Repository navigation
Conversation
E2E tests are runningAuthorization passed for this commit. See the E2E Tests workflow for results. |
PR Summary by QodoPublish a generated sandbox environment contract manifest
AI Description
Diagram
High-Level Assessment
Files changed (22)
|
|
🤖 Finished Review · ✅ Success · Started 8:17 PM UTC · Completed 8:39 PM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $4.84 |
Code Review by Qodo
1. The manifest ADR mixes decisions
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| Publish the sandbox environment contract as a generated, committed manifest | ||
| at [`sandbox-env.json`](../normative/sandbox-env/v1/sandbox-env.json), with | ||
| schema and category semantics in its [README](../normative/sandbox-env/v1/README.md). | ||
| A collector derives it by executing the production emitters — the |
There was a problem hiding this comment.
1. The manifest adr mixes decisions 📜 Skill insight ⚙ Maintainability
ADR 0146's Decision section separately decides to publish a generated manifest, derive it from production emitters with a golden test, version it by release tag, and impose PR and nightly validation cadence. These are multiple distinct architectural decisions recorded in one ADR instead of one decision with supporting implementation details.
Agent Prompt
## Issue description
ADR 0146 contains several distinct decisions in one Decision section: the manifest publication model, collector and golden-test enforcement, tag-based versioning, and cross-repository validation cadence.
## Fix Focus Areas
- docs/ADRs/0146-sandbox-environment-contract-manifest.md[49-67]
## Recommended Fix
Refocus ADR 0146 on one primary decision about the sandbox environment contract. Move implementation mechanics and validation cadence into supporting documentation, or create separate ADRs for materially independent versioning and cross-repository validation decisions, with explicit references between them.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| The sandbox environment surface — what the runner injects into the sandbox and | ||
| reserves from harness override — was hand-synced in three descriptions, none | ||
| machine-checked: the `reservedSandboxKeys` sync note in `internal/cli/run.go`, | ||
| the agents repo's `SANDBOX_RUNTIME_VARS` allowlist in |
There was a problem hiding this comment.
3. The adr repeats the drift problem 📜 Skill insight ⚙ Maintainability
The Context section reproduces several paragraphs of the environment-drift incident instead of giving a brief summary with links to the existing problem documentation. Readers must maintain duplicated details about allowlists, released runners, and the drift-control gap across the ADR and threat-model material.
Agent Prompt
## Issue description
The ADR Context section restates detailed problem and incident material that belongs in the linked problem documentation, increasing the risk that the ADR and problem docs drift apart.
## Fix Focus Areas
- docs/ADRs/0146-sandbox-environment-contract-manifest.md[22-41]
## Recommended Fix
Replace the detailed incident narrative with a concise summary of the motivation and links to the relevant problem documents and incident references. Keep implementation details and the full threat-model discussion in their canonical documents.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| "harness_delivered": { | ||
| "ANTHROPIC_VERTEX_PROJECT_ID": { | ||
| "provenance": "fullsend agent new Vertex scaffold (internal/agentnew); the fleet delivers the same variables through env/gcp-vertex.env in fullsend-ai/agents", |
There was a problem hiding this comment.
7. Fleet exports fail manifest validation 🔗 Cross-repo conflict ≡ Correctness
harness_delivered is derived only from the Vertex scaffold, so it omits GOOGLE_CLOUD_PROJECT and ANTHROPIC_DEFAULT_SONNET_MODEL even though the agents fleet delivers both through env/gcp-vertex.env. When agents switches its reachability check to this manifest, references to those fleet-delivered variables will appear unreachable.
Agent Prompt
## Issue description
The published harness-delivered inventory covers only the Vertex scaffold, while the agents fleet delivers additional variables through its shared environment file.
## Fix Focus Areas
- docs/normative/sandbox-env/v1/sandbox-env.json[43-60]
- internal/cli/env_manifest_collector_test.go[428-443]
- docs/normative/sandbox-env/v1/README.md[103-111]
- /cross_repos/agents/env/gcp-vertex.env[1-17]
## Recommended Fix
Either include the additional fleet-delivered names with accurate provenance and a cross-repo check, or narrow the documented inventory explicitly to scaffold-delivered variables so consumers do not treat it as an exhaustive fleet contract.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| "pi": [ | ||
| "JITI_FS_CACHE", | ||
| "PI_CODING_AGENT_DIR", |
There was a problem hiding this comment.
8. Pi exports fail manifest validation 🔗 Cross-repo conflict ≡ Correctness
collectSandboxEnvManifest populates runtime_specific only from EnvExports(), omitting launch-command exports such as FULLSEND_RUNTIME for codex and pi, and FULLSEND_PI_MANIFEST, GOOGLE_CLOUD_PROJECT, and GOOGLE_CLOUD_LOCATION for pi. When the agents-repo reachability gate checks skills against the manifest, it can reject references to variables the runner supplies, including $FULLSEND_RUNTIME in bootstrap-guided skills and GOOGLE_CLOUD_LOCATION for pi on Vertex; gateway-route exports are also absent from the inventory.
Agent Prompt
## Issue description
The sandbox env manifest collects runtime `EnvExports()` but omits variables exported by runtime launch commands, so its published inventory can under-report variables available to skills. Account for codex and pi launch exports and gateway-route exports, including their applicable gates.
## Fix Focus Areas
- internal/cli/env_manifest_collector_test.go[332-337]
- internal/runtime/codex_run.go[400-409]
- internal/runtime/pi_run.go[498-521]
- docs/normative/sandbox-env/v1/sandbox-env.json[25-41]
- docs/normative/sandbox-env/v1/README.md[87-101]
- /cross_repos/agents/LOCAL.md[280-285]
## Recommended Fix
Extend collection and its assertions to include export names from each production runtime's launch command alongside `EnvExports()`, using the runtime launch builders as the source where practical. Include `FULLSEND_RUNTIME`, the applicable pi exports, and gateway-only variables with accurate gate descriptions, preserving the Vertex gate for `GOOGLE_CLOUD_PROJECT`. Regenerate the manifest with `-update` and keep its README and the agents documentation aligned with what the inventory covers.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
|
<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, high churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, high churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (2)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, high churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (3)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, high churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (4)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, high churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (5)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, high churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (6)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, elevated churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (7)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, elevated churn across touched documentation files, and full alignment with an active linked issue. Previous run (8)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, elevated churn across touched documentation files, and full alignment with an active linked issue. Previous run (9)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, elevated churn and multi-author contention across touched documentation files, and full alignment with an active linked issue. Previous run (10)<!-- fullsend:risk-assessment --> DetailsAdditive contract manifest package and tests with no protected path or dependency changes, high churn across touched doc files, and well-scoped issue alignment yield a moderate risk score. Previous run (11)<!-- fullsend:risk-assessment --> DetailsAdditive contract manifest package and tests with no protected path or dependency changes, high churn across touched doc files, and well-scoped issue alignment yield a moderate risk score. Previous run (12)<!-- fullsend:risk-assessment --> DetailsAdditive contract manifest package and tests with no protected path or dependency changes, high churn across touched doc files, and well-scoped issue alignment yield a moderate risk score. Previous run (13)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, elevated churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (14)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, elevated churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (15)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, offset by elevated churn and coupling on existing documentation files, and full alignment with an active linked issue. Previous run (16)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, elevated churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (17)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, high churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (18)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, high churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (19)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, elevated churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (20)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, elevated churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (21)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, elevated churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (22)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, elevated churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (23)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, elevated churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (24)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, elevated churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (25)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, high churn and change coupling across touched documentation files, and full alignment with an active linked issue. Previous run (26)<!-- fullsend:risk-assessment --> DetailsLarge additive change with no protected paths or workflow edits, high churn and change coupling across touched documentation files, and full alignment with an active linked issue. |
ReviewFindingsMedium
Low
Earlier findings
Next steps:
Previous run<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJyZXF1ZXN0LWNoYW5nZXMiLCJmaW5kaW5ncyI6W3sic2V2ZXJpdHkiOiJtZWRpdW0iLCJjYXRlZ29yeSI6ImxvZ2ljLWVycm9yIiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfMmU4MGE3ZTdlNjE0ZGU2MSIsImxpbmUiOjM5NSwiYWN0aW9uYWJsZSI6dHJ1ZX0seyJzZXZlcml0eSI6Im1lZGl1bSIsImNhdGVnb3J5IjoiYXBpLWNvbnRyYWN0IiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfMWJiZDI3MmFiNTFiODRmMyIsImxpbmUiOjYyLCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoibWVkaXVtIiwiY2F0ZWdvcnkiOiJ0ZXN0LWluYWRlcXVhdGUiLCJmaWxlIjoiaW50ZXJuYWwvY2xpL2Vudl9tYW5pZmVzdF9jb2xsZWN0b3JfdGVzdC5nbyIsImlkIjoiZl83Y2ZjMzM5NTIyNWQyMjQwIiwibGluZSI6NzIsImFjdGlvbmFibGUiOnRydWV9LHsic2V2ZXJpdHkiOiJtZWRpdW0iLCJjYXRlZ29yeSI6InVuZGVyLWVuZ2luZWVyaW5nIiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfMzNiNTE4NzVkNzg4OTljNCIsImxpbmUiOjQwMiwiYWN0aW9uYWJsZSI6ZmFsc2V9LHsic2V2ZXJpdHkiOiJtZWRpdW0iLCJjYXRlZ29yeSI6ImFyY2hpdGVjdHVyYWwtY29uZmxpY3QiLCJmaWxlIjoiZG9jcy9BRFJzLzAxNDYtc2FuZGJveC1lbnZpcm9ubWVudC1jb250cmFjdC1tYW5pZmVzdC5tZCIsImlkIjoiZl9jNjUwMTQxODRmMTMxY2Q2IiwibGluZSI6MSwiYWN0aW9uYWJsZSI6ZmFsc2V9LHsic2V2ZXJpdHkiOiJsb3ciLCJjYXRlZ29yeSI6ImluY29ycmVjdC1kb2MiLCJmaWxlIjoiZG9jcy9ub3JtYXRpdmUvc2FuZGJveC1lbnYvdjEvUkVBRE1FLm1kIiwiaWQiOiJmXzljZTE0ZmE2ZjE3NjI5ZDMiLCJsaW5lIjoxMDEsImFjdGlvbmFibGUiOnRydWV9LHsic2V2ZXJpdHkiOiJsb3ciLCJjYXRlZ29yeSI6ImluY29ycmVjdC1kb2MiLCJmaWxlIjoiZG9jcy9jb250cmlidXRpbmcvcnVudGltZS1pbXBsZW1lbnRhdGlvbi5tZCIsImlkIjoiZl8xMDRiMjhjMmExODMzZjMzIiwibGluZSI6NjcsImFjdGlvbmFibGUiOnRydWV9LHsic2V2ZXJpdHkiOiJsb3ciLCJjYXRlZ29yeSI6InBhdHRlcm4taW5jb25zaXN0ZW5jeSIsImZpbGUiOiJkb2NzL2NvbnRyaWJ1dGluZy9ydW50aW1lLWltcGxlbWVudGF0aW9uLm1kIiwiaWQiOiJmXzBjZTg0N2QwNWQ5NjExOTIiLCJsaW5lIjo2NCwiYWN0aW9uYWJsZSI6dHJ1ZX0seyJzZXZlcml0eSI6ImxvdyIsImNhdGVnb3J5IjoiZG9jLXN0eWxlIiwiZmlsZSI6ImRvY3Mvbm9ybWF0aXZlL3NhbmRib3gtZW52L3YxL1JFQURNRS5tZCIsImlkIjoiZl84OTg0MjNhYTVlOGNlNWRlIiwibGluZSI6MTIxLCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoibG93IiwiY2F0ZWdvcnkiOiJkZXNpZ24tc21lbGwiLCJmaWxlIjoiaW50ZXJuYWwvY2xpL2Vudl9tYW5pZmVzdF9jb2xsZWN0b3JfdGVzdC5nbyIsImlkIjoiZl8xMjZjMzIyZTQxZTg2OWZkIiwibGluZSI6Mjk3LCJhY3Rpb25hYmxlIjpmYWxzZX0seyJzZXZlcml0eSI6ImxvdyIsImNhdGVnb3J5IjoiY29tcGxleGl0eS1yYXRpbyIsImZpbGUiOiJpbnRlcm5hbC9jbGkvZW52X21hbmlmZXN0X2NvbGxlY3Rvcl90ZXN0LmdvIiwiaWQiOiJmXzlhZjA2MGY5ZjU3OTMwMjEiLCJsaW5lIjo1NjUsImFjdGlvbmFibGUiOmZhbHNlfSx7InNldmVyaXR5IjoibG93IiwiY2F0ZWdvcnkiOiJvdmVyLWVuZ2luZWVyaW5nIiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfN2YyYzkwZDY4ZjM3NzE1NSIsImxpbmUiOjg4LCJhY3Rpb25hYmxlIjpmYWxzZX0seyJzZXZlcml0eSI6ImluZm8iLCJjYXRlZ29yeSI6ImluY29tcGxldGUtZG9jIiwiZmlsZSI6ImRvY3MvcnVudGltZXMvY29kZXgubWQiLCJpZCI6ImZfOGUxYTNjN2E5ZDkyMzU5YiIsImFjdGlvbmFibGUiOmZhbHNlfSx7InNldmVyaXR5IjoiaW5mbyIsImNhdGVnb3J5IjoiaW5jb21wbGV0ZS1kb2MiLCJmaWxlIjoiZG9jcy9ydW50aW1lcy9vcGVuY29kZS5tZCIsImlkIjoiZl8xZmUyNTIxMDhiZmMxYWI5IiwiYWN0aW9uYWJsZSI6ZmFsc2V9LHsic2V2ZXJpdHkiOiJpbmZvIiwiY2F0ZWdvcnkiOiJiYWNrd2FyZC1pbmNvbXBhdGlibGUiLCJmaWxlIjoiZG9jcy9ub3JtYXRpdmUvc2FuZGJveC1lbnYvdjEvUkVBRE1FLm1kIiwiaWQiOiJmXzRmMGI2ZTc1YjE5MTEwMGIiLCJsaW5lIjoyMDgsImFjdGlvbmFibGUiOmZhbHNlfSx7InNldmVyaXR5IjoiaW5mbyIsImNhdGVnb3J5IjoibWlzc2luZy1kZXByZWNhdGlvbiIsImZpbGUiOiJkb2NzL25vcm1hdGl2ZS9zYW5kYm94LWVudi92MS9SRUFETUUubWQiLCJpZCI6ImZfOThlYjVlNjMzYzQ4ZDc0NiIsImxpbmUiOjEyNiwiYWN0aW9uYWJsZSI6ZmFsc2V9LHsic2V2ZXJpdHkiOiJpbmZvIiwiY2F0ZWdvcnkiOiJkb2Mtc3R5bGUiLCJmaWxlIjoiZG9jcy9wcm9ibGVtcy9hZ2VudC1pbmZyYXN0cnVjdHVyZS5tZCIsImlkIjoiZl8xODQ5YmQ1ODI1YjM1ZmI5IiwibGluZSI6MTI0LCJhY3Rpb25hYmxlIjpmYWxzZX0seyJzZXZlcml0eSI6ImluZm8iLCJjYXRlZ29yeSI6ImFwaS1zaGFwZSIsImZpbGUiOiJpbnRlcm5hbC9lbnZtYW5pZmVzdC9idWlsZGVyLmdvIiwiaWQiOiJmX2FmYzQ3ZGEwNTFkYmI4YmYiLCJsaW5lIjo3NiwiYWN0aW9uYWJsZSI6ZmFsc2V9LHsic2V2ZXJpdHkiOiJtZWRpdW0iLCJjYXRlZ29yeSI6ImFwaS1jb250cmFjdCIsImZpbGUiOiJpbnRlcm5hbC9jbGkvZW52X21hbmlmZXN0X2NvbGxlY3Rvcl90ZXN0LmdvIiwiaWQiOiJmXzYxMGQ5ODZlZDJlZWE3YjgiLCJsaW5lIjo2MiwiYWN0aW9uYWJsZSI6dHJ1ZX1dLCJkaXNwb3NpdGlvbnMiOlt7ImlkIjoiZl8yZTgwYTdlN2U2MTRkZTYxIiwic3RhdHVzIjoib3BlbiJ9LHsiaWQiOiJmXzFiYmQyNzJhYjUxYjg0ZjMiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfN2NmYzMzOTUyMjVkMjI0MCIsInN0YXR1cyI6Im9wZW4ifSx7ImlkIjoiZl85Y2UxNGZhNmYxNzYyOWQzIiwic3RhdHVzIjoib3BlbiJ9LHsiaWQiOiJmXzEwNGIyOGMyYTE4MzNmMzMiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfMGNlODQ3ZDA1ZDk2MTE5MiIsInN0YXR1cyI6Im9wZW4ifSx7ImlkIjoiZl84OTg0MjNhYTVlOGNlNWRlIiwic3RhdHVzIjoib3BlbiJ9LHsiaWQiOiJmXzhlMWEzYzdhOWQ5MjM1OWIiLCJzdGF0dXMiOiJyZWNsYXNzaWZpZWQifSx7ImlkIjoiZl8xZmUyNTIxMDhiZmMxYWI5Iiwic3RhdHVzIjoicmVjbGFzc2lmaWVkIn0seyJpZCI6ImZfNGYwYjZlNzViMTkxMTAwYiIsInN0YXR1cyI6InJlY2xhc3NpZmllZCJ9LHsiaWQiOiJmXzk4ZWI1ZTYzM2M0OGQ3NDYiLCJzdGF0dXMiOiJyZWNsYXNzaWZpZWQifSx7ImlkIjoiZl8xODQ5YmQ1ODI1YjM1ZmI5Iiwic3RhdHVzIjoicmVjbGFzc2lmaWVkIn0seyJpZCI6ImZfYWZjNDdkYTA1MWRiYjhiZiIsInN0YXR1cyI6InJlY2xhc3NpZmllZCJ9LHsiaWQiOiJmXzYxMGQ5ODZlZDJlZWE3YjgiLCJzdGF0dXMiOiJyZXNvbHZlZF9ieV9jaGFuZ2UifV19 --> ReviewFindingsMedium
Low
Earlier findings
Next steps:
Previous run (2)<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJyZXF1ZXN0LWNoYW5nZXMiLCJmaW5kaW5ncyI6W3sic2V2ZXJpdHkiOiJtZWRpdW0iLCJjYXRlZ29yeSI6ImxvZ2ljLWVycm9yIiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfMmU4MGE3ZTdlNjE0ZGU2MSIsImxpbmUiOjM5NSwiYWN0aW9uYWJsZSI6dHJ1ZX0seyJzZXZlcml0eSI6Im1lZGl1bSIsImNhdGVnb3J5IjoiYXBpLWNvbnRyYWN0IiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfMWJiZDI3MmFiNTFiODRmMyIsImxpbmUiOjYyLCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoibWVkaXVtIiwiY2F0ZWdvcnkiOiJ0ZXN0LWluYWRlcXVhdGUiLCJmaWxlIjoiaW50ZXJuYWwvY2xpL2Vudl9tYW5pZmVzdF9jb2xsZWN0b3JfdGVzdC5nbyIsImlkIjoiZl83Y2ZjMzM5NTIyNWQyMjQwIiwibGluZSI6NzIsImFjdGlvbmFibGUiOnRydWV9LHsic2V2ZXJpdHkiOiJsb3ciLCJjYXRlZ29yeSI6ImluY29ycmVjdC1kb2MiLCJmaWxlIjoiZG9jcy9ub3JtYXRpdmUvc2FuZGJveC1lbnYvdjEvUkVBRE1FLm1kIiwiaWQiOiJmXzljZTE0ZmE2ZjE3NjI5ZDMiLCJsaW5lIjoxMDEsImFjdGlvbmFibGUiOnRydWV9LHsic2V2ZXJpdHkiOiJsb3ciLCJjYXRlZ29yeSI6ImluY29ycmVjdC1kb2MiLCJmaWxlIjoiZG9jcy9jb250cmlidXRpbmcvcnVudGltZS1pbXBsZW1lbnRhdGlvbi5tZCIsImlkIjoiZl8xMDRiMjhjMmExODMzZjMzIiwibGluZSI6NjgsImFjdGlvbmFibGUiOnRydWV9LHsic2V2ZXJpdHkiOiJsb3ciLCJjYXRlZ29yeSI6InBhdHRlcm4taW5jb25zaXN0ZW5jeSIsImZpbGUiOiJkb2NzL2NvbnRyaWJ1dGluZy9ydW50aW1lLWltcGxlbWVudGF0aW9uLm1kIiwiaWQiOiJmXzBjZTg0N2QwNWQ5NjExOTIiLCJsaW5lIjo2NCwiYWN0aW9uYWJsZSI6dHJ1ZX0seyJzZXZlcml0eSI6ImxvdyIsImNhdGVnb3J5IjoiZG9jLXN0eWxlIiwiZmlsZSI6ImRvY3Mvbm9ybWF0aXZlL3NhbmRib3gtZW52L3YxL1JFQURNRS5tZCIsImlkIjoiZl84OTg0MjNhYTVlOGNlNWRlIiwibGluZSI6MTIxLCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoiaW5mbyIsImNhdGVnb3J5IjoiaW5jb21wbGV0ZS1kb2MiLCJmaWxlIjoiZG9jcy9ydW50aW1lcy9jb2RleC5tZCIsImlkIjoiZl84ZTFhM2M3YTlkOTIzNTliIiwiYWN0aW9uYWJsZSI6ZmFsc2V9LHsic2V2ZXJpdHkiOiJpbmZvIiwiY2F0ZWdvcnkiOiJpbmNvbXBsZXRlLWRvYyIsImZpbGUiOiJkb2NzL3J1bnRpbWVzL29wZW5jb2RlLm1kIiwiaWQiOiJmXzFmZTI1MjEwOGJmYzFhYjkiLCJhY3Rpb25hYmxlIjpmYWxzZX0seyJzZXZlcml0eSI6ImluZm8iLCJjYXRlZ29yeSI6ImJhY2t3YXJkLWluY29tcGF0aWJsZSIsImZpbGUiOiJkb2NzL25vcm1hdGl2ZS9zYW5kYm94LWVudi92MS9SRUFETUUubWQiLCJpZCI6ImZfNGYwYjZlNzViMTkxMTAwYiIsImxpbmUiOjIwOCwiYWN0aW9uYWJsZSI6ZmFsc2V9LHsic2V2ZXJpdHkiOiJpbmZvIiwiY2F0ZWdvcnkiOiJtaXNzaW5nLWRlcHJlY2F0aW9uIiwiZmlsZSI6ImRvY3Mvbm9ybWF0aXZlL3NhbmRib3gtZW52L3YxL1JFQURNRS5tZCIsImlkIjoiZl85OGViNWU2MzNjNDhkNzQ2IiwibGluZSI6MTI2LCJhY3Rpb25hYmxlIjpmYWxzZX0seyJzZXZlcml0eSI6ImluZm8iLCJjYXRlZ29yeSI6ImRvYy1zdHlsZSIsImZpbGUiOiJkb2NzL3Byb2JsZW1zL2FnZW50LWluZnJhc3RydWN0dXJlLm1kIiwiaWQiOiJmXzE4NDliZDU4MjViMzVmYjkiLCJsaW5lIjoxMjQsImFjdGlvbmFibGUiOmZhbHNlfSx7InNldmVyaXR5IjoiaW5mbyIsImNhdGVnb3J5IjoiYXBpLXNoYXBlIiwiZmlsZSI6ImludGVybmFsL2Vudm1hbmlmZXN0L2J1aWxkZXIuZ28iLCJpZCI6ImZfYWZjNDdkYTA1MWRiYjhiZiIsImxpbmUiOjc2LCJhY3Rpb25hYmxlIjpmYWxzZX0seyJzZXZlcml0eSI6Im1lZGl1bSIsImNhdGVnb3J5IjoiYXBpLWNvbnRyYWN0IiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfNjEwZDk4NmVkMmVlYTdiOCIsImxpbmUiOjYyLCJhY3Rpb25hYmxlIjp0cnVlfV0sImRpc3Bvc2l0aW9ucyI6W3siaWQiOiJmXzJlODBhN2U3ZTYxNGRlNjEiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfMWJiZDI3MmFiNTFiODRmMyIsInN0YXR1cyI6Im9wZW4ifSx7ImlkIjoiZl83Y2ZjMzM5NTIyNWQyMjQwIiwic3RhdHVzIjoib3BlbiJ9LHsiaWQiOiJmXzljZTE0ZmE2ZjE3NjI5ZDMiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfMTA0YjI4YzJhMTgzM2YzMyIsInN0YXR1cyI6Im9wZW4ifSx7ImlkIjoiZl8wY2U4NDdkMDVkOTYxMTkyIiwic3RhdHVzIjoib3BlbiJ9LHsiaWQiOiJmXzg5ODQyM2FhNWU4Y2U1ZGUiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfOGUxYTNjN2E5ZDkyMzU5YiIsInN0YXR1cyI6InJlY2xhc3NpZmllZCJ9LHsiaWQiOiJmXzFmZTI1MjEwOGJmYzFhYjkiLCJzdGF0dXMiOiJyZWNsYXNzaWZpZWQifSx7ImlkIjoiZl80ZjBiNmU3NWIxOTExMDBiIiwic3RhdHVzIjoicmVjbGFzc2lmaWVkIn0seyJpZCI6ImZfOThlYjVlNjMzYzQ4ZDc0NiIsInN0YXR1cyI6InJlY2xhc3NpZmllZCJ9LHsiaWQiOiJmXzE4NDliZDU4MjViMzVmYjkiLCJzdGF0dXMiOiJyZWNsYXNzaWZpZWQifSx7ImlkIjoiZl9hZmM0N2RhMDUxZGJiOGJmIiwic3RhdHVzIjoicmVjbGFzc2lmaWVkIn0seyJpZCI6ImZfNjEwZDk4NmVkMmVlYTdiOCIsInN0YXR1cyI6InJlc29sdmVkX2J5X2NoYW5nZSJ9XX0= --> ReviewFindingsMedium
Low
Next steps:
Previous run (3)<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJyZXF1ZXN0LWNoYW5nZXMiLCJmaW5kaW5ncyI6W3sic2V2ZXJpdHkiOiJtZWRpdW0iLCJjYXRlZ29yeSI6ImxvZ2ljLWVycm9yIiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfMmU4MGE3ZTdlNjE0ZGU2MSIsImxpbmUiOjM5NSwiYWN0aW9uYWJsZSI6dHJ1ZX0seyJzZXZlcml0eSI6Im1lZGl1bSIsImNhdGVnb3J5IjoiYXBpLWNvbnRyYWN0IiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfMWJiZDI3MmFiNTFiODRmMyIsImxpbmUiOjYyLCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoibWVkaXVtIiwiY2F0ZWdvcnkiOiJ0ZXN0LWluYWRlcXVhdGUiLCJmaWxlIjoiaW50ZXJuYWwvY2xpL2Vudl9tYW5pZmVzdF9jb2xsZWN0b3JfdGVzdC5nbyIsImlkIjoiZl83Y2ZjMzM5NTIyNWQyMjQwIiwibGluZSI6NzIsImFjdGlvbmFibGUiOnRydWV9LHsic2V2ZXJpdHkiOiJsb3ciLCJjYXRlZ29yeSI6ImluY29ycmVjdC1kb2MiLCJmaWxlIjoiZG9jcy9ub3JtYXRpdmUvc2FuZGJveC1lbnYvdjEvUkVBRE1FLm1kIiwiaWQiOiJmXzljZTE0ZmE2ZjE3NjI5ZDMiLCJsaW5lIjoxMDAsImFjdGlvbmFibGUiOnRydWV9LHsic2V2ZXJpdHkiOiJsb3ciLCJjYXRlZ29yeSI6ImluY29ycmVjdC1kb2MiLCJmaWxlIjoiZG9jcy9jb250cmlidXRpbmcvcnVudGltZS1pbXBsZW1lbnRhdGlvbi5tZCIsImlkIjoiZl8xMDRiMjhjMmExODMzZjMzIiwibGluZSI6NjgsImFjdGlvbmFibGUiOnRydWV9LHsic2V2ZXJpdHkiOiJsb3ciLCJjYXRlZ29yeSI6InBhdHRlcm4taW5jb25zaXN0ZW5jeSIsImZpbGUiOiJkb2NzL2NvbnRyaWJ1dGluZy9ydW50aW1lLWltcGxlbWVudGF0aW9uLm1kIiwiaWQiOiJmXzBjZTg0N2QwNWQ5NjExOTIiLCJsaW5lIjo2NCwiYWN0aW9uYWJsZSI6dHJ1ZX0seyJzZXZlcml0eSI6ImxvdyIsImNhdGVnb3J5IjoiZG9jLXN0eWxlIiwiZmlsZSI6ImRvY3Mvbm9ybWF0aXZlL3NhbmRib3gtZW52L3YxL1JFQURNRS5tZCIsImlkIjoiZl84OTg0MjNhYTVlOGNlNWRlIiwibGluZSI6MTIxLCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoiaW5mbyIsImNhdGVnb3J5IjoiaW5jb21wbGV0ZS1kb2MiLCJmaWxlIjoiZG9jcy9ydW50aW1lcy9jb2RleC5tZCIsImlkIjoiZl84ZTFhM2M3YTlkOTIzNTliIiwiYWN0aW9uYWJsZSI6ZmFsc2V9LHsic2V2ZXJpdHkiOiJpbmZvIiwiY2F0ZWdvcnkiOiJpbmNvbXBsZXRlLWRvYyIsImZpbGUiOiJkb2NzL3J1bnRpbWVzL29wZW5jb2RlLm1kIiwiaWQiOiJmXzFmZTI1MjEwOGJmYzFhYjkiLCJhY3Rpb25hYmxlIjpmYWxzZX0seyJzZXZlcml0eSI6ImluZm8iLCJjYXRlZ29yeSI6ImJhY2t3YXJkLWluY29tcGF0aWJsZSIsImZpbGUiOiJkb2NzL25vcm1hdGl2ZS9zYW5kYm94LWVudi92MS9SRUFETUUubWQiLCJpZCI6ImZfNGYwYjZlNzViMTkxMTAwYiIsImxpbmUiOjIwOCwiYWN0aW9uYWJsZSI6ZmFsc2V9LHsic2V2ZXJpdHkiOiJpbmZvIiwiY2F0ZWdvcnkiOiJtaXNzaW5nLWRlcHJlY2F0aW9uIiwiZmlsZSI6ImRvY3Mvbm9ybWF0aXZlL3NhbmRib3gtZW52L3YxL1JFQURNRS5tZCIsImlkIjoiZl85OGViNWU2MzNjNDhkNzQ2IiwibGluZSI6MTI2LCJhY3Rpb25hYmxlIjpmYWxzZX0seyJzZXZlcml0eSI6ImluZm8iLCJjYXRlZ29yeSI6ImRvYy1zdHlsZSIsImZpbGUiOiJkb2NzL3Byb2JsZW1zL2FnZW50LWluZnJhc3RydWN0dXJlLm1kIiwiaWQiOiJmXzE4NDliZDU4MjViMzVmYjkiLCJsaW5lIjoxMjQsImFjdGlvbmFibGUiOmZhbHNlfSx7InNldmVyaXR5IjoiaW5mbyIsImNhdGVnb3J5IjoiYXBpLXNoYXBlIiwiZmlsZSI6ImludGVybmFsL2Vudm1hbmlmZXN0L2J1aWxkZXIuZ28iLCJpZCI6ImZfYWZjNDdkYTA1MWRiYjhiZiIsImxpbmUiOjc2LCJhY3Rpb25hYmxlIjpmYWxzZX0seyJzZXZlcml0eSI6Im1lZGl1bSIsImNhdGVnb3J5IjoiYXBpLWNvbnRyYWN0IiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfNjEwZDk4NmVkMmVlYTdiOCIsImxpbmUiOjYyLCJhY3Rpb25hYmxlIjp0cnVlfV0sImRpc3Bvc2l0aW9ucyI6W3siaWQiOiJmXzJlODBhN2U3ZTYxNGRlNjEiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfMWJiZDI3MmFiNTFiODRmMyIsInN0YXR1cyI6Im9wZW4ifSx7ImlkIjoiZl83Y2ZjMzM5NTIyNWQyMjQwIiwic3RhdHVzIjoib3BlbiJ9LHsiaWQiOiJmXzljZTE0ZmE2ZjE3NjI5ZDMiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfMTA0YjI4YzJhMTgzM2YzMyIsInN0YXR1cyI6Im9wZW4ifSx7ImlkIjoiZl8wY2U4NDdkMDVkOTYxMTkyIiwic3RhdHVzIjoib3BlbiJ9LHsiaWQiOiJmXzg5ODQyM2FhNWU4Y2U1ZGUiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfOGUxYTNjN2E5ZDkyMzU5YiIsInN0YXR1cyI6InJlY2xhc3NpZmllZCJ9LHsiaWQiOiJmXzFmZTI1MjEwOGJmYzFhYjkiLCJzdGF0dXMiOiJyZWNsYXNzaWZpZWQifSx7ImlkIjoiZl80ZjBiNmU3NWIxOTExMDBiIiwic3RhdHVzIjoicmVjbGFzc2lmaWVkIn0seyJpZCI6ImZfOThlYjVlNjMzYzQ4ZDc0NiIsInN0YXR1cyI6InJlY2xhc3NpZmllZCJ9LHsiaWQiOiJmXzE4NDliZDU4MjViMzVmYjkiLCJzdGF0dXMiOiJyZWNsYXNzaWZpZWQifSx7ImlkIjoiZl9hZmM0N2RhMDUxZGJiOGJmIiwic3RhdHVzIjoicmVjbGFzc2lmaWVkIn0seyJpZCI6ImZfNjEwZDk4NmVkMmVlYTdiOCIsInN0YXR1cyI6InJlc29sdmVkX2J5X2NoYW5nZSJ9XX0= --> ReviewFindingsMedium
Low
Earlier findings
Next steps:
Previous run (4)<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJyZXF1ZXN0LWNoYW5nZXMiLCJmaW5kaW5ncyI6W3sic2V2ZXJpdHkiOiJtZWRpdW0iLCJjYXRlZ29yeSI6ImxvZ2ljLWVycm9yIiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfMmU4MGE3ZTdlNjE0ZGU2MSIsImxpbmUiOjM5NSwiYWN0aW9uYWJsZSI6dHJ1ZX0seyJzZXZlcml0eSI6Im1lZGl1bSIsImNhdGVnb3J5IjoiYXBpLWNvbnRyYWN0IiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfMWJiZDI3MmFiNTFiODRmMyIsImxpbmUiOjYyLCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoibWVkaXVtIiwiY2F0ZWdvcnkiOiJ0ZXN0LWluYWRlcXVhdGUiLCJmaWxlIjoiaW50ZXJuYWwvY2xpL2Vudl9tYW5pZmVzdF9jb2xsZWN0b3JfdGVzdC5nbyIsImlkIjoiZl83Y2ZjMzM5NTIyNWQyMjQwIiwibGluZSI6NzIsImFjdGlvbmFibGUiOnRydWV9LHsic2V2ZXJpdHkiOiJsb3ciLCJjYXRlZ29yeSI6ImluY29ycmVjdC1kb2MiLCJmaWxlIjoiZG9jcy9ub3JtYXRpdmUvc2FuZGJveC1lbnYvdjEvUkVBRE1FLm1kIiwiaWQiOiJmXzljZTE0ZmE2ZjE3NjI5ZDMiLCJsaW5lIjoxMDAsImFjdGlvbmFibGUiOnRydWV9LHsic2V2ZXJpdHkiOiJsb3ciLCJjYXRlZ29yeSI6ImluY29ycmVjdC1kb2MiLCJmaWxlIjoiZG9jcy9jb250cmlidXRpbmcvcnVudGltZS1pbXBsZW1lbnRhdGlvbi5tZCIsImlkIjoiZl8xMDRiMjhjMmExODMzZjMzIiwibGluZSI6NjgsImFjdGlvbmFibGUiOnRydWV9LHsic2V2ZXJpdHkiOiJsb3ciLCJjYXRlZ29yeSI6InBhdHRlcm4taW5jb25zaXN0ZW5jeSIsImZpbGUiOiJkb2NzL2NvbnRyaWJ1dGluZy9ydW50aW1lLWltcGxlbWVudGF0aW9uLm1kIiwiaWQiOiJmXzBjZTg0N2QwNWQ5NjExOTIiLCJsaW5lIjo2NCwiYWN0aW9uYWJsZSI6dHJ1ZX0seyJzZXZlcml0eSI6ImxvdyIsImNhdGVnb3J5IjoiZG9jLXN0eWxlIiwiZmlsZSI6ImRvY3Mvbm9ybWF0aXZlL3NhbmRib3gtZW52L3YxL1JFQURNRS5tZCIsImlkIjoiZl84OTg0MjNhYTVlOGNlNWRlIiwibGluZSI6MTIxLCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoiaW5mbyIsImNhdGVnb3J5IjoiaW5jb21wbGV0ZS1kb2MiLCJmaWxlIjoiZG9jcy9ydW50aW1lcy9jb2RleC5tZCIsImlkIjoiZl84ZTFhM2M3YTlkOTIzNTliIiwiYWN0aW9uYWJsZSI6ZmFsc2V9LHsic2V2ZXJpdHkiOiJpbmZvIiwiY2F0ZWdvcnkiOiJpbmNvbXBsZXRlLWRvYyIsImZpbGUiOiJkb2NzL3J1bnRpbWVzL29wZW5jb2RlLm1kIiwiaWQiOiJmXzFmZTI1MjEwOGJmYzFhYjkiLCJhY3Rpb25hYmxlIjpmYWxzZX0seyJzZXZlcml0eSI6ImluZm8iLCJjYXRlZ29yeSI6ImJhY2t3YXJkLWluY29tcGF0aWJsZSIsImZpbGUiOiJkb2NzL25vcm1hdGl2ZS9zYW5kYm94LWVudi92MS9SRUFETUUubWQiLCJpZCI6ImZfNGYwYjZlNzViMTkxMTAwYiIsImxpbmUiOjIwOCwiYWN0aW9uYWJsZSI6ZmFsc2V9LHsic2V2ZXJpdHkiOiJpbmZvIiwiY2F0ZWdvcnkiOiJtaXNzaW5nLWRlcHJlY2F0aW9uIiwiZmlsZSI6ImRvY3Mvbm9ybWF0aXZlL3NhbmRib3gtZW52L3YxL1JFQURNRS5tZCIsImlkIjoiZl85OGViNWU2MzNjNDhkNzQ2IiwibGluZSI6MTI2LCJhY3Rpb25hYmxlIjpmYWxzZX0seyJzZXZlcml0eSI6ImluZm8iLCJjYXRlZ29yeSI6ImRvYy1zdHlsZSIsImZpbGUiOiJkb2NzL3Byb2JsZW1zL2FnZW50LWluZnJhc3RydWN0dXJlLm1kIiwiaWQiOiJmXzE4NDliZDU4MjViMzVmYjkiLCJsaW5lIjoxMjQsImFjdGlvbmFibGUiOmZhbHNlfSx7InNldmVyaXR5IjoiaW5mbyIsImNhdGVnb3J5IjoiYXBpLXNoYXBlIiwiZmlsZSI6ImludGVybmFsL2Vudm1hbmlmZXN0L2J1aWxkZXIuZ28iLCJpZCI6ImZfYWZjNDdkYTA1MWRiYjhiZiIsImxpbmUiOjc2LCJhY3Rpb25hYmxlIjpmYWxzZX0seyJzZXZlcml0eSI6Im1lZGl1bSIsImNhdGVnb3J5IjoiYXBpLWNvbnRyYWN0IiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfNjEwZDk4NmVkMmVlYTdiOCIsImxpbmUiOjYyLCJhY3Rpb25hYmxlIjp0cnVlfV0sImRpc3Bvc2l0aW9ucyI6W3siaWQiOiJmXzJlODBhN2U3ZTYxNGRlNjEiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfMWJiZDI3MmFiNTFiODRmMyIsInN0YXR1cyI6Im9wZW4ifSx7ImlkIjoiZl83Y2ZjMzM5NTIyNWQyMjQwIiwic3RhdHVzIjoib3BlbiJ9LHsiaWQiOiJmXzg5ODQyM2FhNWU4Y2U1ZGUiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfMGNlODQ3ZDA1ZDk2MTE5MiIsInN0YXR1cyI6Im9wZW4ifSx7ImlkIjoiZl8xMDRiMjhjMmExODMzZjMzIiwic3RhdHVzIjoib3BlbiJ9LHsiaWQiOiJmXzljZTE0ZmE2ZjE3NjI5ZDMiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfOGUxYTNjN2E5ZDkyMzU5YiIsInN0YXR1cyI6InJlY2xhc3NpZmllZCJ9LHsiaWQiOiJmXzFmZTI1MjEwOGJmYzFhYjkiLCJzdGF0dXMiOiJyZWNsYXNzaWZpZWQifSx7ImlkIjoiZl80ZjBiNmU3NWIxOTExMDBiIiwic3RhdHVzIjoicmVjbGFzc2lmaWVkIn0seyJpZCI6ImZfOThlYjVlNjMzYzQ4ZDc0NiIsInN0YXR1cyI6InJlY2xhc3NpZmllZCJ9LHsiaWQiOiJmXzE4NDliZDU4MjViMzVmYjkiLCJzdGF0dXMiOiJyZWNsYXNzaWZpZWQifSx7ImlkIjoiZl9hZmM0N2RhMDUxZGJiOGJmIiwic3RhdHVzIjoicmVjbGFzc2lmaWVkIn0seyJpZCI6ImZfNjEwZDk4NmVkMmVlYTdiOCIsInN0YXR1cyI6InJlc29sdmVkX2J5X2NoYW5nZSJ9XX0= --> ReviewFindingsMedium
Low
Earlier findings
Next steps:
Previous run (5)<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJyZXF1ZXN0LWNoYW5nZXMiLCJmaW5kaW5ncyI6W3sic2V2ZXJpdHkiOiJtZWRpdW0iLCJjYXRlZ29yeSI6ImxvZ2ljLWVycm9yIiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfMmU4MGE3ZTdlNjE0ZGU2MSIsImxpbmUiOjM5NSwiYWN0aW9uYWJsZSI6dHJ1ZX0seyJzZXZlcml0eSI6Im1lZGl1bSIsImNhdGVnb3J5IjoiYXBpLWNvbnRyYWN0IiwiZmlsZSI6ImludGVybmFsL2NsaS9lbnZfbWFuaWZlc3RfY29sbGVjdG9yX3Rlc3QuZ28iLCJpZCI6ImZfMWJiZDI3MmFiNTFiODRmMyIsImxpbmUiOjYyLCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoibWVkaXVtIiwiY2F0ZWdvcnkiOiJ0ZXN0LWluYWRlcXVhdGUiLCJmaWxlIjoiaW50ZXJuYWwvY2xpL2Vudl9tYW5pZmVzdF9jb2xsZWN0b3JfdGVzdC5nbyIsImlkIjoiZl83Y2ZjMzM5NTIyNWQyMjQwIiwibGluZSI6NzIsImFjdGlvbmFibGUiOnRydWV9LHsic2V2ZXJpdHkiOiJsb3ciLCJjYXRlZ29yeSI6ImRvYy1zdHlsZSIsImZpbGUiOiJkb2NzL25vcm1hdGl2ZS9zYW5kYm94LWVudi92MS9SRUFETUUubWQiLCJpZCI6ImZfODk4NDIzYWE1ZThjZTVkZSIsImxpbmUiOjEyMSwiYWN0aW9uYWJsZSI6dHJ1ZX0seyJzZXZlcml0eSI6ImxvdyIsImNhdGVnb3J5IjoicGF0dGVybi1pbmNvbnNpc3RlbmN5IiwiZmlsZSI6ImRvY3MvY29udHJpYnV0aW5nL3J1bnRpbWUtaW1wbGVtZW50YXRpb24ubWQiLCJpZCI6ImZfMGNlODQ3ZDA1ZDk2MTE5MiIsImxpbmUiOjY0LCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoibG93IiwiY2F0ZWdvcnkiOiJpbmNvcnJlY3QtZG9jIiwiZmlsZSI6ImRvY3MvY29udHJpYnV0aW5nL3J1bnRpbWUtaW1wbGVtZW50YXRpb24ubWQiLCJpZCI6ImZfMTA0YjI4YzJhMTgzM2YzMyIsImxpbmUiOjY4LCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoibG93IiwiY2F0ZWdvcnkiOiJpbmNvcnJlY3QtZG9jIiwiZmlsZSI6ImRvY3Mvbm9ybWF0aXZlL3NhbmRib3gtZW52L3YxL1JFQURNRS5tZCIsImlkIjoiZl85Y2UxNGZhNmYxNzYyOWQzIiwibGluZSI6MTAwLCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoibG93IiwiY2F0ZWdvcnkiOiJpbmNvbXBsZXRlLWRvYyIsImZpbGUiOiJkb2NzL3J1bnRpbWVzL2NvZGV4Lm1kIiwiaWQiOiJmXzhlMWEzYzdhOWQ5MjM1OWIiLCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoibG93IiwiY2F0ZWdvcnkiOiJpbmNvbXBsZXRlLWRvYyIsImZpbGUiOiJkb2NzL3J1bnRpbWVzL29wZW5jb2RlLm1kIiwiaWQiOiJmXzFmZTI1MjEwOGJmYzFhYjkiLCJhY3Rpb25hYmxlIjp0cnVlfSx7InNldmVyaXR5IjoibG93IiwiY2F0ZWdvcnkiOiJiYWNrd2FyZC1pbmNvbXBhdGlibGUiLCJmaWxlIjoiZG9jcy9ub3JtYXRpdmUvc2FuZGJveC1lbnYvdjEvUkVBRE1FLm1kIiwiaWQiOiJmXzRmMGI2ZTc1YjE5MTEwMGIiLCJsaW5lIjoyMDgsImFjdGlvbmFibGUiOmZhbHNlfSx7InNldmVyaXR5IjoiaW5mbyIsImNhdGVnb3J5IjoibWlzc2luZy1kZXByZWNhdGlvbiIsImZpbGUiOiJkb2NzL25vcm1hdGl2ZS9zYW5kYm94LWVudi92MS9SRUFETUUubWQiLCJpZCI6ImZfOThlYjVlNjMzYzQ4ZDc0NiIsImxpbmUiOjEyNiwiYWN0aW9uYWJsZSI6ZmFsc2V9LHsic2V2ZXJpdHkiOiJpbmZvIiwiY2F0ZWdvcnkiOiJkb2Mtc3R5bGUiLCJmaWxlIjoiZG9jcy9wcm9ibGVtcy9hZ2VudC1pbmZyYXN0cnVjdHVyZS5tZCIsImlkIjoiZl8xODQ5YmQ1ODI1YjM1ZmI5IiwibGluZSI6MTI0LCJhY3Rpb25hYmxlIjpmYWxzZX0seyJzZXZlcml0eSI6ImluZm8iLCJjYXRlZ29yeSI6ImFwaS1zaGFwZSIsImZpbGUiOiJpbnRlcm5hbC9lbnZtYW5pZmVzdC9idWlsZGVyLmdvIiwiaWQiOiJmX2FmYzQ3ZGEwNTFkYmI4YmYiLCJsaW5lIjo3NiwiYWN0aW9uYWJsZSI6ZmFsc2V9LHsic2V2ZXJpdHkiOiJtZWRpdW0iLCJjYXRlZ29yeSI6ImFwaS1jb250cmFjdCIsImZpbGUiOiJpbnRlcm5hbC9jbGkvZW52X21hbmlmZXN0X2NvbGxlY3Rvcl90ZXN0LmdvIiwiaWQiOiJmXzYxMGQ5ODZlZDJlZWE3YjgiLCJsaW5lIjo2MiwiYWN0aW9uYWJsZSI6dHJ1ZX1dLCJkaXNwb3NpdGlvbnMiOlt7ImlkIjoiZl8yZTgwYTdlN2U2MTRkZTYxIiwic3RhdHVzIjoib3BlbiJ9LHsiaWQiOiJmXzFiYmQyNzJhYjUxYjg0ZjMiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfN2NmYzMzOTUyMjVkMjI0MCIsInN0YXR1cyI6Im9wZW4ifSx7ImlkIjoiZl84OTg0MjNhYTVlOGNlNWRlIiwic3RhdHVzIjoib3BlbiJ9LHsiaWQiOiJmXzBjZTg0N2QwNWQ5NjExOTIiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfMTA0YjI4YzJhMTgzM2YzMyIsInN0YXR1cyI6Im9wZW4ifSx7ImlkIjoiZl84ZTFhM2M3YTlkOTIzNTliIiwic3RhdHVzIjoib3BlbiJ9LHsiaWQiOiJmXzFmZTI1MjEwOGJmYzFhYjkiLCJzdGF0dXMiOiJvcGVuIn0seyJpZCI6ImZfOWNlMTRmYTZmMTc2MjlkMyIsInN0YXR1cyI6Im9wZW4ifSx7ImlkIjoiZl80ZjBiNmU3NWIxOTExMDBiIiwic3RhdHVzIjoib3BlbiJ9LHsiaWQiOiJmXzk4ZWI1ZTYzM2M0OGQ3NDYiLCJzdGF0dXMiOiJyZWNsYXNzaWZpZWQifSx7ImlkIjoiZl8xODQ5YmQ1ODI1YjM1ZmI5Iiwic3RhdHVzIjoicmVjbGFzc2lmaWVkIn0seyJpZCI6ImZfYWZjNDdkYTA1MWRiYjhiZiIsInN0YXR1cyI6InJlY2xhc3NpZmllZCJ9LHsiaWQiOiJmXzYxMGQ5ODZlZDJlZWE3YjgiLCJzdGF0dXMiOiJyZXNvbHZlZF9ieV9jaGFuZ2UifV19 --> ReviewFindingsMedium
Low
Earlier findings
Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
component/sandbox
e38def5 to
8e22ebc
Compare
|
🤖 Review · ❌ Terminated · Started 8:49 PM UTC · Ended 9:03 PM UTC Commit: |
Site previewPreview: https://fb7c8f82-site.fullsend-ai.workers.dev Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 8:49 PM UTC · Completed 9:03 PM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $3.40 |
8e22ebc to
405ae6c
Compare
|
🤖 Finished Review · ✅ Success · Started 10:39 PM UTC · Completed 10:54 PM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $3.27 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
405ae6c to
bc697d2
Compare
|
🤖 Finished Review · ✅ Success · Started 6:00 AM UTC · Completed 6:14 AM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $3.46 |
|
🤖 Finished Review · ✅ Success · Started 4:26 AM UTC · Completed 4:48 AM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $3.25 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 1:23 PM UTC · Completed 1:38 PM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $2.93 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 4:54 PM UTC · Completed 5:16 PM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $2.61 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 9:50 PM UTC · Completed 10:07 PM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $4.28 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 12:11 AM UTC · Completed 12:25 AM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $3.32 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 4:48 AM UTC · Completed 5:02 AM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $3.06 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 5:36 PM UTC · Completed 5:49 PM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $3.11 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 10:31 PM UTC · Completed 10:43 PM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $3.37 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 11:28 AM UTC · Completed 11:40 AM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $2.95 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 5:37 PM UTC · Completed 5:49 PM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $2.81 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 9:57 PM UTC · Completed 10:08 PM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $2.89 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 1:22 AM UTC · Completed 1:39 AM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $3.64 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
The environment variables the runner injects into sandboxes and the names reserved from env.sandbox overrides were documented as scattered prose. Codify them as a versioned, generated contract so runtimes and harness authors can rely on a single normative artifact. - Add internal/envmanifest package: v1 manifest types and builder - Publish docs/normative/sandbox-env/v1/ (README, generated manifest, JSON schema), pinned to actual runner behavior by collector and golden tests in internal/cli - Record the decision in ADR 0146 - Cross-reference the contract from CLI, harness, runtime, and agent guides Assisted-by: glm-5 Generated with AI assistance (glm-5) AI-Assisted: true Signed-off-by: Jay Flowers <jay.flowers@gmail.com>
- Reformat Options section into bullet points - Rephrase "collector" and "production emitters" for accessibility - Clarify fullsend_version line (tag is the version, no field removed) - Add required ## Forge scope section - Wrap long lines in security-threat-model.md and architecture.md Addresses PR fullsend-ai#8679 review feedback from @rh-hemartin and fullsend-ai-review[bot]. AI-Assisted: true Assisted-by: claude-opus-4 Signed-off-by: Jay Flowers <jay.flowers@gmail.com>
Fix test stub argument position ($4→$5) to match production openshell upload arg order, add exec arms for ClaudeRuntime.Bootstrap probes, and filter hookEnvExportKeys to .env-targeting lines only. Reclassify iteration-env trio (FULLSEND_TIMEOUT_MINUTES, FULLSEND_ITERATION_DEADLINE, TRACEPARENT) from always to conditional since writeIterationEnv failure is tolerated. Exclude readonly non-exported env-data vars (FULLSEND_RUNNER_PATH, FULLSEND_ENV_PYTHON, FULLSEND_TRUSTED_PATH, FULLSEND_READLINK, FULLSEND_ENV_EXPORTS) from the manifest exports. Union sandbox.ReservedCredentialKeys() into the reserved set so runtime-blocked keys (HTTPS_PROXY, NODE_OPTIONS, GIT_SSH_COMMAND, etc.) appear in the published contract alongside reservedSandboxKeys. Add deprecated category to the manifest schema, builder, normative spec, and golden test expectations. Fix normalized() Conditional map aliasing (clone instead of reference). Update ADR 0146 with commit-SHA permalinks for code citations and correct ADR 0038 attribution (tag pinning complements, not replaces, the commit-SHA + integrity-hash mechanism). Regenerate golden manifest. Addresses PR fullsend-ai#8679 review findings. Signed-off-by: Jay Flowers <Jay.Flowers@gmail.com> AI-Assisted: true Assisted-by: claude-opus-4 Signed-off-by: Jay Flowers <jay.flowers@gmail.com>
…en test claim Addresses qodo review findings: - Remove standalone References section (not in ADR template); all links already appear inline in Context, Decision, and Consequences. - Add ADR 0038 cross-reference in Context where the tag-pinned topology is introduced. - Add agents#1672 follow-up reference in Context. - Fix misleading claim that golden test catches new runtimes — it is TestEnvManifestRuntimeEnumeration that pins the runtime list; the golden test covers the committed manifest content. Signed-off-by: Jay Flowers <jay@unbound.force> AI-Assisted: true Signed-off-by: Jay Flowers <jay.flowers@gmail.com>
|
🤖 Finished Review · ✅ Success · Started 6:45 AM UTC · Completed 7:00 AM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $3.07 |
| for _, name := range productionSandboxRuntimes { | ||
| backend, err := agentruntime.Resolve(name) | ||
| require.NoError(t, err, "resolving runtime %q", name) | ||
| b.AddRuntimeSpecific(name, parseExportedEnvKeys(backend.EnvExports()...)...) |
There was a problem hiding this comment.
[medium] api-contract
The collector omits variables exported by runtime launch commands outside EnvExports(). For example, buildPiRunCommand exports FULLSEND_RUNTIME, FULLSEND_PI_MANIFEST and GOOGLE_CLOUD_LOCATION (pi_run.go), and the Codex and OpenCode launch commands export FULLSEND_RUNTIME. None appears in the committed manifest, and changes to these emitters cannot affect the golden result. This makes the advertised inventory of runner-injected sandbox variables (the README claims it covers every code path that injects environment variables) incomplete, and downstream reachability checks would reject valid variable references.
Suggested fix: Collect the launch-command exports with their runtime and feature conditions, or explicitly narrow the contract and provide a separate inventory for those runner-injected variables.
| // envManifestKeyRe matches a KEY= assignment token while excluding $KEY | ||
| // references: an emitter's output assigns the names it exports and reads the | ||
| // ones it prefixes with $. | ||
| var envManifestKeyRe = regexp.MustCompile(`(?:^|[^A-Za-z0-9_$])([A-Za-z_][A-Za-z0-9_]*)=`) |
There was a problem hiding this comment.
[medium] test-inadequate
The export collector (envManifestKeyRe) recognizes KEY= assi... rather than exported variables. Both 'export CODEX_HOME=...' and 'CODEX_HOME=...' produce the same key, so dropping 'export' can break the agent environment without changing the manifest or failing the golden test. The regex also matches assignment-like text inside quoted values (e.g. a URL containing '?PHANTOM=value' yields a nonexistent PHANTOM variable). The hand-maintained readonly exclusion list does not address either behavior.
Suggested fix: Use export-aware parsing or inspect the resulting exported environment, and add regression tests for unexported assignments and assignment-like text inside values.
| "FULLSEND_FETCH_TOKEN": "the runtime fetch service is enabled (ADR 0038)", | ||
| "FULLSEND_TRACE_ID": "trace-ID injection succeeds; the run warns and continues when it fails", | ||
| "TIRITH_FAIL_ON": "security.sandbox_hooks.tirith.fail_on is set", | ||
| "TIRITH_REQUIRED": "Tirith scanning is required (security.sandbox_hooks.tirith.enabled, default true)", |
There was a problem hiding this comment.
[low] api-contract
The gates for the hook variables (TIRITH_REQUIRED, TIRITH_FAIL_ON, FULLSEND_EGRESS_ALLOWLIST) do not state which runtimes support them. The collector only runs ClaudeRuntime.Bootstrap; OpenCodeRuntime.Bootstrap never calls appendHookEnv, yet opencode is a production runtime in the manifest. Practical impact is small because opencode fails closed when hooks are enabled (opencode_run.go), but the gate descriptions are incomplete as a contract statement.
Suggested fix: Add the supported-runtime restriction (claude, codex, pi) to these gate descriptions, or document that opencode currently fails closed when hooks are enabled.
| configuration changes the runtime. | ||
|
|
||
| The enumerated runtimes are the runner's resolution registry minus test | ||
| stubs. A runtime that exports nothing appears with an empty set — `opencode` |
There was a problem hiding this comment.
[low] incorrect-doc
README says 'A runtime that exports nothing appears with an empty set — opencode — rather than being omitted.' but sandbox-env.json lists three opencode exports (OPENCODE_CONFIG_DIR, OPENCODE_DISABLE_EXTERNAL_SKILLS, OPENCODE_DISABLE_PROJECT_CONFIG), as does the abridged example near line 59. The collector comment near line 41 repeats the stale claim.
Suggested fix: Remove the opencode example or state that opencode currently exports those three variables; fix the collector comment too.
| - [ ] `internal/cli/env_manifest_collector_test.go` and | ||
| `internal/cli/env_manifest_golden_test.go` — the runtime's `EnvExports()` | ||
| names must land in the generated | ||
| [sandbox environment contract](../normative/sandbox-env/v1/README.md); |
There was a problem hiding this comment.
[low] incorrect-doc
Line 67 says registering a runtime without a manifest decision fails the golden test; at HEAD this fails TestEnvManifestRuntimeEnumeration, while TestEnvManifestGolden only byte-compares the committed manifest against the collector output. ADR 0146 and the normative README distinguish the two but this checklist does not.
Suggested fix: Name TestEnvManifestRuntimeEnumeration for registration drift and 'TestEnvManifestGolden -update' for regenerating the manifest.
| if the runtime is user-selectable). | ||
| - [x] `internal/config/config_test.go` — update any assertion on | ||
| `ValidRuntimes()` to include the new name. | ||
| - [ ] `internal/cli/env_manifest_collector_test.go` and |
There was a problem hiding this comment.
[low] pattern-inconsistency
Every other entry under 'Consumer-completeness touchpoints' uses '- [x]', but the newly added test checklist item at line 64 uses '- [ ]'.
Suggested fix: Change '- [ ]' to '- [x]' on line 64.
| entries naming these keys are skipped with a warning: the runner removes | ||
| them so harness configuration cannot shadow runner infrastructure, inject | ||
| OIDC and provider credentials, or override security-critical process | ||
| variables (e.g. `HTTPS_PROXY`, `LD_PRELOAD`, `NODE_OPTIONS`). A key may appear both here and in an export |
There was a problem hiding this comment.
[low] doc-style
Line 121 is 105 characters long, violating the Markdown prose wrapping rule (~80 columns) while surrounding lines are wrapped.
Suggested fix: Wrap the sentence at ~80 columns.
Summary
Codifies the sandbox environment-variable contract as a versioned, generated
manifest so runtimes and harness authors rely on a single normative artifact
instead of scattered prose. A new
internal/envmanifestpackage defines thev1 manifest types and a deterministic builder; a collector in
internal/cliexecutes the production emitters themselves (bootstrapEnv, per-iteration env,
trace/timeout vars, per-runtime
EnvExports(), the Vertex scaffold env, andthe post-merge reserved-key set), so the manifest cannot drift from the code
that owns the surface.
Related Issue
Changes
internal/envmanifestpackage: v1 manifest types, deterministicbuilder, JSON round-trip (98% statement coverage)
docs/normative/sandbox-env/v1/— README (provenance andguarantees) plus the generated, committed
sandbox-env.json(8 always-on,9 conditional, 4 runtime-specific groups, 4 harness-delivered, 34 reserved
keys)
TestEnvManifestGolden(byte-compare,-updateflag, fail-closed on newruntime registration) plus collector tests in
internal/clivalidate against the released tag at PR time and main nightly per ADR 0139)
agent-infrastructure, security-threat-model, run CLI, harness reference,
runtime and agent guides)
hand-maintained
SANDBOX_RUNTIME_VARSallowlist to the released-tagmanifest (incidents refactor!: rename --source-org flag to --app-set in mint enroll #1677/Review agent should honor explicit author dismissals of findings #1672 motivation)
Testing
make lintpasses (stage changes first, then run)Full suite
go test -race -count=1 ./...green except 4 local environmentalfailures (internal/forge/gitlab TLS CA, internal/repos /var-vs-/private/var,
internal/runtime flock ×2, plus an intermittent 5th in internal/scaffold) —
all baseline-verified pre-existing on clean main
3ec97b9; CI on Linux isthe arbiter. Patch coverage:
internal/envmanifest98% of statements(target 80%, floor 75%).
Checklist
!for breaking changes)This PR was generated by /uf.finale (AI-assisted).