checkpoint 2026-06-22 remediation: crypto/secret gate hardening + hygiene#120
Merged
Conversation
The 2026-06-22 checkpoint found codeArbiter's own enforcement gates blind to
the language the repo is written in. CRYPTO_RE detected only Python verify=False
while all networked first-party code (farm.ts, ca-sandbox) is TS, so a
rejectUnauthorized:false / NODE_TLS_REJECT_UNAUTHORIZED bypass would commit with
the H-09 gate never firing — security-controls.md bans the form the gate could
not see. SECRET_RE matched only `key = "val"` assignments, missing the
colon/object-literal forms ("api_key": "...", apiKey: "...") that dominate a
TS/JSON repo plus AWS/ghp_/sk-ant- key prefixes.
Broadens both regexes (the SECRET_RE quoted-value requirement keeps false
positives bounded), aligns the farm.ts outbound SECRET_LINE redactor so the gate
and the redactor never drift, and adds test_hooklib.py — direct coverage for the
two regexes and the previously-untested _hooklib helpers, closing that coverage
gap too. No banned primitive or real secret is introduced; the test fixtures are
fake (AWS canonical EXAMPLE keys). auth-crypto-reviewer PASS, ReDoS cleared.
CHANGELOG: the crypto/secret commit gates now catch the Node/TS TLS-disable and object-literal/prefixed-secret forms, not just the Python/assignment forms.
Claude-Session: https://claude.ai/code/session_016NVNTNAPKXzWD8bmmjVHP7
The 2026-06-22 checkpoint flagged pages:write / id-token:write granted at the workflow level, so the build job — which runs on pull_request, including fork PRs — inherited write tokens it never uses. Only the push-gated deploy job needs them. Drops the workflow default to contents:read and grants the elevated perms at the deploy job. Least-privilege; no behavior change (forks already get read-only tokens by default). Claude-Session: https://claude.ai/code/session_016NVNTNAPKXzWD8bmmjVHP7
Records the pre-2.5.0 checkpoint sweep (.codearbiter/checkpoints/2026-06-22.md): five reviewers, the CRYPTO_RE/SECRET_RE HIGH+MEDIUMs now fixed, zero ADR drift, ca-sandbox isolation and farm.ts TLS/secret handling confirmed clean. Approves BlueOak-1.0.0 and CC0-1.0 in security-controls.md (user decision via SMARTS arbitration) to cover the docs site's transitive deps — site/ is not in the shipped plugin payload, so this clears the dependency BLOCK without touching the payload. Marks v2.docs.0002 done, queues the two deferred checkpoint items (_sloplib direct tests, sharp -> optionalDependencies), and records the SECRET_RE half of the enforcement open-question as resolved. Claude-Session: https://claude.ai/code/session_016NVNTNAPKXzWD8bmmjVHP7
coverage-auditor's NEEDS-TRIAGE from the 2026-06-22 checkpoint: the pre-existing CRYPTO_RE branches (3des/RSA/sha1/...) are tested only indirectly. Out of scope for the hardening fix; queued so the gap isn't lost. Claude-Session: https://claude.ai/code/session_016NVNTNAPKXzWD8bmmjVHP7
SUaDtL
added a commit
that referenced
this pull request
Jun 22, 2026
The 2.5.0 section listed only #116/#117. Adds the task-board lifecycle + /ca:task feature (#118) under Added, and a Fixed group for the farm setup-doc dead-link (#119) and the crypto/secret gate hardening (#120), rolled from each commit's CHANGELOG footer. Dates the section to the release day. Project-state-only changes (.codearbiter/) stay out of the log per its stated scope. Claude-Session: https://claude.ai/code/session_016NVNTNAPKXzWD8bmmjVHP7 Co-authored-by: SUaDtL <SUaDtL@users.noreply.github.com>
Merged
SUaDtL
added a commit
that referenced
this pull request
Jun 22, 2026
* docs(changelog): roll up #118/#119/#120 into the 2.5.0 section The 2.5.0 section listed only #116/#117. Adds the task-board lifecycle + /ca:task feature (#118) under Added, and a Fixed group for the farm setup-doc dead-link (#119) and the crypto/secret gate hardening (#120), rolled from each commit's CHANGELOG footer. Dates the section to the release day. Project-state-only changes (.codearbiter/) stay out of the log per its stated scope. Claude-Session: https://claude.ai/code/session_016NVNTNAPKXzWD8bmmjVHP7 * feat(site): docs site polish — bespoke landing, Feature Forge, anti-slop copy (#122) * feat(site): bespoke landing, Feature Forge surfacing, anti-slop copy The #94 --farm artifact built a working docs site but it read as a scaffold: stock Starlight chrome, four generic cards, and a landing that printed `/ca:sprint --farm` while explaining neither --farm nor the Feature Forge anywhere on the site. This polish pass makes the site earn a first-time visitor's understanding within one screen: - A bespoke landing with a CSS-only animated gate-catch terminal that shows a gate blocking a banned crypto primitive, then clearing — the actual conversion mechanic, not an assertion. Honors prefers-reduced-motion with a static full transcript; the transcript is real DOM text. - Feature Forge surfaced as the differentiator: a landing showcase, a Concepts section with the two-axis labelling model, and preview badges driven by a site-side generator allowlist (no plugins/ca change). --farm is now linked to its explanation. - Three hand-authored SVG diagrams (lane-flow, two-axis, gate model) and custom callouts across the inner pages. - Copy de-slopped: em-dashes cut from 7/16/10 to 0/0/0 in body prose, plus removal of templated phrasing and LLM-tell vocabulary. - Functional: logo/favicon/social wired, base-safe internal links, Pagefind verified in dist. Reviewed via multi-agent build with adversarial verify (visual design, link/base-path, copy anti-slop); 4 blocking findings caught and fixed. Crypto-compliance gate passed (demo transcript text, no operational crypto). Site suite green: typecheck clean, 104 tests, build 77 pages. CHANGELOG: Public docs site redesigned — bespoke landing with a live gate-catch demo, Feature Forge showcase + preview badges, and a copy anti-slop pass. Ref: .codearbiter/specs/docs-site-polish.md Claude-Session: https://claude.ai/code/session_016NVNTNAPKXzWD8bmmjVHP7 * docs(governance): record docs-site-polish spec + harvest follow-ups Persist the approved spec that drove the feat(site) docs overhaul and record the two follow-ups its build surfaced, so the out-of-scope work isn't lost: - Allowlist-drift reconciler: a CI/doctor check that the site-side Feature Forge preview allowlist matches real preview status. - Base-path img-href convention: unify the relative vs BASE_URL forms used for diagram/image sources across the site. Ref: .codearbiter/specs/docs-site-polish.md Claude-Session: https://claude.ai/code/session_016NVNTNAPKXzWD8bmmjVHP7 * docs(governance): harvest coverage-auditor follow-ups for docs site The PR coverage audit confirmed the build green but flagged two spec acceptance criteria the build delivered as content without the automated assertion the spec promised (AC-9 diagram titles, AC-13 Concepts forge section), plus an untested defensive path in forge-status. Record them so the spec's testability promise is honored rather than quietly dropped. Ref: .codearbiter/specs/docs-site-polish.md Claude-Session: https://claude.ai/code/session_016NVNTNAPKXzWD8bmmjVHP7 --------- Co-authored-by: SUaDtL <SUaDtL@users.noreply.github.com> * fix(site): use Starlight 0.33+ array syntax for the social config (#124) CI's clean `npm ci` installs the pinned Starlight ^0.40.0, which rejects the legacy `social: { github: ... }` object form and fails the docs build at config:setup. The dev tree masked this: local node_modules held a stale Starlight 0.32.6 that still accepted the object form, so the local build passed while CI went red. Convert to the array-of-link-items syntax 0.33+ requires. Verified against a clean install (Starlight 0.40.0): build exits 0 (77 pages), typecheck clean, 104 tests pass. CHANGELOG: Docs site builds again on the pinned Starlight; the GitHub social link renders in the site header. Closes: docs deploy build failure on PR #123 Claude-Session: https://claude.ai/code/session_016NVNTNAPKXzWD8bmmjVHP7 Co-authored-by: SUaDtL <SUaDtL@users.noreply.github.com> --------- Co-authored-by: SUaDtL <SUaDtL@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remediation for the pre-2.5.0 checkpoint sweep (
.codearbiter/checkpoints/2026-06-22.md). Five reviewers ran; this clears the one HIGH, the actionable MEDIUMs, and the site-license BLOCK.The HIGH — codeArbiter's own gate was blind to its own language
CRYPTO_REdetected only Pythonverify=False, but every networked first-party file (farm.ts, all ofca-sandbox) is TypeScript.security-controls.mdbansrejectUnauthorized: false, yet the H-09 gate driving that policy could not see it. No live occurrence existed; it was a pure enforcement-coverage gap in the shipped gate.CRYPTO_REnow matchesrejectUnauthorized\s*[:=]\s*falseandNODE_TLS_REJECT_UNAUTHORIZED.SECRET_REnow matches the colon/object-literal forms ("api_key": "...",apiKey: "...") plusaws_secret_access_key/client_secretand the high-entropy prefixesAKIA…/ghp_…/sk-ant-…. The quoted-value requirement keeps false positives bounded.farm.tsSECRET_LINE(the outbound redactor) gains the same prefixes so the gate and the redactor never drift..github/scripts/test_hooklib.py(30 tests) gives the two regexes direct coverage and also closes the separate checkpoint MEDIUM that_hooklibhad no direct unit tests.Hygiene
ci(docs)—pages: write/id-token: writemoved from workflow level to the deploy job, so the PR/fork build job stays read-only (security LOW).docs(governance)— approvesBlueOak-1.0.0+CC0-1.0insecurity-controls.md(decision via SMARTS arbitration) to clear the site-only license BLOCK;site/is not in the shipped payload. Marksv2.docs.0002done; boards three deferred follow-ups (_sloplibtests,sharpto optionalDependencies, legacyCRYPTO_REtest backfill).Test plan
test_hooklib.py);_hooklib.pycompiles;check-plugin-refs.py caintact.plugins/ca/tools:npm run typecheckclean,npm test112/112 green (was 108; +4redactSecretsprefix tests),npm run buildregeneratesfarm.jswith no stale delta.Review
auth-crypto-reviewer PASS (0 findings; confirmed every test secret is a fake fixture, no banned primitive introduced, ReDoS cleared on pathological inputs). coverage-auditor PASS (0 findings; every new branch covered with positive and negative cases). The crypto/secret change cleared the diff-bound H-09b/H-10b security-gate marker before commit.
Release note
Rides the unpublished 2.5.0 (payload change, no further bump). The
fix(security)CHANGELOG line lands at/ca:releasealongside #118 and #119.https://claude.ai/code/session_016NVNTNAPKXzWD8bmmjVHP7