repair(governance): enforce scoped doctoring Security Notes - #1204
repair(governance): enforce scoped doctoring Security Notes#1204seonghobae wants to merge 15 commits into
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='5066b03ae60ca979d043b92178402392e3edabdf'
base='314ddeae7b775a4957594b599358c8255617eb2e'
echo '=== commit identity ==='
git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
echo '=== exact name-status delta ==='
git diff --name-status "$base" "$head"
echo '=== exact patch ==='
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
scripts/checks/verify_security_notes.py \
scripts/checks/test_verify_security_notes.py \
scripts/harness/quickcheck.sh
echo '=== checker structure at exact head ==='
ast-grep outline scripts/checks/verify_security_notes.py --items all || true
echo '=== checker content at exact head ==='
cat -n scripts/checks/verify_security_notes.py
echo '=== test structure at exact head ==='
ast-grep outline scripts/checks/test_verify_security_notes.py --items all || true
echo '=== test content at exact head ==='
cat -n scripts/checks/test_verify_security_notes.py
echo '=== quickcheck relevant calls ==='
rg -n -C 8 'verify_security_notes|test_verify_security_notes|Security Notes' scripts/harness/quickcheck.sh
echo '=== baseline checker content ==='
git show "$base:scripts/checks/verify_security_notes.py" | cat -nLength of output: 22554 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='5066b03ae60ca979d043b92178402392e3edabdf'
base='314ddeae7b775a4957594b599358c8255617eb2e'
echo '=== registry target in exact head tree ==='
git ls-tree -r --name-only "$head" -- docs/doctoring | sed -n '/sidebar-disabled-tooltips\.md$/p'
echo '=== doctoring markdown files and Security Notes/trust-boundary headings ==='
if [ -d docs/doctoring ]; then
fd -e md . docs/doctoring -x sh -c '
printf "\n--- %s ---\n" "$1"
rg -n -i -C 2 "^[[:space:]]{0,3}#{1,6}[[:space:]]+.*(security notes|trust.boundary)|security notes|trust.boundary" "$1" || true
' sh {}
fi
echo '=== plan files containing References and Security Notes/subsection headings ==='
if [ -d docs/plans ]; then
fd -e md . docs/plans -x sh -c '
if rg -qi "^[[:space:]]{0,3}##[[:space:]]+references|security notes" "$1"; then
printf "\n--- %s ---\n" "$1"
rg -n -i -C 2 "^[[:space:]]{0,3}#{1,6}[[:space:]]+(security notes|references|attack surface|trust boundary|mitigations|test points|realistic threats|remaining risk)" "$1" || true
fi
' sh {}
fi
echo '=== all direct checker calls and imports ==='
rg -n -C 3 '(find_security_notes_violations|security_notes_section|verify_security_notes\.py)' \
-g '*.py' -g '*.sh' -g '*.md' .
echo '=== baseline-vs-head function body, whitespace visible ==='
git diff --no-ext-diff --word-diff=porcelain "$base" "$head" -- scripts/checks/verify_security_notes.py
echo '=== test cases that exercise heading/body placement ==='
rg -n -C 4 '(Security Notes|trust.boundary|References|Approaches considered|Decision)' \
scripts/checks/test_verify_security_notes.pyLength of output: 31871
The source-controlled
The new quickcheck ordering is correct. It runs the policy regression immediately before the production Security Notes gate. You are interacting with an AI system. |
|
@coderabbitai review Fresh review request for exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='47595c4c7bae985068878ba2a816e9e978da6a73'
base='314ddeae7b775a4957594b599358c8255617eb2e'
echo '=== commit identity and ancestry ==='
git cat-file -t "$head"
git cat-file -t "$base"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
echo '=== exact delta ==='
git diff --name-status "$base" "$head"
git diff --no-ext-diff --unified=100 "$base" "$head" -- \
scripts/checks/verify_security_notes.py \
scripts/checks/test_verify_security_notes.py \
scripts/harness/quickcheck.sh
echo '=== exact-head checker outline and contents ==='
ast-grep outline scripts/checks/verify_security_notes.py --items all || true
cat -n scripts/checks/verify_security_notes.py
echo '=== protected-base checker contents ==='
git show "$base:scripts/checks/verify_security_notes.py" | cat -n
echo '=== exact-head regression tests ==='
ast-grep outline scripts/checks/test_verify_security_notes.py --items all || true
cat -n scripts/checks/test_verify_security_notes.py
echo '=== quickcheck integration ==='
rg -n -C 8 'test_verify_security_notes|verify_security_notes' scripts/harness/quickcheck.sh
echo '=== registered doctoring target existence in exact head ==='
git ls-tree -r --name-only "$head" -- docs/doctoring | rg -n '(^|/)sidebar-disabled-tooltips\.md$' || true
echo '=== all direct checker references in exact head ==='
rg -n -C 3 '\b(find_security_notes_violations|security_notes_section|DOCTORING_SECURITY_NOTES_REQUIRED)\b' \
scripts/checks scripts/harnessLength of output: 29266
I found one blocking issue.
The registry is a source-controlled, explicit scope marker. The The plan parser at Lines 30-47 and the six required subsection strings are unchanged from the protected base. The existing |
|
@coderabbitai review Fresh exact-head review for |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='7ec499bae3ea4016f57fc58c4816edad4b8d8d8d8f'
base='314ddeae7b775a4957594b599358c8255617eb2e'
# Correct the requested head variable from the authoritative user-provided hash.
head='7ec499bae3ea4016f57fc58c4816edad4b8d8d8f'
echo '=== commit identity and ancestry ==='
git cat-file -t "$head"
git cat-file -t "$base"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'protected_base_is_ancestor=yes'
echo '=== exact protected-base delta ==='
git diff --name-status "$base" "$head"
git diff --no-ext-diff --unified=120 "$base" "$head" -- \
scripts/checks/verify_security_notes.py \
scripts/checks/test_verify_security_notes.py \
scripts/harness/quickcheck.sh
echo '=== exact-head checker structure and content ==='
ast-grep outline scripts/checks/verify_security_notes.py --items all || true
cat -n scripts/checks/verify_security_notes.py
echo '=== protected-base checker content ==='
git show "$base:scripts/checks/verify_security_notes.py" | cat -n
echo '=== exact-head regression test structure and content ==='
ast-grep outline scripts/checks/test_verify_security_notes.py --items all || true
cat -n scripts/checks/test_verify_security_notes.py
echo '=== exact-head quickcheck integration ==='
rg -n -C 10 '\btest_verify_security_notes\.py\b|\bverify_security_notes\.py\b' \
scripts/harness/quickcheck.sh
echo '=== registered file presence in exact-head tree ==='
git ls-tree -r --name-only "$head" -- docs/doctoring | \
rg '(^|/)sidebar-disabled-tooltips\.md$' || true
echo '=== checker call sites and policy constants ==='
rg -n -C 4 \
'\b(DOCTORING_SECURITY_NOTES_REQUIRED|security_notes_section|doctoring_security_notes_section|find_security_notes_violations)\b' \
scripts/checks scripts/harness
echo '=== markdown fence and heading-related test fixtures ==='
rg -n -i -C 6 \
'(fence|```|Security Notes|trust.boundary|References|Attack surface|Realistic threats|Remaining risk)' \
scripts/checks/test_verify_security_notes.pyLength of output: 37866
I found one blocking issue.
The other requested properties are correct:
|
|
@coderabbitai review Fresh exact-head review for |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='58d76aab5dd614375758af3c143a79e8c78712e8'
base='314ddeae7b775a4957594b599358c8255617eb2e'
echo '=== exact commit identity and ancestry ==='
git cat-file -t "$head"
git cat-file -t "$base"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'protected_base_is_ancestor=yes'
echo '=== exact protected-base changed-file scope ==='
git diff --name-status "$base" "$head"
echo '--- changed paths only ---'
git diff --name-only "$base" "$head"
echo '=== exact patch for stated governance files ==='
git diff --no-ext-diff --unified=120 "$base" "$head" -- \
scripts/checks/verify_security_notes.py \
scripts/checks/test_verify_security_notes.py \
scripts/harness/quickcheck.sh
echo '=== exact-head checker outline ==='
ast-grep outline scripts/checks/verify_security_notes.py --items all || true
echo '=== exact-head checker ==='
git show "$head:scripts/checks/verify_security_notes.py" | cat -n
echo '=== protected-base checker ==='
git show "$base:scripts/checks/verify_security_notes.py" | cat -n
echo '=== exact-head regression tests ==='
ast-grep outline scripts/checks/test_verify_security_notes.py --items all || true
git show "$head:scripts/checks/test_verify_security_notes.py" | cat -n
echo '=== quickcheck Security Notes ordering ==='
git show "$head:scripts/harness/quickcheck.sh" | \
rg -n -C 10 '\btest_verify_security_notes\.py\b|\bverify_security_notes\.py\b'
echo '=== registry target presence in exact-head tree ==='
git ls-tree -r --name-only "$head" -- docs/doctoring | \
rg '(^|/)sidebar-disabled-tooltips\.md$' || true
echo '=== direct checker call sites at exact head ==='
git grep -n -I -E \
'(DOCTORING_SECURITY_NOTES_REQUIRED|security_notes_section|doctoring_security_notes_section|find_security_notes_violations)' \
"$head" -- scripts/checks scripts/harness || true
echo '=== parser and fixture lines related to Markdown code and section boundaries ==='
git show "$head:scripts/checks/test_verify_security_notes.py" | \
rg -n -i -C 8 \
'(fence|indented|code block|```|Security Notes|Trust boundary|References|Attack surface|Realistic threats|Remaining risk)' || trueLength of output: 33635
I found one blocking issue.
The requested repairs are otherwise present:
|
|
@coderabbitai review Fresh exact-head review for |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='21d8856f95e93baf93511d4162438760f2238981'
base='314ddeae7b775a4957594b599358c8255617eb2e'
echo '=== exact commit identity and ancestry ==='
git cat-file -t "$head"
git cat-file -t "$base"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'protected_base_is_ancestor=yes'
echo '=== protected-base changed-file scope ==='
git diff --name-status "$base" "$head"
echo '--- changed paths ---'
git diff --name-only "$base" "$head"
echo '=== exact patch: governance files ==='
git diff --no-ext-diff --unified=120 "$base" "$head" -- \
scripts/checks/verify_security_notes.py \
scripts/checks/test_verify_security_notes.py \
scripts/harness/quickcheck.sh
echo '=== exact-head checker outline ==='
git show "$head:scripts/checks/verify_security_notes.py" > /tmp/verify_security_notes.py
ast-grep outline /tmp/verify_security_notes.py --items all || true
echo '=== exact-head checker ==='
cat -n /tmp/verify_security_notes.py
echo '=== protected-base checker ==='
git show "$base:scripts/checks/verify_security_notes.py" | cat -n
echo '=== exact-head regression tests ==='
git show "$head:scripts/checks/test_verify_security_notes.py" | cat -n
echo '=== quickcheck ordering ==='
git show "$head:scripts/harness/quickcheck.sh" | \
rg -n -C 10 '\btest_verify_security_notes\.py\b|\bverify_security_notes\.py\b'
echo '=== registered doctoring document in exact tree ==='
git ls-tree -r --name-only "$head" -- docs/doctoring | \
rg '(^|/)sidebar-disabled-tooltips\.md$' || true
echo '=== exact code-filtering and doctoring-policy locations ==='
git show "$head:scripts/checks/verify_security_notes.py" | \
rg -n -C 8 \
'(DOCTORING_SECURITY_NOTES_REQUIRED|doctoring_markdown_lines|doctoring_security_notes_section|Trust boundary|fenced|indent|path\.exists|security_notes_section)' || true
echo '=== exact RED fixtures for code blocks and trust boundary ==='
git show "$head:scripts/checks/test_verify_security_notes.py" | \
rg -n -i -C 8 \
'(fenced|indented|code block|```|Security Notes|Trust boundary|heading.only|token.only|short.fragment|narrative)' || true
echo '=== plan extractor equality after normalizing header line numbers ==='
git diff --no-ext-diff -U0 "$base" "$head" -- scripts/checks/verify_security_notes.py | \
rg -n -C 3 'security_notes_section|required_subsections|docs/plans' || trueLength of output: 43440
I found no blocking issue.
I did not execute repository code in the inspection sandbox. You are interacting with an AI system. |
|
@coderabbitai review Please review only current exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='b217087f7697dbc255cd31688ad5868fd489ee15'
base='314ddeae7b775a4957594b599358c8255617eb2e'
echo '=== exact commit identity and ancestry ==='
git cat-file -t "$head"
git cat-file -t "$base"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'protected_base_is_ancestor=yes'
echo '=== exact protected-base scope ==='
git diff --name-status "$base" "$head"
git diff --name-only "$base" "$head"
echo '=== exact governance patch ==='
git diff --no-ext-diff --unified=140 "$base" "$head" -- \
scripts/checks/verify_security_notes.py \
scripts/checks/test_verify_security_notes.py \
scripts/harness/quickcheck.sh
echo '=== exact-head checker structure ==='
git show "$head:scripts/checks/verify_security_notes.py" > /tmp/verify_security_notes.py
ast-grep outline /tmp/verify_security_notes.py --items all || true
echo '=== exact-head checker ==='
cat -n /tmp/verify_security_notes.py
echo '=== protected-base checker ==='
git show "$base:scripts/checks/verify_security_notes.py" | cat -n
echo '=== exact-head test module ==='
git show "$head:scripts/checks/test_verify_security_notes.py" | cat -n
echo '=== quickcheck Security Notes ordering ==='
git show "$head:scripts/harness/quickcheck.sh" | \
rg -n -C 10 '\btest_verify_security_notes\.py\b|\bverify_security_notes\.py\b'
echo '=== registered doctoring document in exact tree ==='
git ls-tree -r --name-only "$head" -- docs/doctoring | \
rg '(^|/)sidebar-disabled-tooltips\.md$' || true
echo '=== exact Markdown filtering and HTML-comment fixtures ==='
git show "$head:scripts/checks/verify_security_notes.py" | \
rg -n -i -C 12 \
'(doctoring_markdown_lines|comment|fenced|indent|Security Notes|Trust boundary|path\.exists|security_notes_section)' || true
git show "$head:scripts/checks/test_verify_security_notes.py" | \
rg -n -i -C 10 \
'(html|comment|multiline|fenced|indented|Security Notes|Trust boundary|References)' || true
echo '=== plan extractor diff check ==='
git diff --no-ext-diff -U0 "$base" "$head" -- scripts/checks/verify_security_notes.py | \
rg -n -C 4 '(security_notes_section|required_subsections|docs/plans)' || true
echo '=== direct policy references in exact tree ==='
git grep -n -I -E \
'(DOCTORING_SECURITY_NOTES_REQUIRED|doctoring_markdown_lines|doctoring_security_notes_section|find_security_notes_violations)' \
"$head" -- scripts/checks scripts/harness || trueLength of output: 52247
I found no actionable issue.
I performed static inspection only. I did not treat queued or non-terminal checks as passing evidence. You are interacting with an AI system. |
seonghobae
added
maintenance
priority: high
ChatGPT Codex Connector
1 participant
Governance finding
Closes #1203 only when this change reaches protected
develop.Protected base is
develop@314ddeae7b775a4957594b599358c8255617eb2e; current exact head isb217087f7697dbc255cd31688ad5868fd489ee15. The canonicalverify_security_notes.pygate previously enforced the six-subsection Security Notes contract only fordocs/plans/*.md. That allowed reviewed trust-boundary evidence indocs/doctoring/sidebar-disabled-tooltips.mdto disappear while quickcheck still reported the Security Notes gate as passing.This is repository-policy ownership, not Tooltip product ownership. #1193 source/docs are not copied into this branch.
RED → GREEN contract
The checker keeps the existing plan parser and six-subsection policy unchanged and adds an explicit opt-in registry for doctoring evidence whose reviewed trust-boundary statement must survive regeneration. The first registered document is
sidebar-disabled-tooltips.md.A registered doctoring document is enforced only when it exists in the checked tree. This lets the generic policy reach protected
developbefore dependent #1193 without consuming a mutable sibling. Once present, the document must contain an explicit level-two## Security Notessection, an explicit level-three### Trust boundarysubsection, substantive prose, and evidence that is part of rendered Markdown rather than hidden/example content.The focused regression pins these fail-closed cases:
Security Notes/trust-boundary text outside the governed section;A structured rendered
### Trust boundarywith substantive prose remains GREEN. Quickcheck runs this regression immediately before the production Security Notes gate.Review/finding repairs
CodeRabbit review of predecessor
5066b03ae60ca979d043b92178402392e3edabdfidentified two valid P1 defects: baretrust boundarytext could satisfy doctoring validation, and plan extraction accidentally stopped at## References. Both were repaired without weakening the protected-base plan policy.Review of later exact
58d76aab5dd614375758af3c143a79e8c78712e8found another valid P1: fenced or indented code could impersonate the doctoring headings.doctoring_markdown_lines()now excludes both before heading/body extraction.Fresh inspection of exact
21d8856f95e93baf93511d4162438760f2238981found one more equivalent rendering bypass: multiline HTML comments were still returned as ordinary Markdown lines, so a hidden## Security Notes→### Trust boundaryblock could satisfy the gate while rendering no governance evidence. REDb160bb354748dab4ef03308f64772d73aa71e930added the hidden-comment regression. GREENb217087f7697dbc255cd31688ad5868fd489ee15strips HTML-comment spans before doctoring heading/body admission while leaving fenced-code state authoritative. No product/UI/runtime trust boundary changed.Fresh exact-head CodeRabbit review of
b217087f...found no actionable issue and specifically re-checked HTML-comment exclusion, the focused hidden-comment regression, fenced/indented-code exclusion, and unchanged plan-policy behavior. This is review evidence, not a formal GitHubAPPROVED, and does not replace protected-branch acceptance.Hosted exact-head evidence
Hosted
cirun34570305066,ci / build-and-testjob103171867553reached current exactb217087f...and proves the new governance slice itself is GREEN before the repository's pre-existing formatter prerequisite stops the lane:scripts/checks/test_verify_security_notes.py: 5 tests, all PASS.ruff check src tests: PASS.ruff format --check src testsreports onlytests/test_supply_chain_policy.py(1 file would be reformatted, 89 files already formatted).tests/test_supply_chain_policy.pyis not #1204 ownership. It is the known #1176 formatter prerequisite. This PR therefore does not copy, rewrite, or bypass that file; #1176 must reach protected ancestry first, after which #1204 is ordinarily reconciled and revalidated. SBOM forb217087f...is already SUCCESS; remaining current-head workflows are accepted only when terminal-success, never from queued/pending state.Scope
Exact branch delta over protected
developremains three repository-governance files only:scripts/checks/verify_security_notes.pyscripts/checks/test_verify_security_notes.pyscripts/harness/quickcheck.shThe
quickcheck.shdelta is one additive test invocation. Active Distribution PR #1126 also owns release-related quickcheck changes on a separate Draft lineage; this PR does not copy or depend on that mutable branch. If either owner reaches protected ancestry first, the other must ordinarily reconcile and preserve both independent checks rather than overwrite or force-rebase.No Tooltip/UI source, doctoring product document, dependency, lockfile, model, audio/MIR code, release workflow, required status, or gate threshold is changed.
Security Notes
The registry is the durable machine-readable scope marker for selected doctoring trust-boundary evidence. It deliberately does not impose the plan template's six subsections on every doctoring note. Registered files not yet present are ignored until their owning product document reaches the checked tree; when present, the required headings and substantive trust-boundary statement must exist in rendered Markdown, not fenced/indented code or HTML comments. Removing a registry entry is therefore a review-visible policy change, not an agent-memory or
.julesside effect.Keep Draft until #1176 reaches protected ancestry, this branch is ordinarily reconciled, one unchanged exact head has applicable repository/central checks terminal-success, valid review findings are exhausted, and ordinary protected-branch acceptance plus qualifying independent non-author review are available. No self-approval, bypass, force-push, destructive rebase, no-op retrigger, synthetic status, or gate weakening.