KeiSeiKit-1.0/_capabilities/output/merge-result/text.md at 0c814736ffdd8d8fa975d85f2aad7002740c606e

Parfii-bot 5f7a5b2639 fix(wave18): 8 HIGH audit findings closed + three-role pipeline actually built

47 crates, 801 tests green (up from 771 at v0.34.0). Wave 18 audit
found 8 HIGH findings across architect/critic/security/validator. All
closed. Three-role pipeline REBUILT after validator discovered Wave 16
commit was a half-commit (files claimed but never tracked).

## A. Three-role pipeline (REBUILD — was missing from v0.33.0 despite
      CHANGELOG claim)

Files validator flagged absent: _roles/auditor.toml + merger.toml,
4 _capabilities/{policy/git-ops-scope,output/verdict,output/merge-result,
verify/fork-audit}/text.md, kei-spawn/src/{pipeline,precedent}.rs,
pipeline_smoke.rs + pipeline_unit.rs tests. ALL NOW REAL (verified by
git log --all and `ls`).

- auditor role: claude-subagent-type=critic, handoff=[merger]
- merger role: git-ops scope, claude-subagent-type=infra-implementer,
  leaf (empty handoff)
- 5 capability text.md (+ capability.toml for each) defining contracts
- kei-spawn pipeline.rs (171 LOC): pipeline_from_role, derive_steps,
  emit_pipeline_json, scaffold_downstream_tasks
- kei-spawn precedent.rs (118 LOC): env-gated advisory shell-out
- --pipeline flag on spawn subcommand
- +11 tests (pipeline_smoke + pipeline_unit)

## B. kei-fork — 4 HIGH fixes (Critic F1+F7a, Security #3+#4)

- `git add -A` → explicit path list from ls-untracked + ls-modified,
  with exclusion filter for .DONE / .KEI_FORK_META.toml / _archive/ /
  _forks/. No more merge bleed. +1 regression test.
- create() rollback: on write_meta or ledger_fork failure, worktree
  + branch cleaned. +1 test via KEI_FORK_FORCE_LEDGER_FAIL=1.
- worktree_add arg injection: added `--` sentinel + is_safe_refname()
  validator (refuses dash-leading, NUL, ..). +3 tests.
- PATH hijack: KEI_FORK_GIT_BIN env override for all Command::new(git).
  +1 test.

## C. kei-spawn — 2 HIGH fixes (Security #1+#2)

- HTTP body unbounded DoS: MAX_BODY_BYTES=10MiB + content-length
  pre-check + streamed cap (io::Read::take) for chunked encoding.
  +2 feature-gated tests.
- PATH hijack: KEI_LEDGER_BIN env override already existed at
  ledger_sh.rs:15; documented precedence + added 4 regression tests
  locking the 3-tier lookup order.

## D. kei-ledger-sign — 1 HIGH fix (Security #2)

- save_keypair atomic POSIX open(2) O_CREAT|O_EXCL + mode 0o600 +
  rename(2) into place. No race window where key is world-readable.
  +2 tests.

## E. spawn_from_task rollback (Critic F7b)

- register_in_ledger helper: on ledger fork failure, rollback_task_dir
  before error propagation. +1 test spawn_rolls_back_task_dir_on_ledger_fail.

## Audit summary

- architect: GO conditional (taxonomy 19% — defer)
- critic: HIGH closed, MEDIUM debt logged
- security: 4 HIGH closed; MEDIUM (tar symlink, watcher symlink) tracked
- validator: CHANGELOG no longer lies — three-role pipeline is real
- patent-compliance: GO / LOW risk unchanged

All 8 HIGH blockers from Wave 18 consolidated audit → GREEN.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-23 20:54:59 +08:00

1.7 KiB

Raw Blame History

Merge result output

Your return report MUST contain the following fields, each on its own line, with exact key names:

COMMIT_SHA: — the SHA-1 of the new commit on main (40 hex chars). If the merge produced multiple commits (e.g. squash vs merge-commit), report the tip of main after your work.
LEDGER_STATUS: — exactly one of done, failed, or still-running. Reflects the ledger row for the fork you merged.
FORK_AGENT_ID: — the agent-id of the writer whose fork you merged (or attempted to merge).
MERGE_METHOD: — exactly one of merge-no-ff, squash, rebase, or cherry-pick. Whatever strategy you actually used.

Skeleton — success:

COMMIT_SHA: e8b37c92d4a1f0...
LEDGER_STATUS: done
FORK_AGENT_ID: ag-edit-local-20260423-142033
MERGE_METHOD: merge-no-ff

blockers: none
next: none

Skeleton — failure (fork diff did not apply):

COMMIT_SHA: <none>
LEDGER_STATUS: failed
FORK_AGENT_ID: ag-edit-local-20260423-142033
MERGE_METHOD: merge-no-ff

blockers:
  - "3-way merge reported conflict in src/pipeline.rs line 42"
next: "Orchestrator re-spawns writer with conflict hint"

Rules:

COMMIT_SHA: — 40 hex chars on success, literal string <none> on failure. Do not paraphrase ("merged but no sha recorded" → FAIL).
LEDGER_STATUS: — must match the actual ledger row. Cross-check with kei-ledger show <agent-id> before emitting.
Merger MUST NOT close the ledger row if the merge failed; the still-running state is legitimate when the merge is deferred.
If you had to rescue a half-merged state (merge --abort + retry), document the rescue in blockers: with the original sha + rescue sha, even on eventual success.

1.7 KiB Raw Blame History

Merge result output

1.7 KiB

Raw Blame History