Repository navigation
docs(#198): close remaining PR #170 guard-contract findings - #200
Conversation
PR #170's final review left three Medium findings unaddressed. The shared guard's shell-syntax list named output redirection, command substitution, and variable expansion, but not input redirection, so --content-file - < ~/.netrc still satisfied the dash-only option check while sourcing a host file. The earlier --content-file bullet still stated that restriction as an unconditional absolute, and Ungoverned-edit detection still claimed four layers must catch every ungoverned edit. Refuse input redirection and non-here-document stdin sources in the guard parser, add matching guard vectors, and qualify both absolute claims with the File-source fail-open and registry- digest recorded-gap phrasing already used in adapter-contract.md and architecture.md. Closes #198
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Repository: redhat-et/ProtoBot/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
🤖 Review · Commit: |
|
Risk Assessment: moderate (2/5) DetailsSmall documentation-only fix with low metadata risk, elevated to moderate by high recent commit churn and regression history across the touched architecture specifications. |
|
Looks good to me Labels: PR modifies Specification Toolkit architecture documentation |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
fullsend-ai-review
Bot
added
ready-for-merge
|
🤖 Finished Review · ✅ Success · Started 5:53 PM UTC · Completed 6:09 PM UTC Commit: Runtime: pi · Model: google-vertex/gemini-3.8-flash → gemini-3.8-flash · Effort: high · Cost: $2.55 |
|
🤖 Finished Retro · ❌ Failure (agent timed out after 30m0s without completing (timeout: 30m0s)) · Started 6:18 PM UTC · Completed 6:50 PM UTC Commit: Runtime: pi · Model: google-vertex/gemini-3.8-flash → gemini-3.8-flash · Effort: high · Cost: $2.42 |
1 participant
Summary
Land the three unresolved Medium findings from PR #170's final review round.
The merged contract still had an input-redirection gap in the shared
guard's shell-syntax refusal list, an unqualified
--content-file/--impact-fileabsolute in the same document as the new File-sourceexceptions, and an Ungoverned-edit detection completeness claim that
contradicted the recorded registry-digest fail-open gap.
Changes
docs/architecture/agent-harness/adapter-contract.md<,<>) and anyother standard-input source that is not a quoted here-document body.
--content-file/--impact-filebullet forwards toFile-source arguments and uses the same per-call / fail-open
terminology.
-value alsorequires stdin bytes from a quoted here-document, not a redirected
host file.
--content-file - < ~/.netrc,--content-stdin < ~/.netrc, and--impact-file - < ~/.netrc.docs/architecture/git-integration.mdcaught" to edits that leave the registry intact, and names a
fail-open write that also rewrites the digest in
.protobot/project.yamlas a recorded gap.docs/architecture/agent-harness/opencode.mdmatching the shared contract.
Testing
python scripts/lint.py --fileson the three changed documents(markdownlint, detect-secrets, end-of-file, trailing-whitespace,
and remaining applicable hooks).
python scripts/lint.py --check-paritypre-commit runcould not fetch hook repos (HTTP 403). Thenetwork-independent
scripts/lint.pyrunner was used instead, asdocumented in AGENTS.md.
Closes #198
Post-script verification
agent/198-guard-input-redirection)af7fce3e519b80d6ad04fa34f48b18f9454ea0ee..HEAD)