Skip to content

fix: remediate exact-main release audit findings - #97

Merged
sanjey99 merged 6 commits into
mainfrom
fix/96-release-readiness-audit
Aug 31, 2026
Merged

fix: remediate exact-main release audit findings#97
sanjey99 merged 6 commits into
mainfrom
fix/96-release-readiness-audit

Conversation

@sanjey99

@sanjey99 sanjey99 commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

Remediates every concrete defect found in the 2026-08-31 exact-main release audit
and adds reproducible release gates for the evidence that was previously blocked or
unverifiable.

  • fixes Project Group controlled-input/caret loss and Agent edit hydration/custom-authority data loss without redesigning the frozen UI
  • bounds durable collections at 10,000, returns bounded 507 capacity failures, and makes Agent creation atomic
  • restricts tokenless access to loopback Host plus same-origin browser requests and refuses any effective public bind without a strong token
  • builds the exact working tree for the live gate, using a non-root controller, named state volume, engine socket, bounded discovery, and cleanup
  • adds executable Server/browser coverage with every production source required and all four metrics enforced at 80%
  • adds pinned-container Terraform fmt/init/validate for hosts without Terraform
  • removes runtime credentials from Terraform variables, cloud-init, plans, and state; transfers them only after apply into a remote mode-0600 environment file
  • reconciles the task ledger, as-built/runbook/defect/build evidence, README, and a new exact test report

Ownership and scope

Independent UI/security sign-off, the external Ark inference, protected-main
integration, and demo rehearsals are evidence responsibilities, not hidden product
exclusions. They are kept explicitly open below and in the task ledger.

Root causes and fixes

Durable and API boundaries

Durable admission was checked only after mutation, concurrent Agent creates did not
reserve capacity, and rejected creates could leave partial workspace/state. Tokenless
mode also trusted arbitrary Host/Origin values, while deployment publication could
bind publicly without the server seeing that effective address.

Admission is now reserved before mutation, all durable push sites are bounded, Agent
publication is atomic, tokenless requests are loopback/same-origin only, and public
binding fails closed without a strong token.

Browser behavior

Controlled React drafts could be consumed before their latest state commit. Agent
edit rendered before presets and Agent data had hydrated, so a rapid authority toggle
could overwrite edits. Focused synchronization/hydration fixes preserve the existing
components and styling. Regression coverage also pins Settings recovery/reset,
Agent CRUD/lifecycle/edit/delete/sorting, direct Playground, malformed/missing
routes, runtime contracts, cancellation links, accessibility names, and no document
overflow.

Live and deployment gates

The old live wrapper forced a host bind mount on the documented affected macOS Docker
Desktop layout and did not independently build the current tree. The new wrapper
builds disposable Runtime/controller images from the exact checkout and runs the
non-root controller on a named volume. Terraform validation now has a pinned Docker
fallback and operates on a disposable module copy. Runtime secrets are no longer
Terraform data.

Coverage and documentation

The repository had neither a coverage provider nor a reproducible 80% check.
Server V8 and browser Istanbul coverage are now separate canonical maps, with every
production file required and statements/branches/functions/lines all enforced.
docs/SHEPHERD_TEST_REPORT.md records exact commands, counts, failures and limits;
historical estimates are explicitly labelled rather than presented as current state.

Test evidence

  • npm run check
    • root script/deploy tests: 26/26
    • Server: 856 passed / 3 explicit opt-in skips
    • Web: 20/20
    • strict production and test typechecks
    • both production builds
  • npm run test:coverage
    • Server: 86.15% statements, 80.05% branches, 91.46% functions, 88.03% lines
    • Browser: 88.50% statements, 80.18% branches, 87.64% functions, 92.37% lines
  • full Playwright matrix: 48/48
    • 24 functional flows at 1280x800
    • 24 functional flows at 1440x900
  • npm run test:terraform
    • Terraform 1.9.8 container
    • Volcengine provider 0.0.58
    • configuration valid
  • npm run test:shepherd:live:preflight
    • exact-tree Runtime/controller builds
    • non-root controller, named volume/socket, one bounded live test discovered
    • zero model requests; temporary resources cleaned
  • npm audit --json: 0 vulnerabilities
  • git diff --check, local Markdown-link validation, and bounded tracked credential/state/artifact scans
  • external Ark live inference
    • not executed: it sends repository-derived prompts and scoped code to the configured endpoint, and the managed executor requires separate informed approval for that transfer
  • independent read-only UI review for [UI-GATE] Complete the final six-surface accessibility and visual gate #45
  • independent part-5 security review for [SEC-REVIEW-2] Independent trust-boundary review and the carried compose exposure #89
  • hosted PR checks at bb1a1df
    • Node 22 / npm run check run 33389614355: pass in 2m59s
    • Required checks run 33389614223: pass in 3m01s
    • final head 96eecb9: Node 22 / npm run check run 33390293339 passed in 3m16s
    • final head 96eecb9: Required checks run 33390293341 passed in 2m34s
    • current head 14b69f2: Node 22 / npm run check run 33391006561 passed in 4m40s
    • current head 14b69f2: Required checks run 33391006569 passed in 3m11s
  • protected-main post-integration rerun
  • three complete demo rehearsals / genuinely available second-machine evidence

Commit log

  • 2e7c915 — harden durable and tokenless boundaries
  • 69c12de — close deterministic browser gate defects
  • 223a5fe — close release-readiness gaps across browser/live/coverage/Terraform/security
  • bb1a1df — reconcile exact-main release evidence
  • 96eecb9 — record hosted release checks
  • 14b69f2 — record the accepted Inter typography detector exception

Review notes

  • No timeout or retry inflation, new skip, assertion weakening, UI redesign, or
    product-scope removal was used to make a gate pass.
  • The default test path remains network/model-free.
  • The release report distinguishes the protected-main base, tested product commit,
    and later documentation commit.

@sanjey99
fix: harden durable and tokenless boundaries
2e7c915 
Summary:
- reject durable collection admissions before schema exhaustion
- require authentication for effective public binds
- enforce loopback same-origin access in tokenless mode

Root cause:
- persistence limits were enforced only after mutation
- runtime authentication considered the internal bind but not the published bind

Fix:
- centralize durable collection capacity checks with concurrent Agent reservations
- validate PUBLIC_BIND_ADDR and guard tokenless API requests by Host and Origin
- cover server and Compose boundaries with causal regressions

Testing:
- 154 focused server tests
- 7 Compose deployment tests
- server TypeScript check
- git diff --check
@sanjey99
fix: close deterministic browser gate defects
69c12de 
Summary:
- eliminate the Project Group mention caret race
- restore direct Playground E2E coverage under the Shepherd-first default
- expose meaningful Settings field names and remove fractional footer clipping

Root cause:
- caret placement was deferred beyond React's controlled-input commit
- legacy fixtures assumed the previous route default and Codex resume argv shape
- numeric controls lacked explicit accessible names and scroll targeting had no rounding margin

Fix:
- synchronously commit mention content before placing the caret
- explicitly select direct mode in legacy tests and parse the resume separator
- add ARIA labels and a one-pixel scroll margin without changing layout

Testing:
- Playwright matrix: 38/38 passed at 1280x800 and 1440x900
- E2E harness units: 19/19 passed
- web unit tests: 20/20 passed
- web typecheck and production build
@sanjey99
fix: close release readiness gaps
223a5fe 
Summary:
- make live Shepherd runtime discovery exact-tree and volume-aware
- enforce server and browser coverage thresholds above 80 percent
- validate pinned Terraform and keep runtime secrets out of state/cloud-init
- cover and fix the Agent edit hydration race plus release browser paths

Root cause:
- release gates relied on ambient executables, incompatible coverage maps, and host-only Terraform
- Terraform threaded runtime credentials through sensitive variables into state and user data
- the Agent edit form rendered before authority hydration completed

Tests:
- server coverage: 86.15/80.05/91.46/88.03
- web coverage: 88.50/80.09/87.64/92.37
- Terraform 1.9.8 validate with volcenginecc 0.0.58
- 34 infrastructure and harness regressions, strict typecheck, npm audit
@sanjey99 sanjey99 mentioned this pull request Aug 31, 2026
Closed
This was referenced Aug 31, 2026
Closed
Closed
Closed
Closed
@sanjey99
sanjey99 marked this pull request as ready for review August 31, 2026 13:23
Copilot AI lite review requested due to automatic review settings August 31, 2026 13:23
Copilot AI reviewed Aug 31, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@sanjey99
sanjey99 merged commit 53f2529 into main Aug 31, 2026
2 checks passed
@sanjey99
sanjey99 deleted the fix/96-release-readiness-audit branch August 31, 2026 13:23
sanjey99 added a commit that referenced this pull request Aug 31, 2026
@sanjey99
docs: record issue 96 protected-main evidence
0a15a90 
Summary:
Reconcile the release ledger and test report after PR #97 merged as 53f2529.

Change:
- Record exact post-integration repository, coverage, browser, Terraform, live-preflight, and hosted results.
- Move issue #96 findings from candidate to integrated while preserving independent UI, security, external Ark, and rehearsal gates.
- Correct the stale OPS-06 compose-exposure status.

Testing:
- Local Markdown links resolve across all five changed documents.
- git diff --cached --check passes.
- Exact merge gates are recorded from the clean 53f2529 worktree.
@sanjey99 sanjey99 mentioned this pull request Aug 31, 2026
Merged
10 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[VERIFY-01] Remediate all exact-main audit findings

2 participants

@sanjey99