Repository navigation
fix(policy): v1.2.37 capture live lexical delta D1/D2/D2e — env-pin bindings + empty git -c options (t_9412d7d5) - #56
Open
maximalang wants to merge 1 commit into
Conversation
…_9412d7d5) The deployed live clone drifted from trunk again: an uncommitted classifier patch (source card t_f6acc5dc, archived; the code existed in no commit or branch, git log --all -S empty) sat in its working tree on top of trunk policy.py, with tests/test_policy_lexical_delta.py untracked beside it. Post-merge QA finding F-A (t_85547708) flagged the repeat of the live-clone-as-sole-carrier pattern from the v1.2.32->34 rescue: any reinstall or checkout to trunk would have lost the fix the running gate already relies on. Captured byte-exact onto trunk 2f2f5ee (v1.2.34): policy.py staged blob cac7780 and test blob 95d7b60 both equal the live canonical blobs (git hash-object in the live repo). The live clone was NOT modified - read-only capture; controlled apply follows the merge. D1 (F1, run2166 call19 class): an EMPTY-value dotted git -c config assignment (option reset/disable, e.g. an empty helper value) is a config-key NAME, not a filesystem operand; only that form directly after git -c is exempt, every non-empty value stays guarded. D2 (F2, run2172 call26 class): dispatcher worker env-pin bindings (HERMES_KANBAN_DB/_BOARD/_TASK/_WORKSPACE/_WORKSPACES_ROOT, HERMES_TENANT) as NAME=value tokens bind a child process and mutate no store; unknown env names carrying a store path stay denied. D2e (fail-closed tightening): when the same command expands a bound pin ($PIN/${PIN}), the bound value re-enters the path-guard subjects, so expansion cannot smuggle a store path past the guard - a shape previously allowed is now denied. Tests: tests/test_policy_lexical_delta.py (captured from the live clone, 13 tests) - FP recurrences F1/F2/F2b plus TP controls proving no weakening. Full battery on this branch (Windows, uv, CPython 3.12.14, mirrors CI): pytest tests/ 901 passed plain and under HERMES_KANBAN_TASK=t_ci_simulated; check_version_uniqueness collision false (1.2.37, released_max 1.2.34); uv lock --check; compileall; drift-check ok:true; fleet-policy --version 1.2.37; build-bundle + verify-bundle green. Version 1.2.37: 1.2.35/1.2.36 are claimed by open PRs #54/#55; policy.py may overlap textually with #54 - merge sequencing is the owner's call.
maximalang
added a commit
that referenced
this pull request
Oct 6, 2026
- version pins 1.2.36 -> 1.2.39 (pyproject.toml, root plugin.yaml, integrations plugin.yaml, src/fleet_policy/__init__.py, uv.lock, tests/test_hardening_v121.py); 1.2.37/1.2.38 are claimed by open PRs #56/#57, so the next free version is taken per the collision rule. - tests/test_v1236_router_hook.py: ROUTER_LIVE_SHA pin follows the canonical router bytes (v2.2 1ae2e34d... -> v3 5d24308d...). - CHANGELOG.md: new [1.2.39] section documenting the ROUTES v3 repo copy. Local CI rehearsal on this tree: pytest tests/ 913 passed; uv lock --check OK; compileall OK; drift-check ok:true; build-bundle + verify-bundle ok:true (84 files); fleet-policy --version 1.2.39; router selftest on the exact blob ALL PASS (18 cases + 7 structural, exit 0).
This was referenced Oct 6, 2026
Owner
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Post-merge QA of v1.2.34 (card t_85547708, finding F-A HIGH) found the deployed
live clone drifted from trunk again: an uncommitted classifier patch — the "lexical
delta" D1/D2/D2e from card t_f6acc5dc (archived) — sat in its working tree on top of
trunk
src/fleet_policy/policy.py, withtests/test_policy_lexical_delta.pyuntracked beside it.
git log --all -S _ENV_PIN_BINDINGwas empty: the code existedin no commit, no branch, no remote. This repeats the "live clone is the sole carrier"
pattern of the v1.2.32→34 rescue; any reinstall or checkout to trunk would silently
lose a fix the running gate already relies on.
Card: t_9412d7d5 (fleet-ops, task_type code).
What
Byte-exact capture of the delta onto trunk
2f2f5ee751b13539a092b980e1dc67bd0bad1b00(v1.2.34), commit66bcbaa7b5f9964351c41d3bac144eef526b09d3:src/fleet_policy/policy.py— committed blobcac7780534e6439fd7d30d0a257758da4f7de27d== live canonical blob (git hash-objectin the live repo, == QA F-A evidence).tests/test_policy_lexical_delta.py— committed blob95d7b609e5dee747bb12a69c060fc410051fc13d== live canonical blob. The test was never tracked and never ran in CI before; it runs in this PR (13 tests).Delta semantics (details in CHANGELOG
[1.2.37]):git -cconfig assignment (option reset/disable) is exempt from filesystem-operand treatment; every non-empty value stays guarded (fail-closed).$PIN/${PIN}), the bound value re-enters the path-guard subjects — a shape previously ALLOWED is now denied.Verification (local battery mirroring CI; Windows, uv 0.12.7, CPython 3.12.14)
uv sync --frozen --all-groupsuv run --frozen python -m pytest tests/ -qHERMES_KANBAN_TASK=t_ci_simulatedpytest tests/test_policy_lexical_delta.py -vscripts/check_version_uniqueness.py --root .{"collision": false, "released_max": "1.2.34", "version": "1.2.37", "colliding_refs": [], "unverified_refs": []}, exit 0uv lock --checkcompileall -q src tests scripts integrationsfleet-policy --root . drift-check{"missing": [], "ok": true}, exit 0fleet-policy --version{"version": "1.2.37"}, exit 0build-bundle/verify-bundleok: true, exit 0uv buildventures_fleet_policy-1.2.37, exit 0git ls-tree HEADblobs == live canonical hashes (above)Merge notes
policy.pymay overlap textually with PR fix(policy): v1.2.35 quoted file-operand path-guard subjects — close F1/F2 control-plane bypass (t_c7b8189d) #54 (v1.2.35, quoted-operand path-guard subjects); sequencing is the owner's call. This capture is intentionally minimal on trunk.