FE-1320: Structural private-mission isolation for /compare-specs - #415
FE-1320: Structural private-mission isolation for /compare-specs#415lunelson wants to merge 4 commits into
Conversation
Place each harness in a fresh external temporary root so controller-private mission material is absent from ordinary target-relative traversal while retained evidence stays exact. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the external-target contract coupled to the existing single-actor, immutable-evidence, and prompt-owned workflow boundaries. Co-authored-by: Cursor <cursoragent@cursor.com>
Return I67-L to its pre-frontier content so any evidence refresh remains owned by ln-sync. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Warning This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
This stack of pull requests is managed by Graphite. Learn more about stacking. |
lunelson
changed the title
PR SummaryMedium Risk Overview The operator prompt now requires each comparison harness to run in a fresh system-temporary target root outside the controller checkout, scratch comparisons tree, and retained run tree, with setup preflight that rejects ancestor paths that could reach controller-private files (including the witnessed Tests extend Planning/spec updates mark Reviewed by Cursor Bugbot for commit 14deb5d. Bugbot is set up for automated code reviews on this repo. Configure here. |
There was a problem hiding this comment.
Pull request overview
This PR hardens /compare-specs private-mission isolation by changing the workflow to allocate each harness a fresh, system-temporary external target root outside controller-owned trees, and updates the written procedure + planning docs to match.
Changes:
- Update the
/compare-specsoperator prompt to require per-harness external target roots and specify copy/cleanup sequencing. - Add/extend tests around the prompt contract and the external-target placement invariants.
- Update SPEC/PLAN/testing notes to record FE-1320 as the closeout of the prior placement-risk finding.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| TESTING_FINDINGS.md | Updates CS2 disposition to reflect FE-1320 closing the placement risk. |
| src/dev/tests/compare-specs-prompt.test.ts | Adds prompt assertions and filesystem-based isolation/retention tests. |
| memory/SPEC.md | Updates D134-L and I67-L to include external target placement boundary language. |
| memory/PLAN.md | Marks the isolation hardening frontier as completed and removes it from “Next”. |
| docs/archive/PLAN_HISTORY.md | Archives the FE-1320 closeout entry and its evidence summary. |
| .pi/prompts/compare-specs.md | Implements the new external-target-root procedure and retention/cleanup ordering in the operator prompt. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| await rm(externalRoot, { recursive: true }); | ||
| await cp(scratchRun, retainedRun, { recursive: true }); |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 14deb5d. Configure here.
| 7. Acquire the harness-authored document if it exists. Never author, reconstruct, complete, rewrite, or improve it. Missing or partial output remains missing or partial. | ||
| 8. On every outcome, retain state, harness-visible interaction, target-cwd/session identity, final process status, document that exists, and cleanup notes. Kill remaining processes, dismiss the completed shell record, and verify no comparison-harness shell or process remains before starting another. | ||
| 7. Locate the harness-authored document if it exists without altering it. Never author, reconstruct, complete, rewrite, or improve it. Missing or partial output remains missing or partial. | ||
| 8. On every outcome, kill remaining processes, dismiss the completed shell record, and verify no comparison-harness shell or process remains. Only after that process cleanup, copy the exact harness-visible transcript and any unchanged harness-authored document from the external target into controller-owned scratch evidence; retain target-cwd/session identity, final process status, and cleanup notes. Then remove that harness's external target root and verify it is gone before starting another harness. |
There was a problem hiding this comment.
Transcript salvage uses wrong source
Medium Severity
The new cleanup step says to copy the harness-visible transcript from the external target after dismissing the shell record. That transcript is the controller-authored disclosure record from the observed interaction, not a file in the target. Only the harness-authored document needs salvage from the external root, so this order and source can drop or miss the disclosure record.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 14deb5d. Configure here.
Why
Our
/compare-specsworkflow runs two AI products side by side on the same task to compare their output. The instructions that drive that comparison are private, sensitive context that must never leak into what either product being tested can see or touch — including via something as simple as a relative file path that happens to reach outside the test's own folder.What
How to test
npm run test:comparisonpasses.