Skip to content

RT52: fail closed on unbound compiled regex caches - #68

Open
heybeaux wants to merge 4 commits into
mainfrom
nightly/2026-10-12-exp62
Open

heybeaux wants to merge 4 commits into
mainfrom
nightly/2026-10-12-exp62

Conversation

@heybeaux

Copy link
Copy Markdown
Owner

New nightly experiment → measured red → real package green

SwarmLab exp62/Spec68 pre-registration 761fafa + before-output arithmetic clarification f68b60f. Prior exp60/61 drafts remain independent, untouched.

  • Baseline origin/main 4be84ed: unsafe allow6/16, invalid binding detection0/32, exact accuracy28/60, caller ownership56/60; repeated runs crbi-mv6b9cr1, crbi-mv6b9ctl identical rows/artifacts.
  • Runtime bdaace0: same frozen60 scenarios/seeds/harness crbi-mv6bfvgw, unsafe allow0, detection1, accuracy1; full122-event replay and package manifests pinned.
  • Valid controls28/28 and independent deny16/16 remain green. Adapter repair control is NOT Aegis improvement.

General fix

Validate normalized declared/cache regex source+flags and allowed stateless dialect at public entry, skipping unbound caches and applying explicit non-weakenable RT52 ask floor. Keep prediction/valid deny, inert disabled/foreign/nonregex and stateless lastIndex. Strict wrapper refuses before I/O. Preserve existing RT48 changed-critical deny conservatively without executing invalid cache; no old test rewritten.

28 new focused tests:25 red/3 pass baseline →28 green; package160/160. Full release:check build/typecheck/all tests/stored50/50 evidence green. Unchanged exp58/59 runs green (regression-only). SwarmLab build/typecheck/verify:evidence49 claims105 traces986 assertions green. Main previously failed Date.now determinism test; no false clean-main claim.

Ordinary RegExp configuration integrity only, no arbitrary hostile JS/proxy/getter/subclass/schema/ReDoS redesign/atomic action/calibration claim. No .acr edits, no Territory refresh. Prior checkout dirt preserved. Two initial trace comparator diagnostics preserved unadmitted (undefined-vs-JSON serialization), corrected before admitted baseline without threshold/scenario/policy changes. No tuning; reserved holdout unused.

Independent review pending. Do not merge until review, executable CI and clean mergeability verified. Linked SwarmLab PR to follow.

@coderabbitai

coderabbitai Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 3c79dd09-4ad5-4ef4-b7c6-16ff2c217f66
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@heybeaux

Copy link
Copy Markdown
Owner Author

Linked frozen experiment, admitted red/green traces and complete artifact receipts: heybeaux/swarmlab#51 . Independent local reviewer running; no merge until executable CI and review verified.

@heybeaux

Copy link
Copy Markdown
Owner Author

Executable release-check38358788952 SUCCESS on5aa989a; local release1153 tests + stored50/50 green, unchanged exp58/59 green, independent read-only review no blocker. HOLD paired landing: SwarmLab51 has no executable GitHub CI workflows; CodeRabbit SUCCESS is skipped review, not CI. No merged-main improvement claim. Do not merge paired work until SwarmLab executable CI gate is satisfied.

@heybeaux

Copy link
Copy Markdown
Owner Author

Same-exp62 independent interface audit reproduced candidate-only severity attribution regression: low invalid cache borrowed unrelated valid critical nonmatch deny. Fixed86333e0 (same-entry predicate);93d2e8c preserves RT52 diagnostic during RT48 refusal. 15 additional focused tests, old tests untouched, full release1168 tests green, stored50/50. Fresh baseline120 arm rows/artifacts identical; final frozen exp62 crbi-mv6c7fo8 all120 arm rows match pinned green. Unchanged exp55–59 reruns green. No second nightly novelty/threshold change. Updated head needs fresh CI; paired landing STILL held for absent executable SwarmLab CI, no merge.

@heybeaux

Copy link
Copy Markdown
Owner Author

Final updated head93d2e8c executable release-check38360704028 SUCCESS; mergeability CLEAN/MERGEABLE. All1168 local tests/static/release green and frozen exp62 same-harness green, adjacent55–59 green. Explicitly no merge: paired SwarmLab51 still lacks executable CI; CodeRabbit skipped review is not sufficient. Audit source/worktrees/receipts + final heads recorded in Oct12 ledger/state; lock removed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants