fix(pr-100): Ossprey review hardening + frontline phases 3–6 - #101
Merged
Conversation
…SEARCH-labeled (Phase 3)
Second dispatch extension per ADR-0005/ADR-0017, registered after DepShield
in SCANNER_GROUPS (applies_to both):
- run_ossprey: `ossprey scan <workdir> -o <ossbom.json>` subprocess adapter.
Credential gate FIRST — skipped_missing_credential is the default runtime
path today (OSSPREY_API_KEY / API_KEY absent; Ossprey access provisioning
is OPEN, slice 35 BLOCKED). Adapter activates when a key lands.
- Exit-code disambiguation (vendor contract: 0 = clean/skipped, 1 = malware
OR scan failure): exit 0 is authoritative-clean; nonzero emits red
'malware' findings ONLY on a positive signal (malicious OSSBOM component,
or an unambiguous verdict line with negation guard) — a scan failure
degrades to unreachable, never a phantom red that would block a clean
artifact. OSSBOM parsing tolerates list and {components|packages:[...]}
shapes with defensive access.
- RESEARCH evidence label per the module's discipline: OSSBOM schema and
verdict wording are vendor-doc-sourced, NOT live-probed — needs
reconciliation against the pinned ossprey-cli before VERIFIED.
- Trust-strip gate deliberately preserved: no Ossprey mention in README/
QUICKSTART/CONTRIBUTING/STATUS/ARCHITECTURE (no user-usable capability
yet — "badges only when functionality exists"). Documented instead in
scanner-output-adapters.md §8, DECISIONS rows, ADR-0017 addendum,
OPTIONAL_SCANNER_KEYS + env-vars (key marked access-OPEN).
- Modal image: guarded best-effort release-binary install (absent binary
degrades to unreachable, acceptable while provisioning is OPEN).
Rebased onto post-merge main (PR #83 + slices 40-43). Gates: 232 sandbox
tests @ 97.03% coverage, 111 guard, 129 cli; ruff/mypy/bandit clean; xenon
split ceilings met; trust-strip rg clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ility (Phase 4, slice 37) CLI monitoring per slice-37's spec (operator observability, extending the existing CLI — not a second truth store): - `tripwire status [--json] [--limit <n>]`: hooks state (~/.tripwire/config.json enable/validity, PreToolUse registration in ~/.claude/settings.json, Supabase monitoring_enabled/threshold, §3 two-switch disagreement warning, and a tamper callout when the hook is registered but config.json is missing — that state DENIES all matched tools); items heatmap distribution via per-status head-counts (immune to PostgREST's 1000-row cap); recent scan-run health with fleet-wide stranded-running detection (dedicated head-count query, not page-local — a strand older than the newest --limit runs is exactly the busy-system case) naming the reconcile remedy; per-scanner latest status with unreachable/skipped tallies. - GWT 2 (enforcement unchanged) proven by test: recorded Supabase calls are select-family only (zero insert/update/upsert/delete/rpc), zero fs writes. - GWT 3: invalid --limit exits nonzero with an actionable example; missing Supabase env degrades to local-hooks-only output (exit 0) instead of hard-failing observability. - Docs: user-guide monitoring section + troubleshooting, DECISIONS rows (surface choice; Bash-interception explicitly not slice-37 scope — the upstream handler already gates skills-path Bash), slice-37 Before-Check name-sketch ticked (gate status left PLANNED for maintainer rituals), CHANGELOG entry. Adversarial verify confirmed 1 major (stranded pagination blind spot) + 4 minors (row-cap counts, missing-config understatement, prototype-key drop, user-scope-only registration claim) — all fixed with regression tests. Gates: 138 cli tests pass, eslint clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ecture note (Phases 5-6, slices 38-39) Phase 5 (slice 38): scripts/full-chain-validation.sh — staged checklist with a single accountable result (exit 0 only when every required stage passes): preflight, credentials, hooks-installed, demo-artifacts, scan-dispatch, verify-status, depshield-dispatch, ossprey-dispatch, cli-monitoring, and a LIVE /tw-self-check stage invoked via `claude -p` (never mocked, output captured into evidence) per the slice-38 GWTs and the original SEQUENCE-13 expectation. `ossprey-dispatch: SKIPPED(access)` is explicit while slice 35 remains BLOCKED. Stages needing Supabase/Modal creds report BLOCKED(.env) honestly; degraded-mode run verified on this machine (evidence JSON written to .test-results/full-chain-evidence.json; gate evidence stays a maintainer ritual — the script never fabricates it). Phase 6 (slice 39): deferred by default per the slice's own spec (Could, hackathon-too-large). Deliverable is docs/research/fe-be-target-architecture.md: current three-plane boundary map, the two pressures worth solving on pull-in (single-implementation six-state machine; anon read path to retire the client-side service-role key), and pinned non-goals. DECISIONS rows recorded for both; slice files left at maintainer-owned gate states. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…chain harness, escaped pipes in a DECISIONS table row - scripts/full-chain-validation.sh: interpolate $CONFIG_JSON instead of a quoted tilde path (SC2088); move `|| true` outside the command substitutions so the A && B || C pattern disappears (SC2015) - docs/plan/DECISIONS.md: escape regex pipes in the slice-37 HOOK_MATCHER code span — raw pipes split the markdown table cells (MD056/MD038) Verified locally via `uvx pre-commit run --all-files`: shellcheck, markdownlint, actionlint, gitleaks, ruff(+format), mypy, bandit, xenon, vulture, pylint, pytest-testmon, CLI node tests + ESLint all pass. The eslint-dashboard hook fails only locally (dashboard node_modules not installed on this machine); untouched by this branch and green on main CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ability table env-vars: Vendor procurement quick-steps converted from procedural numbered steps to a reference table (Vendor → Keys → Setup guide link). Step-by-step account creation stays in vendor setup pages per the file's own preamble. prerequisites: Capability-specific notes collapsed from narrative Explanation prose to a 4-row reference table (Capability → Requires). Removes the procedural 'Copy .env.example...' steps and 'Create a disposable project...' instructions that contradict the Reference doc type. Both were pre-existing DIVIO purity violations flagged by nw-documentarist review (2026-08-21) and resolved here per DECISIONS row (APPROVED WITH FOLLOW-ON, same-branch rewrite).
…lidation harness Harden malware stdout parsing, cap live self-check wall clock, enforce OSSPREY_API_KEY-only gating, and add scanner timeout budget CI guard before Ossprey activation.
code-review-graph reviewOverall risk: 0.60 (MEDIUM) — 103 changed function(s)/class(es), 3 affected flow(s), 49 test gap(s) Risk-scored changes
Affected execution flows
Test gaps
Token savings: this graph-backed report used ~69,099 fewer tokens (~83%) than reading every changed file in full (estimated, chars/4 approximation). Powered by code-review-graph — local-first analysis; no code leaves the CI runner. |
neomatrix369
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
claude -pwall-clock timeout in full-chain harness,OSSPREY_API_KEY-only credential gate, scanner timeout budget CI gate, Ossprey binary pinv0.12.0, live CLI reconcile notes on slice 35/36tripwire status— read-only agent-hook + dispatch observability (slice 37)scan_app.py/ ossprey testsSupersedes review gaps called out on PR #100. Coordinate merge with upstream
frontline-hack-phases-3-6to avoid duplicate landings.Test Results
Backend (sandbox)
uv run pytest sandbox/tests/ --cov=sandbox --cov-fail-under=95Backend (guard)
Frontend (CLI)
cd cli && npm test && npm run lintQuality Gates
scripts/check-scanner-timeout-budget.shDocumentation
docs/ARCHITECTURE.md— scanner timeout budget tabledocs/user-guide/env-vars.md—OSSPREY_API_KEYcontractChecklist
./scripts/quality-gates.shpasses locally (pre-commit fast gate + push hooks on commit)Test plan
scripts/full-chain-validation.shreportsBLOCKED(timeout)whenclaude -pexceeds 120sskipped_missing_credentialwithoutOSSPREY_API_KEYfrontline-hack-phases-3-6) to avoid duplicate landingsMade with Cursor
Complexity
Automatically refreshed by CI for product-code changes.
sandbox/)cli/)Functions above the JavaScript threshold