fix(hooks): tail-anchor H-05 audit-log append + reject replace_all; block literal --no-verify (#172 #175)#210
Merged
Merged
Conversation
…lock literal --no-verify
security-reviewer HIGH (first pass): -nm/-vn clusters on git commit weren't caught by the exact-token check. Add a left-to-right cluster scan that recognizes -n before any argument-taking short flag (m/c/C/F/t/S/u) consumes the rest of the token as its value; also stop token scanning at a bare -- (end-of-options) and require is_tail_append's old_string to be unique in the current file.
…uard security-reviewer HIGH (second pass): the -[A-Za-z]+ fullmatch gate in _commit_no_verify_in_cluster skipped any token with a trailing non-letter byte, so an attached-value cluster (-nm=x, -nm123, -vnm=y) was never even inspected and let -n/no-verify through live against a real .git/hooks/pre-commit. Root cause: match on the token's LEADING -+letter instead of requiring the WHOLE token to be letters, then walk characters after the dash and stop at the first non-alphabetic byte (an attached value has begun) in addition to the existing argument-taking-flag stop.
…verify guard) Version bump + README badge sync for the H-05 tail-anchor (#172) and the H-20 --no-verify guard (#175); documents both plus the accepted shell-indirection residual in security-controls.md §Audit trail. Claude-Session: https://claude.ai/code/session_01PVTCDji6bEuf9SifQ8tfsa
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lane A2 — two guard-boundary hardenings from the tribunal audit.
What
pre-edit.py, via new_hooklib.is_tail_append) now tail-anchors — an audit-log Edit is admitted only as a strict append (new= current + appended tail,oldunique), and areplace_allEdit on an audit-log path is rejected outright. Closes the priornew.startswith(old)hole that let a mid-file insertion or multi-site suffix rewrite pass as an "append". Audit-trail integrity is conflict-hierarchy level 1.--no-verify/-nongit commitand a literal--no-verifyongit push— the flag skips the.git/hooksgit-enforce backstop, voiding H-01/H-02/H-09b/H-10b/H-14 for that op. Handles bundled/attached short-flag spellings (-nm,-nm=x,-vnm=y) via a char-walk that mirrors git's own cluster parsing;git push -n(=--dry-run) is correctly left alone.Verification
py_compileclean; LF.-nm, then attached-value-nm=x), the final adversarial pass drove every literalgit commit -nspelling against the actual guard and cross-checked the allowed ones against real git: the entire literal bundled--nclass is closed, no over-block regression, only the documented shell-indirection residual remains (out of scope per ADR-0010). Theis_tail_appendtail-anchor was verified not to over-reject any valid append.Bumps ca 2.8.4 → 2.8.5. Documents both guards + the accepted residual in
security-controls.md§Audit trail.Closes #172
Closes #175
https://claude.ai/code/session_01PVTCDji6bEuf9SifQ8tfsa