Promote 2026-06-13 checkpoint remediation to main (v2.1.0-beta.3) - #45
Merged
Conversation
…aths The pre-edit.py PreToolUse guard had no direct unit coverage; the 2026-06-13 checkpoint flagged it as the one BLOCKS-severity gap. Add test_pre_edit.py exercising the H-05 append-only enforcement (overrides.log / triage.log non-append edits blocked, pure appends allowed) and the H-11 ADR-marker block/allow logic (no marker, stale >30min marker, fresh marker), plus the Windows backslash path-normalization branch. Stdlib-only, subprocess-driven to mirror the existing hook tests; mutation-verified non-vacuous. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The HTTPS check covered only plan.meta.apiBaseUrl at parse time, so a
FARM_API_BASE_URL env override could resolve to http:// and send the
Authorization: Bearer ${FARM_API_KEY} header over cleartext (2026-06-13
checkpoint, MEDIUM). Add assertSecureBaseUrl and call it on the *resolved*
base URL (env -> plan.meta -> default) in validate(), resolveConfig(), and
runCanary(), before any fetch. HTTPS-only with a documented loopback http://
exception (127.0.0.1/localhost, no userinfo), via WHATWG URL parsing -- the
same parser fetch uses, so there is no parser-differential bypass. The thrown
error names only the URL, never the key. Rebuild the shipped farm.js in sync.
Verified by three independent auth/crypto reviews (PASS) and the expanded
vitest suite (69 green, incl. http-override-rejected-pre-fetch).
CHANGELOG: closes the FARM_API_BASE_URL cleartext-Bearer-leak path.
Ref: ADR-0003
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add `npm audit --omit=dev --audit-level=critical` to the tools job, after the locked install and before typecheck (2026-06-13 checkpoint, LOW supply-chain). A CRITICAL advisory in the shipped dependency set now fails the build; lower severities stay non-gating so routine dev-tool advisories do not block unrelated PRs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adopt the hybrid ADR + living-docs governance model: pin load-bearing architecture/security decisions as numbered, immutable, user-attributed ADRs under .codearbiter/decisions/, keeping tech-stack.md and security-controls.md as living reference docs (2026-06-13 checkpoint governance item). Initialize the decision log and four proposed ADRs: - 0001 hybrid ADR + living-docs governance model - 0002 plan.json / FARM_MUTATION_CMD as trusted operator shell input - 0003 HTTPS-only transport with loopback exception; FARM_API_KEY via env - 0004 database-free, stdlib-only architecture All decided-by the git operator (SUaDtL@users.noreply.github.com), status proposed (pending explicit ratification). Update security-controls.md (TLS section rewritten around the resolved-URL validation; boundary-crossings rows for plan.json shell exec and the loopback http:// exception) and tech-stack.md (CVE-gate section). Ref: ADR-0001, ADR-0002, ADR-0003, ADR-0004 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The farm.ts/farm.js payload changed under the already-published 2.1.0-beta.2 tag, so the version-bump CI gate requires a new version. Bump plugin.json, the README version badge, and add the dated CHANGELOG section for beta.3 (security fix, hook tests, CVE gate, ADRs, security-doc updates). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Carry the gated process artifacts for the 2026-06-13 checkpoint sweep and its remediation sprint: the dated checkpoint report, the approved spec and plan ledger, the append-only sprint-log (auto-decisions SD-01..SD-04 with confidence flags), the rebased force-push entry in overrides.log, and the re-zeroed last-checkpoint override baseline. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Append the autonomous landing decision (PR based on the parent branch, not main) to the sprint log. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…iation Remediate 2026-06-13 checkpoint findings (sprint, beta.3)
On explicit user instruction, advance all four architecture decision records from proposed to accepted. ADR frontmatter and the ## Status section now read accepted with a 2026-06-13 ratification line attributed to the git operator; a Ratification record is appended to the decision log (append-only, prior entries untouched). `accepted` is the canonical decision-log Status enum value, resolving the proposed-vs-enum reconciliation flagged at authoring time (SD-03). Ref: ADR-0001, ADR-0002, ADR-0003, ADR-0004 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes the completed 2026-06-13 checkpoint remediation to
main. The 2026-06-12 work already landed via #43; this PR is net the 2026-06-13 sprint (merged to this branch via #44) plus ADR ratification. Tagged and pre-released as v2.1.0-beta.3.What's included
farm.tsvalidates the resolvedapiBaseUrl(env → plan.meta → default) before every fetch viaassertSecureBaseUrl— HTTPS-only + documented loopbackhttp://exception (no userinfo), WHATWG-URL-parsed. Closes theFARM_API_BASE_URL=http://cleartext-Bearer-leak.farm.jsrebuilt in synctests/test_pre_edit.py— H-05 append-only + H-11 ADR-marker block/allow, stale-marker, Windows path branchnpm audit --omit=dev --audit-level=critical) in the tools jobsecurity-controls.mdresolved-URL TLS validation + trust-boundary rows;tech-stack.mdCVE-gate section2.1.0-beta.2 → 2.1.0-beta.3(plugin.json + README badge + CHANGELOG); tagv2.1.0-beta.3Verification
farm.jsin sync.security-gate-passedmarker recorded (H-09b/H-10b satisfied).Conflict-hierarchy note
The decision-log
Statusenum gainedacceptedon ratification, resolving the priorproposed-vs-enum reconciliation at level 2 (fidelity to the recorded decision) — surfaced in the log, not silently reconciled (SD-03).Autonomous decisions
SD-01..SD-05 logged in
.codearbiter/sprint-log.md(all flagged low-confidence for review): artifact-commit timing, URL-parse hardening (+benign host-normalization re-review), decision-log Status, beta.3 bump, PR-base choice.Merge decision is yours —
/ca:sprintnever merges to default.🤖 Generated with Claude Code