Repository navigation
Tighten guardrails and document their limits after review - #10
Merged
Merged
Conversation
A review of 731a3f9 on synthetic data found four gaps. This closes two and states the rest plainly. - The write-guard blocks a hook event it cannot read: invalid JSON, no tool_name or tool_input, or a file tool with no path. All of these were allowed before. NotebookEdit now goes through the guard too. - A finding's clause must name a DPDP section (1-44) or rule (1-23), or a GDPR article (1-99), in its own framework. "Section 999 of the Imaginary Act" passed before. Sub-clauses and cross_reference are still unchecked. - The post-write validator reports an event it cannot read instead of skipping it. - SECURITY.md lists what the guards do not cover: shell and MCP writes, identifiers beyond Aadhaar, PAN and +91 mobiles, clause meaning and applicability, and sector rules. - A sector-only duty goes in the assessment summary, not a DPDP finding standing in for it. AGENTS.md, /audit and the sector guides say so. - The schema-validation test runs on a copy of the tracked demo, so a local audit can't turn npm test red. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Nov 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A review of 731a3f9 on synthetic data found four gaps in the guardrails. This closes the two that code can close, and states the other two plainly so nobody reads a passing check as more than it is.
What changes
Malformed hook input now blocks. The write-guard returned allow (exit 0) for
not json,{}, a Write event with no path, and a NotebookEdit outside the layout. All four now exit 2. NotebookEdit is in the PreToolUse matcher, and the post-write validator reports an event it cannot read instead of skipping it.Fabricated clauses fail validation. Every reference in a finding's
clausemust name a DPDP section (1-44) or rule (1-23), or a GDPR article (1-99), in the finding's own framework. UK GDPR also accepts lettered articles (22A-22D). "Section 999 of the Imaginary Act" now fails. Run against the 154 findings from six real and demo reports, 153 pass. The one that fails is a local blind run that filed CERT-In's 6-hour reporting rule as a DPDP finding, which is the review's sector point exactly.Sector-only duties move to the summary.
AGENTS.md,/auditand the three sector guides now say a duty with no DPDP or GDPR clause behind it goes insummary.md, not a DPDP finding standing in for it. The guides say sector counsel has not reviewed them.SECURITY.md lists every limit. Shell, MCP and other-harness writes skip the hooks. The personal-data filter knows three formats (Aadhaar, PAN, +91 mobiles). A valid clause is well formed, not checked for meaning or applicability. Nothing validates sector rules.
Not done
Checks
npm test: 27 tests, 26 pass, 1 skipped on Windows (the hook-command test, which runs on Linux CI).npm run validate -- --strictpasses on tracked data. Locally it flags the gitignoredacme-blind-fullreport above.Edits to
.claude/scripts,.claude/schemasand.claude/settings.jsonwere made through the shell under maintainer direction, since the guard blocks agent edits there. Read those diffs by eye.🤖 Generated with Claude Code