Skip to content

CE-Harness v1.0.2 — Quality Sprint

Choose a tag to compare

View all tags
@doz34 doz34 released this 10 Jun 06:04
v1.0.2
6b052ea

CE-Harness v1.0.2 — Quality Sprint

14 latent bugs fixed in one substantive patch, organized into 4 batches. Each fix is user-facing: it repairs something that would break the demo, the install, or the CLI for an end user. No new modules, no new dependencies.

What's fixed

Batch A — 4 bugs user-blocking (install/demo)

  • ci_cd_pinning.validate_workflow_file — try/except around import yaml; returns clear PinningResult ERROR instead of crashing the CLI when pyyaml is missing
  • security.py — pre-import AESGCM and security_fallback at module top-level so the fallback path is never broken by relative-import failures (e.g., script mode)
  • code_api.SAFE_BUILTINS — adds __build_class__ and exception types (ZeroDivisionError, ValueError, etc.) so legitimate class and try/except blocks work
  • contract_validator.load_and_validate — fixed broken YAML→JSON fallback; now returns a clear ContractResult error

Batch B — 3 functional bugs

  • validate_github_workflow — handles container as a string and services as a list (both legal GitHub Actions forms that were silently accepted)
  • safe_subagent_result — rejects oversized values via ValueError instead of silently truncating (99999999999999 → 9999999999 was corrupting token counts)
  • post_tool_use_clear_result — sanitizes tool_name via regex (defeats ../../../../tmp/evil path traversal)

Batch C — 4 correctness bugs

  • PBKDF2 epoch key derivation iterations 1,000 → 200,000 (OWASP 2023 floor)
  • state.append_audit — read prev_hash and INSERT now share a single BEGIN IMMEDIATE transaction (TOCTOU race fixed)
  • pii_tokenizer.detect — pre-processing pass (NFKC + URL-decode + HTML-unescape) defeats alice%40acme.com, alice＆#64;acme.com, alice＠acme.com (fullwidth) bypasses
  • code_api.execute — wall-clock timeout parameter (default 30s) via SIGALRM; while True: pass no longer hangs the agent

Batch D — 3 claim/code alignment

  • RotatingHMAC.verify(strict_epoch=True) — actually enforced now (the docstring promised this; the code was a no-op)
  • verify_isolation — inspects the ledger DB for real instead of returning a hardcoded dict; returns is_valid=False with reason if the subagent was never spawned
  • memory_blocks — PRAGMA foreign_keys=ON on every connection (was declared but not enforced)

Tests

  • 318/318 pass (one new test added for strict_epoch invariant)
  • Adversarial suite unchanged (green)
  • Install + demo: green
  • pip uninstall cryptography pyyaml → 317/318 (1 skip on the yaml test, expected)

🤖 Generated with Claude Code

Assets 2
Loading