gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Plan verification gate remediation

Browse Source
This commit is contained in:
Gabriel Brown
2026-08-26 21:11:25 -04:00
parent 0d894afe3e
commit 044139ed63
2 changed files with 729 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/superpowers/specs/2026-08-26-repository-audit-remediation-design.md
+9 -5
View File
@@ -50,6 +50,7 @@ comments:
```text
hermetic tests/setup/boot-contract
live-host tests/quickshell/updates-contract
live-compositor tests/hypr/keybind-categories-contract
live-desktop tests/quickshell/settings-pages-contract
network tests/quickshell/home-assistant-helper-contract
@@ -59,6 +60,7 @@ privileged tests/setup/root-server-bootstrap-contract
The vocabulary is deliberately small:
- `hermetic`: temporary state and stubbed system commands only.
- `live-host`: reads the real machine or session without changing it or contacting a non-fixture endpoint.
- `live-compositor`: reads or reloads the running compositor, without moving windows.
- `live-desktop`: maps surfaces, moves focus or windows, or changes desktop state.
- `network`: contacts a non-fixture network endpoint.
@@ -69,7 +71,7 @@ Capabilities may be combined. `panama test --safe` runs only `hermetic` contract
`panama test` keeps its current all-contract meaning, but prints the capabilities
before each non-hermetic contract and requires a TTY confirmation. Automation must
grant each needed capability explicitly with repeatable flags such as
`--allow live-compositor --allow network`; there is no grant that means "anything."
`--allow live-host --allow live-compositor`; there is no grant that means "anything."
Pattern selection does not bypass this rule.
The existing `tests/desktop-hijacking` file is retired after its explanations move
@@ -424,9 +426,10 @@ Final repository verification includes the complete hermetic suite, Hyprland con
validation, generated-document checks, Compose rendering with fixture env files, secret
scanning, and `git diff --check`.
Live desktop checks are a separate, explicitly approved gate after all hermetic work is
green. Server cutover, service restarts, SSH reload, firewall mutation, and production
deployment are not part of this implementation branch.
Non-hermetic checks are separate, explicitly granted gates after all hermetic work is
green. `live-host` remains read-only; compositor, desktop, and network checks receive
only their named grants. Server cutover, service restarts, SSH reload, firewall mutation,
and production deployment are not part of this implementation branch.
## Audit finding ledger
@@ -493,6 +496,7 @@ This table prevents a smaller issue from disappearing behind the larger repairs.
The remediation is complete when every ledger row has a verified implementation. A row
may leave the ledger only when a failing behavioral test disproves the audit finding and
Gabriel approves that removal. The hermetic suite must be green with no hidden stderr;
no contract classified safe may touch live desktop, network, or privileged state;
no contract classified safe may read live host/compositor state or touch live desktop,
network, or privileged state;
generated documentation and configuration validators must pass; and an independent
final review must find no unresolved Critical or Important issue.