🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess - #1148

Closed

seonghobae wants to merge 34 commits into

mainfrom

sentinel-fix-b603-6842490092164470832

Commits on Aug 19, 2026

feat(integration): establish CWL ecosystem contract v1
seonghobae
committed
122c899
test(integration): expose envelope validation gaps
seonghobae
committed
a7f0805
fix(integration): reject ambiguous event identities
seonghobae
committed
2cad923
fix(integration): reject ambiguous command identities
seonghobae
committed
d08e8d7
docs(integration): adopt current async and trace baselines
seonghobae
committed
960857c
docs(doctoring): update ecosystem standards evidence
seonghobae
committed
7bdb17f
docs(adr): harden ecosystem contract decision
seonghobae
committed
e4561be
test(integration): reject reserved trace flag bits
seonghobae
committed
4a94736
fix(integration): reserve trace flag bits in event envelopes
seonghobae
committed
368e077
fix(integration): reserve trace flag bits in command envelopes
seonghobae
committed
3c86ab2
docs(integration): record reserved trace flag contract
seonghobae
committed
aaea531
docs(integration): bind trace flag semantics in ADR
seonghobae
committed
d6bc400
docs(integration): require zeroed reserved trace flags
seonghobae
committed
11e9aef
fix(integration): enforce strict RFC 3339 timestamps
seonghobae
committed
d0fde05
🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess
seonghobae
committed
c50f566
🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess
seonghobae
committed
e9f3476
fix(actions): preserve caller OIDC permission
seonghobae
committed
a797f40
🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess
seonghobae
committed
dab5242
fix(actions): preserve caller OIDC permission
seonghobae
committed
bfafc29
🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess
seonghobae
committed
36e9a8c
fix(actions): restore reusable workflow OIDC grants
seonghobae
committed
69eb621
🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess
seonghobae
committed
37c6c42
fix: grant OIDC permission to reusable workflow callers
seonghobae
committed
e29751d
🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess
seonghobae
committed
0e43672
🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess
seonghobae
committed
479557b
fix: restore reusable workflow OIDC grants
seonghobae
committed
a4d0c43
🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess
seonghobae
committed
92ad772
🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess
seonghobae
committed
c8ef795
Merge branch 'main' into sentinel-fix-b603-6842490092164470832
opencode-agent[bot]
authored
37347e5
Merge branch 'main' into sentinel-fix-b603-6842490092164470832
opencode-agent[bot]
authored
8a2ec9e
fix(automation): preserve OIDC permissions for reusable scheduler callers
seonghobae
committed
8ac2817

Navigation Menu

Uh oh!

🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess - #1148

🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess#1148
seonghobae wants to merge 34 commits into
mainfrom
sentinel-fix-b603-6842490092164470832

Commits on Aug 19, 2026

feat(integration): establish CWL ecosystem contract v1

test(integration): expose envelope validation gaps

fix(integration): reject ambiguous event identities

fix(integration): reject ambiguous command identities

docs(integration): adopt current async and trace baselines

docs(doctoring): update ecosystem standards evidence

docs(adr): harden ecosystem contract decision

test(integration): reject reserved trace flag bits

fix(integration): reserve trace flag bits in event envelopes

fix(integration): reserve trace flag bits in command envelopes

docs(integration): record reserved trace flag contract

docs(integration): bind trace flag semantics in ADR

docs(integration): require zeroed reserved trace flags

fix(integration): enforce strict RFC 3339 timestamps

🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess

🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess

fix(actions): preserve caller OIDC permission

🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess

fix(actions): preserve caller OIDC permission

🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess

fix(actions): restore reusable workflow OIDC grants

🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess

fix: grant OIDC permission to reusable workflow callers

🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess

🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess

fix: restore reusable workflow OIDC grants

🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess

🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess

Merge branch 'main' into sentinel-fix-b603-6842490092164470832

Merge branch 'main' into sentinel-fix-b603-6842490092164470832

fix(automation): preserve OIDC permissions for reusable scheduler callers

Commits on Aug 20, 2026

🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess

fix(automation): restore caller OIDC grants after Sentinel refresh

🛡️ Sentinel: [MEDIUM] Fix B603 by explicitly defining shell=False in subprocess