Skip to content

fix(spawn): scrub secret baseline env from crew launches - #85

Merged
quinnbot-ai merged 12 commits into
mainfrom
fm/fm-spawn-env-scrub-landing
Aug 3, 2026
Merged

quinnbot-ai merged 12 commits into
mainfrom
fm/fm-spawn-env-scrub-landing

Conversation

@quinnbot-ai

@quinnbot-ai quinnbot-ai commented Aug 3, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • fail closed before fleet mutation unless the operator secret baseline can be parsed completely
  • scrub every baseline secret variable and BASH_ENV across harness, raw, and secondmate launch boundaries
  • preserve required launch state including GOTMPDIR, HOME, and PATH while excluding unset -f function names
  • add focused regression coverage for declaration forms, failure modes, all harnesses, and actual child environments

Validation

  • no-mistakes review, focused tests, documentation audit, and lint completed on 6be7b43
  • review fixes R1-R7 and Bash 3.2 portability fix retained in pipeline-owned commits

Pipeline

Updates from git push no-mistakes

@quinnbot-ai quinnbot-ai closed this Aug 3, 2026
@quinnbot-ai quinnbot-ai reopened this Aug 3, 2026
@quinnbot-ai
quinnbot-ai force-pushed the fm/fm-spawn-env-scrub-landing branch from 6be7b43 to 4590dcf Compare August 3, 2026 17:40
@quinnbot-ai
quinnbot-ai merged commit 06afaf2 into main Aug 3, 2026
11 checks passed
quinnbot-ai added a commit that referenced this pull request Aug 10, 2026
* fix: scrub baseline secrets from crew launches

* no-mistakes(review): Harden crew launch secret scrubbing

* no-mistakes(review): Close remaining secret scrub bypasses

* no-mistakes(review): Preserve launch environment for function unsets

* no-mistakes(review): Guard empty arrays on Bash 3.2

* no-mistakes(document): Document BASH_ENV secret-scrub behavior

* no-mistakes(lint): Resolve spawn scrub ShellCheck warnings

* test: adapt scrub coverage to fork launch helpers

* test: provision isolated spawn baselines

* test: isolate Herdr spawn baseline

* ci: seed Herdr spawn baseline

* test: inspect scrubbed secondmate launches

---------

Co-authored-by: QuinnBot <quinnbot@proton.me>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant