fix(security): differential gate + immediate VEX so every CVE resolves - #88
Merged
Merged
Conversation
git-steer stopped landing fixes because the ADR-005 gate held good security fixes for reasons unrelated to the bump. This restores the simple contract: if there's a fix, apply it; if there isn't, VEX it until one exists. Three changes, all in the shared remediation path (every caller benefits): 1. Differential gate (run-gate.mjs + verify-functional-form.yml). The gate now checks the BASE branch too and only counts a dimension as NO-GO when it REGRESSES (passed on base, fails on fix). Pre-existing repo debt — a missing test file, a broken monorepo import, an already-red build — no longer holds a fix it didn't cause. (Unsticks commit-relay: BUILD passes, the held TEST/SMOKE were already failing on main.) Genuine regressions still produce NO-GO. 2. --legacy-peer-deps fallback in the gate's npm install. An ERESOLVE peer conflict is npm being strict, not the fix being unsafe. (Unsticks DriveIQ's vite/@vitejs/plugin-react peer conflict.) 3. Terminal disposition in escalate-remediate.mjs. A no-op fall-out (worker can't bump a transitive dep) now gets a VEX `under_investigation` on the FIRST sweep instead of looping to the hard-stop; the residual escalates to `affected` at threshold and lifts to `fixed` on clear. No CVE sits in limbo. Also drop the stale ry-ops/blog entry from dispatch-fixes.mjs (transferred to fabric-forge/blog, out of the managed fleet). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
git-steer stopped landing CVE fixes. Diagnosis: the automation was running fine, but the ADR-005 functional-integrity gate was holding good security fixes for reasons unrelated to the bump, so every repo with any pre-existing breakage froze after 3 NO-GO sweeps. This PR restores the simple contract:
Evidence (from the frozen fleet)
npm test→ test file missing on main too; SMOKE → broken monorepo import on main toonpm installhit a vite peer-dep conflict; never retried--legacy-peer-depsWhat changed (all in the shared remediation path — every caller benefits)
run-gate.mjs+verify-functional-form.yml): gate the base branch too; a dimension is only NO-GO if it regresses (passed on base, fails on fix). Pre-existing failures are neutralized and reported as such. Genuine regressions still produce NO-GO (verified).--legacy-peer-depsfallback in the gate's npm install ladder (npm ci→npm install→npm install --legacy-peer-deps).escalate-remediate.mjs): a no-op residual gets VEXunder_investigationon the first sweep; escalates toaffectedat the hard-stop threshold; lifts tofixedon clear. Nothing sits in limbo.ry-ops/blogfromdispatch-fixes.mjs(transferred tofabric-forge/blog, out of the managed fleet).Testing
npm run buildclean;npm test42 passed / 3 skipped.🤖 Generated with Claude Code