This repository was archived by the owner on Aug 24, 2026. It is now read-only.
fix: 注册层门禁硬化——issue #31 审计收敛（ADR-0022） - #32
Merged
Conversation
实装 validate.py 语义防线（不可随 golden 越过）： - capability-whitelist：agent.allow ⊆ profile.allow（变异 K–Q 拦截） - must_run 执行通道 × 工具面交叉校验（变异 A） - 执行通道词表（tool_required/platform_direct/runtime_builtin，判据 9） - event_producers seat:/agent: 引用解析（变异 F） - 场景断言防掏空：载体非空 + asserts_floor_total（变异 E） - check 降级防护：有 CI 执行点须 active（变异 G） - test-author 输出语义禁判决族（变异 I；CT-TA-004 升级 validate-executed） - profile.io_guarantees 输出契约（变异 J） - deadlock 修复：any 边不计相位出边（变异 R 由 validate 拦截） - per-change_class 相位可达性求解（C-1 分类死锁灭绝） - dispatch extra_keys 钥匙有主（C-2：owner_ratify 补生产者） - flow_ref fail-closed + external 豁免清单（D-3） - JSON Schema 语法校验（D-5）；workflow 绑定/孤儿检测（B-7） - adversary credential.impersonation 声明化（B-5） 声明侧对齐：review dispatch 表 / review.waived / card_gate.requires 条件化（C-3）/ curator 提案 deny（B-6）/ arbiter+reviewer workflow 绑定 / review-decision.json（B-4）/ wave-plan card trace_id（D-5）/ 账本类目 语义（D-4）/ maintain_loop 扫描器显式化（C-4）/ CT 3 条升级 validate-executed（D-1）。含 21 个负向回归测试（60 全绿）。
|
Warning Review limit reached
Next review available in: 9 minutes Limit details: You’ve used all 3 included reviews currently available. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (23)
Comment |
PR Summary by QodoHarden registry semantic gates and governance declarations
AI Description
Diagram
High-Level Assessment
Files changed (23)
|
Code Review by Qodo
1. Mutable profiles bypass whitelist
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+76
to
+79
| open: "外部扫描器自动开（含指标/证据/期望状态引用）——dependabot/scorecard 平台带外 | ||
| （显式依赖，体系外）；supply-audit（checks.yaml planned）激活后并入。本仓内机制 | ||
| 不自开 issue：drift-check 产 drift 报告经 owner 周审转 proposals、CT 失败经 | ||
| adversary findings、escape 经 owner——入口收敛于外部扫描器（ADR-0022 显式化， |
There was a problem hiding this comment.
1. supply-audit remains planned 📘 Rule violation ≡ Correctness
The changed maintenance-flow declaration references supply-audit, but its registry entry has status: planned rather than an approved/active status. This can make the declared issue-opening path depend on a check that is not approved for use.
Agent Prompt
## Issue description
The maintenance flow references `supply-audit` while its check registry entry is still `planned`, contrary to the requirement that referenced entries be approved.
## Issue Context
Either implement and approve/activate the check before declaring it as a flow dependency, or remove/defer the reference until that status transition occurs.
## Fix Focus Areas
- standards/flows.yaml[76-80]
- standards/checks.yaml[78-83]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+385
to
+388
| _prof_allow = set(((prof.get("capabilities") or {}).get("allow")) or []) | ||
| excess = allow - _prof_allow | ||
| if excess: | ||
| fail(f"agent:{aid} capabilities.allow 越出 profile({arch}) 白名单: {sorted(excess)}" |
There was a problem hiding this comment.
2. Mutable profiles bypass whitelist 🐞 Bug ⛨ Security
The new agent whitelist only enforces agent.allow ⊆ profile.allow, while profiles themselves are checked only against the global side-effect vocabulary, so a PR can add a privileged capability to both the profile and agent and pass validation. This defeats the advertised K–Q semantic defense and the newly promoted curator/researcher control tests, including allowing vcs_admin for curator or write capabilities for researcher.
Agent Prompt
## Issue description
Coordinated edits to an archetype profile and its agent instances bypass the new capability whitelist because the profile is treated as mutable authority and is only checked against the global vocabulary.
## Issue Context
The control tests now claim validator-enforced invariants such as curator never receiving `vcs_admin` and researcher receiving no write capability. Add explicit semantic invariants for these archetypes (or an independently protected capability policy) rather than deriving the boundary solely from the same mutable profile.
## Fix Focus Areas
- scripts/validate.py[237-241]
- scripts/validate.py[382-389]
- standards/control-tests.yaml[125-134]
- standards/control-tests.yaml[179-188]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+362
to
+363
| dep: {mode: seat, seat: test_author, extra_keys: [owner_ratify]} | ||
| schema: {mode: seat, seat: test_author, extra_keys: [owner_ratify]} |
There was a problem hiding this comment.
3. Owner ratification remains unenforced 🐞 Bug ⛨ Security
The new extra_keys: [owner_ratify] metadata is only checked for a producer or textual mention; it is never required by the verify-to-integrate transition or the reachability solver. Dependency and schema changes can therefore reach integration after gate.pass and review.approve without the declared owner third key.
Agent Prompt
## Issue description
`owner_ratify` is declared as an extra merge key for dependency and schema changes but is not consumed by the executable phase transition or validator solver.
## Issue Context
Model class-specific merge requirements structurally and ensure both the runtime transition/integrator and validator require the extra keys before integration. Merely checking that a producer name exists is insufficient.
## Fix Focus Areas
- standards/team-collaboration.yaml[310-310]
- standards/team-collaboration.yaml[362-363]
- standards/team-collaboration.yaml[371-371]
- scripts/validate.py[190-207]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+12
to
+14
| "decision", | ||
| "reviewer_seat", | ||
| "trace_id" |
There was a problem hiding this comment.
4. Waived events fail schema 🐞 Bug ≡ Correctness
reviewer_seat is unconditionally required and restricted to human seats, but review.waived is produced by mechanism:card-gate for doc/trivial changes. A truthful waived event therefore cannot satisfy the newly declared payload contract, blocking the fast paths this PR adds.
Agent Prompt
## Issue description
The review-decision schema requires a human `reviewer_seat` even for `waived` decisions produced by card-gate.
## Issue Context
Use conditional JSON Schema branches: require an appropriate human seat for approve/changes_requested, and represent the card-gate mechanism (or omit reviewer_seat and require a producer field) for waived decisions.
## Fix Focus Areas
- registry/schemas/review-decision.json[8-15]
- registry/schemas/review-decision.json[28-40]
- standards/team-collaboration.yaml[331-332]
- standards/team-collaboration.yaml[357-359]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+838
to
+842
| if not isinstance(_sch, dict) or _sch.get("type") != "object": | ||
| fail(f"schema {sp.name} 顶层须为 type: object（io 契约载体——ADR-0022）") | ||
| continue | ||
| if not isinstance(_sch.get("properties"), dict): | ||
| fail(f"schema {sp.name} 缺 properties 对象（ADR-0022）") |
There was a problem hiding this comment.
5. Schema validation misses invalid schemas 🐞 Bug ☼ Reliability
The new JSON Schema gate checks only JSON parsing and a few top-level fields, so invalid nested
schemas such as {"properties":{"x":{"type":"bogus"}}} pass validation. As a result, malformed IO
contracts can still merge despite this PR marking JSON Schema syntax validation as implemented.
Agent Prompt
## Issue description
The validator does not validate registry schemas against their declared JSON Schema metaschema, allowing invalid keyword values and malformed nested schemas.
## Issue Context
Use a Draft 2020-12 metaschema validator such as `Draft202012Validator.check_schema` for every schema, report validation errors through `fail`, and retain repository-specific checks only where they add policy beyond the metaschema.
## Fix Focus Areas
- scripts/validate.py[831-850]
- tests/test_validate.py[482-493]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+310
to
+313
| - {from: verify, to: integrate, when: "gate.pass AND (review.approve OR review.waived)"} # waived=doc/trivial | ||
| # 免 review（dispatch 表判定，card_gate 产事件）——waived≠免判卷：verifier gate | ||
| # 照跑（change-classes trivial.review 注）。ADR-0022：原"AND review.approve"使 | ||
| # review=none 类按 change_class 分类死锁（issue #31 C-1） |
There was a problem hiding this comment.
6. Waived merge copies stay stale 🐞 Bug ⚙ Maintainability
The PR adds review.waived to the canonical transition but leaves sibling machine-facing declarations requiring only review.approve. Consumers or auditors using the team orchestration or attention ledger will still treat doc/trivial merges as impossible, recreating the classification deadlock this change intends to remove.
Agent Prompt
## Issue description
Sibling merge-policy declarations still require only `review.approve` after the canonical graph adds `review.waived`.
## Issue Context
Update all copies to include waived decisions, or remove duplicated predicates and reference the canonical structured policy. Add validator coverage to prevent future divergence.
## Fix Focus Areas
- standards/team-collaboration.yaml[310-313]
- registry/teams/dev-wave.yaml[26-30]
- standards/attention-ledger.yaml[54-57]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+507
to
+511
| _must_have = ((prof.get("io_guarantees") or {}).get("output_must_have")) or [] | ||
| _missing = [k for k in _must_have if k not in _oprops] | ||
| if _missing: | ||
| fail(f"agent:{aid} 输出 schema {_out_ref} 缺 {arch}.io_guarantees.output_must_have " | ||
| f"必备字段 {_missing}（输出契约链断裂，ADR-0022）") |
There was a problem hiding this comment.
7. Guarantees permit omitted fields 🐞 Bug ≡ Correctness
io_guarantees.output_must_have is checked only against schema properties, not required, so a planner output may legally omit contracts_ref (or any other declared guarantee) while validation still passes. This defeats the new output-contract gate and allows consumers to receive incomplete wave plans.
Agent Prompt
## Issue description
`output_must_have` currently verifies only that fields are declared in schema `properties`; it must also verify that those fields are required in emitted output.
## Issue Context
The planner profile now declares `contracts_ref` as guaranteed, but `wave-plan.json` does not list it in its top-level `required` array. Thus a syntactically valid planner output can omit it.
## Fix Focus Areas
- scripts/validate.py[507-511]
- standards/archetype-profiles.yaml[94-95]
- registry/schemas/wave-plan.json[8-14]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+33
to
+35
| "rationale": { | ||
| "type": "string", | ||
| "description": "changes_requested 时必填（返工依据）" |
There was a problem hiding this comment.
8. Rejections lack mandatory rationale 🐞 Bug ≡ Correctness
The new review-decision schema states that rationale is mandatory for changes_requested, but neither the unconditional required list nor a conditional rule enforces it. A schema-valid rejection event can therefore omit the only documented rework basis and send the builder back to build without a reason.
Agent Prompt
## Issue description
The review-decision contract documents `rationale` as required for `changes_requested`, but the JSON Schema does not enforce that condition, allowing such payloads to omit the rationale.
## Issue Context
A payload containing all top-level required fields and `decision: "changes_requested"` but omitting `rationale` is accepted. This removes the stated return-work basis from a review event; add an `if`/`then` condition requiring a non-empty rationale when the decision is `changes_requested`, plus positive and negative schema tests.
## Fix Focus Areas
- registry/schemas/review-decision.json[8-15]
- registry/schemas/review-decision.json[28-35]
- registry/schemas/review-decision.json[46-46]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+75
to
+79
| review.*: {read: [team_members, scheduler, owner], write: [test_author, curator]} | ||
| # review 裁定= decision 类自述事件（合并闸门钥匙之一）； | ||
| # test_author=代码符合性（logic/dep/schema/prod）， | ||
| # curator=spike 入库审核（dispatch 表——ADR-0022）； | ||
| # payload 契约=registry/schemas/review-decision.json |
There was a problem hiding this comment.
9. Waiver producer lacks channel access 🐞 Bug ≡ Correctness
review.waived is newly declared as produced by mechanism:card-gate, but the changed review.* ACL permits writes only from test_author and curator. Consequently the card-gate cannot publish the waiver event required by doc/trivial's new verify → integrate transition, leaving those classes blocked at verify when ACL enforcement is applied.
Agent Prompt
## Issue description
The review channel ACL does not authorize the mechanism selected as the producer of `review.waived`.
## Issue Context
Doc and trivial dispatch modes depend on `review.waived` to satisfy the new verify-to-integrate condition. The declared producer is `mechanism:card-gate`, while `review.*` write access is limited to the two human/agent seats.
## Fix Focus Areas
- standards/team-collaboration.yaml[75-79]
- standards/team-collaboration.yaml[310-313]
- standards/team-collaboration.yaml[328-332]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
独立验证 issue #31（独立审计，基准 55818ef）后实施的收敛修复。当前 HEAD（012ac71/ADR-0021）复测：15/15 变异全部双门禁放行——snapshot-diff 只能拦"未同步 golden"的篡改，语义层防线确实缺失。本 PR 实装 validate.py 语义防线 + 声明侧对齐，详见 ADR-0022。
验证结论（issue #31 说法核实）
B-7、C-1C-4、D-1~D-5：属实（静态核验：verify 出边全依赖 review.*、owner_ratify 无生产者、flow_ref 无校验且 governance/ 不存在、wave-plan card 缺 trace_id 等）修复（收敛判据对照）
另含：B-2（deployer must_run→check:rollback-plan-required）、B-4（review-decision.json）、B-5（credential.impersonation + internal_flow 对齐 steps.md）、B-6（curator write_file deny）、B-7（arbiter.steps.md + reviewer workflow 绑定 + 孤儿检测）、C-3（card_gate.requires 条件化）、C-4（扫描器枚举）、D-4（账本类目语义 + ambiguity_rule）、D-5（JSON Schema 语法校验 + wave-plan trace_id）。
不修（documented，ADR-0022 决策 3）
测试