fix(ci): dedicated pack-guard job (B1–B4, S10–S26) by jcdavis131 · Pull Request #91 · jcdavis131/dottie

jcdavis131 · 2026-10-19T05:39:32Z

Stacked on #89 (cursor/leakgate-fixtures-generated). Retarget to main once #89 merges. Draft until then. Do not mark ready, do not merge.

Mill is the only writer of fixture data: this PR does not touch gen.py, source.json, validate.py, MANIFEST.json, or EVAL_ONLY.

Head

6ede50eb5aa765b8575ee66689a8c3b4af1761e6

Scan scope

Pack-guard greps the whole tree, not a base diff:

git ls-files -z (full index)
git ls-tree -r -z --full-tree --name-only "$GITHUB_SHA" (full commit tree)

This round (on `d56d7ca0`)

Dropped PACK_GUARD_BLOB_PIN_TEST / TP. Guard allow is only PIN or LEG. d023f314 is absent from ci.yml. apps/x/fixtures/rows.jsonl is refused (rc=1).

Vendored Critic suites byte-identical (not edited):

suite	sha256
`test_critic_91_0b05.py` (0b05_r2)	`49c11d0e1fd3596f4eefb13737a2d13aa4cc49fa816e481665ee4347a60b4d54`
`test_critic_91_0ac5.py` (0ac5_r2)	`182d9dcd264312b7a76de6b79f3d0ffc20edcf41d1859d05b8dcb68ed7cbb2cc`

Warn-only CSV-header tripwire: four paper-skill tables pinned; extras print WARN csv tripwire and never fail CI (|| true). Listing uses git_scrub ls-files.

KNOWN_LEGACY is unchanged.

Counts (`WT=/workspace`)

suite	result
discover	343 OK, 1 skip (341 + 0ac5 leftover test + tripwire)
0b05_r2	11/11
f8f1	8/8
ce30_r2	9/9
50d2_r2	15/15
0ac5_r2	9/9
mutations	29/29
136f	36/36
`apps/x/fixtures/rows.jsonl`	rc=1

File hashes at this head

file	sha256
`.github/workflows/ci.yml`	`11099ec30253b068c910d4d7e6220bfe8e722f5675c927b94b2c8b88523d9381`
`apps/dottie-os/tests/test_ultradata_factory.py`	`ff4d72bf99bb5654c582e8a0f639994520392d8b0ee80436682fc16ee7d70134`
`apps/dottie-os/tests/test_critic_91_0b05.py`	`49c11d0e1fd3596f4eefb13737a2d13aa4cc49fa816e481665ee4347a60b4d54`
`apps/dottie-os/tests/test_critic_91_0ac5.py`	`182d9dcd264312b7a76de6b79f3d0ffc20edcf41d1859d05b8dcb68ed7cbb2cc`

Capture git rev-parse / cd / git ls-files before grepping so a failing git cannot print "No pack artifacts tracked" and exit 0. Keep the step keys {name, run} and the same pack patterns. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

S4 allowlists the extracted dottie-os-smoke step as {name, run} and the job as {runs-on, steps} (what main has today), rejects workflow defaults, and rejects earlier index-mutation / GIT_* env steps. S5 forbids (Code|General)_Agent_\d{6} and openbmb in source.json raw text. Four placements go red with setUpClass stubbed; Mill's source.json still passes. Also run the extracted guard outside a repo, with GIT_INDEX_FILE=/dev/null, and from a subdirectory that has a tracked pack at root. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

vercel · 2026-10-19T05:39:38Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
arxiviq	Ready	Preview	Oct 23, 2026 1:53pm UTC
dottie-os-console	Ready	Preview	Oct 23, 2026 1:53pm UTC

Run /usr/bin/git with GIT_* and BASH_ENV unset so a hollow index, empty GIT_DIR, or git shim cannot pass. Match packs with ls-files -z / grep -zEi, require .github/workflows/ci.yml and at least 1280 entries (half of 2561), and cross-check git ls-tree HEAD. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

S6: workflow keys must be {name, on, jobs} and on: must equal main's trigger block. S7: ban GITHUB_ENV/PATH, read-tree, reset, git … rm, sparse, and checkout with: in earlier steps. S8: no other workflow may reuse the guard job or step name. S9: (Code|General)_Agent_\d{6} is IGNORECASE. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Original drop sha256 0cbbaa78bc4de52a32ccf64a9e5ecb622a670fde381a018c4d185a6c71e355ad. WT defaults to this repo; mkrepo plants the 1280-file floor so Part A and Part B run under unittest discover. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

ls-tree -r -z --full-tree --name-only "$GITHUB_SHA" under the scrubbed /usr/bin/git. Fail closed if GITHUB_SHA is unset, not 40 hex, or not a commit. Apply the ci.yml-present and N=1280 floor to the tree list too. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

HEAD reset --hard to an older commit still trips when a pack is in GITHUB_SHA; ls-tree without -r is red for a subdirectory pack; unset or bogus GITHUB_SHA is red. Critic Part B pins GITHUB_SHA from the temp repo. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Move the tracked-pack check out of dottie-os-smoke so PR unittest code cannot shim grep via GITHUB_ENV/GITHUB_PATH/BASH_ENV. The new pack-guard job has no needs: pinned actions/checkout (persist-credentials: false) then the guard. Git runs under env -i with --no-replace-objects and core.fsmonitor=false. Match is unanchored curated_pack_|ultradata_harvest_ via /usr/bin/grep. Every uses: in ci.yml is pinned to a 40-hex SHA. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Extract the guard from the pack-guard job, pin checkout/shell/uses, reject YAML multi-docs and duplicate keys, and vendor test_critic_91_136f.py (sha256 5bf36a2c…). Part A stays 45/45 red; Part B 27/27. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Structural tests now require -euo pipefail on the guard shell, a unique pack-guard job id and display name with no if/needs/strategy/name, and checkout with: exactly persist-credentials: false. Each has a mutation that turns TrackedPackArtifactGuardTests red. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Require Cam review for every workflow file, not only ci.yml, and for the Forge/Critic tests that pin the pack-guard check name. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Parse every .github/workflows *.{yml,yaml} with PyYAML or a vendored fail-closed loader so a second job id or name cannot spoof the required check (4-space, flow style, Pack-Guard, pack_guard, ${{). Pin env -i to PATH=/usr/bin:/bin HOME=/nonexistent LC_ALL=C. Widen path match to curated[-_]?pack|ultradata[-_]?harvest[-_] so curated-pack-v2.jsonl is caught without tripping run_ultradata_harvest.py. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Drop sha256 f251c6c9b34b5add838b6f45e93fb538ccb61b0704b5652428440033a0ecfbc5. S18 add-then-delete is skipped; squash-only merges is a Cam setting. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

cursor · 2026-10-19T07:36:48Z

Head: 50d2e0f82e6f28a265858fc4e02f8dc262ccdfcb (draft, no merge, no force-push).

Counts

af2d E (baseline + 54 mutations): 55/55, including the 4 spoof mutations (4-space indent, flow jobs: {pack-guard: …}, name: Pack-Guard, lookalike pack_guard)
af2d F CODEOWNERS: 2/2
af2d G S18 add-then-delete: skipped — not visible at GITHUB_SHA; Cam: squash-only merges
Part A: 45/45
Part B: 27/27
136f: 36/36
full discover: 280 OK (skipped=1)
leakgate fixture shas: unchanged

CODEOWNERS (@jcdavis131)

/.github/ @jcdavis131
.github/workflows/ci.yml @jcdavis131
apps/dottie-os/tests/test_ultradata_factory.py @jcdavis131
apps/dottie-os/tests/test_critic_91_*.py @jcdavis131

/.github/ owns all of .github/, not only ci.yml.

Required checks for Cam (branch protection, GitHub Actions app), exactly:

pack-guard
dottie-os-smoke
lint-and-test

S25: actions/checkout and actions/setup-python in lint.yml and factory.yml use the same commit pins as ci.yml, with version comments. persist-credentials: false stays on both checkouts. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

S21: one shared Python snippet in pack-guard grep_pack/show_pack_hits. Per path segment: NFKC, lookalike translit, casefold, strip non-alnum; refuse if a segment or the joined path contains curatedpack or ultradataharvest. Exact-path allowlist only: curated-packing-notes.md, uncurated_package.py, and the two run_ultradata_harvest.py scripts. Catches Critic's 22 names. S24: every file in .github/workflows is checked: no pull_request_target or workflow_run; no external reusable workflows or secrets: inherit; every uses pinned to a lowercase 40-hex sha on the allowlist; refuse github-script, gh/curl API posting, secrets.* in steps, clone-URL tokens, and mixed-case GHA keys. Vendors test_critic_91_ce30.py unmodified (sha256 90a3ee41). Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Byte-identical drop (sha256 4cdf999eef803bd20ee448a3c836230fcf9fe294bf2b3c11a20ffeba081986a0). Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Official tags v5 and v5.6.0 both point at a26af69b; checkout 11bd7190 stays v4.2.2. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Refuse any ${{ }} that mentions secrets or github.token/GITHUB_TOKEN after whitespace/case normalize. Allow only push, pull_request, schedule, workflow_dispatch. Local actions only under ./.github/, scanned the same way. Pack-guard PATH_PY also refuses archives, compressed files, jsonl outside fixture-like dirs, LFS pointers, symlinks, and gitlinks by git mode and content. uncurated_package.py is test-only allowlist, still unioned into CI because ce30 runs the real guard. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Byte-identical drop of test_critic_91_0b05.py (sha256 36130a164b5130b8404b05986308ad551396cedd02fb17abff6c8f899b4daeaf). Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Tokenize ${{ }} like GitHub (unquoted }} only), allow github.<prop> from a fixed safe list, and scan YAML-unescaped scalars. Local docker images must be digest-pinned; node main/pre/post must stay under .github/. S26 allowlist skips names only. JSONL/gz parents are an exact 32-dir list. CI PATH_PY A= is production-only. Archives, JSONL, LFS, size cap (3 MiB), and related magics are content-checked. HEAD-tree test asserts the cap does not refuse anything tracked today. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Pack-guard scans the whole index and GITHUB_SHA tree, so folder exemptions would keep new jsonl green. Replace them with exact (path, sha256) PIN plus a separate KNOWN_LEGACY list for the two files already on main, waiting on a Cam/Mill move. Copies, renames, and edited bytes are refused. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

Remove PACK_GUARD_BLOB_PIN_TEST so apps/x/fixtures/rows.jsonl is refused. Vendor Critic 0b05_r2 and 0ac5_r2 byte-identical. Warn-only CSV tripwire pins the four paper-skill tables and never fails CI. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

CI pull_request HEAD is the merge commit. Recording 6ede50e keeps merge-ref drift at 3 (budget 20). Recording origin/main 09b0765 is 25. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

cursoragent and others added 2 commits October 19, 2026 05:39

vercel Bot deployed to Preview – arxiviq October 19, 2026 05:39

View deployment

vercel Bot deployed to Preview – dottie-os-console October 19, 2026 05:39

View deployment

cursoragent and others added 3 commits October 19, 2026 05:52

vercel Bot deployed to Preview – arxiviq October 19, 2026 05:52

View deployment

vercel Bot deployed to Preview – dottie-os-console October 19, 2026 05:52

View deployment

cursor Bot changed the title ~~fix(ci): pack-guard fail-closed + S4/S5 leak-gate follow-ups~~ fix(ci): pack-guard fail-closed + S4/S5/S6–S9 leak-gate follow-ups Oct 19, 2026

cursoragent and others added 2 commits October 19, 2026 05:55

vercel Bot deployed to Preview – arxiviq October 19, 2026 05:56

View deployment

vercel Bot deployed to Preview – dottie-os-console October 19, 2026 05:56

View deployment

cursoragent and others added 2 commits October 19, 2026 06:15

vercel Bot deployed to Preview – arxiviq October 19, 2026 06:15

View deployment

cursor Bot changed the title ~~fix(ci): pack-guard fail-closed + S4/S5/S6–S9 leak-gate follow-ups~~ fix(ci): dedicated pack-guard job (B1–B3, S10–S17) Oct 19, 2026

vercel Bot deployed to Preview – dottie-os-console October 19, 2026 06:16

View deployment

vercel Bot deployed to Preview – arxiviq October 19, 2026 06:20

View deployment

vercel Bot deployed to Preview – dottie-os-console October 19, 2026 06:20

View deployment

cursoragent and others added 3 commits October 19, 2026 07:36

fix(github): CODEOWNERS own /.github/ and pack-guard tests

4cd2467

Require Cam review for every workflow file, not only ci.yml, and for the Forge/Critic tests that pin the pack-guard check name. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

test(dottie-os): vendor Critic 91 af2d suite

50d2e0f

Drop sha256 f251c6c9b34b5add838b6f45e93fb538ccb61b0704b5652428440033a0ecfbc5. S18 add-then-delete is skipped; squash-only merges is a Cam setting. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

vercel Bot deployed to Preview – arxiviq October 19, 2026 07:36

View deployment

vercel Bot deployed to Preview – dottie-os-console October 19, 2026 07:36

View deployment

cursor Bot changed the title ~~fix(ci): dedicated pack-guard job (B1–B3, S10–S17)~~ fix(ci): dedicated pack-guard job (B1–B4, S10–S21) Oct 19, 2026

cursor Bot changed the title ~~fix(ci): dedicated pack-guard job (B1–B4, S10–S21)~~ fix(ci): dedicated pack-guard job (B1–B4, S10–S23) Oct 19, 2026

vercel Bot deployed to Preview – dottie-os-console October 19, 2026 08:13

View deployment

cursoragent and others added 2 commits October 19, 2026 08:43

vercel Bot deployed to Preview – arxiviq October 19, 2026 08:44

View deployment

vercel Bot deployed to Preview – dottie-os-console October 19, 2026 08:44

View deployment

cursor Bot changed the title ~~fix(ci): dedicated pack-guard job (B1–B4, S10–S23)~~ fix(ci): dedicated pack-guard job (B1–B4, S10–S25) Oct 19, 2026

cursoragent and others added 3 commits October 19, 2026 09:21

test(dottie-os): vendor Critic #91 f8f1 suite

ac6c1ed

Byte-identical drop (sha256 4cdf999eef803bd20ee448a3c836230fcf9fe294bf2b3c11a20ffeba081986a0). Co-authored-by: Cam Davis <jcdavis131@gmail.com>

fix(ci): name pinned setup-python sha as v5.6.0

2770a3d

Official tags v5 and v5.6.0 both point at a26af69b; checkout 11bd7190 stays v4.2.2. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

vercel Bot deployed to Preview – arxiviq October 19, 2026 09:22

View deployment

cursor Bot changed the title ~~fix(ci): dedicated pack-guard job (B1–B4, S10–S25)~~ fix(ci): dedicated pack-guard job (B1–B4, S10–S26) Oct 19, 2026

vercel Bot deployed to Preview – dottie-os-console October 19, 2026 09:22

View deployment

cursoragent and others added 2 commits October 19, 2026 10:00

test(dottie-os): vendor Critic #91 0b05 suite

e50c3d7

Byte-identical drop of test_critic_91_0b05.py (sha256 36130a164b5130b8404b05986308ad551396cedd02fb17abff6c8f899b4daeaf). Co-authored-by: Cam Davis <jcdavis131@gmail.com>

vercel Bot deployed to Preview – arxiviq October 19, 2026 10:01

View deployment

vercel Bot deployed to Preview – dottie-os-console October 19, 2026 10:02

View deployment

vercel Bot deployed to Preview – arxiviq October 19, 2026 10:44

View deployment

vercel Bot deployed to Preview – dottie-os-console October 19, 2026 10:44

View deployment

vercel Bot deployed to Preview – arxiviq October 19, 2026 11:19

View deployment

vercel Bot deployed to Preview – dottie-os-console October 19, 2026 11:19

View deployment

cursor Bot changed the base branch from cursor/leakgate-fixtures-generated to main October 23, 2026 13:31

jcdavis131 closed this Oct 23, 2026

jcdavis131 reopened this Oct 23, 2026

jcdavis131 mentioned this pull request Oct 23, 2026

HANDOFF: restamp at main tip 09b0765 (merge of #89) #92

Open

3 tasks done

docs(handoff): restamp trusted-first block to 6ede50e for #91

2f4c472

CI pull_request HEAD is the merge commit. Recording 6ede50e keeps merge-ref drift at 3 (budget 20). Recording origin/main 09b0765 is 25. Co-authored-by: Cam Davis <jcdavis131@gmail.com>

vercel Bot deployed to Preview – arxiviq October 23, 2026 13:52

View deployment

vercel Bot deployed to Preview – dottie-os-console October 23, 2026 13:53

View deployment

Navigation Menu

Repository navigation

fix(ci): dedicated pack-guard job (B1–B4, S10–S26) - #91

fix(ci): dedicated pack-guard job (B1–B4, S10–S26)#91
jcdavis131 wants to merge 25 commits into
mainfrom
cursor/leakgate-guard-hardening

jcdavis131 commented Oct 19, 2026 •

edited by cursor Bot

Loading

Uh oh!

vercel Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Oct 19, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jcdavis131 commented Oct 19, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Head

Scan scope

This round (on d56d7ca0)

Counts (WT=/workspace)

File hashes at this head

Uh oh!

vercel Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Oct 19, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jcdavis131 commented Oct 19, 2026 •

edited by cursor Bot

Loading

This round (on `d56d7ca0`)

Counts (`WT=/workspace`)

vercel Bot commented Oct 19, 2026 •

edited

Loading