Repository navigation
Sync specs with contributed functionality - #1877
Merged
Merged
Conversation
Back-fill the specs for the 46 commits since the last sync that changed behaviour without touching a spec: the public-surface scrub mod (#1676), adapter hardening (#1862), the hook managers with install strategy `none` (#1838), Linux `allowAllUnixSockets` and its socket cover (#1809), the touch-overlay dismissal and matcher (#1832, #1833), the per-family Codex manifests (#1836), Vulnogram reviewer comments (#1840), the verify false-pass fixes (#1808), gateway refusal hints (#1810), adversarial-review output and agy fixes (#1852, #1854, #1871), and code-review inline comment text (#1853). Also correct drift found on the way: the threat-model pointer now names Appendix B after the #1859 restructure, the troubleshooting catalogue has fourteen entries, and the overview's Mentoring and Pairing skill counts match docs/modes.md. Generated-by: Claude Opus 5
#1676 gave magpie-security a .codex-plugin/plugin.json and an empty hooks/codex-hooks.json, because its hooks.json now carries a Claude Code mod, but the "Which manifest Codex reads" table and the Hooks paragraph still named only magpie-setup and magpie-utilities. Generated-by: Claude Opus 5
potiuk
enabled auto-merge (squash)
October 28, 2026 00:40
github-actions
Bot
added
family:setup
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings
tools/spec-loop/specs/up tomain(e03b74530). It covers the 46 commits since the last sync that changed behaviour without updating a spec.Back-filled
security-issue-lifecycle: the deterministic public-surface scrub mod (feat(security): add deterministic public-surface scrub Claude Code mod (part of #1497) #1676)adapters: rollups read only from collaborators, IMAP verified TLS, the Jira bridge HTTPS-only, SourceHut body-file and--allow-mutation, and the jira-patch attachment pin (Tighten adapter defaults: TLS, collaborator rollups, HTTPS-only bridge #1862)agent-isolation-sandbox: hook managers with install strategynone(feat(hook-manager): register managers that need no install fix (#1825) #1838), LinuxallowAllUnixSocketsand its socket cover (fix(agent-isolation): guard Linux allowAllUnixSockets with denyRead #1809), touch-overlay dismissal and matcher (fix(agent-isolation): show the touch overlay for every signature #1832, fix(agent-isolation): arm the touch overlay for every git that reaches the key #1833)marketplace-distribution: per-family Codex manifests for setup, utilities and security (fix(setup): load the upgrade hook in Codex #1836, feat(security): add deterministic public-surface scrub Claude Code mod (part of #1497) #1676)cve-tooling: Vulnogram reviewer comments cannot be resolved; the ledger and a courtesy reply record them (docs(security): Vulnogram review comments cannot be resolved #1840)sandbox-diagnostics: verify false-pass fixes (fix(setup): make isolated-setup-verify checks catch false passes #1808), the two new troubleshooting entries and gateway refusal hints (fix(agent-isolation): guard Linux allowAllUnixSockets with denyRead #1809, fix(agent-isolation): hint on container-gateway policy refusals #1810)adversarial-review: head/tail raw output and stderr, agy subagent handoff (fix(adversarial-review): say why an Antigravity review came back empty #1852, fix(adversarial-review): keep the end of a reviewer's raw output and its stderr #1854, adversarial-review: keep agy from handing the review to a subagent #1871)pr-management-family: inline comments carry the finding text (fix(code-review): give inline comments the finding's text, not just its rule #1853)Drift corrected
security-model-preparationnow names Appendix B after the Restructure the threat model project-wide and add SECURITY.md #1859 restructure.docs/modes.md.Separate commit:
docs/setup/marketplace.mdstill said that only setup and utilities carry a.codex-plugin/. #1676 gavemagpie-securityone too..last-syncbumped toe03b74530.Generative AI disclosure: drafted with Claude Code (Claude Opus 5); every change reviewed against the merged code.
🤖 Generated with Claude Code