176 Draft at `e85473a`, non-force-restacked on #1175 with five-file path-depth delta unchanged and compare 3 ahead / 0 behind. Do not Close #1099, #1175, #1166, or #1135. -56. Keep #1177 Draft stacked on #1176 at `af6aa91`. Executable aws/gcloud/az deploy writes fail closed; reads and echo lookalikes stay inventory. Do not Close #1099, #1176, or #1174. Remaining unique leftover: `aws s3 sync`/`cp` object-store writes and `az containerapp up`. +56. Keep #1177 Draft at `a1ca31f`, non-force-restacked on #1176 with manifest prose/reporting RED `481e171` and structural command-source GREEN. Compare is 4 ahead / 0 behind; no hosted stacked Checks exist. Do not Close #1099, #1176, or #1174. Remaining unique leftover: `aws s3 sync`/`cp` object-store writes and `az containerapp up`. ## Standards and acceptance basis From c940a6db0046f4cfc30b9bdb00fe762fdcb53d91 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 13:36:17 +0900 Subject: [PATCH 113/192] docs(gaps): record escaped homoglyph and exfiltration repairs --- docs/product-technical-gap-baseline.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1321ad30..dee4d6ef 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 04:22 UTC +**Snapshot:** 2026-09-08 04:36 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -126,7 +126,7 @@ Responsibility boundaries: | AppGuardrail #1130, Jules webhook SSRF subset, exact head `0243a1a5a1cef758b14ae85f87b2ea1dd86e9e82` | converted to Draft at 05:37 UTC. Effective delta is `set_webhook`/route plumbing, a regex `try`/`except ValueError` lookaround, and `.jules/sentinel.md`. No runtime tests and no AST FP/FN contract. Canonical owner remains #1107. | same storage-boundary SSRF class as #1107, implemented as a weaker regex-only slice | keep Draft. Do not Close until complete carryover onto #1107 is verified. Do not race #1107 to `develop`. | | AppGuardrail #972 / Issue #927, branch `feat/scan-assurance-927`, exact head `c488cfffe4dd95a9be8b8ed99e77a86cc8d5d81f` | open/Draft. Non-force restack onto protected `develop@e71d37e` completed 05:37 UTC (`ahead` of predecessor `4ba738a...` by the merge commit only). REST `mergeable=MERGEABLE`, `mergeStateStatus=BLOCKED`. Fresh exact-head checks are in flight and do not inherit predecessor GREEN. | `0 findings` must not render as `clean` unless repository/commit identity, findings digest, detector completion, requested engines, scope, freshness, and gate accounting all verify. Ambiguous evidence is `untrusted`/`failed`/`incomplete`. | keep Draft through current-head Tests/security/SAST/CodeQL/dedicated assurance coverage and independent review. #1005 remains the report-consumer successor and must restack after this head is stable. Do not Close #927. | | AppGuardrail #1006 / Issue #928, branch `feat/issue-928-evidence-handoff`, exact head `35c28e22b5d50f1da943718cdb1984dcee098d62` | open/non-Draft. Non-force restack onto `develop@e71d37e` completed 05:37 UTC. REST `mergeable=MERGEABLE`, `mergeStateStatus=BLOCKED`. Dashboard clipboard/UI slice remains out of scope. | transport-neutral, redacted, digest-verified remediation bundle so an agent workflow cannot copy hostile or unbounded evidence | require fresh exact-head checks after restack; keep the UI/CSP/Storybook slice as a later G-03 successor. Do not Close #928. | -| AppGuardrail #1036, shared-skill supply-chain detection, exact head `a3ebce93da53c85b239c55f4653bad9c06f6a89f` | open/Ready/mergeable. RED `976e8f4...` adds supported block/flow/JSON placeholder positives and rendered-name/description-prose negatives. Implementation `6453ed5...` added paths/forms, but exact-head Tests `34181802375` failed all 9 placeholder positives while 1,027 tests passed: doubled backslashes in a YAML single-quoted regex made `\\t`/`\\{` literal text. Review `3953964264` also exposed multi-property JSON. GREEN `a3ebce9...` normalizes escapes and allows bounded scalar siblings before/after structural `name`; nine fresh workflows including Tests `34185415928` and CodeQL `34185415933` are queued. | installable skill/agent manifests can hide mixed-script identifiers, prompt-injection/exfiltration directives, or unresolved placeholders; regex serialization is executable detector correctness, and evidence must cover every declared path without treating prose as a structural name. | keep Ready with ordinary auto-merge, but require unchanged-head Checks, qualifying independent approval/current-head review, and evidence-backed thread resolution before protection may merge. | +| AppGuardrail #1036, shared-skill supply-chain detection, exact head `0ef5715468acb674aeb0f3833e820996d4644871` | open/Ready/mergeable. CodeRabbit review `PRR_kwDOSqamhM8AAAABMjRduQ` exposed raw JSON `\\u04xx` mixed-script evasion and URL-first exfiltration ordering. RED `14697f6...` → GREEN `53faaeb...` covers escaped mixed-script while escaped Cyrillic-only, ASCII, and description prose stay negative. RED `f432a09...` → GREEN `0ef5715...` covers data-first and URL-first directives while documentation URLs without an exfiltration verb stay negative. Exact YAML/regex probes and changed-test AST pass; nine fresh workflows including Tests `34187414899` and CodeQL `34187414913` are queued. | installable skill/agent manifests can hide mixed-script identifiers via JSON escape serialization or reorder endpoint/data wording; detector evidence must preserve mixed-script, structural-name, directive-verb, and prose-negative boundaries. | keep Ready with ordinary auto-merge, but require unchanged-head Checks, qualifying independent approval/current-head review, and evidence-backed thread resolution before protection may merge. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; Tests and Security Process are terminal success; Security Scan, SAST, CodeQL, Strix, Noema and OpenCode remain queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | @@ -161,7 +161,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 04:22 UTC records #1036 Ready at `a3ebce9` and Draft stack #1177 `a1ca31f` → #1176 `e85473a` → #1175 `2399792` → #1174 `746501e`, all non-force-restacked with distinct deltas preserved; newer independent rows in this snapshot remain preserved. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 04:36 UTC records #1036 Ready at `0ef5715` and Draft stack #1177 `a1ca31f` → #1176 `e85473a` → #1175 `2399792` → #1174 `746501e`, all non-force-restacked with distinct deltas preserved; newer independent rows in this snapshot remain preserved. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -190,7 +190,7 @@ re-fetch docs/issues/PRs/current heads 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. 3. Keep #1068 on source-neutral exact head `2379b37f05b12af8e22990965d42da2e69b9c611` as the single Draft hostless/unresolved-DNS lane. The head is an empty-file Strix-retrigger descendant of `325d48e...` / `a06a96fc...` and adds no security delta; predecessor Checks do not transfer; no independent approval exists; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. -5. Keep #1036 Ready on exact head `a3ebce93da53c85b239c55f4653bad9c06f6a89f`. Failed Tests `34181802375` prove the doubled-escape regression; GREEN `a3ebce9...` restores structural forms and bounded JSON siblings. Nine fresh workflows are queued; auto-merge remains protection-blocked until unchanged-head Checks and review pass. +5. Keep #1036 Ready on exact head `0ef5715468acb674aeb0f3833e820996d4644871`. RED/GREEN `14697f6...`/`53faaeb...` closes JSON-escaped Cyrillic mixed-script evasion; `f432a09...`/`0ef5715...` closes URL-first exfiltration ordering while preserving negative boundaries. Nine fresh workflows are queued; auto-merge remains protection-blocked until unchanged-head Checks and review pass. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. From c35e00b4f2e32a4f1ca62212bde22f4b00fcc316 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 14:06:24 +0900 Subject: [PATCH 114/192] docs: record #1179 object-store and containerapp successor Exact head 8ca0628 stacked on #1177 fails closed on aws s3 sync/cp and az containerapp up. Relates to #1099. --- docs/product-technical-gap-baseline.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index dee4d6ef..a24ce84a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 04:36 UTC +**Snapshot:** 2026-09-08 05:05 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 04:22 UTC snapshot +## Security-defect corpus — live 2026-09-08 05:05 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `a1ca31ff1fbc02c1d2af109b1b08030006b23da3` | open/Draft successor on current #1176 (`e85473a...`). Original RED/GREEN `ee554d2`/`af6aa91`; follow-up manifest prose/reporting RED `481e171` and structural command-source GREEN two-parent merge `a1ca31f`. Exact detector/test AST passed; compare is 4 ahead / 0 behind with the five-file cloud delta preserved and mergeable. No hosted workflow exists on the custom base. | actual AWS/gcloud/Azure deploy command values fail closed; description prose and `echo`/`printf`/`print` command values remain negative, while a later real command stays positive. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1176, or #1174. | +| AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `8ca0628d96d5dc4db3a78de6e620a1ab4049b0e9` | open/Draft successor stacked on live #1177 (`a1ca31f...`). RED `97cdbd0` → GREEN `8ca0628`. Plugin coverage suite 453 passed. | executable `aws s3 sync` and `aws s3 cp` fail as `claude-plugin-aws-s3-write-command`. `az containerapp up` fails as `claude-plugin-az-containerapp-up-command`. `aws s3 ls`, comments, echo lookalikes, and README wording stay inventory. CloudFormation stays #1177. Snippets are command labels. | keep Draft stacked on #1177. Do not Close #1099, #1177, or #1174. | +| AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `a1ca31ff1fbc02c1d2af109b1b08030006b23da3` | open/Draft successor on current #1176 (`e85473a...`). Original RED/GREEN `ee554d2`/`af6aa91`; follow-up manifest prose/reporting RED `481e171` and structural command-source GREEN two-parent merge `a1ca31f`. Exact detector/test AST passed; compare is 4 ahead / 0 behind with the five-file cloud delta preserved and mergeable. No hosted workflow exists on the custom base. Object-store successor is #1179. | actual AWS/gcloud/Azure deploy command values fail closed; description prose and `echo`/`printf`/`print` command values remain negative, while a later real command stays positive. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1176, or #1174. | | AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `e85473a37832b6cb02fd8a03e6711c4039199e99` | open/Draft on current #1175 (`2399792...`). Path-depth RED/GREEN `7406d01`/`815e55d`; predecessor suite 426 passed. Two-parent merge `e85473a...` integrates current #1175 and inherited #1174 precision without changing the five-file delta; compare is 3 ahead / 0 behind and mergeable. | files/archive members deeper than 32 components fail as `claude-plugin-excessive-path-depth`; bound-depth and sibling archive classes remain distinct. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1175, #1166, or #1135. | | AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `2399792f6cc4ced2652130aed93f3016d085a97a` | open/Draft on current #1174 (`746501e...`). Checksum RED/GREEN `5a7abb3`/`eb2389e`; predecessor suite 416 passed. Two-parent merge `2399792...` integrates #1174 precision without changing the six-file delta; compare is 3 ahead / 0 behind and mergeable. | unsigned first-party digest rows fail closed; empty/symlink signatures do not qualify, mismatch stays #1169, and network verification is not claimed. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1174, or #1169. | | AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `746501ec718cf248f69ca00f385c813531d6167a` | open/Draft successor stacked on #1173 (`e465cd7...`). Original RED/GREEN `50b5551`/`af6b2ec`; hook precision `8b1e262`/`590f477`. Follow-up RED `e257d90` proves raw whole-manifest scanning still classified description prose and reporting-only command values; GREEN `746501e` parses structural manifest `command` strings and preserves later real deploy commands. Python AST validation passed; no hosted workflow exists on the custom base. | executable hook or manifest `vercel deploy` / `fly(?:ctl)? deploy` fail closed, while comments, description prose, and `echo`/`printf`/`print` command values are not this class. | keep Draft stacked on #1173; obtain stacked integration evidence. Do not Close #1099 or #1173. | @@ -161,7 +162,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 04:36 UTC records #1036 Ready at `0ef5715` and Draft stack #1177 `a1ca31f` → #1176 `e85473a` → #1175 `2399792` → #1174 `746501e`, all non-force-restacked with distinct deltas preserved; newer independent rows in this snapshot remain preserved. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 05:05 UTC records Draft #1179 `8ca0628` on #1177 `a1ca31f` → #1176 `e85473a` → #1175 `2399792` → #1174 `746501e`, #1036 Ready at `0ef5715`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -241,7 +242,8 @@ re-fetch docs/issues/PRs/current heads 53. Keep #1174 Draft stacked on #1173 at `746501e`. Manifest prose/reporting-command RED `e257d90` → structural command-source GREEN `746501e`; AST passes but stacked integration evidence is absent. Do not Close #1099 or #1173. 54. Keep #1175 Draft at `2399792`, non-force-restacked on #1174 with six-file checksum delta unchanged and compare 3 ahead / 0 behind. Do not Close #1099, #1174, or #1169. 55. Keep #1176 Draft at `e85473a`, non-force-restacked on #1175 with five-file path-depth delta unchanged and compare 3 ahead / 0 behind. Do not Close #1099, #1175, #1166, or #1135. -56. Keep #1177 Draft at `a1ca31f`, non-force-restacked on #1176 with manifest prose/reporting RED `481e171` and structural command-source GREEN. Compare is 4 ahead / 0 behind; no hosted stacked Checks exist. Do not Close #1099, #1176, or #1174. Remaining unique leftover: `aws s3 sync`/`cp` object-store writes and `az containerapp up`. +56. Keep #1177 Draft at `a1ca31f`, non-force-restacked on #1176 with manifest prose/reporting RED `481e171` and structural command-source GREEN. Compare is 4 ahead / 0 behind; no hosted stacked Checks exist. Do not Close #1099, #1176, or #1174. +57. Keep #1179 Draft stacked on #1177 at `8ca0628`. Executable `aws s3 sync`/`cp` and `az containerapp up` fail closed; `aws s3 ls` stays inventory. Do not Close #1099, #1177, or #1174. Remaining unique leftover: `npm publish` / `pypi upload` / `cargo publish` package-registry writes. ## Standards and acceptance basis From 194ddfec0df4b66f9bc0c0a8509264b45b49aca8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 14:12:27 +0900 Subject: [PATCH 115/192] docs: record #1180 registry-publish successor Summary: - Snapshot 2026-09-08 05:11 UTC records Draft #1180 `ffcb8ef` stacked on #1179. - Executable npm publish, twine upload, and cargo publish fail closed. - Remaining leftover: pnpm/yarn/uv/poetry publish. Rationale: - #999 is the single writer of the product-technical gap baseline. - Do not Close #1099 or #1179. Tests: - documentation-only; detector evidence lives on #1180 (465 passed) --- docs/product-technical-gap-baseline.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index a24ce84a..e673332c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 05:05 UTC +**Snapshot:** 2026-09-08 05:11 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,14 +68,15 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 05:05 UTC snapshot +## Security-defect corpus — live 2026-09-08 05:11 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `8ca0628d96d5dc4db3a78de6e620a1ab4049b0e9` | open/Draft successor stacked on live #1177 (`a1ca31f...`). RED `97cdbd0` → GREEN `8ca0628`. Plugin coverage suite 453 passed. | executable `aws s3 sync` and `aws s3 cp` fail as `claude-plugin-aws-s3-write-command`. `az containerapp up` fails as `claude-plugin-az-containerapp-up-command`. `aws s3 ls`, comments, echo lookalikes, and README wording stay inventory. CloudFormation stays #1177. Snippets are command labels. | keep Draft stacked on #1177. Do not Close #1099, #1177, or #1174. | +| AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `ffcb8efa8b69adf3d842ed7ce509012f273ebb33` | open/Draft successor stacked on #1179 (`8ca0628...`). RED `3253383` → GREEN `ffcb8ef`. Plugin coverage suite 465 passed. | executable `npm publish` fails as `claude-plugin-npm-publish-command`. `twine upload` fails as `claude-plugin-pypi-upload-command`. `cargo publish` fails as `claude-plugin-cargo-publish-command`. `npm pack`, `cargo check`, comments, echo lookalikes, README, and description prose stay inventory. s3 writes stay #1179. Snippets are command labels. | keep Draft stacked on #1179. Do not Close #1099 or #1179. | +| AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `8ca0628d96d5dc4db3a78de6e620a1ab4049b0e9` | open/Draft successor stacked on live #1177 (`a1ca31f...`). RED `97cdbd0` → GREEN `8ca0628`. Plugin coverage suite 453 passed. Registry-publish successor is #1180. | executable `aws s3 sync` and `aws s3 cp` fail as `claude-plugin-aws-s3-write-command`. `az containerapp up` fails as `claude-plugin-az-containerapp-up-command`. `aws s3 ls`, comments, echo lookalikes, and README wording stay inventory. CloudFormation stays #1177. Snippets are command labels. | keep Draft stacked on #1177. Do not Close #1099, #1177, or #1174. | | AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `a1ca31ff1fbc02c1d2af109b1b08030006b23da3` | open/Draft successor on current #1176 (`e85473a...`). Original RED/GREEN `ee554d2`/`af6aa91`; follow-up manifest prose/reporting RED `481e171` and structural command-source GREEN two-parent merge `a1ca31f`. Exact detector/test AST passed; compare is 4 ahead / 0 behind with the five-file cloud delta preserved and mergeable. No hosted workflow exists on the custom base. Object-store successor is #1179. | actual AWS/gcloud/Azure deploy command values fail closed; description prose and `echo`/`printf`/`print` command values remain negative, while a later real command stays positive. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1176, or #1174. | | AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `e85473a37832b6cb02fd8a03e6711c4039199e99` | open/Draft on current #1175 (`2399792...`). Path-depth RED/GREEN `7406d01`/`815e55d`; predecessor suite 426 passed. Two-parent merge `e85473a...` integrates current #1175 and inherited #1174 precision without changing the five-file delta; compare is 3 ahead / 0 behind and mergeable. | files/archive members deeper than 32 components fail as `claude-plugin-excessive-path-depth`; bound-depth and sibling archive classes remain distinct. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1175, #1166, or #1135. | | AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `2399792f6cc4ced2652130aed93f3016d085a97a` | open/Draft on current #1174 (`746501e...`). Checksum RED/GREEN `5a7abb3`/`eb2389e`; predecessor suite 416 passed. Two-parent merge `2399792...` integrates #1174 precision without changing the six-file delta; compare is 3 ahead / 0 behind and mergeable. | unsigned first-party digest rows fail closed; empty/symlink signatures do not qualify, mismatch stays #1169, and network verification is not claimed. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1174, or #1169. | @@ -162,7 +163,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 05:05 UTC records Draft #1179 `8ca0628` on #1177 `a1ca31f` → #1176 `e85473a` → #1175 `2399792` → #1174 `746501e`, #1036 Ready at `0ef5715`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 05:11 UTC records Draft #1180 `ffcb8ef` on #1179 `8ca0628` on #1177 `a1ca31f`, #1036 Ready at `0ef5715`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -243,7 +244,8 @@ re-fetch docs/issues/PRs/current heads 54. Keep #1175 Draft at `2399792`, non-force-restacked on #1174 with six-file checksum delta unchanged and compare 3 ahead / 0 behind. Do not Close #1099, #1174, or #1169. 55. Keep #1176 Draft at `e85473a`, non-force-restacked on #1175 with five-file path-depth delta unchanged and compare 3 ahead / 0 behind. Do not Close #1099, #1175, #1166, or #1135. 56. Keep #1177 Draft at `a1ca31f`, non-force-restacked on #1176 with manifest prose/reporting RED `481e171` and structural command-source GREEN. Compare is 4 ahead / 0 behind; no hosted stacked Checks exist. Do not Close #1099, #1176, or #1174. -57. Keep #1179 Draft stacked on #1177 at `8ca0628`. Executable `aws s3 sync`/`cp` and `az containerapp up` fail closed; `aws s3 ls` stays inventory. Do not Close #1099, #1177, or #1174. Remaining unique leftover: `npm publish` / `pypi upload` / `cargo publish` package-registry writes. +57. Keep #1179 Draft stacked on #1177 at `8ca0628`. Executable `aws s3 sync`/`cp` and `az containerapp up` fail closed; `aws s3 ls` stays inventory. Do not Close #1099, #1177, or #1174. +58. Keep #1180 Draft stacked on #1179 at `ffcb8ef`. Executable `npm publish`, `twine upload`, and `cargo publish` fail closed. Do not Close #1099 or #1179. Remaining unique leftover: `pnpm publish` / `yarn npm publish` / `uv publish` / `poetry publish`. ## Standards and acceptance basis From df9c8d17119bb554e0fd8f27a9a46a817c6a1660 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 14:33:17 +0900 Subject: [PATCH 116/192] docs: refresh plugin detector stack evidence --- docs/product-technical-gap-baseline.md | 34 +++++++++++++------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e673332c..c0592a28 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 05:11 UTC +**Snapshot:** 2026-09-08 05:25 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,20 +68,20 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 05:11 UTC snapshot +## Security-defect corpus — live 2026-09-08 05:25 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `ffcb8efa8b69adf3d842ed7ce509012f273ebb33` | open/Draft successor stacked on #1179 (`8ca0628...`). RED `3253383` → GREEN `ffcb8ef`. Plugin coverage suite 465 passed. | executable `npm publish` fails as `claude-plugin-npm-publish-command`. `twine upload` fails as `claude-plugin-pypi-upload-command`. `cargo publish` fails as `claude-plugin-cargo-publish-command`. `npm pack`, `cargo check`, comments, echo lookalikes, README, and description prose stay inventory. s3 writes stay #1179. Snippets are command labels. | keep Draft stacked on #1179. Do not Close #1099 or #1179. | -| AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `8ca0628d96d5dc4db3a78de6e620a1ab4049b0e9` | open/Draft successor stacked on live #1177 (`a1ca31f...`). RED `97cdbd0` → GREEN `8ca0628`. Plugin coverage suite 453 passed. Registry-publish successor is #1180. | executable `aws s3 sync` and `aws s3 cp` fail as `claude-plugin-aws-s3-write-command`. `az containerapp up` fails as `claude-plugin-az-containerapp-up-command`. `aws s3 ls`, comments, echo lookalikes, and README wording stay inventory. CloudFormation stays #1177. Snippets are command labels. | keep Draft stacked on #1177. Do not Close #1099, #1177, or #1174. | -| AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `a1ca31ff1fbc02c1d2af109b1b08030006b23da3` | open/Draft successor on current #1176 (`e85473a...`). Original RED/GREEN `ee554d2`/`af6aa91`; follow-up manifest prose/reporting RED `481e171` and structural command-source GREEN two-parent merge `a1ca31f`. Exact detector/test AST passed; compare is 4 ahead / 0 behind with the five-file cloud delta preserved and mergeable. No hosted workflow exists on the custom base. Object-store successor is #1179. | actual AWS/gcloud/Azure deploy command values fail closed; description prose and `echo`/`printf`/`print` command values remain negative, while a later real command stays positive. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1176, or #1174. | -| AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `e85473a37832b6cb02fd8a03e6711c4039199e99` | open/Draft on current #1175 (`2399792...`). Path-depth RED/GREEN `7406d01`/`815e55d`; predecessor suite 426 passed. Two-parent merge `e85473a...` integrates current #1175 and inherited #1174 precision without changing the five-file delta; compare is 3 ahead / 0 behind and mergeable. | files/archive members deeper than 32 components fail as `claude-plugin-excessive-path-depth`; bound-depth and sibling archive classes remain distinct. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1175, #1166, or #1135. | -| AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `2399792f6cc4ced2652130aed93f3016d085a97a` | open/Draft on current #1174 (`746501e...`). Checksum RED/GREEN `5a7abb3`/`eb2389e`; predecessor suite 416 passed. Two-parent merge `2399792...` integrates #1174 precision without changing the six-file delta; compare is 3 ahead / 0 behind and mergeable. | unsigned first-party digest rows fail closed; empty/symlink signatures do not qualify, mismatch stays #1169, and network verification is not claimed. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1174, or #1169. | -| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `746501ec718cf248f69ca00f385c813531d6167a` | open/Draft successor stacked on #1173 (`e465cd7...`). Original RED/GREEN `50b5551`/`af6b2ec`; hook precision `8b1e262`/`590f477`. Follow-up RED `e257d90` proves raw whole-manifest scanning still classified description prose and reporting-only command values; GREEN `746501e` parses structural manifest `command` strings and preserves later real deploy commands. Python AST validation passed; no hosted workflow exists on the custom base. | executable hook or manifest `vercel deploy` / `fly(?:ctl)? deploy` fail closed, while comments, description prose, and `echo`/`printf`/`print` command values are not this class. | keep Draft stacked on #1173; obtain stacked integration evidence. Do not Close #1099 or #1173. | -| AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `e465cd71b495215e6ab7bc1ce298b588c0edfd75` | open/Draft successor stacked on #1172 (`936311c...`). RED `0e1f365` → GREEN `e465cd7`. Plugin coverage suite 375 passed; detector statements 2563/2563 on Python 3.13. Hosted-deploy successor is #1174. | hook or manifest `terraform apply` fails as `claude-plugin-terraform-apply-command`. `helm install` fails as `claude-plugin-helm-install-command`. On this slice `terraform plan`, `helm list`, `vercel deploy`, and `fly deploy` stay inventory; vercel/fly successor is #1174. kubectl/docker-push stay #1172. README terraform wording is not a hook. Snippets are command labels. | keep Draft stacked on #1172. Do not Close #1099 or #1172. | +| AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `af45351edc214136780b66ed3a96ad15acca036c` | open/Draft successor on current #1179 (`3073ffdb...`). Non-force two-parent restack is 5 ahead / 0 behind and its changed files are exactly the five registry-publish files; the previously omitted #1179 object-store RED fixture is present in the tree. Exact AST, inherited S3 direction probes 3/3, and npm/twine/cargo detector identities 3/3 pass. No hosted workflow exists on the custom base. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities. Packaging/check/comment/echo/prose lookalikes remain negative; S3 direction remains #1179. | keep Draft stacked on #1179 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1179. | +| AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `3073ffdbbddbaa30d363f366d7dc5deea250f939` | open/Draft successor on current #1177 (`fdcda62...`), 0 behind. Direction RED `f480ae0...` to GREEN `51d1da4...`; later-write RED `44761c2...` to current GREEN `3073ffdb...`. Exact-source AST passes; literal-download negatives 2/2 and write/ambiguous/later-write positives 6/6 pass. No hosted workflow exists on the custom base. | a literal two-operand `aws s3 cp` or `aws s3 sync` from S3 to local is download inventory, but local-to-S3, S3-to-S3, dynamic or option-bearing ambiguity, and a later write after a safe download fail closed as `claude-plugin-aws-s3-write-command`. | keep Draft stacked on #1177 and obtain hosted integration/coverage/current-head review. Do not Close #1099, #1177, or #1174. | +| AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `fdcda62e0948117231c130f62f47cb61ca1a3a8c` | open/Draft on current #1176 (`6f6e47c...`), non-force restacked 5 ahead / 0 behind with its cloud-deploy delta preserved. Exact detector/test AST and inherited command-context probes pass; no hosted workflow exists on the custom base. Object-store successor is #1179. | actual AWS/gcloud/Azure deploy command values fail closed; description prose and `echo`/`printf`/`print` command values remain negative, while a later real command stays positive. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1176, or #1174. | +| AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `6f6e47c46e73ca6d6b802808b4e134203ba59f48` | open/Draft on current #1175 (`aa5128f...`), non-force restacked 4 ahead / 0 behind with its path-depth delta preserved. Exact candidate AST passes; no hosted workflow exists on the custom base. | files/archive members deeper than 32 components fail as `claude-plugin-excessive-path-depth`; bound-depth and sibling archive classes remain distinct. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1175, #1166, or #1135. | +| AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `aa5128fb115668ce8abf869dd1d711e72fe09baa` | open/Draft on current #1174 (`d8f5f76...`), non-force restacked 4 ahead / 0 behind with its unsigned-checksum delta preserved. Exact candidate AST passes; no hosted workflow exists on the custom base. | unsigned first-party digest rows fail closed; empty/symlink signatures do not qualify, mismatch stays #1169, and network verification is not claimed. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1174, or #1169. | +| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `d8f5f76400f952410d1f4e0cda268a2e3d184c45` | open/Draft successor on current #1173 (`41669d...`), non-force restacked 7 ahead / 0 behind with hosted-deploy delta preserved. It inherits the current structural command-source helper; exact AST and comment/reporting negative plus executable-command positive probes pass. No hosted workflow exists on the custom base. | executable hook or manifest `vercel deploy` and `fly deploy` fail closed, while comments, description prose, and reporting-only values are not this class. | keep Draft stacked on #1173 and obtain hosted integration evidence. Do not Close #1099 or #1173. | +| AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `41669d695c60635d38c2f2ef5174141f20f9a24b` | open/Draft successor on #1172 (`936311c...`). RED `33aae04...` proves comments, reporting-only hooks, manifest prose, and reporting command values were raw-regex false positives; GREEN lineage `1f901a...` / `7051748...` / `41669d...` introduced bounded structural command-source parsing, fixed an intermediate literal-escape SyntaxError, and preserved concurrent helper constants. Exact source/test AST, negatives 3/3, and positives 3/3 pass. No hosted workflow exists on the custom base. | only executable `terraform apply` or `helm install` command context fails closed; `terraform plan`, `helm list`, comments, prose and reporting-only values remain inventory, while a later real command remains positive. | keep Draft stacked on #1172 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1172. | | AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. Terraform/helm successor is #1173. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. On this slice `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory; terraform/helm successor is #1173. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | | AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. Deployment-write successor is #1172. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | | AppGuardrail #1170, branch `feat/claude-plugin-github-merge-release-1099`, exact head `b506b824987326bd82f5fb5f8d037194a21163b6` | open/Draft successor stacked on #1169 (`226ca73...`). RED `527edb5` → GREEN `b506b82`. Focused merge/release tests 16 passed plus inventory lock; detector statement coverage 2455/2455 on Python 3.13. Credential-store successor is #1171. | hook or manifest `gh pr merge` fails as `claude-plugin-github-merge-command`. `gh release` create, upload, delete, or edit fails as `claude-plugin-github-release-command`. On this slice `gh issue create`, `gh pr review`, `gh release list`, `kubectl apply`, and `docker push` stay inventory; kubectl/docker-push successor is #1172. Hardcoded PATs stay `claude-plugin-github-write-token`. Snippets are command labels. | keep Draft stacked on #1169. Do not Close #1099 or #1169. Do not steal checksum-mismatch or github-write-token. | @@ -163,7 +163,7 @@ Where regex families need path reachability, mutable state, shell semantics, or | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 05:11 UTC records Draft #1180 `ffcb8ef` on #1179 `8ca0628` on #1177 `a1ca31f`, #1036 Ready at `0ef5715`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 05:25 UTC records Draft #1180 `af45351` on #1179 `3073ffdb` on #1177 `fdcda62`, #1036 Ready at `0ef5715`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -239,13 +239,13 @@ re-fetch docs/issues/PRs/current heads 49. Keep #1170 Draft stacked on #1169 at `b506b82`. Hook/manifest `gh pr merge` and `gh release` write verbs fail closed. Issue create, PR review, and release list stay inventory on this slice. Do not Close #1099 or #1169. 50. Keep #1171 Draft stacked on #1170 at `9370a0d`. Host cookie/token stores beyond browser profiles fail closed. Do not Close #1099, #1170, #1150, or #1137. 51. Keep #1172 Draft stacked on #1171 at `936311c`. Hook/manifest `kubectl apply` and `docker push` fail closed. Do not Close #1099, #1171, or #1170. -52. Keep #1173 Draft stacked on #1172 at `e465cd7`. Hook/manifest `terraform apply` and `helm install` fail closed. `terraform plan` and `helm list` stay inventory on this slice. Do not Close #1099 or #1172. -53. Keep #1174 Draft stacked on #1173 at `746501e`. Manifest prose/reporting-command RED `e257d90` → structural command-source GREEN `746501e`; AST passes but stacked integration evidence is absent. Do not Close #1099 or #1173. -54. Keep #1175 Draft at `2399792`, non-force-restacked on #1174 with six-file checksum delta unchanged and compare 3 ahead / 0 behind. Do not Close #1099, #1174, or #1169. -55. Keep #1176 Draft at `e85473a`, non-force-restacked on #1175 with five-file path-depth delta unchanged and compare 3 ahead / 0 behind. Do not Close #1099, #1175, #1166, or #1135. -56. Keep #1177 Draft at `a1ca31f`, non-force-restacked on #1176 with manifest prose/reporting RED `481e171` and structural command-source GREEN. Compare is 4 ahead / 0 behind; no hosted stacked Checks exist. Do not Close #1099, #1176, or #1174. -57. Keep #1179 Draft stacked on #1177 at `8ca0628`. Executable `aws s3 sync`/`cp` and `az containerapp up` fail closed; `aws s3 ls` stays inventory. Do not Close #1099, #1177, or #1174. -58. Keep #1180 Draft stacked on #1179 at `ffcb8ef`. Executable `npm publish`, `twine upload`, and `cargo publish` fail closed. Do not Close #1099 or #1179. Remaining unique leftover: `pnpm publish` / `yarn npm publish` / `uv publish` / `poetry publish`. +52. Keep #1173 Draft stacked on #1172 at `41669d6`. RED `33aae04` to structural command-source GREEN; exact AST, negative 3/3 and positive 3/3 probes pass, but hosted stacked evidence is absent. Do not Close #1099 or #1172. +53. Keep #1174 Draft at `d8f5f76`, non-force-restacked on #1173 with hosted-deploy delta preserved and compare 7 ahead / 0 behind. Do not Close #1099 or #1173. +54. Keep #1175 Draft at `aa5128f`, non-force-restacked on #1174 with unsigned-checksum delta preserved and compare 4 ahead / 0 behind. Do not Close #1099, #1174, or #1169. +55. Keep #1176 Draft at `6f6e47c`, non-force-restacked on #1175 with path-depth delta preserved and compare 4 ahead / 0 behind. Do not Close #1099, #1175, #1166, or #1135. +56. Keep #1177 Draft at `fdcda62`, non-force-restacked on #1176 with cloud-deploy delta preserved and compare 5 ahead / 0 behind. Do not Close #1099, #1176, or #1174. +57. Keep #1179 Draft stacked on #1177 at `3073ffdb`. Literal S3 downloads stay inventory; writes, ambiguous forms and later writes fail closed. RED/GREEN and exact probes pass; no hosted stacked Checks exist. Do not Close #1099, #1177, or #1174. +58. Keep #1180 Draft stacked on #1179 at `af45351`. Its five-file registry delta is 5 ahead / 0 behind and the #1179 RED fixture is present; exact AST and inherited/unique probes pass. Do not Close #1099 or #1179. Remaining unique leftover: `pnpm publish` / `yarn npm publish` / `uv publish` / `poetry publish`. ## Standards and acceptance basis From bd881e96cac53522a9e47c72ff53eaabf903af4a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 14:36:49 +0900 Subject: [PATCH 117/192] docs: define fail-closed assurance state mapping --- docs/product-technical-gap-baseline.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c0592a28..c6dcf458 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -152,6 +152,19 @@ Every retained security defect must record: Where regex families need path reachability, mutable state, shell semantics, or increasingly incompatible adjacency exceptions, stop treating another regular expression as the default answer. Preserve existing rule IDs and corpus as migration oracles and move the shared causal state into an executable structural analyzer. +## Assurance state mapping + +The candidate `appguardrail.scan-assurance.v1` contract has one authoritative result field, `scan_outcome_code`: `clean`, `findings_present`, `incomplete`, `failed`, or `untrusted`. Source lifecycle labels are not aliases for that field. `appguardrail.scan-evidence.v1.execution` accepts `completed`, `failed`, or `incomplete`; requested external engines accept `completed`, `unavailable`, `failed`, or `not_requested`. + +| Observed evidence condition | Canonical assurance mapping | Required consumer behavior | +| --- | --- | --- | +| all required evidence is current, identity/digest-valid and complete | `clean` only when finding count is zero; otherwise `findings_present` | dashboard may render `Clean Scan` only for `clean`; deploy gate applies its finding threshold to `findings_present` | +| missing, queued, running, cancelled, unavailable, inconclusive, stale, incomplete execution, incomplete detector set, or a requested engine not completed | `incomplete` with a reason preserving the source condition; `inconclusive` maps to `incomplete`, never `clean` | JSON/report/dashboard show incomplete; SARIF records the outcome in run properties; deploy gate fails closed | +| scanner or requested-engine execution failed | `failed` | preserve failure rather than collapsing it into no findings; deploy gate fails closed | +| malformed evidence, repository/commit/digest/count mismatch, future timestamp, or invalid provenance | `untrusted` | reject the assurance claim; deploy gate fails closed | + +Dashboard, JSON, SARIF, reports, and deploy gates must consume `scan_outcome_code` from the same assurance envelope. If orchestration has only a lifecycle condition and cannot produce a valid envelope, it must synthesize the corresponding non-clean result at its boundary or withhold a clean result; omission is never `clean`. + ## Buyer-visible Gap register | ID | Buyer-visible Gap | Current evidence | Smallest valuable slice | Exit evidence | Status | @@ -171,7 +184,7 @@ Where regex families need path reachability, mutable state, shell semantics, or - GitHub Actions polling analysis must distinguish per-request transport budgets from total control-flow bounds, preserve job/run/loop locality, model branch and exit reachability, distinguish executable commands from quoted/comment text, and account for selected shell/fail-fast semantics before using shell errors as safety or vulnerability evidence. - Safety state is causal, not nominal: initialization must precede the candidate loop; deadlines/limits/counters must converge; state in sibling/earlier loops cannot sanitize another loop; textual `exit` is not safety evidence when a prior unconditional transfer makes it unreachable; an independent monotonic total bound must remain authoritative even if a non-owning retry counter resets. - URL-validation tests that prove a public resolved hostname must control DNS deterministically. Reserved/example hostnames are not evidence that production should accept unresolved destinations. -- Missing/queued/failed/stale/cancelled/unavailable evidence are distinct typed states. A required workflow `startup_failure` with zero jobs is control-plane/infrastructure evidence, not a source-test success or failure and never transfers from another head. +- Missing, queued, running, stale, cancelled, unavailable, inconclusive and failed source conditions remain distinct provenance/reason values even when the assurance mapping groups them into `incomplete`, `failed`, or `untrusted`. A required workflow `startup_failure` with zero jobs is control-plane/infrastructure evidence, not a source-test success or failure and never transfers from another head. - AppGuardrail is security tooling, not mathematical-science code. Rust/native work requires measured isolation/performance justification and a versioned boundary rather than language preference alone. - Any future database changes use normalized tenant ownership, descriptive identifiers, migration rollback and measured locking/partition strategy; this document introduces no schema. From 91f92c0c892dc32b34b1ce0d8d8f3c2caf44585c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 14:37:05 +0900 Subject: [PATCH 118/192] docs: align gap snapshot changelog --- CHANGELOG.d/999-gap-baseline-0540.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.d/999-gap-baseline-0540.md b/CHANGELOG.d/999-gap-baseline-0540.md index 4d0652c7..c98dacb1 100644 --- a/CHANGELOG.d/999-gap-baseline-0540.md +++ b/CHANGELOG.d/999-gap-baseline-0540.md @@ -1,3 +1,3 @@ -# Gap baseline snapshot 2026-09-07 05:40 UTC +# Gap baseline snapshot 2026-09-08 05:25 UTC -Records live exact-head evidence for the commercial-readiness loop: #998 coverage/bootstrap SUCCESS, #972 and #1006 non-force restacks onto `develop@e71d37e`, #1130 Draft under canonical #1107, and G-06 structural analyzer successor stacked on #1088. This is documentation of Proposed work, not a protected capability claim. +Records live exact-head evidence for the commercial-readiness loop: #1036 skill-supply-chain repairs; #1173 structural command-context RED/GREEN; non-force, zero-behind #1174-#1177 stack integration; #1179 S3 direction and later-write regressions; #1180 registry-publish inheritance; and the canonical fail-closed assurance-state mapping. This documents Proposed work and exact candidate evidence, not a protected capability, approval, release, or certification claim. From a0f48e62fa6ce84efffdd4e398f1007ccea604be Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 14:40:33 +0900 Subject: [PATCH 119/192] docs: record exact-head CodeQL handoff evidence --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c6dcf458..744cc2a7 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -128,7 +128,7 @@ Responsibility boundaries: | AppGuardrail #1130, Jules webhook SSRF subset, exact head `0243a1a5a1cef758b14ae85f87b2ea1dd86e9e82` | converted to Draft at 05:37 UTC. Effective delta is `set_webhook`/route plumbing, a regex `try`/`except ValueError` lookaround, and `.jules/sentinel.md`. No runtime tests and no AST FP/FN contract. Canonical owner remains #1107. | same storage-boundary SSRF class as #1107, implemented as a weaker regex-only slice | keep Draft. Do not Close until complete carryover onto #1107 is verified. Do not race #1107 to `develop`. | | AppGuardrail #972 / Issue #927, branch `feat/scan-assurance-927`, exact head `c488cfffe4dd95a9be8b8ed99e77a86cc8d5d81f` | open/Draft. Non-force restack onto protected `develop@e71d37e` completed 05:37 UTC (`ahead` of predecessor `4ba738a...` by the merge commit only). REST `mergeable=MERGEABLE`, `mergeStateStatus=BLOCKED`. Fresh exact-head checks are in flight and do not inherit predecessor GREEN. | `0 findings` must not render as `clean` unless repository/commit identity, findings digest, detector completion, requested engines, scope, freshness, and gate accounting all verify. Ambiguous evidence is `untrusted`/`failed`/`incomplete`. | keep Draft through current-head Tests/security/SAST/CodeQL/dedicated assurance coverage and independent review. #1005 remains the report-consumer successor and must restack after this head is stable. Do not Close #927. | | AppGuardrail #1006 / Issue #928, branch `feat/issue-928-evidence-handoff`, exact head `35c28e22b5d50f1da943718cdb1984dcee098d62` | open/non-Draft. Non-force restack onto `develop@e71d37e` completed 05:37 UTC. REST `mergeable=MERGEABLE`, `mergeStateStatus=BLOCKED`. Dashboard clipboard/UI slice remains out of scope. | transport-neutral, redacted, digest-verified remediation bundle so an agent workflow cannot copy hostile or unbounded evidence | require fresh exact-head checks after restack; keep the UI/CSP/Storybook slice as a later G-03 successor. Do not Close #928. | -| AppGuardrail #1036, shared-skill supply-chain detection, exact head `0ef5715468acb674aeb0f3833e820996d4644871` | open/Ready/mergeable. CodeRabbit review `PRR_kwDOSqamhM8AAAABMjRduQ` exposed raw JSON `\\u04xx` mixed-script evasion and URL-first exfiltration ordering. RED `14697f6...` → GREEN `53faaeb...` covers escaped mixed-script while escaped Cyrillic-only, ASCII, and description prose stay negative. RED `f432a09...` → GREEN `0ef5715...` covers data-first and URL-first directives while documentation URLs without an exfiltration verb stay negative. Exact YAML/regex probes and changed-test AST pass; nine fresh workflows including Tests `34187414899` and CodeQL `34187414913` are queued. | installable skill/agent manifests can hide mixed-script identifiers via JSON escape serialization or reorder endpoint/data wording; detector evidence must preserve mixed-script, structural-name, directive-verb, and prose-negative boundaries. | keep Ready with ordinary auto-merge, but require unchanged-head Checks, qualifying independent approval/current-head review, and evidence-backed thread resolution before protection may merge. | +| AppGuardrail #1036, shared-skill supply-chain detection, exact head `0ef5715468acb674aeb0f3833e820996d4644871` | open/Ready/mergeable. CodeRabbit review exposed raw JSON `\\u04xx` mixed-script evasion and URL-first exfiltration ordering; RED/GREEN `14697f6...`/`53faaeb...` and `f432a09...`/`0ef5715...` preserve escaped Cyrillic-only, ASCII, prose and documentation-URL negatives. Tests, Security Process, Security Scan, SAST Semgrep and four coverage workflows are terminal success. CodeQL PR run `34187414913` is terminal failure because python/actions compatibility jobs read `VERDICT_STATE=pending`; exact-head dispatch job `101945476410` succeeded afterward, but no authenticated terminal verdict is present yet. Twelve historical review threads remain platform-unresolved and a qualifying current-head independent approval is not established. | installable skill/agent manifests can hide mixed-script identifiers via JSON escape serialization or reorder endpoint/data wording; detector evidence must preserve mixed-script, structural-name, directive-verb, and prose-negative boundaries. | keep ordinary protection blocked; accept only an authenticated exact-head CodeQL terminal verdict, fresh current-head review, and evidence-backed thread resolution. Do not treat the pending handoff failure as source-test failure or success. | | AppGuardrail #1111, repository Actions queue/consolidation, exact head `77d25085b873a38c58cb55bca2300df404365a1c` | open/mergeable with ordinary squash auto-merge enabled and zero unresolved review threads; Tests and Security Process are terminal success; Security Scan, SAST, CodeQL, Strix, Noema and OpenCode remain queued/pending, with no qualifying approval present | prior candidate used unsupported `concurrency.queue: max` and suppressed actionlint, but GitHub concurrency can replace an older pending run even when the running job is not cancelled. RED contract requires release workflows to have no concurrency group; production removes both lossy blocks and the suppression while retaining exact-head cancellation only for PR validation. Current-head follow-up also rejects scalar top-level forms such as `concurrency: release-group`, closing the review-discovered contract hole. | require fresh exact-head workflow/schema evidence and independent review. Preserve every release dispatch/tag as its own run; never reintroduce an unsupported key or warning suppression. | | AppGuardrail #963 / Issue #550, discarded tenant authorization context, head `c656fe68cc616852f51a97e456cdf4e0b54fa168` | open/mergeable | tenant-admin authorization can be checked while returned tenant context is discarded before global reads or tenant-sensitive mutation | keep detector oracle pinned separately from live causal-owner candidate; refresh fixed oracle only after owner protected merge. | | `ContextualWisdomLab/clearfolio` #541, causal owner for #550, live head `917b97d153196920da76f9ba4f0df761fdf7a4ac` | open/mergeable; descendant of non-destructive security restoration `1337efe45640740b338d021d64e41c045ecf7201` | concurrent `020c0ec...` reintroduced global/controller-local tenant filtering and keyless SHA-256 retry identity while deleting application/repository/HMAC contracts; restoration preserved history while reinstating tenant-scoped ports and keyed/domain-separated HMAC | require owner exact-head CI/security/review and protected merge; then update AppGuardrail #963 protected fixed-source oracle. | @@ -176,7 +176,7 @@ Dashboard, JSON, SARIF, reports, and deploy gates must consume `scan_outcome_cod | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 05:25 UTC records Draft #1180 `af45351` on #1179 `3073ffdb` on #1177 `fdcda62`, #1036 Ready at `0ef5715`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 05:25 UTC records Draft #1180 `af45351` on #1179 `3073ffdb` on #1177 `fdcda62`, #1036 Ready at `0ef5715` with CodeQL pending-handoff failure, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -205,7 +205,7 @@ re-fetch docs/issues/PRs/current heads 2. Treat #1088's repeated regex-state divergence—including unreachable exits, independent total bounds, command-substitution tokenization and conditional-block ownership—as migration oracles for G-06 structural GitHub Actions/shell analysis rather than continuing unlimited regex growth. 3. Keep #1068 on source-neutral exact head `2379b37f05b12af8e22990965d42da2e69b9c611` as the single Draft hostless/unresolved-DNS lane. The head is an empty-file Strix-retrigger descendant of `325d48e...` / `a06a96fc...` and adds no security delta; predecessor Checks do not transfer; no independent approval exists; #1128 is retired only by verified complete carryover. 4. Keep exact-head `startup_failure` with zero jobs classified as central control-plane evidence. `ContextualWisdomLab/.github#712` owns the current queue/startup RCA; do not churn leaf source or reuse predecessor GREEN. -5. Keep #1036 Ready on exact head `0ef5715468acb674aeb0f3833e820996d4644871`. RED/GREEN `14697f6...`/`53faaeb...` closes JSON-escaped Cyrillic mixed-script evasion; `f432a09...`/`0ef5715...` closes URL-first exfiltration ordering while preserving negative boundaries. Nine fresh workflows are queued; auto-merge remains protection-blocked until unchanged-head Checks and review pass. +5. Keep #1036 Ready on exact head `0ef5715468acb674aeb0f3833e820996d4644871`. Eight repository source/security workflows are SUCCESS. CodeQL PR `34187414913` failed closed with `VERDICT_STATE=pending` for python/actions after successful exact-head dispatch job `101945476410`; no authenticated terminal verdict exists yet. Twelve historical threads remain platform-unresolved and qualifying current-head approval is not established. Ordinary auto-merge stays protection-blocked. 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. From a1aee7615ba29702e9022798bdde7318abafb2bb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 15:02:59 +0900 Subject: [PATCH 120/192] docs(gap): record dashboard UI evidence boundary --- docs/product-technical-gap-baseline.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 744cc2a7..0c16ed18 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 05:25 UTC +**Snapshot:** 2026-09-08 06:05 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,13 +68,14 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 05:25 UTC snapshot +## Security-defect corpus — live 2026-09-08 06:05 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | +| AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with only `scanner/dashboard/index.html` and `tests/test_dashboard_core.py`; eight repository workflows succeeded, CodeQL PR `34181962755` failed, no review/thread exists, and no browser/E2E artifact is present. #1181 exact `d9254a4a017d42b89283135b62c1fd75de61e14d` independently reproduced the product/test intent but added a `.jules/palette.md` doctrine already owned by protected `Native File Input Iteration Friction`; it was corrected from Ready to Draft. At review time seven workflows succeeded and Security Scan/CodeQL remained queued. | Static markup can prove a visible native button but cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. A local unversioned Playwright claim is not exact-head evidence. Browser infrastructure currently exists only on unmerged Draft #1117 and must not be copied as protected authority. | keep #1181 open as predecessor until #1131 completely carries and proves the valid delta. Keep #1131 Draft; integrate #1117 first or non-force stack on a verified current prerequisite, then add current-head browser/E2E and screenshot evidence before Ready. | | AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `af45351edc214136780b66ed3a96ad15acca036c` | open/Draft successor on current #1179 (`3073ffdb...`). Non-force two-parent restack is 5 ahead / 0 behind and its changed files are exactly the five registry-publish files; the previously omitted #1179 object-store RED fixture is present in the tree. Exact AST, inherited S3 direction probes 3/3, and npm/twine/cargo detector identities 3/3 pass. No hosted workflow exists on the custom base. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities. Packaging/check/comment/echo/prose lookalikes remain negative; S3 direction remains #1179. | keep Draft stacked on #1179 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1179. | | AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `3073ffdbbddbaa30d363f366d7dc5deea250f939` | open/Draft successor on current #1177 (`fdcda62...`), 0 behind. Direction RED `f480ae0...` to GREEN `51d1da4...`; later-write RED `44761c2...` to current GREEN `3073ffdb...`. Exact-source AST passes; literal-download negatives 2/2 and write/ambiguous/later-write positives 6/6 pass. No hosted workflow exists on the custom base. | a literal two-operand `aws s3 cp` or `aws s3 sync` from S3 to local is download inventory, but local-to-S3, S3-to-S3, dynamic or option-bearing ambiguity, and a later write after a safe download fail closed as `claude-plugin-aws-s3-write-command`. | keep Draft stacked on #1177 and obtain hosted integration/coverage/current-head review. Do not Close #1099, #1177, or #1174. | | AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `fdcda62e0948117231c130f62f47cb61ca1a3a8c` | open/Draft on current #1176 (`6f6e47c...`), non-force restacked 5 ahead / 0 behind with its cloud-deploy delta preserved. Exact detector/test AST and inherited command-context probes pass; no hosted workflow exists on the custom base. Object-store successor is #1179. | actual AWS/gcloud/Azure deploy command values fail closed; description prose and `echo`/`printf`/`print` command values remain negative, while a later real command stays positive. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1176, or #1174. | @@ -176,7 +177,7 @@ Dashboard, JSON, SARIF, reports, and deploy gates must consume `scan_outcome_cod | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 05:25 UTC records Draft #1180 `af45351` on #1179 `3073ffdb` on #1177 `fdcda62`, #1036 Ready at `0ef5715` with CodeQL pending-handoff failure, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 06:05 UTC records Draft #1180 `af45351` on #1179 `3073ffdb` on #1177 `fdcda62`, #1036 Ready at `0ef5715` with CodeQL pending-handoff failure, canonical file-picker UX #1131 `5f93858` plus preserved Draft predecessor #1181 `d9254a4`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -260,6 +261,9 @@ re-fetch docs/issues/PRs/current heads 57. Keep #1179 Draft stacked on #1177 at `3073ffdb`. Literal S3 downloads stay inventory; writes, ambiguous forms and later writes fail closed. RED/GREEN and exact probes pass; no hosted stacked Checks exist. Do not Close #1099, #1177, or #1174. 58. Keep #1180 Draft stacked on #1179 at `af45351`. Its five-file registry delta is 5 ahead / 0 behind and the #1179 RED fixture is present; exact AST and inherited/unique probes pass. Do not Close #1099 or #1179. Remaining unique leftover: `pnpm publish` / `yarn npm publish` / `uv publish` / `poetry publish`. +59. Keep #1131 Draft at `5f93858` as the canonical dashboard file-picker UX owner. Static markup Tests are not browser acceptance. Browser/Playwright infrastructure remains unmerged on Draft #1117; integrate that prerequisite or non-force stack without copying unprotected authority, then prove keyboard, pointer, cancel/reselect, focus, accessibility-tree, responsive and failure-state behavior on one exact head. +60. Keep #1181 Draft at `d9254a4` as a duplicate predecessor until #1131 completely carries and accepts every valid product/test delta. Its unique `.jules/palette.md` entry duplicates protected `Native File Input Iteration Friction` authority and is not a separate product delta. Do not Close either PR before verified successor acceptance. + ## Standards and acceptance basis These references guide control design; they are not a claim of CSAP, SOC 2, or another certification. From 64fc02b78641816252ff2ffb579542bb8b13919e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 15:03:12 +0900 Subject: [PATCH 121/192] docs(changelog): align UI evidence snapshot --- CHANGELOG.d/999-gap-baseline-0540.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.d/999-gap-baseline-0540.md b/CHANGELOG.d/999-gap-baseline-0540.md index c98dacb1..2b87cb78 100644 --- a/CHANGELOG.d/999-gap-baseline-0540.md +++ b/CHANGELOG.d/999-gap-baseline-0540.md @@ -1,3 +1,3 @@ -# Gap baseline snapshot 2026-09-08 05:25 UTC +# Gap baseline snapshot 2026-09-08 06:05 UTC -Records live exact-head evidence for the commercial-readiness loop: #1036 skill-supply-chain repairs; #1173 structural command-context RED/GREEN; non-force, zero-behind #1174-#1177 stack integration; #1179 S3 direction and later-write regressions; #1180 registry-publish inheritance; and the canonical fail-closed assurance-state mapping. This documents Proposed work and exact candidate evidence, not a protected capability, approval, release, or certification claim. +Records live exact-head evidence for the commercial-readiness loop: #1036 skill-supply-chain repairs; #1173 structural command-context RED/GREEN; non-force, zero-behind #1174-#1177 stack integration; #1179 S3 direction and later-write regressions; #1180 registry-publish inheritance; the canonical fail-closed assurance-state mapping; and the #1131/#1181 dashboard file-picker ownership, duplicate-doctrine, and browser-evidence boundary. This documents Proposed work and exact candidate evidence, not a protected capability, approval, release, or certification claim. From 3e5640f64d0c73c972050fb2c976280cf7faf202 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 15:06:17 +0900 Subject: [PATCH 122/192] docs(gap): bind exact browser security evidence --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 0c16ed18..b455c5e3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -75,7 +75,7 @@ Responsibility boundaries: | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with only `scanner/dashboard/index.html` and `tests/test_dashboard_core.py`; eight repository workflows succeeded, CodeQL PR `34181962755` failed, no review/thread exists, and no browser/E2E artifact is present. #1181 exact `d9254a4a017d42b89283135b62c1fd75de61e14d` independently reproduced the product/test intent but added a `.jules/palette.md` doctrine already owned by protected `Native File Input Iteration Friction`; it was corrected from Ready to Draft. At review time seven workflows succeeded and Security Scan/CodeQL remained queued. | Static markup can prove a visible native button but cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. A local unversioned Playwright claim is not exact-head evidence. Browser infrastructure currently exists only on unmerged Draft #1117 and must not be copied as protected authority. | keep #1181 open as predecessor until #1131 completely carries and proves the valid delta. Keep #1131 Draft; integrate #1117 first or non-force stack on a verified current prerequisite, then add current-head browser/E2E and screenshot evidence before Ready. | +| AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with only `scanner/dashboard/index.html` and `tests/test_dashboard_core.py`; eight repository workflows succeeded, CodeQL PR `34181962755` failed, no review/thread exists, and no browser/E2E artifact is present. #1181 exact `d9254a4a017d42b89283135b62c1fd75de61e14d` independently reproduced the product/test intent but added a `.jules/palette.md` doctrine already owned by protected `Native File Input Iteration Friction`; it was corrected from Ready to Draft. At review time seven workflows succeeded and Security Scan/CodeQL remained queued. | Static markup can prove a visible native button but cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. A local unversioned Playwright claim is not exact-head evidence. Unmerged Draft #1117 exact `d3283a1` carries the browser infrastructure and its XSS Chromium oracle passed in Python 3.11/3.13 Tests run `34068384354`; this proves that security boundary only, while CodeQL remains pending-handoff and it is not protected authority to copy. | keep #1181 open as predecessor until #1131 completely carries and proves the valid delta. Keep #1131 Draft; integrate #1117 first or non-force stack on a verified current prerequisite, then add current-head browser/E2E and screenshot evidence before Ready. | | AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `af45351edc214136780b66ed3a96ad15acca036c` | open/Draft successor on current #1179 (`3073ffdb...`). Non-force two-parent restack is 5 ahead / 0 behind and its changed files are exactly the five registry-publish files; the previously omitted #1179 object-store RED fixture is present in the tree. Exact AST, inherited S3 direction probes 3/3, and npm/twine/cargo detector identities 3/3 pass. No hosted workflow exists on the custom base. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities. Packaging/check/comment/echo/prose lookalikes remain negative; S3 direction remains #1179. | keep Draft stacked on #1179 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1179. | | AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `3073ffdbbddbaa30d363f366d7dc5deea250f939` | open/Draft successor on current #1177 (`fdcda62...`), 0 behind. Direction RED `f480ae0...` to GREEN `51d1da4...`; later-write RED `44761c2...` to current GREEN `3073ffdb...`. Exact-source AST passes; literal-download negatives 2/2 and write/ambiguous/later-write positives 6/6 pass. No hosted workflow exists on the custom base. | a literal two-operand `aws s3 cp` or `aws s3 sync` from S3 to local is download inventory, but local-to-S3, S3-to-S3, dynamic or option-bearing ambiguity, and a later write after a safe download fail closed as `claude-plugin-aws-s3-write-command`. | keep Draft stacked on #1177 and obtain hosted integration/coverage/current-head review. Do not Close #1099, #1177, or #1174. | | AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `fdcda62e0948117231c130f62f47cb61ca1a3a8c` | open/Draft on current #1176 (`6f6e47c...`), non-force restacked 5 ahead / 0 behind with its cloud-deploy delta preserved. Exact detector/test AST and inherited command-context probes pass; no hosted workflow exists on the custom base. Object-store successor is #1179. | actual AWS/gcloud/Azure deploy command values fail closed; description prose and `echo`/`printf`/`print` command values remain negative, while a later real command stays positive. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1176, or #1174. | @@ -210,7 +210,7 @@ re-fetch docs/issues/PRs/current heads 6. Keep #1080, #1068, #1036 and #963 exact-head evidence independent; predecessor success never transfers. 7. Keep `ContextualWisdomLab/clearfolio` #541 owner evidence separate from AppGuardrail #963 detector maturity until protected owner merge. 8. Refresh this baseline after material exact-head changes, protected merges/releases, new reproducible security classes, or PRD/ADR/ARCHITECTURE boundary changes. -9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft until the Chromium injection oracle and all exact-head security workflows are GREEN and a qualifying independent review exists; do not substitute static escaping inspection for the browser DOM contract. +9. Keep #1117 at exact head `d3283a168446a71c9f983f14a348712cdb6e7fe5` in Draft. Tests run `34068384354` installed Chromium and passed the injection/no-dialog/zero-injected-image oracle on Python 3.11/3.13; seven other repository workflows are GREEN. CodeQL `34068384347` failed closed with `VERDICT_STATE=pending` for Python/Actions, and no qualifying current-head approval exists. This browser security evidence does not prove #1131 file-picker UX. 10. Keep #998 Draft at `8b95c2b` until current-head Strix/CodeQL-verdict are terminal-success. Tests, AST coverage, Semgrep, Noema, and `opencode-review` are SUCCESS. Strix FAILURE is `STRIX_PROVIDER_UNAVAILABLE` (G-07), not a new FN. CodeQL compatibility FAILURE remains pending-handoff after a successful dispatch. OpenCode success is robot-review evidence, not GitHub APPROVE. Do not Close #983. 11. Keep #966 at `f707289` as the canonical orphan-detector owner. Current-head OpenCode `CHANGES_REQUESTED` is check-rollup (CodeQL-compat/Noema/Strix), not a remaining detector bug. Relates to #929 and must not Close it. 12. Keep #1129 Draft stacked on #998 at `c5be73c`. Unique delta remains #1099/#1106. #1134 is at `36e8f37` and #1135 at `ef28b05` after non-force restack. Do not Close #1087, #929, #983, or #1106. From 16ffc0227f039eb2dfeb1d739500d0eaebfd6c1a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 15:07:51 +0900 Subject: [PATCH 123/192] docs(gap): refresh duplicate predecessor checks --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b455c5e3..b9b4b281 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -75,7 +75,7 @@ Responsibility boundaries: | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with only `scanner/dashboard/index.html` and `tests/test_dashboard_core.py`; eight repository workflows succeeded, CodeQL PR `34181962755` failed, no review/thread exists, and no browser/E2E artifact is present. #1181 exact `d9254a4a017d42b89283135b62c1fd75de61e14d` independently reproduced the product/test intent but added a `.jules/palette.md` doctrine already owned by protected `Native File Input Iteration Friction`; it was corrected from Ready to Draft. At review time seven workflows succeeded and Security Scan/CodeQL remained queued. | Static markup can prove a visible native button but cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. A local unversioned Playwright claim is not exact-head evidence. Unmerged Draft #1117 exact `d3283a1` carries the browser infrastructure and its XSS Chromium oracle passed in Python 3.11/3.13 Tests run `34068384354`; this proves that security boundary only, while CodeQL remains pending-handoff and it is not protected authority to copy. | keep #1181 open as predecessor until #1131 completely carries and proves the valid delta. Keep #1131 Draft; integrate #1117 first or non-force stack on a verified current prerequisite, then add current-head browser/E2E and screenshot evidence before Ready. | +| AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with only `scanner/dashboard/index.html` and `tests/test_dashboard_core.py`; eight repository workflows succeeded, CodeQL PR `34181962755` failed, no review/thread exists, and no browser/E2E artifact is present. #1181 exact `d9254a4a017d42b89283135b62c1fd75de61e14d` independently reproduced the product/test intent but added a `.jules/palette.md` doctrine already owned by protected `Native File Input Iteration Friction`; it was corrected from Ready to Draft. Eight repository workflows are now GREEN; CodeQL PR `34189867456` remains queued. | Static markup can prove a visible native button but cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. A local unversioned Playwright claim is not exact-head evidence. Unmerged Draft #1117 exact `d3283a1` carries the browser infrastructure and its XSS Chromium oracle passed in Python 3.11/3.13 Tests run `34068384354`; this proves that security boundary only, while CodeQL remains pending-handoff and it is not protected authority to copy. | keep #1181 open as predecessor until #1131 completely carries and proves the valid delta. Keep #1131 Draft; integrate #1117 first or non-force stack on a verified current prerequisite, then add current-head browser/E2E and screenshot evidence before Ready. | | AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `af45351edc214136780b66ed3a96ad15acca036c` | open/Draft successor on current #1179 (`3073ffdb...`). Non-force two-parent restack is 5 ahead / 0 behind and its changed files are exactly the five registry-publish files; the previously omitted #1179 object-store RED fixture is present in the tree. Exact AST, inherited S3 direction probes 3/3, and npm/twine/cargo detector identities 3/3 pass. No hosted workflow exists on the custom base. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities. Packaging/check/comment/echo/prose lookalikes remain negative; S3 direction remains #1179. | keep Draft stacked on #1179 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1179. | | AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `3073ffdbbddbaa30d363f366d7dc5deea250f939` | open/Draft successor on current #1177 (`fdcda62...`), 0 behind. Direction RED `f480ae0...` to GREEN `51d1da4...`; later-write RED `44761c2...` to current GREEN `3073ffdb...`. Exact-source AST passes; literal-download negatives 2/2 and write/ambiguous/later-write positives 6/6 pass. No hosted workflow exists on the custom base. | a literal two-operand `aws s3 cp` or `aws s3 sync` from S3 to local is download inventory, but local-to-S3, S3-to-S3, dynamic or option-bearing ambiguity, and a later write after a safe download fail closed as `claude-plugin-aws-s3-write-command`. | keep Draft stacked on #1177 and obtain hosted integration/coverage/current-head review. Do not Close #1099, #1177, or #1174. | | AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `fdcda62e0948117231c130f62f47cb61ca1a3a8c` | open/Draft on current #1176 (`6f6e47c...`), non-force restacked 5 ahead / 0 behind with its cloud-deploy delta preserved. Exact detector/test AST and inherited command-context probes pass; no hosted workflow exists on the custom base. Object-store successor is #1179. | actual AWS/gcloud/Azure deploy command values fail closed; description prose and `echo`/`printf`/`print` command values remain negative, while a later real command stays positive. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1176, or #1174. | From 83402a0d977b8bae5f77ba19fa0060842732705c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 15:09:08 +0900 Subject: [PATCH 124/192] docs: record #1182 pnpm uv poetry publish successor Exact head e933579 stacked on #1180 fails closed on pnpm, uv, and poetry publish. yarn npm publish stays npm. Relates to #1099. --- docs/product-technical-gap-baseline.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b9b4b281..3472a15c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 06:05 UTC +**Snapshot:** 2026-09-08 06:07 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,7 +68,7 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 06:05 UTC snapshot +## Security-defect corpus — live 2026-09-08 06:07 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | @@ -76,7 +76,8 @@ Responsibility boundaries: | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with only `scanner/dashboard/index.html` and `tests/test_dashboard_core.py`; eight repository workflows succeeded, CodeQL PR `34181962755` failed, no review/thread exists, and no browser/E2E artifact is present. #1181 exact `d9254a4a017d42b89283135b62c1fd75de61e14d` independently reproduced the product/test intent but added a `.jules/palette.md` doctrine already owned by protected `Native File Input Iteration Friction`; it was corrected from Ready to Draft. Eight repository workflows are now GREEN; CodeQL PR `34189867456` remains queued. | Static markup can prove a visible native button but cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. A local unversioned Playwright claim is not exact-head evidence. Unmerged Draft #1117 exact `d3283a1` carries the browser infrastructure and its XSS Chromium oracle passed in Python 3.11/3.13 Tests run `34068384354`; this proves that security boundary only, while CodeQL remains pending-handoff and it is not protected authority to copy. | keep #1181 open as predecessor until #1131 completely carries and proves the valid delta. Keep #1131 Draft; integrate #1117 first or non-force stack on a verified current prerequisite, then add current-head browser/E2E and screenshot evidence before Ready. | -| AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `af45351edc214136780b66ed3a96ad15acca036c` | open/Draft successor on current #1179 (`3073ffdb...`). Non-force two-parent restack is 5 ahead / 0 behind and its changed files are exactly the five registry-publish files; the previously omitted #1179 object-store RED fixture is present in the tree. Exact AST, inherited S3 direction probes 3/3, and npm/twine/cargo detector identities 3/3 pass. No hosted workflow exists on the custom base. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities. Packaging/check/comment/echo/prose lookalikes remain negative; S3 direction remains #1179. | keep Draft stacked on #1179 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1179. | +| AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `e933579f2b248ed43e5165824a7fe642025a1c5d` | open/Draft successor stacked on live #1180 (`af45351...`). RED `f734512` → GREEN `e933579`. Plugin coverage suite 484 passed. | executable `pnpm publish` fails as `claude-plugin-pnpm-publish-command`. `uv publish` fails as `claude-plugin-uv-publish-command`. `poetry publish` fails as `claude-plugin-poetry-publish-command`. `yarn npm publish` stays #1180 npm-publish. `pnpm list`, comments, echo lookalikes, and README wording stay inventory. Snippets are command labels. | keep Draft stacked on #1180. Do not Close #1099 or #1180. | +| AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `af45351edc214136780b66ed3a96ad15acca036c` | open/Draft successor on current #1179 (`3073ffdb...`). Non-force two-parent restack is 5 ahead / 0 behind and its changed files are exactly the five registry-publish files; the previously omitted #1179 object-store RED fixture is present in the tree. Exact AST, inherited S3 direction probes 3/3, and npm/twine/cargo detector identities 3/3 pass. No hosted workflow exists on the custom base. Alt-publish successor is #1182. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities. Packaging/check/comment/echo/prose lookalikes remain negative; S3 direction remains #1179. | keep Draft stacked on #1179 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1179. | | AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `3073ffdbbddbaa30d363f366d7dc5deea250f939` | open/Draft successor on current #1177 (`fdcda62...`), 0 behind. Direction RED `f480ae0...` to GREEN `51d1da4...`; later-write RED `44761c2...` to current GREEN `3073ffdb...`. Exact-source AST passes; literal-download negatives 2/2 and write/ambiguous/later-write positives 6/6 pass. No hosted workflow exists on the custom base. | a literal two-operand `aws s3 cp` or `aws s3 sync` from S3 to local is download inventory, but local-to-S3, S3-to-S3, dynamic or option-bearing ambiguity, and a later write after a safe download fail closed as `claude-plugin-aws-s3-write-command`. | keep Draft stacked on #1177 and obtain hosted integration/coverage/current-head review. Do not Close #1099, #1177, or #1174. | | AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `fdcda62e0948117231c130f62f47cb61ca1a3a8c` | open/Draft on current #1176 (`6f6e47c...`), non-force restacked 5 ahead / 0 behind with its cloud-deploy delta preserved. Exact detector/test AST and inherited command-context probes pass; no hosted workflow exists on the custom base. Object-store successor is #1179. | actual AWS/gcloud/Azure deploy command values fail closed; description prose and `echo`/`printf`/`print` command values remain negative, while a later real command stays positive. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1176, or #1174. | | AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `6f6e47c46e73ca6d6b802808b4e134203ba59f48` | open/Draft on current #1175 (`aa5128f...`), non-force restacked 4 ahead / 0 behind with its path-depth delta preserved. Exact candidate AST passes; no hosted workflow exists on the custom base. | files/archive members deeper than 32 components fail as `claude-plugin-excessive-path-depth`; bound-depth and sibling archive classes remain distinct. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1175, #1166, or #1135. | @@ -177,7 +178,7 @@ Dashboard, JSON, SARIF, reports, and deploy gates must consume `scan_outcome_cod | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 06:05 UTC records Draft #1180 `af45351` on #1179 `3073ffdb` on #1177 `fdcda62`, #1036 Ready at `0ef5715` with CodeQL pending-handoff failure, canonical file-picker UX #1131 `5f93858` plus preserved Draft predecessor #1181 `d9254a4`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 06:07 UTC records Draft #1182 `e933579` on #1180 `af45351` on #1179 `3073ffdb`, #1036 Ready at `0ef5715`, canonical file-picker UX #1131 `5f93858`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -259,10 +260,10 @@ re-fetch docs/issues/PRs/current heads 55. Keep #1176 Draft at `6f6e47c`, non-force-restacked on #1175 with path-depth delta preserved and compare 4 ahead / 0 behind. Do not Close #1099, #1175, #1166, or #1135. 56. Keep #1177 Draft at `fdcda62`, non-force-restacked on #1176 with cloud-deploy delta preserved and compare 5 ahead / 0 behind. Do not Close #1099, #1176, or #1174. 57. Keep #1179 Draft stacked on #1177 at `3073ffdb`. Literal S3 downloads stay inventory; writes, ambiguous forms and later writes fail closed. RED/GREEN and exact probes pass; no hosted stacked Checks exist. Do not Close #1099, #1177, or #1174. -58. Keep #1180 Draft stacked on #1179 at `af45351`. Its five-file registry delta is 5 ahead / 0 behind and the #1179 RED fixture is present; exact AST and inherited/unique probes pass. Do not Close #1099 or #1179. Remaining unique leftover: `pnpm publish` / `yarn npm publish` / `uv publish` / `poetry publish`. - -59. Keep #1131 Draft at `5f93858` as the canonical dashboard file-picker UX owner. Static markup Tests are not browser acceptance. Browser/Playwright infrastructure remains unmerged on Draft #1117; integrate that prerequisite or non-force stack without copying unprotected authority, then prove keyboard, pointer, cancel/reselect, focus, accessibility-tree, responsive and failure-state behavior on one exact head. -60. Keep #1181 Draft at `d9254a4` as a duplicate predecessor until #1131 completely carries and accepts every valid product/test delta. Its unique `.jules/palette.md` entry duplicates protected `Native File Input Iteration Friction` authority and is not a separate product delta. Do not Close either PR before verified successor acceptance. +58. Keep #1180 Draft stacked on #1179 at `af45351`. Its five-file registry delta is 5 ahead / 0 behind and the #1179 RED fixture is present; exact AST and inherited/unique probes pass. Do not Close #1099 or #1179. +59. Keep #1182 Draft stacked on #1180 at `e933579`. Executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` stays the npm class. Do not Close #1099 or #1180. Remaining unique leftover: `gem push` / `nuget push` package-registry writes. +60. Keep #1131 Draft at `5f93858` as the canonical dashboard file-picker UX owner. Static markup Tests are not browser acceptance. Browser/Playwright infrastructure remains unmerged on Draft #1117; integrate that prerequisite or non-force stack without copying unprotected authority, then prove keyboard, pointer, cancel/reselect, focus, accessibility-tree, responsive and failure-state behavior on one exact head. +61. Keep #1181 Draft at `d9254a4` as a duplicate predecessor until #1131 completely carries and accepts every valid product/test delta. Its unique `.jules/palette.md` entry duplicates protected `Native File Input Iteration Friction` authority and is not a separate product delta. Do not Close either PR before verified successor acceptance. ## Standards and acceptance basis From 33be215959b9d32e404ecde14b6fdea0a502daad Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 15:17:36 +0900 Subject: [PATCH 125/192] docs: record #1183 gem-nuget successor Summary: - Snapshot 2026-09-08 06:17 UTC records Draft #1183 `798da47` stacked on #1182. - Executable gem push and nuget push fail closed. - Remaining leftover: composer/pub/go upload. Rationale: - #999 is the single writer of the product-technical gap baseline. - Do not Close #1099 or #1182. Tests: - documentation-only; detector evidence lives on #1183 (495 passed) --- docs/product-technical-gap-baseline.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 3472a15c..c00f8d40 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 06:07 UTC +**Snapshot:** 2026-09-08 06:17 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,7 +68,7 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 06:07 UTC snapshot +## Security-defect corpus — live 2026-09-08 06:17 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | @@ -76,7 +76,8 @@ Responsibility boundaries: | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with only `scanner/dashboard/index.html` and `tests/test_dashboard_core.py`; eight repository workflows succeeded, CodeQL PR `34181962755` failed, no review/thread exists, and no browser/E2E artifact is present. #1181 exact `d9254a4a017d42b89283135b62c1fd75de61e14d` independently reproduced the product/test intent but added a `.jules/palette.md` doctrine already owned by protected `Native File Input Iteration Friction`; it was corrected from Ready to Draft. Eight repository workflows are now GREEN; CodeQL PR `34189867456` remains queued. | Static markup can prove a visible native button but cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. A local unversioned Playwright claim is not exact-head evidence. Unmerged Draft #1117 exact `d3283a1` carries the browser infrastructure and its XSS Chromium oracle passed in Python 3.11/3.13 Tests run `34068384354`; this proves that security boundary only, while CodeQL remains pending-handoff and it is not protected authority to copy. | keep #1181 open as predecessor until #1131 completely carries and proves the valid delta. Keep #1131 Draft; integrate #1117 first or non-force stack on a verified current prerequisite, then add current-head browser/E2E and screenshot evidence before Ready. | -| AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `e933579f2b248ed43e5165824a7fe642025a1c5d` | open/Draft successor stacked on live #1180 (`af45351...`). RED `f734512` → GREEN `e933579`. Plugin coverage suite 484 passed. | executable `pnpm publish` fails as `claude-plugin-pnpm-publish-command`. `uv publish` fails as `claude-plugin-uv-publish-command`. `poetry publish` fails as `claude-plugin-poetry-publish-command`. `yarn npm publish` stays #1180 npm-publish. `pnpm list`, comments, echo lookalikes, and README wording stay inventory. Snippets are command labels. | keep Draft stacked on #1180. Do not Close #1099 or #1180. | +| AppGuardrail #1183, branch `feat/claude-plugin-gem-nuget-1099`, exact head `798da4703bb81f91eed0380fe9603ad41ae620e5` | open/Draft successor stacked on #1182 (`e933579...`). RED `6d1afd3` → GREEN `798da47`. Plugin coverage suite 495 passed. | executable `gem push` fails as `claude-plugin-gem-push-command`. `nuget push` and `dotnet nuget push` fail as `claude-plugin-nuget-push-command`. `gem list`, `nuget list`, comments, echo lookalikes, README, and description prose stay inventory. pnpm stays #1182. Snippets are command labels. | keep Draft stacked on #1182. Do not Close #1099 or #1182. | +| AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `e933579f2b248ed43e5165824a7fe642025a1c5d` | open/Draft successor stacked on live #1180 (`af45351...`). RED `f734512` → GREEN `e933579`. Plugin coverage suite 484 passed. Gem/nuget successor is #1183. | executable `pnpm publish` fails as `claude-plugin-pnpm-publish-command`. `uv publish` fails as `claude-plugin-uv-publish-command`. `poetry publish` fails as `claude-plugin-poetry-publish-command`. `yarn npm publish` stays #1180 npm-publish. `pnpm list`, comments, echo lookalikes, and README wording stay inventory. Snippets are command labels. | keep Draft stacked on #1180. Do not Close #1099 or #1180. | | AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `af45351edc214136780b66ed3a96ad15acca036c` | open/Draft successor on current #1179 (`3073ffdb...`). Non-force two-parent restack is 5 ahead / 0 behind and its changed files are exactly the five registry-publish files; the previously omitted #1179 object-store RED fixture is present in the tree. Exact AST, inherited S3 direction probes 3/3, and npm/twine/cargo detector identities 3/3 pass. No hosted workflow exists on the custom base. Alt-publish successor is #1182. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities. Packaging/check/comment/echo/prose lookalikes remain negative; S3 direction remains #1179. | keep Draft stacked on #1179 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1179. | | AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `3073ffdbbddbaa30d363f366d7dc5deea250f939` | open/Draft successor on current #1177 (`fdcda62...`), 0 behind. Direction RED `f480ae0...` to GREEN `51d1da4...`; later-write RED `44761c2...` to current GREEN `3073ffdb...`. Exact-source AST passes; literal-download negatives 2/2 and write/ambiguous/later-write positives 6/6 pass. No hosted workflow exists on the custom base. | a literal two-operand `aws s3 cp` or `aws s3 sync` from S3 to local is download inventory, but local-to-S3, S3-to-S3, dynamic or option-bearing ambiguity, and a later write after a safe download fail closed as `claude-plugin-aws-s3-write-command`. | keep Draft stacked on #1177 and obtain hosted integration/coverage/current-head review. Do not Close #1099, #1177, or #1174. | | AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `fdcda62e0948117231c130f62f47cb61ca1a3a8c` | open/Draft on current #1176 (`6f6e47c...`), non-force restacked 5 ahead / 0 behind with its cloud-deploy delta preserved. Exact detector/test AST and inherited command-context probes pass; no hosted workflow exists on the custom base. Object-store successor is #1179. | actual AWS/gcloud/Azure deploy command values fail closed; description prose and `echo`/`printf`/`print` command values remain negative, while a later real command stays positive. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1176, or #1174. | @@ -178,7 +179,7 @@ Dashboard, JSON, SARIF, reports, and deploy gates must consume `scan_outcome_cod | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 06:07 UTC records Draft #1182 `e933579` on #1180 `af45351` on #1179 `3073ffdb`, #1036 Ready at `0ef5715`, canonical file-picker UX #1131 `5f93858`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 06:17 UTC records Draft #1183 `798da47` on #1182 `e933579` on #1180 `af45351`, #1036 Ready at `0ef5715`, canonical file-picker UX #1131 `5f93858`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -261,7 +262,8 @@ re-fetch docs/issues/PRs/current heads 56. Keep #1177 Draft at `fdcda62`, non-force-restacked on #1176 with cloud-deploy delta preserved and compare 5 ahead / 0 behind. Do not Close #1099, #1176, or #1174. 57. Keep #1179 Draft stacked on #1177 at `3073ffdb`. Literal S3 downloads stay inventory; writes, ambiguous forms and later writes fail closed. RED/GREEN and exact probes pass; no hosted stacked Checks exist. Do not Close #1099, #1177, or #1174. 58. Keep #1180 Draft stacked on #1179 at `af45351`. Its five-file registry delta is 5 ahead / 0 behind and the #1179 RED fixture is present; exact AST and inherited/unique probes pass. Do not Close #1099 or #1179. -59. Keep #1182 Draft stacked on #1180 at `e933579`. Executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` stays the npm class. Do not Close #1099 or #1180. Remaining unique leftover: `gem push` / `nuget push` package-registry writes. +59. Keep #1182 Draft stacked on #1180 at `e933579`. Executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` stays the npm class. Do not Close #1099 or #1180. +60. Keep #1183 Draft stacked on #1182 at `798da47`. Executable `gem push` and `nuget push` fail closed. Do not Close #1099 or #1182. Remaining unique leftover: `composer publish` / `pub publish` / `go upload`. 60. Keep #1131 Draft at `5f93858` as the canonical dashboard file-picker UX owner. Static markup Tests are not browser acceptance. Browser/Playwright infrastructure remains unmerged on Draft #1117; integrate that prerequisite or non-force stack without copying unprotected authority, then prove keyboard, pointer, cancel/reselect, focus, accessibility-tree, responsive and failure-state behavior on one exact head. 61. Keep #1181 Draft at `d9254a4` as a duplicate predecessor until #1131 completely carries and accepts every valid product/test delta. Its unique `.jules/palette.md` entry duplicates protected `Native File Input Iteration Friction` authority and is not a separate product delta. Do not Close either PR before verified successor acceptance. From 5c9e99619a2993446a9bc45dbfaa29b63fe13f5b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 16:18:14 +0900 Subject: [PATCH 126/192] docs: record quoted command-context repair stack --- docs/product-technical-gap-baseline.md | 43 +++++++++++++------------- 1 file changed, 22 insertions(+), 21 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index c00f8d40..f8c446af 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -76,15 +76,15 @@ Responsibility boundaries: | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with only `scanner/dashboard/index.html` and `tests/test_dashboard_core.py`; eight repository workflows succeeded, CodeQL PR `34181962755` failed, no review/thread exists, and no browser/E2E artifact is present. #1181 exact `d9254a4a017d42b89283135b62c1fd75de61e14d` independently reproduced the product/test intent but added a `.jules/palette.md` doctrine already owned by protected `Native File Input Iteration Friction`; it was corrected from Ready to Draft. Eight repository workflows are now GREEN; CodeQL PR `34189867456` remains queued. | Static markup can prove a visible native button but cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. A local unversioned Playwright claim is not exact-head evidence. Unmerged Draft #1117 exact `d3283a1` carries the browser infrastructure and its XSS Chromium oracle passed in Python 3.11/3.13 Tests run `34068384354`; this proves that security boundary only, while CodeQL remains pending-handoff and it is not protected authority to copy. | keep #1181 open as predecessor until #1131 completely carries and proves the valid delta. Keep #1131 Draft; integrate #1117 first or non-force stack on a verified current prerequisite, then add current-head browser/E2E and screenshot evidence before Ready. | -| AppGuardrail #1183, branch `feat/claude-plugin-gem-nuget-1099`, exact head `798da4703bb81f91eed0380fe9603ad41ae620e5` | open/Draft successor stacked on #1182 (`e933579...`). RED `6d1afd3` → GREEN `798da47`. Plugin coverage suite 495 passed. | executable `gem push` fails as `claude-plugin-gem-push-command`. `nuget push` and `dotnet nuget push` fail as `claude-plugin-nuget-push-command`. `gem list`, `nuget list`, comments, echo lookalikes, README, and description prose stay inventory. pnpm stays #1182. Snippets are command labels. | keep Draft stacked on #1182. Do not Close #1099 or #1182. | -| AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `e933579f2b248ed43e5165824a7fe642025a1c5d` | open/Draft successor stacked on live #1180 (`af45351...`). RED `f734512` → GREEN `e933579`. Plugin coverage suite 484 passed. Gem/nuget successor is #1183. | executable `pnpm publish` fails as `claude-plugin-pnpm-publish-command`. `uv publish` fails as `claude-plugin-uv-publish-command`. `poetry publish` fails as `claude-plugin-poetry-publish-command`. `yarn npm publish` stays #1180 npm-publish. `pnpm list`, comments, echo lookalikes, and README wording stay inventory. Snippets are command labels. | keep Draft stacked on #1180. Do not Close #1099 or #1180. | -| AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `af45351edc214136780b66ed3a96ad15acca036c` | open/Draft successor on current #1179 (`3073ffdb...`). Non-force two-parent restack is 5 ahead / 0 behind and its changed files are exactly the five registry-publish files; the previously omitted #1179 object-store RED fixture is present in the tree. Exact AST, inherited S3 direction probes 3/3, and npm/twine/cargo detector identities 3/3 pass. No hosted workflow exists on the custom base. Alt-publish successor is #1182. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities. Packaging/check/comment/echo/prose lookalikes remain negative; S3 direction remains #1179. | keep Draft stacked on #1179 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1179. | -| AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `3073ffdbbddbaa30d363f366d7dc5deea250f939` | open/Draft successor on current #1177 (`fdcda62...`), 0 behind. Direction RED `f480ae0...` to GREEN `51d1da4...`; later-write RED `44761c2...` to current GREEN `3073ffdb...`. Exact-source AST passes; literal-download negatives 2/2 and write/ambiguous/later-write positives 6/6 pass. No hosted workflow exists on the custom base. | a literal two-operand `aws s3 cp` or `aws s3 sync` from S3 to local is download inventory, but local-to-S3, S3-to-S3, dynamic or option-bearing ambiguity, and a later write after a safe download fail closed as `claude-plugin-aws-s3-write-command`. | keep Draft stacked on #1177 and obtain hosted integration/coverage/current-head review. Do not Close #1099, #1177, or #1174. | -| AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `fdcda62e0948117231c130f62f47cb61ca1a3a8c` | open/Draft on current #1176 (`6f6e47c...`), non-force restacked 5 ahead / 0 behind with its cloud-deploy delta preserved. Exact detector/test AST and inherited command-context probes pass; no hosted workflow exists on the custom base. Object-store successor is #1179. | actual AWS/gcloud/Azure deploy command values fail closed; description prose and `echo`/`printf`/`print` command values remain negative, while a later real command stays positive. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1176, or #1174. | -| AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `6f6e47c46e73ca6d6b802808b4e134203ba59f48` | open/Draft on current #1175 (`aa5128f...`), non-force restacked 4 ahead / 0 behind with its path-depth delta preserved. Exact candidate AST passes; no hosted workflow exists on the custom base. | files/archive members deeper than 32 components fail as `claude-plugin-excessive-path-depth`; bound-depth and sibling archive classes remain distinct. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1175, #1166, or #1135. | -| AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `aa5128fb115668ce8abf869dd1d711e72fe09baa` | open/Draft on current #1174 (`d8f5f76...`), non-force restacked 4 ahead / 0 behind with its unsigned-checksum delta preserved. Exact candidate AST passes; no hosted workflow exists on the custom base. | unsigned first-party digest rows fail closed; empty/symlink signatures do not qualify, mismatch stays #1169, and network verification is not claimed. | keep Draft and obtain stacked integration evidence. Do not Close #1099, #1174, or #1169. | -| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `d8f5f76400f952410d1f4e0cda268a2e3d184c45` | open/Draft successor on current #1173 (`41669d...`), non-force restacked 7 ahead / 0 behind with hosted-deploy delta preserved. It inherits the current structural command-source helper; exact AST and comment/reporting negative plus executable-command positive probes pass. No hosted workflow exists on the custom base. | executable hook or manifest `vercel deploy` and `fly deploy` fail closed, while comments, description prose, and reporting-only values are not this class. | keep Draft stacked on #1173 and obtain hosted integration evidence. Do not Close #1099 or #1173. | -| AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `41669d695c60635d38c2f2ef5174141f20f9a24b` | open/Draft successor on #1172 (`936311c...`). RED `33aae04...` proves comments, reporting-only hooks, manifest prose, and reporting command values were raw-regex false positives; GREEN lineage `1f901a...` / `7051748...` / `41669d...` introduced bounded structural command-source parsing, fixed an intermediate literal-escape SyntaxError, and preserved concurrent helper constants. Exact source/test AST, negatives 3/3, and positives 3/3 pass. No hosted workflow exists on the custom base. | only executable `terraform apply` or `helm install` command context fails closed; `terraform plan`, `helm list`, comments, prose and reporting-only values remain inventory, while a later real command remains positive. | keep Draft stacked on #1172 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1172. | +| AppGuardrail #1183, branch `feat/claude-plugin-gem-nuget-1099`, exact head `53cd89ec3dcc20d8cfd6c7ad355b705c3d2704c2` | open/Draft successor stacked on current #1182 (`e9df55d...`), 5 ahead / 0 behind. It inherits #1173 quoted-command RED/GREEN without a leaf workaround; exact source/test AST and top-helper negatives/positives pass. No hosted workflow exists on the custom base. | executable `gem push`, `nuget push`, and `dotnet nuget push` retain distinct fail-closed identities; quoted assignments, condition operands, reporting substitutions, comments, echo lookalikes, README, and prose stay negative. | keep Draft stacked on #1182 and obtain hosted integration/current-head review. Do not Close #1099 or #1182. | +| AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `e9df55d04e2563ad90a574d4f2f5685fa52754af` | open/Draft successor stacked on current #1180 (`e835a8f...`), 5 ahead / 0 behind with the alt-publish and terraform/helm regression deltas preserved. | executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` remains the npm class; quoted/reporting command names remain negative. | keep Draft stacked on #1180 and obtain hosted integration/current-head review. Do not Close #1099 or #1180. | +| AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `e835a8fc4e050bb6f960ed04686717b5773bc63f` | open/Draft successor on current #1179 (`f8372ec...`), 8 ahead / 0 behind with registry-publish delta and inherited regressions preserved. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities; packaging/check/comment/echo/prose lookalikes remain negative. | keep Draft stacked on #1179 and obtain hosted integration/current-head review. Do not Close #1099 or #1179. | +| AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `f8372ece60fdf2db61a0fbd733414083ea09d3f1` | open/Draft successor on current #1177 (`7802ad6...`), 10 ahead / 0 behind with object-store direction and later-write regressions preserved. | literal two-operand S3-to-local is inventory; writes, S3-to-S3, ambiguous forms, and later writes fail closed. Quoted command prose stays negative through the canonical helper. | keep Draft stacked on #1177 and obtain hosted integration/current-head review. Do not Close #1099, #1177, or #1174. | +| AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `7802ad62082696dba275a1734c4fb81841f416db` | open/Draft on current #1176 (`8544253...`), 8 ahead / 0 behind with cloud-deploy delta preserved. | executable AWS/gcloud/Azure deploy commands fail closed; quoted/reporting/prose values remain negative while direct substitutions and later real commands remain positive. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1176, or #1174. | +| AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `854425316ceeee270dec78fb0c6723050af36531` | open/Draft on current #1175 (`77f7ffa...`), 7 ahead / 0 behind with path-depth delta preserved. | paths deeper than 32 components fail closed; the canonical command-context helper remains independent and verified. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1175, #1166, or #1135. | +| AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `77f7ffa03cc97670ae66e329b6b811e6264867a4` | open/Draft on current #1174 (`2967d09...`), 7 ahead / 0 behind with unsigned-checksum delta preserved. | unsigned first-party digest rows fail closed; mismatch remains #1169 and the command-context repair does not alter checksum classes. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1174, or #1169. | +| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `2967d093985f96dd0830cd600b86f7f07c7235df` | open/Draft on current #1173 (`3a5b147...`), 10 ahead / 0 behind with hosted-deploy delta preserved. | executable `vercel deploy` and `fly deploy` fail closed; quoted assignments/test operands, reporting substitutions, comments, description prose, and reporting-only values remain negative. | keep Draft stacked on #1173 and obtain hosted integration/current-head review. Do not Close #1099 or #1173. | +| AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `3a5b14771cc7abb6553fa1ec9bcd8b62acc947ac` | open/Draft canonical command-context owner. RED `d7384e53d44a426356a73e24b2b9cc3fe153de27` proves quoted assignments, quoted test operands, and reporting substitution false positives. GREEN `cb208db...`, escape cleanup `3c5fdc4...`, and final test descendant `3a5b147...` add bounded root/`$(...)`/backtick frame tracking. SyntaxWarning-as-error AST passes; exact helpers pass 4 negatives / 3 positives. | only executable command frames fail closed; plain quoted prose and reporting-only substitutions stay inventory, while direct `$(terraform apply)` and backtick Helm commands remain positive. | keep Draft stacked on #1172 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1172. | | AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. Terraform/helm successor is #1173. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. On this slice `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory; terraform/helm successor is #1173. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | | AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. Deployment-write successor is #1172. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | | AppGuardrail #1170, branch `feat/claude-plugin-github-merge-release-1099`, exact head `b506b824987326bd82f5fb5f8d037194a21163b6` | open/Draft successor stacked on #1169 (`226ca73...`). RED `527edb5` → GREEN `b506b82`. Focused merge/release tests 16 passed plus inventory lock; detector statement coverage 2455/2455 on Python 3.13. Credential-store successor is #1171. | hook or manifest `gh pr merge` fails as `claude-plugin-github-merge-command`. `gh release` create, upload, delete, or edit fails as `claude-plugin-github-release-command`. On this slice `gh issue create`, `gh pr review`, `gh release list`, `kubectl apply`, and `docker push` stay inventory; kubectl/docker-push successor is #1172. Hardcoded PATs stay `claude-plugin-github-write-token`. Snippets are command labels. | keep Draft stacked on #1169. Do not Close #1099 or #1169. Do not steal checksum-mismatch or github-write-token. | @@ -179,12 +179,13 @@ Dashboard, JSON, SARIF, reports, and deploy gates must consume `scan_outcome_cod | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 06:17 UTC records Draft #1183 `798da47` on #1182 `e933579` on #1180 `af45351`, #1036 Ready at `0ef5715`, canonical file-picker UX #1131 `5f93858`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; the 2026-09-08 snapshot records the non-force 0-behind #1173→#1183 detector stack, #1036 Ready at `0ef5715`, canonical file-picker UX #1131 `5f93858`, source-neutral Draft predecessor #1181 `b4880bf`, and #998 Draft `8b95c2b` with pending-handoff evidence. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps - Built-in regex rules are valid only for explicitly tested syntax/control-flow. Structural semantics not safely representable must move to an executable analyzer or remain an explicit gap. - GitHub Actions polling analysis must distinguish per-request transport budgets from total control-flow bounds, preserve job/run/loop locality, model branch and exit reachability, distinguish executable commands from quoted/comment text, and account for selected shell/fail-fast semantics before using shell errors as safety or vulnerability evidence. +- Quoted shell strings are inert prose unless the match is inside a parsed command-substitution or backtick frame; reporting-only nested substitutions remain non-executable, while direct substitution commands retain fail-closed detection. - Safety state is causal, not nominal: initialization must precede the candidate loop; deadlines/limits/counters must converge; state in sibling/earlier loops cannot sanitize another loop; textual `exit` is not safety evidence when a prior unconditional transfer makes it unreachable; an independent monotonic total bound must remain authoritative even if a non-owning retry counter resets. - URL-validation tests that prove a public resolved hostname must control DNS deterministically. Reserved/example hostnames are not evidence that production should accept unresolved destinations. - Missing, queued, running, stale, cancelled, unavailable, inconclusive and failed source conditions remain distinct provenance/reason values even when the assurance mapping groups them into `incomplete`, `failed`, or `untrusted`. A required workflow `startup_failure` with zero jobs is control-plane/infrastructure evidence, not a source-test success or failure and never transfers from another head. @@ -255,17 +256,17 @@ re-fetch docs/issues/PRs/current heads 49. Keep #1170 Draft stacked on #1169 at `b506b82`. Hook/manifest `gh pr merge` and `gh release` write verbs fail closed. Issue create, PR review, and release list stay inventory on this slice. Do not Close #1099 or #1169. 50. Keep #1171 Draft stacked on #1170 at `9370a0d`. Host cookie/token stores beyond browser profiles fail closed. Do not Close #1099, #1170, #1150, or #1137. 51. Keep #1172 Draft stacked on #1171 at `936311c`. Hook/manifest `kubectl apply` and `docker push` fail closed. Do not Close #1099, #1171, or #1170. -52. Keep #1173 Draft stacked on #1172 at `41669d6`. RED `33aae04` to structural command-source GREEN; exact AST, negative 3/3 and positive 3/3 probes pass, but hosted stacked evidence is absent. Do not Close #1099 or #1172. -53. Keep #1174 Draft at `d8f5f76`, non-force-restacked on #1173 with hosted-deploy delta preserved and compare 7 ahead / 0 behind. Do not Close #1099 or #1173. -54. Keep #1175 Draft at `aa5128f`, non-force-restacked on #1174 with unsigned-checksum delta preserved and compare 4 ahead / 0 behind. Do not Close #1099, #1174, or #1169. -55. Keep #1176 Draft at `6f6e47c`, non-force-restacked on #1175 with path-depth delta preserved and compare 4 ahead / 0 behind. Do not Close #1099, #1175, #1166, or #1135. -56. Keep #1177 Draft at `fdcda62`, non-force-restacked on #1176 with cloud-deploy delta preserved and compare 5 ahead / 0 behind. Do not Close #1099, #1176, or #1174. -57. Keep #1179 Draft stacked on #1177 at `3073ffdb`. Literal S3 downloads stay inventory; writes, ambiguous forms and later writes fail closed. RED/GREEN and exact probes pass; no hosted stacked Checks exist. Do not Close #1099, #1177, or #1174. -58. Keep #1180 Draft stacked on #1179 at `af45351`. Its five-file registry delta is 5 ahead / 0 behind and the #1179 RED fixture is present; exact AST and inherited/unique probes pass. Do not Close #1099 or #1179. -59. Keep #1182 Draft stacked on #1180 at `e933579`. Executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` stays the npm class. Do not Close #1099 or #1180. -60. Keep #1183 Draft stacked on #1182 at `798da47`. Executable `gem push` and `nuget push` fail closed. Do not Close #1099 or #1182. Remaining unique leftover: `composer publish` / `pub publish` / `go upload`. -60. Keep #1131 Draft at `5f93858` as the canonical dashboard file-picker UX owner. Static markup Tests are not browser acceptance. Browser/Playwright infrastructure remains unmerged on Draft #1117; integrate that prerequisite or non-force stack without copying unprotected authority, then prove keyboard, pointer, cancel/reselect, focus, accessibility-tree, responsive and failure-state behavior on one exact head. -61. Keep #1181 Draft at `d9254a4` as a duplicate predecessor until #1131 completely carries and accepts every valid product/test delta. Its unique `.jules/palette.md` entry duplicates protected `Native File Input Iteration Friction` authority and is not a separate product delta. Do not Close either PR before verified successor acceptance. +52. Keep #1173 Draft at `3a5b147` on #1172. RED `d7384e5` proves quoted assignment/test/reporting-substitution false positives; bounded shell-frame GREEN ends at `3a5b147`. Exact AST with SyntaxWarning-as-error and helper probes 4/4 negative plus 3/3 positive pass; hosted stacked evidence is absent. Do not Close #1099 or #1172. +53. Keep #1174 Draft at `2967d09`, non-force-restacked on #1173 `3a5b147`, 10 ahead / 0 behind with hosted-deploy delta preserved. +54. Keep #1175 Draft at `77f7ffa`, non-force-restacked on #1174 `2967d09`, 7 ahead / 0 behind with unsigned-checksum delta preserved. +55. Keep #1176 Draft at `8544253`, non-force-restacked on #1175 `77f7ffa`, 7 ahead / 0 behind with path-depth delta preserved. +56. Keep #1177 Draft at `7802ad6`, non-force-restacked on #1176 `8544253`, 8 ahead / 0 behind with cloud-deploy delta preserved. +57. Keep #1179 Draft at `f8372ec`, non-force-restacked on #1177 `7802ad6`, 10 ahead / 0 behind with object-store delta preserved. +58. Keep #1180 Draft at `e835a8f`, non-force-restacked on #1179 `f8372ec`, 8 ahead / 0 behind with registry-publish delta preserved. +59. Keep #1182 Draft at `e9df55d`, non-force-restacked on #1180 `e835a8f`, 5 ahead / 0 behind with alt-publish delta preserved. +60. Keep #1183 Draft at `53cd89e`, non-force-restacked on #1182 `e9df55d`, 5 ahead / 0 behind with gem/nuget delta preserved. Remaining unique leftover: `composer publish` / `pub publish` / `go upload`. +61. Keep #1131 Draft at `5f93858` as the canonical dashboard file-picker UX owner. Static markup Tests are not browser acceptance. Browser/Playwright infrastructure remains unmerged on Draft #1117; integrate that prerequisite or non-force stack without copying unprotected authority, then prove keyboard, pointer, cancel/reselect, focus, accessibility-tree, responsive and failure-state behavior on one exact head. +62. Keep #1181 Draft at source-neutral head `b4880bf` as a duplicate predecessor until #1131 completely carries and accepts every valid product/test delta. Exact-head Tests and five other repository workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` remain queued. Do not transfer predecessor evidence or Close either PR before verified successor acceptance. ## Standards and acceptance basis From 2afc120ffed631fe8192d7ef9c3fae91d38e31a8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 16:18:46 +0900 Subject: [PATCH 127/192] docs: align gap snapshot changelog --- CHANGELOG.d/999-gap-baseline-0540.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.d/999-gap-baseline-0540.md b/CHANGELOG.d/999-gap-baseline-0540.md index 2b87cb78..cc071f94 100644 --- a/CHANGELOG.d/999-gap-baseline-0540.md +++ b/CHANGELOG.d/999-gap-baseline-0540.md @@ -1,3 +1,3 @@ -# Gap baseline snapshot 2026-09-08 06:05 UTC +# Gap baseline snapshot 2026-09-08 -Records live exact-head evidence for the commercial-readiness loop: #1036 skill-supply-chain repairs; #1173 structural command-context RED/GREEN; non-force, zero-behind #1174-#1177 stack integration; #1179 S3 direction and later-write regressions; #1180 registry-publish inheritance; the canonical fail-closed assurance-state mapping; and the #1131/#1181 dashboard file-picker ownership, duplicate-doctrine, and browser-evidence boundary. This documents Proposed work and exact candidate evidence, not a protected capability, approval, release, or certification claim. +Records live exact-head evidence for the commercial-readiness loop: #1036 skill-supply-chain repairs; #1173 quoted-shell command-context RED/GREEN; non-force, zero-behind #1174-#1183 stack integration with every unique detector/test delta preserved; the canonical fail-closed assurance-state mapping; and the #1131/#1181 dashboard file-picker ownership, source-neutral predecessor, and browser-evidence boundary. This documents Proposed work and exact candidate evidence, not a protected capability, approval, release, or certification claim. From 41ce1578d81bb2ff4cc959954ecf112b4d98a7b6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 16:20:18 +0900 Subject: [PATCH 128/192] docs: correct current dashboard predecessor evidence --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f8c446af..cf80890e 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -75,7 +75,7 @@ Responsibility boundaries: | AppGuardrail #1152, branch `feat/actions-poll-analyzer-emit-1087`, exact head `255cfd866efd971396e132992a474074487f1939` | open/Draft successor stacked on #1133 (`5baeab9...`). RED `f38e398` then GREEN. Emit + structural + #1088 poll corpus 185 passed. Analyzer 417/417 statements and 196/196 branches. Hosted `exact-head-coverage` on this head is SUCCESS. | `_scan_file` now runs `classify_poll_loops` on `.github/workflows/*.{yml,yaml}` and merges with regex by `(rule_id, file)`. Historical vulnerable fixture emits `github-actions-transport-only-poll-bound` once. Historical fixed fixture stays negative. Regex YAML is unchanged. | keep Draft stacked on #1133. Do not Close #1087, #1088, or #1133. Do not invent a third poll-bound ID. | | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | -| AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with only `scanner/dashboard/index.html` and `tests/test_dashboard_core.py`; eight repository workflows succeeded, CodeQL PR `34181962755` failed, no review/thread exists, and no browser/E2E artifact is present. #1181 exact `d9254a4a017d42b89283135b62c1fd75de61e14d` independently reproduced the product/test intent but added a `.jules/palette.md` doctrine already owned by protected `Native File Input Iteration Friction`; it was corrected from Ready to Draft. Eight repository workflows are now GREEN; CodeQL PR `34189867456` remains queued. | Static markup can prove a visible native button but cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. A local unversioned Playwright claim is not exact-head evidence. Unmerged Draft #1117 exact `d3283a1` carries the browser infrastructure and its XSS Chromium oracle passed in Python 3.11/3.13 Tests run `34068384354`; this proves that security boundary only, while CodeQL remains pending-handoff and it is not protected authority to copy. | keep #1181 open as predecessor until #1131 completely carries and proves the valid delta. Keep #1131 Draft; integrate #1117 first or non-force stack on a verified current prerequisite, then add current-head browser/E2E and screenshot evidence before Ready. | +| AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with static product/test evidence only. #1181 exact `b4880bfde3facc2bf3bb776946afc74b732a0b65` is a source-neutral one-commit descendant of `2aafa234...` (0 changed files); it reproduces the product/test intent but adds duplicate `.jules/palette.md` doctrine. Exact-head Tests `34197874864` and five other workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` are queued. | Static markup cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. Draft #1117 browser evidence proves only its XSS boundary and is not protected authority to copy. | keep #1181 Draft/open until #1131 completely carries and accepts the valid delta. Keep #1131 Draft; integrate the browser prerequisite through ordinary ancestry and add exact-head browser/E2E evidence before Ready. | | AppGuardrail #1183, branch `feat/claude-plugin-gem-nuget-1099`, exact head `53cd89ec3dcc20d8cfd6c7ad355b705c3d2704c2` | open/Draft successor stacked on current #1182 (`e9df55d...`), 5 ahead / 0 behind. It inherits #1173 quoted-command RED/GREEN without a leaf workaround; exact source/test AST and top-helper negatives/positives pass. No hosted workflow exists on the custom base. | executable `gem push`, `nuget push`, and `dotnet nuget push` retain distinct fail-closed identities; quoted assignments, condition operands, reporting substitutions, comments, echo lookalikes, README, and prose stay negative. | keep Draft stacked on #1182 and obtain hosted integration/current-head review. Do not Close #1099 or #1182. | | AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `e9df55d04e2563ad90a574d4f2f5685fa52754af` | open/Draft successor stacked on current #1180 (`e835a8f...`), 5 ahead / 0 behind with the alt-publish and terraform/helm regression deltas preserved. | executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` remains the npm class; quoted/reporting command names remain negative. | keep Draft stacked on #1180 and obtain hosted integration/current-head review. Do not Close #1099 or #1180. | | AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `e835a8fc4e050bb6f960ed04686717b5773bc63f` | open/Draft successor on current #1179 (`f8372ec...`), 8 ahead / 0 behind with registry-publish delta and inherited regressions preserved. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities; packaging/check/comment/echo/prose lookalikes remain negative. | keep Draft stacked on #1179 and obtain hosted integration/current-head review. Do not Close #1099 or #1179. | From 7248e0212906b169f027b03b21a700c40234c525 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 16:21:49 +0900 Subject: [PATCH 129/192] docs: record #1184 dart/flutter pub-publish successor Exact head 7faaaad stacked on #1183 fails closed on dart pub publish, flutter pub publish, and legacy pub publish. Relates to #1099. --- docs/product-technical-gap-baseline.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f8c446af..089037ec 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 06:17 UTC +**Snapshot:** 2026-09-08 07:20 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,7 +68,7 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 06:17 UTC snapshot +## Security-defect corpus — live 2026-09-08 07:20 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | @@ -76,7 +76,8 @@ Responsibility boundaries: | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with only `scanner/dashboard/index.html` and `tests/test_dashboard_core.py`; eight repository workflows succeeded, CodeQL PR `34181962755` failed, no review/thread exists, and no browser/E2E artifact is present. #1181 exact `d9254a4a017d42b89283135b62c1fd75de61e14d` independently reproduced the product/test intent but added a `.jules/palette.md` doctrine already owned by protected `Native File Input Iteration Friction`; it was corrected from Ready to Draft. Eight repository workflows are now GREEN; CodeQL PR `34189867456` remains queued. | Static markup can prove a visible native button but cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. A local unversioned Playwright claim is not exact-head evidence. Unmerged Draft #1117 exact `d3283a1` carries the browser infrastructure and its XSS Chromium oracle passed in Python 3.11/3.13 Tests run `34068384354`; this proves that security boundary only, while CodeQL remains pending-handoff and it is not protected authority to copy. | keep #1181 open as predecessor until #1131 completely carries and proves the valid delta. Keep #1131 Draft; integrate #1117 first or non-force stack on a verified current prerequisite, then add current-head browser/E2E and screenshot evidence before Ready. | -| AppGuardrail #1183, branch `feat/claude-plugin-gem-nuget-1099`, exact head `53cd89ec3dcc20d8cfd6c7ad355b705c3d2704c2` | open/Draft successor stacked on current #1182 (`e9df55d...`), 5 ahead / 0 behind. It inherits #1173 quoted-command RED/GREEN without a leaf workaround; exact source/test AST and top-helper negatives/positives pass. No hosted workflow exists on the custom base. | executable `gem push`, `nuget push`, and `dotnet nuget push` retain distinct fail-closed identities; quoted assignments, condition operands, reporting substitutions, comments, echo lookalikes, README, and prose stay negative. | keep Draft stacked on #1182 and obtain hosted integration/current-head review. Do not Close #1099 or #1182. | +| AppGuardrail #1184, branch `feat/claude-plugin-pub-publish-1099`, exact head `7faaaad5ab2f6bf664f964d51da534f59920cd41` | open/Draft successor stacked on live #1183 (`53cd89e...`) after non-force merge. RED `4351d47` → GREEN `09b6dce` then restack merge `7faaaad`. Focused pub/gem/alt tests 34 passed; plugin suite 506 passed on the pre-restack GREEN. | executable `dart pub publish`, `flutter pub publish`, and legacy `pub publish` fail as `claude-plugin-pub-publish-command`. `dart pub get` stays inventory. `pnpm publish` stays #1182. `composer publish` and `go upload` are not invented. Snippets are command labels. | keep Draft stacked on #1183. Do not Close #1099 or #1183. | +| AppGuardrail #1183, branch `feat/claude-plugin-gem-nuget-1099`, exact head `53cd89ec3dcc20d8cfd6c7ad355b705c3d2704c2` | open/Draft successor stacked on current #1182 (`e9df55d...`), 5 ahead / 0 behind. It inherits #1173 quoted-command RED/GREEN without a leaf workaround; exact source/test AST and top-helper negatives/positives pass. No hosted workflow exists on the custom base. Pub-publish successor is #1184. | executable `gem push`, `nuget push`, and `dotnet nuget push` retain distinct fail-closed identities; quoted assignments, condition operands, reporting substitutions, comments, echo lookalikes, README, and prose stay negative. | keep Draft stacked on #1182 and obtain hosted integration/current-head review. Do not Close #1099 or #1182. | | AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `e9df55d04e2563ad90a574d4f2f5685fa52754af` | open/Draft successor stacked on current #1180 (`e835a8f...`), 5 ahead / 0 behind with the alt-publish and terraform/helm regression deltas preserved. | executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` remains the npm class; quoted/reporting command names remain negative. | keep Draft stacked on #1180 and obtain hosted integration/current-head review. Do not Close #1099 or #1180. | | AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `e835a8fc4e050bb6f960ed04686717b5773bc63f` | open/Draft successor on current #1179 (`f8372ec...`), 8 ahead / 0 behind with registry-publish delta and inherited regressions preserved. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities; packaging/check/comment/echo/prose lookalikes remain negative. | keep Draft stacked on #1179 and obtain hosted integration/current-head review. Do not Close #1099 or #1179. | | AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `f8372ece60fdf2db61a0fbd733414083ea09d3f1` | open/Draft successor on current #1177 (`7802ad6...`), 10 ahead / 0 behind with object-store direction and later-write regressions preserved. | literal two-operand S3-to-local is inventory; writes, S3-to-S3, ambiguous forms, and later writes fail closed. Quoted command prose stays negative through the canonical helper. | keep Draft stacked on #1177 and obtain hosted integration/current-head review. Do not Close #1099, #1177, or #1174. | @@ -179,7 +180,7 @@ Dashboard, JSON, SARIF, reports, and deploy gates must consume `scan_outcome_cod | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; the 2026-09-08 snapshot records the non-force 0-behind #1173→#1183 detector stack, #1036 Ready at `0ef5715`, canonical file-picker UX #1131 `5f93858`, source-neutral Draft predecessor #1181 `b4880bf`, and #998 Draft `8b95c2b` with pending-handoff evidence. | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 07:20 UTC records Draft #1184 `7faaaad` on #1183 `53cd89e` on #1182 `e9df55d`, #1036 Ready at `0ef5715`, canonical file-picker UX #1131 `5f93858`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -264,9 +265,10 @@ re-fetch docs/issues/PRs/current heads 57. Keep #1179 Draft at `f8372ec`, non-force-restacked on #1177 `7802ad6`, 10 ahead / 0 behind with object-store delta preserved. 58. Keep #1180 Draft at `e835a8f`, non-force-restacked on #1179 `f8372ec`, 8 ahead / 0 behind with registry-publish delta preserved. 59. Keep #1182 Draft at `e9df55d`, non-force-restacked on #1180 `e835a8f`, 5 ahead / 0 behind with alt-publish delta preserved. -60. Keep #1183 Draft at `53cd89e`, non-force-restacked on #1182 `e9df55d`, 5 ahead / 0 behind with gem/nuget delta preserved. Remaining unique leftover: `composer publish` / `pub publish` / `go upload`. -61. Keep #1131 Draft at `5f93858` as the canonical dashboard file-picker UX owner. Static markup Tests are not browser acceptance. Browser/Playwright infrastructure remains unmerged on Draft #1117; integrate that prerequisite or non-force stack without copying unprotected authority, then prove keyboard, pointer, cancel/reselect, focus, accessibility-tree, responsive and failure-state behavior on one exact head. -62. Keep #1181 Draft at source-neutral head `b4880bf` as a duplicate predecessor until #1131 completely carries and accepts every valid product/test delta. Exact-head Tests and five other repository workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` remain queued. Do not transfer predecessor evidence or Close either PR before verified successor acceptance. +60. Keep #1183 Draft at `53cd89e`, non-force-restacked on #1182 `e9df55d`, 5 ahead / 0 behind with gem/nuget delta preserved. +61. Keep #1184 Draft stacked on #1183 at `7faaaad`. Executable `dart pub publish` / `flutter pub publish` / `pub publish` fail closed; `dart pub get` stays inventory. Do not invent `composer publish` or `go upload`. Do not Close #1099 or #1183. Remaining unique leftover: `hex publish` / `conda upload`. +62. Keep #1131 Draft at `5f93858` as the canonical dashboard file-picker UX owner. Static markup Tests are not browser acceptance. Browser/Playwright infrastructure remains unmerged on Draft #1117; integrate that prerequisite or non-force stack without copying unprotected authority, then prove keyboard, pointer, cancel/reselect, focus, accessibility-tree, responsive and failure-state behavior on one exact head. +63. Keep #1181 Draft at source-neutral head `b4880bf` as a duplicate predecessor until #1131 completely carries and accepts every valid product/test delta. Exact-head Tests and five other repository workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` remain queued. Do not transfer predecessor evidence or Close either PR before verified successor acceptance. ## Standards and acceptance basis From 73a5f4ecb0d95255a9522a3f1bec4a67e9277538 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 16:36:52 +0900 Subject: [PATCH 130/192] docs: record #1185 hex/conda publish successor Exact head 512710e stacked on #1184 fails closed on hex publish, mix hex.publish, conda upload, and anaconda upload. Relates to #1099. --- CHANGELOG.d/999-gap-baseline-0540.md | 2 +- docs/product-technical-gap-baseline.md | 16 +++++++++------- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.d/999-gap-baseline-0540.md b/CHANGELOG.d/999-gap-baseline-0540.md index cc071f94..3d7290e7 100644 --- a/CHANGELOG.d/999-gap-baseline-0540.md +++ b/CHANGELOG.d/999-gap-baseline-0540.md @@ -1,3 +1,3 @@ # Gap baseline snapshot 2026-09-08 -Records live exact-head evidence for the commercial-readiness loop: #1036 skill-supply-chain repairs; #1173 quoted-shell command-context RED/GREEN; non-force, zero-behind #1174-#1183 stack integration with every unique detector/test delta preserved; the canonical fail-closed assurance-state mapping; and the #1131/#1181 dashboard file-picker ownership, source-neutral predecessor, and browser-evidence boundary. This documents Proposed work and exact candidate evidence, not a protected capability, approval, release, or certification claim. +Records live exact-head evidence for the commercial-readiness loop: #1036 skill-supply-chain repairs; #1173 quoted-shell command-context RED/GREEN; non-force, zero-behind #1174-#1185 stack integration with every unique detector/test delta preserved; Draft #1185 hex/conda publish fail-closed identities; the canonical fail-closed assurance-state mapping; and the #1131/#1181 dashboard file-picker ownership, source-neutral predecessor, and browser-evidence boundary. This documents Proposed work and exact candidate evidence, not a protected capability, approval, release, or certification claim. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 1bcdec01..6bd0d210 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 07:20 UTC +**Snapshot:** 2026-09-08 07:35 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,7 +68,7 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 07:20 UTC snapshot +## Security-defect corpus — live 2026-09-08 07:35 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | @@ -76,7 +76,8 @@ Responsibility boundaries: | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with static product/test evidence only. #1181 exact `b4880bfde3facc2bf3bb776946afc74b732a0b65` is a source-neutral one-commit descendant of `2aafa234...` (0 changed files); it reproduces the product/test intent but adds duplicate `.jules/palette.md` doctrine. Exact-head Tests `34197874864` and five other workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` are queued. | Static markup cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. Draft #1117 browser evidence proves only its XSS boundary and is not protected authority to copy. | keep #1181 Draft/open until #1131 completely carries and accepts the valid delta. Keep #1131 Draft; integrate the browser prerequisite through ordinary ancestry and add exact-head browser/E2E evidence before Ready. | -| AppGuardrail #1184, branch `feat/claude-plugin-pub-publish-1099`, exact head `7faaaad5ab2f6bf664f964d51da534f59920cd41` | open/Draft successor stacked on live #1183 (`53cd89e...`) after non-force merge. RED `4351d47` → GREEN `09b6dce` then restack merge `7faaaad`. Focused pub/gem/alt tests 34 passed; plugin suite 506 passed on the pre-restack GREEN. | executable `dart pub publish`, `flutter pub publish`, and legacy `pub publish` fail as `claude-plugin-pub-publish-command`. `dart pub get` stays inventory. `pnpm publish` stays #1182. `composer publish` and `go upload` are not invented. Snippets are command labels. | keep Draft stacked on #1183. Do not Close #1099 or #1183. | +| AppGuardrail #1185, branch `feat/claude-plugin-hex-conda-1099`, exact head `512710e793884e7aa17456e29df63c6eb02462ac` | open/Draft successor stacked on live #1184 (`7faaaad...`). RED `503ff23` → GREEN `512710e`. Focused hex/pub/gem/alt tests 47 passed; plugin suite 521 passed on Python 3.13. No hosted workflow exists on the custom base. | executable `hex publish` and Mix `mix hex.publish` fail as `claude-plugin-hex-publish-command`. `conda upload` and `anaconda upload` fail as `claude-plugin-conda-upload-command`. `hex info` and `conda list` stay inventory. `dart pub publish` stays #1184. `composer publish` and `go upload` are not invented. Snippets are command labels. | keep Draft stacked on #1184. Do not Close #1099 or #1184. | +| AppGuardrail #1184, branch `feat/claude-plugin-pub-publish-1099`, exact head `7faaaad5ab2f6bf664f964d51da534f59920cd41` | open/Draft successor stacked on live #1183 (`53cd89e...`) after non-force merge. RED `4351d47` → GREEN `09b6dce` then restack merge `7faaaad`. Focused pub/gem/alt tests 34 passed; plugin suite 506 passed on the pre-restack GREEN. Hex/conda successor is #1185. | executable `dart pub publish`, `flutter pub publish`, and legacy `pub publish` fail as `claude-plugin-pub-publish-command`. `dart pub get` stays inventory. `pnpm publish` stays #1182. `composer publish` and `go upload` are not invented. Snippets are command labels. | keep Draft stacked on #1183. Do not Close #1099 or #1183. | | AppGuardrail #1183, branch `feat/claude-plugin-gem-nuget-1099`, exact head `53cd89ec3dcc20d8cfd6c7ad355b705c3d2704c2` | open/Draft successor stacked on current #1182 (`e9df55d...`), 5 ahead / 0 behind. It inherits #1173 quoted-command RED/GREEN without a leaf workaround; exact source/test AST and top-helper negatives/positives pass. No hosted workflow exists on the custom base. Pub-publish successor is #1184. | executable `gem push`, `nuget push`, and `dotnet nuget push` retain distinct fail-closed identities; quoted assignments, condition operands, reporting substitutions, comments, echo lookalikes, README, and prose stay negative. | keep Draft stacked on #1182 and obtain hosted integration/current-head review. Do not Close #1099 or #1182. | | AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `e9df55d04e2563ad90a574d4f2f5685fa52754af` | open/Draft successor stacked on current #1180 (`e835a8f...`), 5 ahead / 0 behind with the alt-publish and terraform/helm regression deltas preserved. | executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` remains the npm class; quoted/reporting command names remain negative. | keep Draft stacked on #1180 and obtain hosted integration/current-head review. Do not Close #1099 or #1180. | | AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `e835a8fc4e050bb6f960ed04686717b5773bc63f` | open/Draft successor on current #1179 (`f8372ec...`), 8 ahead / 0 behind with registry-publish delta and inherited regressions preserved. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities; packaging/check/comment/echo/prose lookalikes remain negative. | keep Draft stacked on #1179 and obtain hosted integration/current-head review. Do not Close #1099 or #1179. | @@ -180,7 +181,7 @@ Dashboard, JSON, SARIF, reports, and deploy gates must consume `scan_outcome_cod | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 07:20 UTC records Draft #1184 `7faaaad` on #1183 `53cd89e` on #1182 `e9df55d`, #1036 Ready at `0ef5715`, canonical file-picker UX #1131 `5f93858`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 07:35 UTC records Draft #1185 `512710e` on #1184 `7faaaad` on #1183 `53cd89e` on #1182 `e9df55d`, #1036 Ready at `0ef5715`, canonical file-picker UX #1131 `5f93858`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -266,9 +267,10 @@ re-fetch docs/issues/PRs/current heads 58. Keep #1180 Draft at `e835a8f`, non-force-restacked on #1179 `f8372ec`, 8 ahead / 0 behind with registry-publish delta preserved. 59. Keep #1182 Draft at `e9df55d`, non-force-restacked on #1180 `e835a8f`, 5 ahead / 0 behind with alt-publish delta preserved. 60. Keep #1183 Draft at `53cd89e`, non-force-restacked on #1182 `e9df55d`, 5 ahead / 0 behind with gem/nuget delta preserved. -61. Keep #1184 Draft stacked on #1183 at `7faaaad`. Executable `dart pub publish` / `flutter pub publish` / `pub publish` fail closed; `dart pub get` stays inventory. Do not invent `composer publish` or `go upload`. Do not Close #1099 or #1183. Remaining unique leftover: `hex publish` / `conda upload`. -62. Keep #1131 Draft at `5f93858` as the canonical dashboard file-picker UX owner. Static markup Tests are not browser acceptance. Browser/Playwright infrastructure remains unmerged on Draft #1117; integrate that prerequisite or non-force stack without copying unprotected authority, then prove keyboard, pointer, cancel/reselect, focus, accessibility-tree, responsive and failure-state behavior on one exact head. -63. Keep #1181 Draft at source-neutral head `b4880bf` as a duplicate predecessor until #1131 completely carries and accepts every valid product/test delta. Exact-head Tests and five other repository workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` remain queued. Do not transfer predecessor evidence or Close either PR before verified successor acceptance. +61. Keep #1184 Draft stacked on #1183 at `7faaaad`. Executable `dart pub publish` / `flutter pub publish` / `pub publish` fail closed; `dart pub get` stays inventory. Hex/conda successor is #1185. Do not Close #1099 or #1183. +62. Keep #1185 Draft stacked on #1184 at `512710e`. Executable `hex publish` / `mix hex.publish` fail closed; `conda upload` / `anaconda upload` fail closed; `hex info` and `conda list` stay inventory. Do not invent `composer publish` or `go upload`. Do not Close #1099 or #1184. Remaining unique leftover: `cabal upload` / `mvn deploy`. +63. Keep #1131 Draft at `5f93858` as the canonical dashboard file-picker UX owner. Static markup Tests are not browser acceptance. Browser/Playwright infrastructure remains unmerged on Draft #1117; integrate that prerequisite or non-force stack without copying unprotected authority, then prove keyboard, pointer, cancel/reselect, focus, accessibility-tree, responsive and failure-state behavior on one exact head. +64. Keep #1181 Draft at source-neutral head `b4880bf` as a duplicate predecessor until #1131 completely carries and accepts every valid product/test delta. Exact-head Tests and five other repository workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` remain queued. Do not transfer predecessor evidence or Close either PR before verified successor acceptance. ## Standards and acceptance basis From b5d234f49f0f08ed1f739523d76a4722505d977e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 16:49:48 +0900 Subject: [PATCH 131/192] docs: record assignment-context RCA and exact detector stack --- docs/product-technical-gap-baseline.md | 44 +++++++++++++------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 6bd0d210..791aa407 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -76,17 +76,17 @@ Responsibility boundaries: | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with static product/test evidence only. #1181 exact `b4880bfde3facc2bf3bb776946afc74b732a0b65` is a source-neutral one-commit descendant of `2aafa234...` (0 changed files); it reproduces the product/test intent but adds duplicate `.jules/palette.md` doctrine. Exact-head Tests `34197874864` and five other workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` are queued. | Static markup cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. Draft #1117 browser evidence proves only its XSS boundary and is not protected authority to copy. | keep #1181 Draft/open until #1131 completely carries and accepts the valid delta. Keep #1131 Draft; integrate the browser prerequisite through ordinary ancestry and add exact-head browser/E2E evidence before Ready. | -| AppGuardrail #1185, branch `feat/claude-plugin-hex-conda-1099`, exact head `512710e793884e7aa17456e29df63c6eb02462ac` | open/Draft successor stacked on live #1184 (`7faaaad...`). RED `503ff23` → GREEN `512710e`. Focused hex/pub/gem/alt tests 47 passed; plugin suite 521 passed on Python 3.13. No hosted workflow exists on the custom base. | executable `hex publish` and Mix `mix hex.publish` fail as `claude-plugin-hex-publish-command`. `conda upload` and `anaconda upload` fail as `claude-plugin-conda-upload-command`. `hex info` and `conda list` stay inventory. `dart pub publish` stays #1184. `composer publish` and `go upload` are not invented. Snippets are command labels. | keep Draft stacked on #1184. Do not Close #1099 or #1184. | -| AppGuardrail #1184, branch `feat/claude-plugin-pub-publish-1099`, exact head `7faaaad5ab2f6bf664f964d51da534f59920cd41` | open/Draft successor stacked on live #1183 (`53cd89e...`) after non-force merge. RED `4351d47` → GREEN `09b6dce` then restack merge `7faaaad`. Focused pub/gem/alt tests 34 passed; plugin suite 506 passed on the pre-restack GREEN. Hex/conda successor is #1185. | executable `dart pub publish`, `flutter pub publish`, and legacy `pub publish` fail as `claude-plugin-pub-publish-command`. `dart pub get` stays inventory. `pnpm publish` stays #1182. `composer publish` and `go upload` are not invented. Snippets are command labels. | keep Draft stacked on #1183. Do not Close #1099 or #1183. | -| AppGuardrail #1183, branch `feat/claude-plugin-gem-nuget-1099`, exact head `53cd89ec3dcc20d8cfd6c7ad355b705c3d2704c2` | open/Draft successor stacked on current #1182 (`e9df55d...`), 5 ahead / 0 behind. It inherits #1173 quoted-command RED/GREEN without a leaf workaround; exact source/test AST and top-helper negatives/positives pass. No hosted workflow exists on the custom base. Pub-publish successor is #1184. | executable `gem push`, `nuget push`, and `dotnet nuget push` retain distinct fail-closed identities; quoted assignments, condition operands, reporting substitutions, comments, echo lookalikes, README, and prose stay negative. | keep Draft stacked on #1182 and obtain hosted integration/current-head review. Do not Close #1099 or #1182. | -| AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `e9df55d04e2563ad90a574d4f2f5685fa52754af` | open/Draft successor stacked on current #1180 (`e835a8f...`), 5 ahead / 0 behind with the alt-publish and terraform/helm regression deltas preserved. | executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` remains the npm class; quoted/reporting command names remain negative. | keep Draft stacked on #1180 and obtain hosted integration/current-head review. Do not Close #1099 or #1180. | -| AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `e835a8fc4e050bb6f960ed04686717b5773bc63f` | open/Draft successor on current #1179 (`f8372ec...`), 8 ahead / 0 behind with registry-publish delta and inherited regressions preserved. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities; packaging/check/comment/echo/prose lookalikes remain negative. | keep Draft stacked on #1179 and obtain hosted integration/current-head review. Do not Close #1099 or #1179. | -| AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `f8372ece60fdf2db61a0fbd733414083ea09d3f1` | open/Draft successor on current #1177 (`7802ad6...`), 10 ahead / 0 behind with object-store direction and later-write regressions preserved. | literal two-operand S3-to-local is inventory; writes, S3-to-S3, ambiguous forms, and later writes fail closed. Quoted command prose stays negative through the canonical helper. | keep Draft stacked on #1177 and obtain hosted integration/current-head review. Do not Close #1099, #1177, or #1174. | -| AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `7802ad62082696dba275a1734c4fb81841f416db` | open/Draft on current #1176 (`8544253...`), 8 ahead / 0 behind with cloud-deploy delta preserved. | executable AWS/gcloud/Azure deploy commands fail closed; quoted/reporting/prose values remain negative while direct substitutions and later real commands remain positive. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1176, or #1174. | -| AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `854425316ceeee270dec78fb0c6723050af36531` | open/Draft on current #1175 (`77f7ffa...`), 7 ahead / 0 behind with path-depth delta preserved. | paths deeper than 32 components fail closed; the canonical command-context helper remains independent and verified. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1175, #1166, or #1135. | -| AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `77f7ffa03cc97670ae66e329b6b811e6264867a4` | open/Draft on current #1174 (`2967d09...`), 7 ahead / 0 behind with unsigned-checksum delta preserved. | unsigned first-party digest rows fail closed; mismatch remains #1169 and the command-context repair does not alter checksum classes. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1174, or #1169. | -| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `2967d093985f96dd0830cd600b86f7f07c7235df` | open/Draft on current #1173 (`3a5b147...`), 10 ahead / 0 behind with hosted-deploy delta preserved. | executable `vercel deploy` and `fly deploy` fail closed; quoted assignments/test operands, reporting substitutions, comments, description prose, and reporting-only values remain negative. | keep Draft stacked on #1173 and obtain hosted integration/current-head review. Do not Close #1099 or #1173. | -| AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `3a5b14771cc7abb6553fa1ec9bcd8b62acc947ac` | open/Draft canonical command-context owner. RED `d7384e53d44a426356a73e24b2b9cc3fe153de27` proves quoted assignments, quoted test operands, and reporting substitution false positives. GREEN `cb208db...`, escape cleanup `3c5fdc4...`, and final test descendant `3a5b147...` add bounded root/`$(...)`/backtick frame tracking. SyntaxWarning-as-error AST passes; exact helpers pass 4 negatives / 3 positives. | only executable command frames fail closed; plain quoted prose and reporting-only substitutions stay inventory, while direct `$(terraform apply)` and backtick Helm commands remain positive. | keep Draft stacked on #1172 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1172. | +| AppGuardrail #1185, branch `feat/claude-plugin-hex-conda-1099`, exact head `6bb03cacb79a1cad614fb9554f56d2c53dd64490` | open/Draft on current #1184 (`3b5f641...`), 5 ahead / 0 behind with Hex/Conda and shared command-context regressions preserved. Exact top source, root regression test, and Hex/Conda test AST pass with SyntaxWarning-as-error; production-helper probes pass 3 negatives and 5 positives. No hosted custom-base acceptance is claimed. | executable `hex publish` / `mix hex.publish` and `conda upload` / `anaconda upload` fail closed; info/list, prose, reporting, and assignment values stay inventory. | keep Draft. Do not Close #1099 or #1184. Remaining unique leftover: `cabal upload` / `mvn deploy`. | +| AppGuardrail #1184, branch `feat/claude-plugin-pub-publish-1099`, exact head `3b5f6416c5cba8f6ce16c53c0e6b74575448e059` | open/Draft on current #1183 (`3e57172...`), 6 ahead / 0 behind with pub-publish and shared command-context regressions preserved. Pre-restack focused tests passed; no hosted custom-base acceptance is claimed. | executable `dart pub publish`, `flutter pub publish`, and legacy `pub publish` fail closed; `dart pub get` and assignment values stay inventory. | keep Draft. Do not Close #1099 or #1183. | +| AppGuardrail #1183, branch `feat/claude-plugin-gem-nuget-1099`, exact head `3e571723a65266c086912b9f3bf1de648150cc01` | open/Draft on current #1182 (`058051f...`), 8 ahead / 0 behind with gem/NuGet and shared command-context regressions preserved. | executable `gem push`, `nuget push`, and `dotnet nuget push` retain distinct fail-closed identities; quoted/reporting/assignment values stay negative. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099 or #1182. | +| AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `058051f72e7a953905bafcf5142eb93f7698e863` | open/Draft on current #1180 (`167a0ba...`), 8 ahead / 0 behind with alt-publish and shared command-context regressions preserved. | executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` remains the npm class; quoted/reporting/assignment values remain negative. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099 or #1180. | +| AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `167a0ba7cc538bb2d3d56679ddc7d24fc71ef32d` | open/Draft on current #1179 (`10c0a34...`), 11 ahead / 0 behind with registry-publish and shared command-context regressions preserved. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities; packaging/check/comment/echo/prose/assignment lookalikes remain negative. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099 or #1179. | +| AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `10c0a34a14200f6013bd904e5bf205487e4b80e8` | open/Draft on current #1177 (`9e35b6e...`), 13 ahead / 0 behind with object-store direction and shared command-context regressions preserved. | literal two-operand S3-to-local is inventory; writes, S3-to-S3, ambiguous forms, and later writes fail closed. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1177, or #1174. | +| AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `9e35b6eb1225210b75d2a63a907de44243df0a7d` | open/Draft on current #1176 (`bcf82ac...`), 11 ahead / 0 behind with cloud-deploy and shared command-context regressions preserved. | executable AWS/gcloud/Azure deploy commands fail closed; quoted/reporting/prose/assignment values remain negative while environment-prefix, direct substitutions, and later real commands remain positive. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1176, or #1174. | +| AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `bcf82acf97fb9bc7b541659fc61740323fc53a45` | open/Draft on current #1175 (`29011cc...`), 10 ahead / 0 behind with path-depth and shared command-context regressions preserved. | paths deeper than 32 components fail closed; the canonical command-context helper remains independent and verified. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1175, #1166, or #1135. | +| AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `29011cca6f465dbd988465c6ff67fe7caa18223b` | open/Draft on current #1174 (`8b1965d...`), 10 ahead / 0 behind with unsigned-checksum and shared command-context regressions preserved. | digest rows without a non-empty, non-symlink sibling signature fail closed; command-context semantics remain inherited from #1173. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1174, or #1169. | +| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `8b1965da8972a627d40fb7b1866b6828007a4a13` | open/Draft on current #1173 (`1e6a3eb...`), 13 ahead / 0 behind with hosted-deploy delta and assignment regressions preserved. | executable `vercel deploy` and `fly deploy` fail closed; quoted prose, reporting substitutions, comments, description prose, reporting-only values, and assignment values remain negative. | keep Draft stacked on #1173 and obtain hosted integration/current-head review. Do not Close #1099 or #1173. | +| AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `1e6a3eb43a5bc2d146656af13e7fa6cad2a77315` | open/Draft canonical command-context owner. Quoted-frame RED `d7384e5...` remains preserved; assignment-value RED `90ae232e852b3d01463d978f9bccd9157c341fe7` proves `message=terraform apply` and `command=helm install` are not the named CLIs. GREEN `1e6a3eb...` ignores only matches starting inside the current assignment word. Exact source/test AST passes with SyntaxWarning-as-error; production-helper probes pass 3 assignment/reporting negatives and 5 environment-prefix/direct/substitution positives. | only executable command frames fail closed; quoted prose, reporting-only substitutions, and assignment values stay inventory. `TF_IN_AUTOMATION=1 terraform apply`, direct commands, and command substitutions remain positive. | keep Draft stacked on #1172 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1172. | | AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. Terraform/helm successor is #1173. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. On this slice `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory; terraform/helm successor is #1173. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | | AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. Deployment-write successor is #1172. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | | AppGuardrail #1170, branch `feat/claude-plugin-github-merge-release-1099`, exact head `b506b824987326bd82f5fb5f8d037194a21163b6` | open/Draft successor stacked on #1169 (`226ca73...`). RED `527edb5` → GREEN `b506b82`. Focused merge/release tests 16 passed plus inventory lock; detector statement coverage 2455/2455 on Python 3.13. Credential-store successor is #1171. | hook or manifest `gh pr merge` fails as `claude-plugin-github-merge-command`. `gh release` create, upload, delete, or edit fails as `claude-plugin-github-release-command`. On this slice `gh issue create`, `gh pr review`, `gh release list`, `kubectl apply`, and `docker push` stay inventory; kubectl/docker-push successor is #1172. Hardcoded PATs stay `claude-plugin-github-write-token`. Snippets are command labels. | keep Draft stacked on #1169. Do not Close #1099 or #1169. Do not steal checksum-mismatch or github-write-token. | @@ -258,17 +258,17 @@ re-fetch docs/issues/PRs/current heads 49. Keep #1170 Draft stacked on #1169 at `b506b82`. Hook/manifest `gh pr merge` and `gh release` write verbs fail closed. Issue create, PR review, and release list stay inventory on this slice. Do not Close #1099 or #1169. 50. Keep #1171 Draft stacked on #1170 at `9370a0d`. Host cookie/token stores beyond browser profiles fail closed. Do not Close #1099, #1170, #1150, or #1137. 51. Keep #1172 Draft stacked on #1171 at `936311c`. Hook/manifest `kubectl apply` and `docker push` fail closed. Do not Close #1099, #1171, or #1170. -52. Keep #1173 Draft at `3a5b147` on #1172. RED `d7384e5` proves quoted assignment/test/reporting-substitution false positives; bounded shell-frame GREEN ends at `3a5b147`. Exact AST with SyntaxWarning-as-error and helper probes 4/4 negative plus 3/3 positive pass; hosted stacked evidence is absent. Do not Close #1099 or #1172. -53. Keep #1174 Draft at `2967d09`, non-force-restacked on #1173 `3a5b147`, 10 ahead / 0 behind with hosted-deploy delta preserved. -54. Keep #1175 Draft at `77f7ffa`, non-force-restacked on #1174 `2967d09`, 7 ahead / 0 behind with unsigned-checksum delta preserved. -55. Keep #1176 Draft at `8544253`, non-force-restacked on #1175 `77f7ffa`, 7 ahead / 0 behind with path-depth delta preserved. -56. Keep #1177 Draft at `7802ad6`, non-force-restacked on #1176 `8544253`, 8 ahead / 0 behind with cloud-deploy delta preserved. -57. Keep #1179 Draft at `f8372ec`, non-force-restacked on #1177 `7802ad6`, 10 ahead / 0 behind with object-store delta preserved. -58. Keep #1180 Draft at `e835a8f`, non-force-restacked on #1179 `f8372ec`, 8 ahead / 0 behind with registry-publish delta preserved. -59. Keep #1182 Draft at `e9df55d`, non-force-restacked on #1180 `e835a8f`, 5 ahead / 0 behind with alt-publish delta preserved. -60. Keep #1183 Draft at `53cd89e`, non-force-restacked on #1182 `e9df55d`, 5 ahead / 0 behind with gem/nuget delta preserved. -61. Keep #1184 Draft stacked on #1183 at `7faaaad`. Executable `dart pub publish` / `flutter pub publish` / `pub publish` fail closed; `dart pub get` stays inventory. Hex/conda successor is #1185. Do not Close #1099 or #1183. -62. Keep #1185 Draft stacked on #1184 at `512710e`. Executable `hex publish` / `mix hex.publish` fail closed; `conda upload` / `anaconda upload` fail closed; `hex info` and `conda list` stay inventory. Do not invent `composer publish` or `go upload`. Do not Close #1099 or #1184. Remaining unique leftover: `cabal upload` / `mvn deploy`. +52. Keep #1173 Draft at `1e6a3eb` on #1172. Preserve quoted-frame RED/GREEN `d7384e5...`/`3a5b147...`; assignment-value RED `90ae232` → GREEN `1e6a3eb` excludes only matches starting inside the current assignment word. Exact AST and 3 negative / 5 positive helper probes pass; hosted stacked evidence is absent. Do not Close #1099 or #1172. +53. Keep #1174 Draft at `8b1965d`, non-force-restacked on #1173 `1e6a3eb`, 13 ahead / 0 behind with hosted-deploy delta preserved. +54. Keep #1175 Draft at `29011cc`, non-force-restacked on #1174 `8b1965d`, 10 ahead / 0 behind with unsigned-checksum delta preserved. +55. Keep #1176 Draft at `bcf82ac`, non-force-restacked on #1175 `29011cc`, 10 ahead / 0 behind with path-depth delta preserved. +56. Keep #1177 Draft at `9e35b6e`, non-force-restacked on #1176 `bcf82ac`, 11 ahead / 0 behind with cloud-deploy delta preserved. +57. Keep #1179 Draft at `10c0a34`, non-force-restacked on #1177 `9e35b6e`, 13 ahead / 0 behind with object-store delta preserved. +58. Keep #1180 Draft at `167a0ba`, non-force-restacked on #1179 `10c0a34`, 11 ahead / 0 behind with registry-publish delta preserved. +59. Keep #1182 Draft at `058051f`, non-force-restacked on #1180 `167a0ba`, 8 ahead / 0 behind with alt-publish delta preserved. +60. Keep #1183 Draft at `3e57172`, non-force-restacked on #1182 `058051f`, 8 ahead / 0 behind with gem/NuGet delta preserved. +61. Keep #1184 Draft at `3b5f641`, non-force-restacked on #1183 `3e57172`, 6 ahead / 0 behind. Dart/Flutter pub detector delta and assignment-context regressions are preserved. Do not Close #1099 or #1183. +62. Keep #1185 Draft at `6bb03ca`, non-force-restacked on #1184 `3b5f641`, 5 ahead / 0 behind. Hex/Conda detector delta and assignment-context regressions are preserved. Do not Close #1099 or #1184. Remaining unique leftover: `cabal upload` / `mvn deploy`. 63. Keep #1131 Draft at `5f93858` as the canonical dashboard file-picker UX owner. Static markup Tests are not browser acceptance. Browser/Playwright infrastructure remains unmerged on Draft #1117; integrate that prerequisite or non-force stack without copying unprotected authority, then prove keyboard, pointer, cancel/reselect, focus, accessibility-tree, responsive and failure-state behavior on one exact head. 64. Keep #1181 Draft at source-neutral head `b4880bf` as a duplicate predecessor until #1131 completely carries and accepts every valid product/test delta. Exact-head Tests and five other repository workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` remain queued. Do not transfer predecessor evidence or Close either PR before verified successor acceptance. From 09c76940590233be2bcd6c17f949ba829d3e5397 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 16:49:49 +0900 Subject: [PATCH 132/192] docs: align gap snapshot with assignment-context repair --- CHANGELOG.d/999-gap-baseline-0540.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.d/999-gap-baseline-0540.md b/CHANGELOG.d/999-gap-baseline-0540.md index 3d7290e7..26ce57c0 100644 --- a/CHANGELOG.d/999-gap-baseline-0540.md +++ b/CHANGELOG.d/999-gap-baseline-0540.md @@ -1,3 +1,3 @@ # Gap baseline snapshot 2026-09-08 -Records live exact-head evidence for the commercial-readiness loop: #1036 skill-supply-chain repairs; #1173 quoted-shell command-context RED/GREEN; non-force, zero-behind #1174-#1185 stack integration with every unique detector/test delta preserved; Draft #1185 hex/conda publish fail-closed identities; the canonical fail-closed assurance-state mapping; and the #1131/#1181 dashboard file-picker ownership, source-neutral predecessor, and browser-evidence boundary. This documents Proposed work and exact candidate evidence, not a protected capability, approval, release, or certification claim. +Records live exact-head evidence for the commercial-readiness loop: #1036 skill-supply-chain repairs; #1173 quoted-shell plus assignment-value command-context RED/GREEN (`90ae232` → `1e6a3eb`); non-force, zero-behind #1174 `8b1965d` through #1185 `6bb03ca` stack integration with every unique detector/test delta preserved; Draft #1185 hex/conda publish fail-closed identities; the canonical fail-closed assurance-state mapping; and the #1131/#1181 dashboard file-picker ownership, source-neutral predecessor, and browser-evidence boundary. This documents Proposed work and exact candidate evidence, not a protected capability, approval, release, or certification claim. From 441077ce83347fed807ff859174ea0d5e31fd443 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 16:53:57 +0900 Subject: [PATCH 133/192] docs: correct command-context probe counts --- docs/product-technical-gap-baseline.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 791aa407..de45654a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -76,7 +76,7 @@ Responsibility boundaries: | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with static product/test evidence only. #1181 exact `b4880bfde3facc2bf3bb776946afc74b732a0b65` is a source-neutral one-commit descendant of `2aafa234...` (0 changed files); it reproduces the product/test intent but adds duplicate `.jules/palette.md` doctrine. Exact-head Tests `34197874864` and five other workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` are queued. | Static markup cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. Draft #1117 browser evidence proves only its XSS boundary and is not protected authority to copy. | keep #1181 Draft/open until #1131 completely carries and accepts the valid delta. Keep #1131 Draft; integrate the browser prerequisite through ordinary ancestry and add exact-head browser/E2E evidence before Ready. | -| AppGuardrail #1185, branch `feat/claude-plugin-hex-conda-1099`, exact head `6bb03cacb79a1cad614fb9554f56d2c53dd64490` | open/Draft on current #1184 (`3b5f641...`), 5 ahead / 0 behind with Hex/Conda and shared command-context regressions preserved. Exact top source, root regression test, and Hex/Conda test AST pass with SyntaxWarning-as-error; production-helper probes pass 3 negatives and 5 positives. No hosted custom-base acceptance is claimed. | executable `hex publish` / `mix hex.publish` and `conda upload` / `anaconda upload` fail closed; info/list, prose, reporting, and assignment values stay inventory. | keep Draft. Do not Close #1099 or #1184. Remaining unique leftover: `cabal upload` / `mvn deploy`. | +| AppGuardrail #1185, branch `feat/claude-plugin-hex-conda-1099`, exact head `6bb03cacb79a1cad614fb9554f56d2c53dd64490` | open/Draft on current #1184 (`3b5f641...`), 5 ahead / 0 behind with Hex/Conda and shared command-context regressions preserved. Exact top source, root regression test, and Hex/Conda test AST pass with SyntaxWarning-as-error; production-helper probes pass 4 negatives and 4 positives. No hosted custom-base acceptance is claimed. | executable `hex publish` / `mix hex.publish` and `conda upload` / `anaconda upload` fail closed; info/list, prose, reporting, and assignment values stay inventory. | keep Draft. Do not Close #1099 or #1184. Remaining unique leftover: `cabal upload` / `mvn deploy`. | | AppGuardrail #1184, branch `feat/claude-plugin-pub-publish-1099`, exact head `3b5f6416c5cba8f6ce16c53c0e6b74575448e059` | open/Draft on current #1183 (`3e57172...`), 6 ahead / 0 behind with pub-publish and shared command-context regressions preserved. Pre-restack focused tests passed; no hosted custom-base acceptance is claimed. | executable `dart pub publish`, `flutter pub publish`, and legacy `pub publish` fail closed; `dart pub get` and assignment values stay inventory. | keep Draft. Do not Close #1099 or #1183. | | AppGuardrail #1183, branch `feat/claude-plugin-gem-nuget-1099`, exact head `3e571723a65266c086912b9f3bf1de648150cc01` | open/Draft on current #1182 (`058051f...`), 8 ahead / 0 behind with gem/NuGet and shared command-context regressions preserved. | executable `gem push`, `nuget push`, and `dotnet nuget push` retain distinct fail-closed identities; quoted/reporting/assignment values stay negative. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099 or #1182. | | AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `058051f72e7a953905bafcf5142eb93f7698e863` | open/Draft on current #1180 (`167a0ba...`), 8 ahead / 0 behind with alt-publish and shared command-context regressions preserved. | executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` remains the npm class; quoted/reporting/assignment values remain negative. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099 or #1180. | @@ -86,7 +86,7 @@ Responsibility boundaries: | AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `bcf82acf97fb9bc7b541659fc61740323fc53a45` | open/Draft on current #1175 (`29011cc...`), 10 ahead / 0 behind with path-depth and shared command-context regressions preserved. | paths deeper than 32 components fail closed; the canonical command-context helper remains independent and verified. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1175, #1166, or #1135. | | AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `29011cca6f465dbd988465c6ff67fe7caa18223b` | open/Draft on current #1174 (`8b1965d...`), 10 ahead / 0 behind with unsigned-checksum and shared command-context regressions preserved. | digest rows without a non-empty, non-symlink sibling signature fail closed; command-context semantics remain inherited from #1173. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1174, or #1169. | | AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `8b1965da8972a627d40fb7b1866b6828007a4a13` | open/Draft on current #1173 (`1e6a3eb...`), 13 ahead / 0 behind with hosted-deploy delta and assignment regressions preserved. | executable `vercel deploy` and `fly deploy` fail closed; quoted prose, reporting substitutions, comments, description prose, reporting-only values, and assignment values remain negative. | keep Draft stacked on #1173 and obtain hosted integration/current-head review. Do not Close #1099 or #1173. | -| AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `1e6a3eb43a5bc2d146656af13e7fa6cad2a77315` | open/Draft canonical command-context owner. Quoted-frame RED `d7384e5...` remains preserved; assignment-value RED `90ae232e852b3d01463d978f9bccd9157c341fe7` proves `message=terraform apply` and `command=helm install` are not the named CLIs. GREEN `1e6a3eb...` ignores only matches starting inside the current assignment word. Exact source/test AST passes with SyntaxWarning-as-error; production-helper probes pass 3 assignment/reporting negatives and 5 environment-prefix/direct/substitution positives. | only executable command frames fail closed; quoted prose, reporting-only substitutions, and assignment values stay inventory. `TF_IN_AUTOMATION=1 terraform apply`, direct commands, and command substitutions remain positive. | keep Draft stacked on #1172 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1172. | +| AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `1e6a3eb43a5bc2d146656af13e7fa6cad2a77315` | open/Draft canonical command-context owner. Quoted-frame RED `d7384e5...` remains preserved; assignment-value RED `90ae232e852b3d01463d978f9bccd9157c341fe7` proves `message=terraform apply` and `command=helm install` are not the named CLIs. GREEN `1e6a3eb...` ignores only matches starting inside the current assignment word. Exact source/test AST passes with SyntaxWarning-as-error; production-helper probes pass 3 assignment/reporting negatives and 3 environment-prefix/substitution positives. | only executable command frames fail closed; quoted prose, reporting-only substitutions, and assignment values stay inventory. `TF_IN_AUTOMATION=1 terraform apply`, direct commands, and command substitutions remain positive. | keep Draft stacked on #1172 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1172. | | AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. Terraform/helm successor is #1173. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. On this slice `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory; terraform/helm successor is #1173. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | | AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. Deployment-write successor is #1172. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | | AppGuardrail #1170, branch `feat/claude-plugin-github-merge-release-1099`, exact head `b506b824987326bd82f5fb5f8d037194a21163b6` | open/Draft successor stacked on #1169 (`226ca73...`). RED `527edb5` → GREEN `b506b82`. Focused merge/release tests 16 passed plus inventory lock; detector statement coverage 2455/2455 on Python 3.13. Credential-store successor is #1171. | hook or manifest `gh pr merge` fails as `claude-plugin-github-merge-command`. `gh release` create, upload, delete, or edit fails as `claude-plugin-github-release-command`. On this slice `gh issue create`, `gh pr review`, `gh release list`, `kubectl apply`, and `docker push` stay inventory; kubectl/docker-push successor is #1172. Hardcoded PATs stay `claude-plugin-github-write-token`. Snippets are command labels. | keep Draft stacked on #1169. Do not Close #1099 or #1169. Do not steal checksum-mismatch or github-write-token. | @@ -258,7 +258,7 @@ re-fetch docs/issues/PRs/current heads 49. Keep #1170 Draft stacked on #1169 at `b506b82`. Hook/manifest `gh pr merge` and `gh release` write verbs fail closed. Issue create, PR review, and release list stay inventory on this slice. Do not Close #1099 or #1169. 50. Keep #1171 Draft stacked on #1170 at `9370a0d`. Host cookie/token stores beyond browser profiles fail closed. Do not Close #1099, #1170, #1150, or #1137. 51. Keep #1172 Draft stacked on #1171 at `936311c`. Hook/manifest `kubectl apply` and `docker push` fail closed. Do not Close #1099, #1171, or #1170. -52. Keep #1173 Draft at `1e6a3eb` on #1172. Preserve quoted-frame RED/GREEN `d7384e5...`/`3a5b147...`; assignment-value RED `90ae232` → GREEN `1e6a3eb` excludes only matches starting inside the current assignment word. Exact AST and 3 negative / 5 positive helper probes pass; hosted stacked evidence is absent. Do not Close #1099 or #1172. +52. Keep #1173 Draft at `1e6a3eb` on #1172. Preserve quoted-frame RED/GREEN `d7384e5...`/`3a5b147...`; assignment-value RED `90ae232` → GREEN `1e6a3eb` excludes only matches starting inside the current assignment word. Exact AST and 3 negative / 3 positive helper probes pass; hosted stacked evidence is absent. Do not Close #1099 or #1172. 53. Keep #1174 Draft at `8b1965d`, non-force-restacked on #1173 `1e6a3eb`, 13 ahead / 0 behind with hosted-deploy delta preserved. 54. Keep #1175 Draft at `29011cc`, non-force-restacked on #1174 `8b1965d`, 10 ahead / 0 behind with unsigned-checksum delta preserved. 55. Keep #1176 Draft at `bcf82ac`, non-force-restacked on #1175 `29011cc`, 10 ahead / 0 behind with path-depth delta preserved. From b7e4731dde193c273f44782910945fa9667c9fb9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 17:04:35 +0900 Subject: [PATCH 134/192] docs: record #1186 cabal/mvn publish successor Exact head 98dac50 stacked on #1185 fails closed on cabal upload, cabal v2-upload, and mvn deploy. Relates to #1099. --- CHANGELOG.d/999-gap-baseline-0540.md | 2 +- docs/product-technical-gap-baseline.md | 16 +++++++++------- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.d/999-gap-baseline-0540.md b/CHANGELOG.d/999-gap-baseline-0540.md index 26ce57c0..e9dc15bb 100644 --- a/CHANGELOG.d/999-gap-baseline-0540.md +++ b/CHANGELOG.d/999-gap-baseline-0540.md @@ -1,3 +1,3 @@ # Gap baseline snapshot 2026-09-08 -Records live exact-head evidence for the commercial-readiness loop: #1036 skill-supply-chain repairs; #1173 quoted-shell plus assignment-value command-context RED/GREEN (`90ae232` → `1e6a3eb`); non-force, zero-behind #1174 `8b1965d` through #1185 `6bb03ca` stack integration with every unique detector/test delta preserved; Draft #1185 hex/conda publish fail-closed identities; the canonical fail-closed assurance-state mapping; and the #1131/#1181 dashboard file-picker ownership, source-neutral predecessor, and browser-evidence boundary. This documents Proposed work and exact candidate evidence, not a protected capability, approval, release, or certification claim. +Records live exact-head evidence for the commercial-readiness loop: #1036 skill-supply-chain repairs; #1173 quoted-shell plus assignment-value command-context RED/GREEN (`90ae232` → `1e6a3eb`); non-force, zero-behind #1174 `8b1965d` through #1186 `98dac50` stack integration with every unique detector/test delta preserved; Draft #1186 cabal/mvn publish fail-closed identities; the canonical fail-closed assurance-state mapping; and the #1131/#1181 dashboard file-picker ownership, source-neutral predecessor, and browser-evidence boundary. This documents Proposed work and exact candidate evidence, not a protected capability, approval, release, or certification claim. diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index de45654a..33e294cc 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 07:35 UTC +**Snapshot:** 2026-09-08 08:03 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -68,7 +68,7 @@ Responsibility boundaries: - **External scanners** keep source/tool/version provenance. Normalization does not relabel their evidence as built-in AppGuardrail evidence. - **Exact-head review/check infrastructure** is acceptance evidence, never a substitute for product truth. -## Security-defect corpus — live 2026-09-08 07:35 UTC snapshot +## Security-defect corpus — live 2026-09-08 08:03 UTC snapshot | Work / corpus item | Exact observed state | Root cause / reusable security meaning | Next safe action | | --- | --- | --- | --- | @@ -76,7 +76,8 @@ Responsibility boundaries: | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with static product/test evidence only. #1181 exact `b4880bfde3facc2bf3bb776946afc74b732a0b65` is a source-neutral one-commit descendant of `2aafa234...` (0 changed files); it reproduces the product/test intent but adds duplicate `.jules/palette.md` doctrine. Exact-head Tests `34197874864` and five other workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` are queued. | Static markup cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. Draft #1117 browser evidence proves only its XSS boundary and is not protected authority to copy. | keep #1181 Draft/open until #1131 completely carries and accepts the valid delta. Keep #1131 Draft; integrate the browser prerequisite through ordinary ancestry and add exact-head browser/E2E evidence before Ready. | -| AppGuardrail #1185, branch `feat/claude-plugin-hex-conda-1099`, exact head `6bb03cacb79a1cad614fb9554f56d2c53dd64490` | open/Draft on current #1184 (`3b5f641...`), 5 ahead / 0 behind with Hex/Conda and shared command-context regressions preserved. Exact top source, root regression test, and Hex/Conda test AST pass with SyntaxWarning-as-error; production-helper probes pass 4 negatives and 4 positives. No hosted custom-base acceptance is claimed. | executable `hex publish` / `mix hex.publish` and `conda upload` / `anaconda upload` fail closed; info/list, prose, reporting, and assignment values stay inventory. | keep Draft. Do not Close #1099 or #1184. Remaining unique leftover: `cabal upload` / `mvn deploy`. | +| AppGuardrail #1186, branch `feat/claude-plugin-cabal-mvn-1099`, exact head `98dac50a072e34616d13d6d2aa647b8de712190b` | open/Draft successor stacked on live #1185 (`6bb03ca...`). RED `d057c3d` → GREEN `98dac50`. Focused cabal/hex/pub/gem tests 50 passed; plugin suite 538 passed on Python 3.13. No hosted workflow exists on the custom base. | executable `cabal upload` / `cabal v2-upload` fail as `claude-plugin-cabal-upload-command`. `mvn deploy` / `mvn deploy:deploy-file` fail as `claude-plugin-mvn-deploy-command`. `cabal list` and `mvn package` stay inventory. Assignment values stay inventory. `hex publish` stays #1185. `composer publish` and `go upload` are not invented. Snippets are command labels. | keep Draft stacked on #1185. Do not Close #1099 or #1185. | +| AppGuardrail #1185, branch `feat/claude-plugin-hex-conda-1099`, exact head `6bb03cacb79a1cad614fb9554f56d2c53dd64490` | open/Draft on current #1184 (`3b5f641...`), 5 ahead / 0 behind with Hex/Conda and shared command-context regressions preserved. Exact top source, root regression test, and Hex/Conda test AST pass with SyntaxWarning-as-error; production-helper probes pass 4 negatives and 4 positives. No hosted custom-base acceptance is claimed. Cabal/mvn successor is #1186. | executable `hex publish` / `mix hex.publish` and `conda upload` / `anaconda upload` fail closed; info/list, prose, reporting, and assignment values stay inventory. | keep Draft. Do not Close #1099 or #1184. | | AppGuardrail #1184, branch `feat/claude-plugin-pub-publish-1099`, exact head `3b5f6416c5cba8f6ce16c53c0e6b74575448e059` | open/Draft on current #1183 (`3e57172...`), 6 ahead / 0 behind with pub-publish and shared command-context regressions preserved. Pre-restack focused tests passed; no hosted custom-base acceptance is claimed. | executable `dart pub publish`, `flutter pub publish`, and legacy `pub publish` fail closed; `dart pub get` and assignment values stay inventory. | keep Draft. Do not Close #1099 or #1183. | | AppGuardrail #1183, branch `feat/claude-plugin-gem-nuget-1099`, exact head `3e571723a65266c086912b9f3bf1de648150cc01` | open/Draft on current #1182 (`058051f...`), 8 ahead / 0 behind with gem/NuGet and shared command-context regressions preserved. | executable `gem push`, `nuget push`, and `dotnet nuget push` retain distinct fail-closed identities; quoted/reporting/assignment values stay negative. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099 or #1182. | | AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `058051f72e7a953905bafcf5142eb93f7698e863` | open/Draft on current #1180 (`167a0ba...`), 8 ahead / 0 behind with alt-publish and shared command-context regressions preserved. | executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` remains the npm class; quoted/reporting/assignment values remain negative. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099 or #1180. | @@ -181,7 +182,7 @@ Dashboard, JSON, SARIF, reports, and deploy gates must consume `scan_outcome_cod | G-05 | Acquisition reviewers lack one compact exact-head source/check/provenance/causal-repair package. | OPERABILITY/assurance contracts; evidence distributed | deterministic buyer-evidence package bound to SHA/run/artifact/release | recomputable digest, no raw secrets, failed vs unavailable distinction, protected-head smoke proof | **Open** | | G-06 | Stateful regex detector families alternate between FP and FN repairs as control-flow/provenance complexity grows. | #1088 remains the regex corpus owner at `d9744331...`. Draft #1133 `5baeab9` has hosted exact-head coverage SUCCESS. Draft successor #1152 `255cfd8` hooks `_scan_file` with `(rule_id, file)` merge; historical vulnerable count is 1; hosted `exact-head-coverage` is SUCCESS. Regex YAML unchanged. | keep #1152 Draft through remaining review; apply the same pattern to #1080 only after that provenance model is stable | differential corpus against current rules; all historical positives retained; safe negatives stay negative; comparison direction, timeout ownership/static positivity, branch reachability, unreachable control transfers, command-vs-quoted text, declaration order, selected shell/fail-fast state, independent total bounds, and realistic performance measured | **In progress / active in #1152 stacked on #1133** | | G-07 | Shared required-review/security capacity can be consumed by wait loops even after the original transport-only defect is bounded. | protected `.github` wall-clock repair plus Proposed #1706 event-driven one-shot work; `.github#712` remains the canonical queue/startup RCA and includes AppGuardrail exact-head zero-job CodeQL canary `33640116203` | canonical `.github` one-shot admission + exact-run/event reconciliation, no repository-authored polling/model timeout | RED prerequisite→production GREEN; no real sleeps; exact PR/head/run validation; temporary source-fix machinery deleted; full central suite and required security/review GREEN | **Proposed / active owner prerequisite** | -| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 07:35 UTC records Draft #1185 `512710e` on #1184 `7faaaad` on #1183 `53cd89e` on #1182 `e9df55d`, #1036 Ready at `0ef5715`, canonical file-picker UX #1131 `5f93858`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | +| G-08 | This baseline can become stale while the security corpus changes rapidly. | PR #999 is the single writer; snapshot 2026-09-08 08:03 UTC records Draft #1186 `98dac50` on #1185 `6bb03ca` on #1184 `3b5f641` on #1183 `3e57172`, #1036 Ready at `0ef5715`, canonical file-picker UX #1131 `5f93858`, and #998 Draft `8b95c2b` with Strix/CodeQL-compat pending-handoff (G-07). | refresh from live exact heads while never claiming open candidates as protected behavior | protected merge of current snapshot; subsequent material changes produce another explicit snapshot | **In progress in #999** | ## Technical / TRD gaps @@ -268,9 +269,10 @@ re-fetch docs/issues/PRs/current heads 59. Keep #1182 Draft at `058051f`, non-force-restacked on #1180 `167a0ba`, 8 ahead / 0 behind with alt-publish delta preserved. 60. Keep #1183 Draft at `3e57172`, non-force-restacked on #1182 `058051f`, 8 ahead / 0 behind with gem/NuGet delta preserved. 61. Keep #1184 Draft at `3b5f641`, non-force-restacked on #1183 `3e57172`, 6 ahead / 0 behind. Dart/Flutter pub detector delta and assignment-context regressions are preserved. Do not Close #1099 or #1183. -62. Keep #1185 Draft at `6bb03ca`, non-force-restacked on #1184 `3b5f641`, 5 ahead / 0 behind. Hex/Conda detector delta and assignment-context regressions are preserved. Do not Close #1099 or #1184. Remaining unique leftover: `cabal upload` / `mvn deploy`. -63. Keep #1131 Draft at `5f93858` as the canonical dashboard file-picker UX owner. Static markup Tests are not browser acceptance. Browser/Playwright infrastructure remains unmerged on Draft #1117; integrate that prerequisite or non-force stack without copying unprotected authority, then prove keyboard, pointer, cancel/reselect, focus, accessibility-tree, responsive and failure-state behavior on one exact head. -64. Keep #1181 Draft at source-neutral head `b4880bf` as a duplicate predecessor until #1131 completely carries and accepts every valid product/test delta. Exact-head Tests and five other repository workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` remain queued. Do not transfer predecessor evidence or Close either PR before verified successor acceptance. +62. Keep #1185 Draft at `6bb03ca`, non-force-restacked on #1184 `3b5f641`, 5 ahead / 0 behind. Hex/Conda detector delta and assignment-context regressions are preserved. Cabal/mvn successor is #1186. Do not Close #1099 or #1184. +63. Keep #1186 Draft stacked on #1185 at `98dac50`. Executable `cabal upload` / `cabal v2-upload` and `mvn deploy` fail closed; `cabal list` and `mvn package` stay inventory. Assignment values stay inventory. Do not invent `composer publish` or `go upload`. Do not Close #1099 or #1185. Remaining unique leftover: `gradle publish` / `luarocks upload`. +64. Keep #1131 Draft at `5f93858` as the canonical dashboard file-picker UX owner. Static markup Tests are not browser acceptance. Browser/Playwright infrastructure remains unmerged on Draft #1117; integrate that prerequisite or non-force stack without copying unprotected authority, then prove keyboard, pointer, cancel/reselect, focus, accessibility-tree, responsive and failure-state behavior on one exact head. +65. Keep #1181 Draft at source-neutral head `b4880bf` as a duplicate predecessor until #1131 completely carries and accepts every valid product/test delta. Exact-head Tests and five other repository workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` remain queued. Do not transfer predecessor evidence or Close either PR before verified successor acceptance. ## Standards and acceptance basis From 9e02557ccbbfcdd097d204ab641fc11cde2c5909 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 17:22:26 +0900 Subject: [PATCH 135/192] docs: record heredoc-safe #1173-#1186 stack --- docs/product-technical-gap-baseline.md | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 33e294cc..a1b9992c 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -1,6 +1,6 @@ # AppGuardrail product and technical gap baseline -**Snapshot:** 2026-09-08 08:03 UTC +**Snapshot:** 2026-09-08 08:20 UTC **Authority:** protected `develop` documentation plus live exact-head GitHub evidence **Status:** working baseline; not a release, certification, or protected-branch capability claim @@ -76,18 +76,18 @@ Responsibility boundaries: | AppGuardrail #1133, branch `feat/actions-poll-structural-analyzer-1087`, exact head `5baeab93de2a940b024dd31463ce7417ae990e3a` | open/Draft successor stacked on #1088 (`d9744331...`). REST mergeability is versus the #1088 branch, not protected `develop`. Analyzer GREEN remains `529ecb0`; `5baeab9` adds `.github/workflows/actions-poll-analyzer-coverage.yml`. Hosted `exact-head-coverage` on this head is SUCCESS. ADR-0009 Status Proposed. Emission successor is #1152. | regex adjacency windows cannot prove init-before-loop, unreachable `exit`, reversed comparisons, quoted text, or sibling-job timeouts. Additive `classify_poll_loops` records those causal facts while preserving detector IDs `github-actions-transport-only-poll-bound` and `github-actions-transport-failure-budget-poll-bound`. | keep Draft stacked on #1088. Exact-head coverage is SUCCESS; remaining merge blockers are review and the #1088 base. Do not Close #1087 or #1088. | | AppGuardrail #1088 / Issue #1087, branch `sentinel/detect-transport-only-poll-bound-1087`, exact head `d9744331b83e9a47d4b0a84f1e81e42e382aa4c2` | open/Draft; mergeable but not merge-ready. RED `d50f49ccea1cbf2aecc6da268850fddfc80db3b6` is repaired by production `99bdf459cf7939896740c61c2c3fe9c222377312`; docs predecessor `e63c34279491c9c8c90764215d6ba39c8ad8d9e3` passed local polling 126/126 and hosted Tests plus six repository controls, while the full local suite had 1,126 pass / one unrelated pre-existing `src/....py` Path/String contract failure. `d9744331...` removes the narrower duplicate `docs/product-technical-gap-baseline.md` from #1088 after verifying complete carryover in canonical single-writer #999; detector/test files are unchanged. On this exact head, Tests, Security Process and four coverage workflows are terminal success; Security Scan, SAST Semgrep and CodeQL PR remain queued. No qualifying independent approval exists; 11 current review threads remain open. | verified `ContextualWisdomLab/.github` incident: a retry budget counted only transport failures, so healthy API/no-verdict iterations could retain a runner. Forward `-gt` and statically positive owning-job `${{ N }}` timeouts are now recognized without accepting reversed/non-expiring, zero/negative/dynamic, or sibling-job bounds. | keep all four detector identities and corpus as G-06 migration oracles. Stay Draft through fresh exact-head Checks/review; keep the Gap baseline only in #999 and do not Close #1087. | | AppGuardrail #1131 / #1181 dashboard file-picker UX | #1131 exact `5f938580fd32b15fc99508b26cbc47839f577a04` is the canonical Draft with static product/test evidence only. #1181 exact `b4880bfde3facc2bf3bb776946afc74b732a0b65` is a source-neutral one-commit descendant of `2aafa234...` (0 changed files); it reproduces the product/test intent but adds duplicate `.jules/palette.md` doctrine. Exact-head Tests `34197874864` and five other workflows are GREEN; Security Scan `34197874811`, SAST `34197874903`, and CodeQL `34197874838` are queued. | Static markup cannot prove picker activation, keyboard/focus, cancel/reselect, accessibility-tree naming, responsive behavior, or failure states. Draft #1117 browser evidence proves only its XSS boundary and is not protected authority to copy. | keep #1181 Draft/open until #1131 completely carries and accepts the valid delta. Keep #1131 Draft; integrate the browser prerequisite through ordinary ancestry and add exact-head browser/E2E evidence before Ready. | -| AppGuardrail #1186, branch `feat/claude-plugin-cabal-mvn-1099`, exact head `98dac50a072e34616d13d6d2aa647b8de712190b` | open/Draft successor stacked on live #1185 (`6bb03ca...`). RED `d057c3d` → GREEN `98dac50`. Focused cabal/hex/pub/gem tests 50 passed; plugin suite 538 passed on Python 3.13. No hosted workflow exists on the custom base. | executable `cabal upload` / `cabal v2-upload` fail as `claude-plugin-cabal-upload-command`. `mvn deploy` / `mvn deploy:deploy-file` fail as `claude-plugin-mvn-deploy-command`. `cabal list` and `mvn package` stay inventory. Assignment values stay inventory. `hex publish` stays #1185. `composer publish` and `go upload` are not invented. Snippets are command labels. | keep Draft stacked on #1185. Do not Close #1099 or #1185. | -| AppGuardrail #1185, branch `feat/claude-plugin-hex-conda-1099`, exact head `6bb03cacb79a1cad614fb9554f56d2c53dd64490` | open/Draft on current #1184 (`3b5f641...`), 5 ahead / 0 behind with Hex/Conda and shared command-context regressions preserved. Exact top source, root regression test, and Hex/Conda test AST pass with SyntaxWarning-as-error; production-helper probes pass 4 negatives and 4 positives. No hosted custom-base acceptance is claimed. Cabal/mvn successor is #1186. | executable `hex publish` / `mix hex.publish` and `conda upload` / `anaconda upload` fail closed; info/list, prose, reporting, and assignment values stay inventory. | keep Draft. Do not Close #1099 or #1184. | -| AppGuardrail #1184, branch `feat/claude-plugin-pub-publish-1099`, exact head `3b5f6416c5cba8f6ce16c53c0e6b74575448e059` | open/Draft on current #1183 (`3e57172...`), 6 ahead / 0 behind with pub-publish and shared command-context regressions preserved. Pre-restack focused tests passed; no hosted custom-base acceptance is claimed. | executable `dart pub publish`, `flutter pub publish`, and legacy `pub publish` fail closed; `dart pub get` and assignment values stay inventory. | keep Draft. Do not Close #1099 or #1183. | -| AppGuardrail #1183, branch `feat/claude-plugin-gem-nuget-1099`, exact head `3e571723a65266c086912b9f3bf1de648150cc01` | open/Draft on current #1182 (`058051f...`), 8 ahead / 0 behind with gem/NuGet and shared command-context regressions preserved. | executable `gem push`, `nuget push`, and `dotnet nuget push` retain distinct fail-closed identities; quoted/reporting/assignment values stay negative. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099 or #1182. | -| AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `058051f72e7a953905bafcf5142eb93f7698e863` | open/Draft on current #1180 (`167a0ba...`), 8 ahead / 0 behind with alt-publish and shared command-context regressions preserved. | executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` remains the npm class; quoted/reporting/assignment values remain negative. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099 or #1180. | -| AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `167a0ba7cc538bb2d3d56679ddc7d24fc71ef32d` | open/Draft on current #1179 (`10c0a34...`), 11 ahead / 0 behind with registry-publish and shared command-context regressions preserved. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities; packaging/check/comment/echo/prose/assignment lookalikes remain negative. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099 or #1179. | -| AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `10c0a34a14200f6013bd904e5bf205487e4b80e8` | open/Draft on current #1177 (`9e35b6e...`), 13 ahead / 0 behind with object-store direction and shared command-context regressions preserved. | literal two-operand S3-to-local is inventory; writes, S3-to-S3, ambiguous forms, and later writes fail closed. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1177, or #1174. | -| AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `9e35b6eb1225210b75d2a63a907de44243df0a7d` | open/Draft on current #1176 (`bcf82ac...`), 11 ahead / 0 behind with cloud-deploy and shared command-context regressions preserved. | executable AWS/gcloud/Azure deploy commands fail closed; quoted/reporting/prose/assignment values remain negative while environment-prefix, direct substitutions, and later real commands remain positive. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1176, or #1174. | -| AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `bcf82acf97fb9bc7b541659fc61740323fc53a45` | open/Draft on current #1175 (`29011cc...`), 10 ahead / 0 behind with path-depth and shared command-context regressions preserved. | paths deeper than 32 components fail closed; the canonical command-context helper remains independent and verified. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1175, #1166, or #1135. | -| AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `29011cca6f465dbd988465c6ff67fe7caa18223b` | open/Draft on current #1174 (`8b1965d...`), 10 ahead / 0 behind with unsigned-checksum and shared command-context regressions preserved. | digest rows without a non-empty, non-symlink sibling signature fail closed; command-context semantics remain inherited from #1173. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1174, or #1169. | -| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `8b1965da8972a627d40fb7b1866b6828007a4a13` | open/Draft on current #1173 (`1e6a3eb...`), 13 ahead / 0 behind with hosted-deploy delta and assignment regressions preserved. | executable `vercel deploy` and `fly deploy` fail closed; quoted prose, reporting substitutions, comments, description prose, reporting-only values, and assignment values remain negative. | keep Draft stacked on #1173 and obtain hosted integration/current-head review. Do not Close #1099 or #1173. | -| AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `1e6a3eb43a5bc2d146656af13e7fa6cad2a77315` | open/Draft canonical command-context owner. Quoted-frame RED `d7384e5...` remains preserved; assignment-value RED `90ae232e852b3d01463d978f9bccd9157c341fe7` proves `message=terraform apply` and `command=helm install` are not the named CLIs. GREEN `1e6a3eb...` ignores only matches starting inside the current assignment word. Exact source/test AST passes with SyntaxWarning-as-error; production-helper probes pass 3 assignment/reporting negatives and 3 environment-prefix/substitution positives. | only executable command frames fail closed; quoted prose, reporting-only substitutions, and assignment values stay inventory. `TF_IN_AUTOMATION=1 terraform apply`, direct commands, and command substitutions remain positive. | keep Draft stacked on #1172 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1172. | +| AppGuardrail #1186, branch `feat/claude-plugin-cabal-mvn-1099`, exact head `fb44e77367da1746c8460541c0baed3162c850dc` | open/Draft successor stacked on live #1185 (`e350ee0...`), 5 ahead / 0 behind. RED `d057c3d` → GREEN `98dac50`. Focused cabal/hex/pub/gem tests 50 passed; plugin suite 538 passed on Python 3.13. No hosted workflow exists on the custom base. Closed literal here-document payloads are inherited as negative; post-boundary real commands remain positive. | executable `cabal upload` / `cabal v2-upload` fail as `claude-plugin-cabal-upload-command`. `mvn deploy` / `mvn deploy:deploy-file` fail as `claude-plugin-mvn-deploy-command`. `cabal list` and `mvn package` stay inventory. Assignment values stay inventory. `hex publish` stays #1185. `composer publish` and `go upload` are not invented. Snippets are command labels. | keep Draft stacked on #1185. Do not Close #1099 or #1185. | +| AppGuardrail #1185, branch `feat/claude-plugin-hex-conda-1099`, exact head `e350ee0ad6e2e313c2d1e38cbdc4f0418477280e` | open/Draft on current #1184 (`bde4451...`), 8 ahead / 0 behind with Hex/Conda and shared command-context regressions preserved. Exact top source, root regression test, and Hex/Conda test AST pass with SyntaxWarning-as-error; production-helper probes pass 4 negatives and 4 positives. No hosted custom-base acceptance is claimed. Cabal/mvn successor is #1186. Closed literal here-document payloads are inherited as negative; post-boundary real commands remain positive. | executable `hex publish` / `mix hex.publish` and `conda upload` / `anaconda upload` fail closed; info/list, prose, reporting, and assignment values stay inventory. | keep Draft. Do not Close #1099 or #1184. | +| AppGuardrail #1184, branch `feat/claude-plugin-pub-publish-1099`, exact head `bde44516021aa6c1fd6c2be7c7beb9345a671d97` | open/Draft on current #1183 (`4253dde...`), 9 ahead / 0 behind with pub-publish and shared command-context regressions preserved. Pre-restack focused tests passed; no hosted custom-base acceptance is claimed. Closed literal here-document payloads are inherited as negative; post-boundary real commands remain positive. | executable `dart pub publish`, `flutter pub publish`, and legacy `pub publish` fail closed; `dart pub get` and assignment values stay inventory. | keep Draft. Do not Close #1099 or #1183. | +| AppGuardrail #1183, branch `feat/claude-plugin-gem-nuget-1099`, exact head `4253ddeb380245db514c885fc6bf26662515211c` | open/Draft on current #1182 (`2c7b065...`), 11 ahead / 0 behind with gem/NuGet and shared command-context regressions preserved. Closed literal here-document payloads are inherited as negative; post-boundary real commands remain positive. | executable `gem push`, `nuget push`, and `dotnet nuget push` retain distinct fail-closed identities; quoted/reporting/assignment values stay negative. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099 or #1182. | +| AppGuardrail #1182, branch `feat/claude-plugin-alt-publish-1099`, exact head `2c7b0656fdd9e1977483fb007e3173d387254893` | open/Draft on current #1180 (`ecc7a1c...`), 11 ahead / 0 behind with alt-publish and shared command-context regressions preserved. Closed literal here-document payloads are inherited as negative; post-boundary real commands remain positive. | executable `pnpm publish`, `uv publish`, and `poetry publish` fail closed; `yarn npm publish` remains the npm class; quoted/reporting/assignment values remain negative. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099 or #1180. | +| AppGuardrail #1180, branch `feat/claude-plugin-registry-publish-1099`, exact head `ecc7a1c883cd06d80a9431b35aa152282c7a5f9e` | open/Draft on current #1179 (`730d429...`), 14 ahead / 0 behind with registry-publish and shared command-context regressions preserved. Closed literal here-document payloads are inherited as negative; post-boundary real commands remain positive. | executable `npm publish`, `twine upload`, and `cargo publish` retain distinct fail-closed identities; packaging/check/comment/echo/prose/assignment lookalikes remain negative. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099 or #1179. | +| AppGuardrail #1179, branch `feat/claude-plugin-object-store-1099`, exact head `730d42926d383c59e9f01a12df625b32c3824285` | open/Draft on current #1177 (`9e0e4ad...`), 16 ahead / 0 behind with object-store direction and shared command-context regressions preserved. | literal two-operand S3-to-local is inventory; writes, S3-to-S3, ambiguous forms, and later writes fail closed. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1177, or #1174. | +| AppGuardrail #1177, branch `feat/claude-plugin-cloud-deploy-1099`, exact head `9e0e4ad0ef263ae8a265482051df871a74bf871c` | open/Draft on current #1176 (`e29cc87...`), 14 ahead / 0 behind with cloud-deploy and shared command-context regressions preserved. Closed literal here-document payloads are inherited as negative; post-boundary real commands remain positive. | executable AWS/gcloud/Azure deploy commands fail closed; quoted/reporting/prose/assignment values remain negative while environment-prefix, direct substitutions, and later real commands remain positive. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1176, or #1174. | +| AppGuardrail #1176, branch `feat/claude-plugin-path-depth-1099`, exact head `e29cc87bcb33b084c17d563539356f7979136223` | open/Draft on current #1175 (`bb9cd1d...`), 13 ahead / 0 behind with path-depth and shared command-context regressions preserved. Closed literal here-document payloads are inherited as negative; post-boundary real commands remain positive. | paths deeper than 32 components fail closed; the canonical command-context helper remains independent and verified. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1175, #1166, or #1135. | +| AppGuardrail #1175, branch `feat/claude-plugin-unsigned-checksum-1099`, exact head `bb9cd1dd6af007f2b1e85978974150480da3fad6` | open/Draft on current #1174 (`c069e93...`), 13 ahead / 0 behind with unsigned-checksum and shared command-context regressions preserved. Closed literal here-document payloads are inherited as negative; post-boundary real commands remain positive. | digest rows without a non-empty, non-symlink sibling signature fail closed; command-context semantics remain inherited from #1173. | keep Draft and obtain hosted integration/current-head review. Do not Close #1099, #1174, or #1169. | +| AppGuardrail #1174, branch `feat/claude-plugin-hosted-deploy-1099`, exact head `c069e93ed7ca0b82fd19179a6b68f671c3d0be20` | open/Draft on current #1173 (`184b4b4...`), 16 ahead / 0 behind with hosted-deploy delta and assignment regressions preserved. Closed literal here-document payloads are inherited as negative; post-boundary real commands remain positive. | executable `vercel deploy` and `fly deploy` fail closed; quoted prose, reporting substitutions, comments, description prose, reporting-only values, and assignment values remain negative. | keep Draft stacked on #1173 and obtain hosted integration/current-head review. Do not Close #1099 or #1173. | +| AppGuardrail #1173, branch `feat/claude-plugin-terraform-helm-1099`, exact head `184b4b4f55906284ac1d8059e46cec8f0d9cfc9a` | open/Draft canonical command-context owner. Heredoc RED `6f6be77d6b1bbef327de001ffb3fcaef2623b998` proves closed literal payload lines were misclassified; GREEN `12faf2f46847ba05448ad4885d75559d8f26e301`, positive-boundary test `fa9df24...`, and traceability exact head `184b4b4...` repair the shared helper. Exact source/test AST passes with SyntaxWarning-as-error; production-helper probes pass 2 payload negatives and 6 direct/post-boundary/substitution positives. | Closed literal identifier-delimited payloads, including quoted delimiters and `<<-` tab stripping, are inert. Real commands after the close or after quoted/commented opener lookalikes remain positive. Ambiguous, multiple, non-identifier, and unclosed forms remain fail-closed. | keep Draft stacked on #1172 and obtain hosted integration/coverage/current-head review. Do not Close #1099 or #1172. | | AppGuardrail #1172, branch `feat/claude-plugin-deployment-write-1099`, exact head `936311c206ce4aa283e0ec643e2f03f594b5bed1` | open/Draft successor stacked on #1171 (`9370a0d...`). RED `391358f` → GREEN `936311c`. Plugin coverage suite 369 passed; detector statements 1813/1813. Terraform/helm successor is #1173. | hook or manifest `kubectl apply` fails as `claude-plugin-kubectl-apply-command`. `docker push` and `docker image push` fail as `claude-plugin-docker-push-command`. On this slice `kubectl get`, `docker ps`, `terraform apply`, and `helm install` stay inventory; terraform/helm successor is #1173. README wording is not a hook. Merge stays #1170. Sockets stay docker-socket. Snippets are command labels. | keep Draft stacked on #1171. Do not Close #1099, #1171, or #1170. | | AppGuardrail #1171, branch `feat/claude-plugin-credential-store-1099`, exact head `9370a0dd44e9af15c7b6ccb7165c042ad3de377c` | open/Draft successor stacked on #1170 (`b506b82...`). RED `cc3db8c` → GREEN `9370a0d`. Plugin coverage suite 347 passed; detector statement coverage 2505/2505. Deployment-write successor is #1172. | host `.netrc`, AWS credentials, `gh` hosts.yml, Docker config.json, cookie jars, and `~/.ssh/id_*` (not `.pub`) fail as `claude-plugin-credential-store-access`. Chrome/Firefox profiles stay #1150. Hardcoded `ghp_` stays #1137. `gh pr merge` stays #1170. | keep Draft stacked on #1170. Do not Close #1099, #1170, #1150, or #1137. | | AppGuardrail #1170, branch `feat/claude-plugin-github-merge-release-1099`, exact head `b506b824987326bd82f5fb5f8d037194a21163b6` | open/Draft successor stacked on #1169 (`226ca73...`). RED `527edb5` → GREEN `b506b82`. Focused merge/release tests 16 passed plus inventory lock; detector statement coverage 2455/2455 on Python 3.13. Credential-store successor is #1171. | hook or manifest `gh pr merge` fails as `claude-plugin-github-merge-command`. `gh release` create, upload, delete, or edit fails as `claude-plugin-github-release-command`. On this slice `gh issue create`, `gh pr review`, `gh release list`, `kubectl apply`, and `docker push` stay inventory; kubectl/docker-push successor is #1172. Hardcoded PATs stay `claude-plugin-github-write-token`. Snippets are command labels. | keep Draft stacked on #1169. Do not Close #1099 or #1169. Do not steal checksum-mismatch or github-write-token. | From e926e1d30551f0eb7cf7f8dff96f2a50fee56757 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 8 Sep 2026 17:22:27 +0900 Subject: [PATCH 136/192] docs: note heredoc command-context precision --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 110a549d..a48f3039 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,7 @@ - 대시보드 검색창 커서 유지 — 검색어 중간에서 텍스트를 수정할 때마다 커서가 검색어의 맨 끝으로 점프하는 불편함을 수정했습니다. 이제 입력창의 커서 위치(`selectionStart`/`selectionEnd`)가 동적 렌더링 이후에도 원래 위치에 정확히 유지되어 자연스러운 타이핑 경험을 제공합니다. ### 보안 +- Claude plugin 실행 명령 문맥 정밀화 — 닫힌 literal here-document 본문의 `terraform apply`/`helm install` 같은 문자열은 데이터로 취급해 HIGH 오탐을 제거했습니다. 인용 delimiter와 `<<-` 탭 제거 형식을 지원하며, 닫히지 않거나 모호한 형식은 fail-closed로 유지합니다. 종료 delimiter 뒤의 실제 명령과 인용/주석 opener 유사 문자열 뒤의 실제 명령은 계속 검출합니다. - 리포트 출력 하드닝 — 생성된 markdown 리포트가 HTML로 렌더될 때 악성 finding 내용(예: 외부 엔진이 스캔한 코드의 `