fix(hooks): DEV:exit audit completeness, atomic gate-marker writes, single-spawn protected-tip check (deep-review HARD-GATE batch B)#133
Merged
Conversation
Deep-review 2026-06-24-root HARD-GATE batch B (rides untagged 2.5.2). v2.rev.0017 (observability-001): when SessionStart clears a LIVE dev-active marker (a prior session entered /ca:dev and ended without /ca:arbiter), append a synthetic "[ISO-8601] | BY: session-cleanup | DEV: exit" line to overrides.log BEFORE removing the marker, so the audit trail keeps a matched DEV: enter/exit pair instead of an orphaned enter. Append-only, best-effort (a write failure never bricks startup). Extracted as clear_dev_marker() and unit-tested. v2.rev.0022 (migration-002): add _hooklib.write_text_atomic (sibling temp + os.replace, temp cleaned on failure); migration-pass.py and security-pass.py write their gate markers through it, so a crash mid-write can no longer leave a half-written marker that the backstop reads as an unrecognized digest and forces a spurious gate re-run. Fail-closed behavior preserved. Verify: test_hooklib 64/0, hooks unittest 529/0, cold-install PASS, migration 31/0. Claude-Session: https://claude.ai/code/session_01M3e2cHcf864YSxDmCohcET
Deep-review 2026-06-24-root HARD-GATE batch B (rides untagged 2.5.2). v2.rev.0023 (performance-006): the detached-HEAD protected-tip check spawned three sequential `git rev-parse` (HEAD, main, master). Replace with one `git show-ref --head refs/heads/main refs/heads/master`, which lists HEAD plus each protected branch that exists and omits a missing one with no fatal. A naive one-shot `git rev-parse HEAD main master` is NOT usable: rev-parse stops at the first unresolvable arg, so a missing `main` would hide a present `master` tip and silently allow a commit onto it. Block/allow decisions unchanged. Adds two guard-matrix parity cases: detached HEAD on a `master` tip (main absent) blocks; detached HEAD on an older commit (main present, HEAD != tip) allows. Guard matrix 86 -> 88 assertions, 0 failed. Claude-Session: https://claude.ai/code/session_01M3e2cHcf864YSxDmCohcET
SUaDtL
added a commit
that referenced
this pull request
Jun 26, 2026
* docs(changelog): roll the 2.5.2 HARD-GATE batch into the release notes The [2.5.2] section existed for the deep-review quick-kills but predated the HARD-GATE enforcement batch (#132, #133). Append those entries and correct the section intro, which claimed "no enforcement-behavior change" before the gate fixes landed. Re-dates the section to the release date (2026-06-25). Scope: the ca plugin only. Batch C (#134) is ca-sandbox and belongs to the ca-sandbox-v* series, not this v2.5.2 ca release. Claude-Session: https://claude.ai/code/session_01M3e2cHcf864YSxDmCohcET * fix(hooks): list rc2/blowfish in the H-09 advisory crypto reminder Batch A broadened CRYPTO_RE to match rc2/blowfish but left the human-readable post-write reminder string listing only MD5/SHA1/DES/RC4, so the advisory under- described what the commit gate now catches. Align the reminder. Claude-Session: https://claude.ai/code/session_01M3e2cHcf864YSxDmCohcET * docs(ca): pre-release prose pass — tighten the core, dedup the lazy-load routers, reconcile to 2.5.2 Always-loaded core (ORCHESTRATOR.md): collapse the softened §0 duplicate of the §3 hard rules, trim the register, and replace hardcoded `main` with "the default branch". Lazy-load schema: routing-table.md is declared the single deterministic trigger-to-route surface, reference-map.md the read-before-a-scope surface, and skills/INDEX points to routing-table for routing; the redirect repeat-list regains the dropped sprint/preview/metrics/task. SPRINT.md stops restating the worker-seam philosophy (it lives once in farm.md). farm.md drops two redundancies. Accuracy vs the merged HARD-GATE batch: arbiter.md no longer instructs a manual DEV: exit line that SessionStart now writes itself (was a duplicate-audit-line bug); auth-crypto-reviewer lists rc2/blowfish; release.md states the ca-only window scope; checkpoint-aggregator's roster/sections are illustrative (the live fleet is six reviewers, not four). README aligns the farm worker description with the root README (OpenAI-compatible, Zen default) and restores the "Claude still writes the failing tests" guarantee. Skill trims: debug frontmatter, secret-handling stakes, a commit-gate Phase 4 redundancy. Claude-Session: https://claude.ai/code/session_01M3e2cHcf864YSxDmCohcET * docs(governance): reconcile .codearbiter docs to the merged enforcement + roll the docs-pass changelog note security-controls.md: drop the misleading "(in new code)" qualifier from the forbidden-crypto list (the CRYPTO_RE gate is line-based, context-free); name the automated SessionStart `BY: session-cleanup | DEV: exit` write as the one framework writer of overrides.log (observability-001); fix the dangling CONFIRM-07 reference to ADR-0007. tech-stack.md: widen the manual secret-sweep pattern to match SECRET_RE's compound-name and key-prefix shapes, and split the H-09b (crypto) / H-10b (secret) attribution. coding-standards.md: the LF rule is now a MUST (a diff that introduces CRLF on tracked text is rejected). CHANGELOG: a Documentation note for the 2.5.2 docs pass. Claude-Session: https://claude.ai/code/session_01M3e2cHcf864YSxDmCohcET * docs(site): enterprise enforcement + hooks reference; fix the gate-catch demo and version pill Adds a "How it works" sidebar group with two pages: Enforcement & Security (the activation contract, the blocking commit-time gates H-01/02/03/05/09b/10b/11/14 with the digest-bound TOCTOU close and fail-closed-on-unreadable-diff behavior, the advisory reminders and why they are advisory, the 2.5.2 hardening, and the fail-loud + interpreter-dual-registration posture) and a complete Hooks reference documenting every hook by event, script, controls, and fail posture. Fixes: the GateCatchTerminal demo cited H-09 (the advisory reminder) for a block that is actually H-09b, and showed a bare `git commit` going green after a fix; it now routes the green path through the crypto-compliance gate so it matches the real digest-bound mechanic. The two-axis diagram's highlighted version pill moves to v2.5.2 (both the public/ and src/assets/ copies). concepts.md meta description drops a prose-separator em-dash. Build + link-audit green (79 pages, 6952 links). Claude-Session: https://claude.ai/code/session_01M3e2cHcf864YSxDmCohcET * docs(ca): keep "no emojis" on one line in the register (fix test_ux_conversion) The register trim line-wrapped "no\nemojis", and test_ux_conversion asserts the literal substring "no emojis" is present. Rewrap so the substring stays intact. No content change. Claude-Session: https://claude.ai/code/session_01M3e2cHcf864YSxDmCohcET --------- Co-authored-by: SUaDtL <SUaDtL@users.noreply.github.com>
SUaDtL
added a commit
that referenced
this pull request
Jun 26, 2026
…1.1 release (#136) Mark the AUTO quick-kills (v2.rev.0001-0013, shipped in #127) and the HARD-GATE batch (v2.rev.0016-0019, 0021-0025, shipped in #132/#133/#134 and released in v2.5.2) as done on the board. v2.rev.0020 (farm god-module split) stays open as the deferred post-release /ca:refactor; 0026/0027 stay open as the DECISION CONFIRMs. Adds ca-sandbox.release.0001: Batch C's container-isolation hardening (#134) is in main on ca-sandbox 0.1.1 but the latest tag is ca-sandbox-v0.1.0, so it is unreleased; /ca:release is ca-only (ADR-0007), so this needs a ca-sandbox release path or a manual tag + Release. Claude-Session: https://claude.ai/code/session_01M3e2cHcf864YSxDmCohcET Co-authored-by: SUaDtL <SUaDtL@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Deep-review 2026-06-24-root HARD-GATE batch B (3 of the 9). Rides untagged 2.5.2 (no new bump). Two type-homogeneous commits.
v2.rev.0017 —
fix(hooks)DEV:exit audit completeness (observability-001)SessionStart unconditionally removed the
dev-activemarker, so a session that entered/ca:devand ended without/ca:arbiterleft an orphanedDEV: enterinoverrides.logwith no close. Now, when the marker is live,clear_dev_marker()appends[<ISO-8601 UTC>] | BY: session-cleanup | DEV: exit | NOTE: cleared by SessionStart …before removing it — append-only, best-effort (a write failure never bricks startup). No marker -> no append.v2.rev.0022 —
fix(hooks)atomic gate-marker writes (migration-002)migration-pass.py/security-pass.pywrote their markers with a plain truncate-then-write; a crash mid-write left a half-written marker the backstop reads as an unrecognized digest, forcing a spurious gate re-run. New_hooklib.write_text_atomic(siblingmkstemp+os.replace, temp cleaned on failure) is the one writer both use. Fail-closed behavior preserved.v2.rev.0023 —
perf(hooks)single-spawn protected-tip check (performance-006)head_on_protected_tipspawned three sequentialgit rev-parse. Replaced with onegit show-ref --head refs/heads/main refs/heads/master.Correctness note: the finding suggested
git rev-parse HEAD main master, butrev-parsestops at the first unresolvable arg — a missingmainwould hide a presentmastertip and silently allow a commit onto it.show-reflists only the refs that exist (exit 0 on missing) and includes the detached HEAD line, so it is the robust one-spawn form. Block/allow decisions unchanged; two parity cases added (detached HEAD on amastertip blocks; on an older commit allows).Verification
test_hooklib64/0,test_hook_guards88/0 (86 -> 88),test_hooks_cold_installPASS,test_migration_backstop31/0, hooks unittest 529/0.https://claude.ai/code/session_01M3e2cHcf864YSxDmCohcET