Repository navigation
fix(policy): bind scoped late-cycle Requirements admission - #4
Conversation
## Summary Remove the rejected Semgrep fork producer, candidate workflow, runtime patches and fork-specific tests/plans. Retain official Semgrep 1.179.0 with MCP 1.29.0. Latest official Semgrep 1.182.0 still pins MCP 1.29.0, and normal resolution with patched MCP 1.30.0 fails. Retain the certifi 2026.10.19 correction and core 0.55.11 preparation. Per the owner's 2026-10-21 direction, add one reviewed MCP 1.29.0 exception for CVE-2026-59951 / GHSA-84m7-p3x7-pcfv through 2026-11-04 inclusive. The strict audit visibly reports WAIVED for that finding only. Other findings, versions, skipped subjects and expiry remain blocking. MCP remains vulnerable; ordinary reviewed automation does not start its server. Do not expose a stateful Streamable HTTP MCP server during the exception. Review upstream weekly and remove the exception after a verified compatible official fix. ## Validation - 54 focused security tests pass, including real frozen/installed certificate checks and exact exception/expiry rejection. - All three strict frozen audits pass with the single authorized MCP waiver. - Required local type/lint/YAML/contract/license/Bandit gates pass. Official Semgrep SAST reports zero findings. - Independent mapping and final code reviews accept the corrected scope. No introduced SpecFact review error or warning remains; existing whole-file findings have explicit dispositions. - Frozen regeneration, reproducibility, version synchronization and strict OpenSpec validation pass. Scoped smart-test passes 53 selected unit tests; this is not full-suite coverage evidence. ## Boundaries All required CI and exact-head human authority remain enforced. Signing is CI/CD only. No fork package/publisher, merge, release, promotion or related-PR closure is authorized by this change. The runtime source delta against dev changes only version strings. A later dependency-only hotfix release must start from actual published v0.55.4 commit d579970 and exclude unreleased dev runtime changes. This PR does not promote all dev commits. Issue #780 tracks implementation under #747. Baseline Z3 issue #783 remains separate. Earlier candidate results are historical, unadopted evidence in Git; they do not supply acceptance or publication authority for this scope. ## Current protected status At head 0262dbe, native Security Audit and Trusted Requirements Authority pass. Other native checks have completed successfully or are skipped. The three Requirements contexts remain red on `prior-red-proof-invalid`, despite eleven passing selected tests. Exact parameter collection is fixed. The separately authorized [draft policy contract PR](nold-ai/.github#4) records the current immutable evidence and a distinct proposed late-cycle admission class. It is documentation only, issues no admission, and changes no executable policy. Implementation, authenticated transport, distinct human admission approval and core consumer integration remain unperformed. No policy deployment or merge is authorized.
djm81
changed the title
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review this PR for defects on the applied scope as guardrail baseline for the repo |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
djm81
left a comment
djm81
left a comment
There was a problem hiding this comment.
PASS+NOTES. Independent AI technical landing review by Codex agent /root/policy4_landing_verifier, which did not author this change. Reviewed on 2026-10-21 Europe/Berlin. This is not a human governance approval or a late-cycle admission grant.
Reviewed head 78c2ba9 against main base 0787cc7. Stable base-to-head git patch-id is 4f8a6d5e03df368a05cacd91a0624e74ec87e6c6. Remote PR readback confirmed these identities and base main. Isolated detached checkout was /private/tmp/specfact-policy4-landing-verify.
Ran /private/tmp/specfact-pr782-policy-review/.venv/bin/python -m pytest -q tests from that checkout. Result was 179 passed in 1.78 seconds. Ran the actual isolated CLI root, request and decide --help successfully. BASE has no late_cycle_admission.py CLI; HEAD introduces request preparation and a refusing decision path. An actual decide invocation with a forged passed native packet, empty event, invalid revision and no token returned exit 1, stdout Refused, an audit-only Refused sidecar, and unchanged native input. The suite independently exercises undeployed revision, wrong deployed bytes, missing/edited/deleted/ambiguous/expired grants, revoked permission, head races, origin identity, additional native findings, malformed packets and explicit run-attempt binding. These mocked trust paths are not a claim of live admission.
Read the full policy, its tests, inert workflow candidate, proposal, final-mapping-acceptance.md and pin-context.md. No active .github/workflows file changes are present. The request workflow remains outside the Actions workflow directory. Verified ea0509f is an ancestor of head and its executable bytes exactly equal HEAD. Script SHA256 is a7ec16bfb3f3f4b2413cad5b105be673ace81fb17a73d71f51ea7044b831805e. The final commit changes only proposal context wording. The deployed guard requires main ancestry plus exact remote script bytes. Admission additionally requires a separate exact canonical human comment, current human write/admin permission and repeated live subject/comment checks. Native gate failure remains explicit in successful synthetic decisions.
Notes and operator limits. This verdict covers policy PR4 landing into main while preserving the pinned ancestor. It does not approve core PR784, activate or register the inert workflow, create a human authority record, sign evidence, or grant missing-RED admission. The parent collector's live final-core origin verification is separate evidence and was not independently rerun here. Policy must refuse until its pinned revision is deployed and a separate applicable grant exists. Retain the accepted single stdlib-script quality exception. Stale head/base or altered workflow provenance requires renewed verification. Forged origin, stale grant/head and extra native failures are mitigated by the enforced identity, live rechecks and strict packet contract. Rollback disables this capability and retains ordinary native refusal. Confidence is high for local CLI/refusal behavior and reviewed landing boundaries; live admission remains separately gated. No code changes, merge, deployment, signing, CI retry or human approval was performed by this verifier.
PR #782 merged with missing historical Requirements provenance. This separately requested follow-up enforces an explicit, revision-bound human admission at producer, fresh execution and final verdict. Raw native failure remains unchanged, and independent Code Review and all CI stay required. - Call the immutable live policy independently at each boundary. Audit sidecars grant no later authority. An isolated CI job attests the original native artifact. - Preserve the eleven dependency cases and three CI controls, with all fourteen selectors and protected mapping digests unchanged. - Restore all three current-run evidence transfers by exact artifact ID. The pinned download action discarded a valid requested rerun ID through name deduplication. One shared workflow program checks repository/run/head/name, SHA-256, bounded HTTPS transfer and inert ZIP extraction before exclusive publication. Existing context survives. Policy [nold-ai/.github#4](nold-ai/.github#4) was owner-approved and deployed. Genuine fresh origin verification then exposed a literal synthetic-merge ID refusal despite identical signed tree/ancestry. Reviewed correction [nold-ai/.github#5](nold-ai/.github#5) has green CI and 264 passing policy tests. Core pins its immutable revision, but the candidate remains inactive pending explicit owner approval for protected deployment. Its new path requires both valid signed identities, the exact reviewed full tree and identical ordered base/head parents, while retaining actual source attestation. Fresh exact authority and separate missing-RED admission follow deployed-policy verification. Previous grants cannot transfer. Validation includes 179 policy tests, 114 focused core tests, independent security review with eight additional hostile probe groups, genuine live exact-ID transfers through the final program, and normal commit hooks. The required local smart-test gate passed its 111 selected tests. Full lint, YAML, pinned workflow lint, strict OpenSpec and unchanged mapping/plan checks pass. New test code has zero review findings; seven precisely scoped diagnostics in unchanged existing functions have independently verified baseline exceptions documented in [TDD evidence](https://github.com/nold-ai/specfact-cli/blob/c73a9d6d3809ac763edb4eeacb7ad4e2d082e38d/openspec/changes/isolate-semgrep-security-runtime/TDD_EVIDENCE.md). Final-head CI is running. Scope is CI, tests and issue #780 specifications. Official packages, certifi 2026.10.19, core 0.55.11 and the reviewed MCP exception through 4 November 2026 remain as merged. Signing and attestation generation are CI/CD-only. Core merging and any further protected deployment require owner approval. A future dependency-only release starts from published v0.55.4 and excludes unrelated dev runtime changes. This PR publishes no release.
Why
PR #782 merged with missing historical Requirements provenance. This implements the owner's requested, separate human admission for core follow-up #784, preserving the failed native proof.
What changed
Scope
Tradeoffs
One stdlib-only executable avoids a second trusted download/import mechanism. The three core boundaries independently evaluate live authority; audit sidecars carry no authority.
Blast Radius
Ordinary native success bypasses admission. Every exceptional input fails closed until protected deployment and separate exact-subject approval. Rollback restores refusal and preserves native evidence.
Verification
Core #784 pins implementation commit ea0509f. Protected deployment must retain that commit as an ancestor of main. A squash or rebase merge would require a new core pin and renewed exact-head approvals. The dormant request-preparation workflow does not need activation for the three runtime evaluators.