Repository navigation
Conversation
Record clean, schema-surplus, and schema-refusal inspection outcomes without changing schema-stage validation rules. Signed-off-by: Srinivasa Consultants <78673153+dinakarjs@users.noreply.github.com>
|
Security impact / review gate: this changes runtime audit producers and activates the existing catalog schema stage on gateway responses, so please retain the two-independent-maintainer-approval requirement ruled on #764. No audit format, signing/hash-chain algorithm, historical records, key handling or approval gate changes. The new refusal reason excludes response content. Inspected result labels persist through egress refusal/fault; redacted output is the same byte sequence authorized, hashed and returned. Please resolve the explicit required-field semantics question in the PR description before this leaves draft: the existing stage denies a missing required field while the prose spec says it passes. The helper is unchanged here, and the paired software controls document the gateway before/after consequence. 2477 unit tests passed (6 skipped); Ruff, strict mypy, Bandit and four independent source-bypass controls passed. This is synthetic software evidence, not complete schema/TRACE conformance or live-provider/hardware acceptance. |
|
🟡 Contributor Check: MEDIUM
Automated check by AgenTrust Contributor Check. |
github-actions
Bot
added
the
needs-review:MEDIUM
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
noah-ing
left a comment
noah-ing
left a comment
There was a problem hiding this comment.
Reviewed draft head 66b2f88b3ba80088c9fea8a1f7a94799343f34a2. The new live gateway call can treat schema-invalid tool output as allowed under response-inspection settings. The focused suite passes (73 tests), but paired negative controls and a 45-case property sweep expose the missed denial boundary. I added the reproductions and affected lines to the existing private response-inspection advisory so maintainers can fix and regression-test this without publishing the bypass details. Please keep this draft unmerged until every mode enforces core schema validity, the nested response contract is resolved, and the two independent maintainer approvals required by #764 are obtained; the present automated gate checks only one.
| # Scanner sanitization is not schema-surplus stripping. Validate the | ||
| # scanned content and bind only the bytes that may reach egress. | ||
| _finalization.failure_stage = "response_schema" | ||
| schema_result, schema_bytes = _stage2_schema_validation(agt_result.encode(), entry) |
There was a problem hiding this comment.
This makes the existing inspection helper part of the live gateway path. Its current behavior can allow output that fails the declared schema. Please fix and regression-test the denial boundary before wiring it into a mergeable release; the confidential advisory contains the concrete cases.
|
@carloshvp keeping this draft unmerged following the current-head changes-requested review. I will not publish the private reproduction details here. The existing advisory is not visible in my current repository advisory listing, and the review does not include its URL. Please coordinate access/a direct private link to the existing response-inspection report, or a maintainer-controlled private fix branch, so the exact reported cases and correction can be assessed there. A local unpublished candidate and regression packet are now prepared: 2,509 unit tests passed, 6 skipped; 32 additional controls; targeted Ruff/mypy/whitespace checks pass. Two in-memory guard removals cause 9 and 1 assertion failures. This candidate has not been checked against the exact private report and is not a claim that the review is resolved. It can be handed off through the approved private destination without exposing its code/tests here. The public head remains |
|
@dinakarjs added you to GHSA-jjxv-w6fg-x8vm, the response-inspection advisory noah-ing's review refers to. The reproductions are there. Please put your candidate fix and regression tests on that advisory's private fork. This PR stays a draft until the fix lands there. |
Preserve both changelog entries and existing upstream history. Retain the original bounded audit producer wiring. The private repair is not imported; draft, security, schema-contract and two-independent-maintainer-approval holds remain. Prepared with OpenAI Codex. Signed-off-by: Srinivasa Dinakar Jainti <dinakarjs@gmail.com>
Conflict refresh — 1 November 2026
The branch now includes current main 1fbc1b2, preserving its history and both changelog entries. CHANGELOG.md was the only textual merge conflict; the proxy merged automatically and was reviewed against main. Head:
f1095387cf0f6ccd146480bf67934155c92807a5; tree:815c5fd87be8720d599382efbdbd8564ce1c9c83equals the locally tested tree.This is branch maintenance, not completion of the security repair. The PR remains draft. Existing changes-requested reviews, the private advisory process, the unresolved schema contract and the requirement for two independent maintainer approvals remain in force. No private repair code, tests or advisory details are imported by this refresh.
Existing implementation
Wire the catalog schema stage after native response scanning and retain its result on terminal audit writes. Inspected clean responses emit
pass, actual schema surplus removal emitssurplus_stripped, and schema refusal emitsschema_violation. Scanner sanitization and log-only surplus emitpass; calls with no response inspection retain null. Session-startn/a, the audit vocabulary and historical records are unchanged. Allowed redaction hashes and authorizes returned bytes, and completed inspection results survive later egress refusals/faults.This implements the bounded producer contract requested in #764. It does not establish full schema conformance. The schema helper is unchanged. The existing public question remains: the helper denies missing required fields while the prose specification says they pass. Maintainers must resolve that contract alongside the security review before readiness or merge.
Validation on this refresh
Tests use synthetic/mocked upstream and scanner seams. They do not resolve the outstanding private review, supply independent approval, establish live-provider/hardware acceptance or authorize release. Prior source-bypass evidence remains historical; no new mutation sweep is claimed for a changelog conflict resolution. Current-head hosted checks and independent review remain required.
Prepared with OpenAI Codex; DCO-signed. No upstream PR merge, private disclosure or release performed.
Hosted follow-through — 1 November 2026
All returned PR-triggered technical workflows now completed successfully on
f1095387cf0f6ccd146480bf67934155c92807a5: CI (six Python 3.11–3.13 Linux/Windows matrix jobs and governance), ClusterFuzzLite, CodeQL, Confinement reference and the pull-request Docker workflow. The inapplicable Dependabot auto-merge workflow was skipped. CI evidence; fuzzing evidence.This closes the hosted technical follow-through for the conflict refresh. It is not a complete branch-protection inventory or a security approval. Draft, advisory, schema-contract and two-independent-maintainer-approval holds remain.