From ac8235ca58fb901d977a86b10e289be96cd2e289 Mon Sep 17 00:00:00 2001 From: Defame1297 Date: Sun, 21 Jun 2026 01:33:34 +0000 Subject: [PATCH] fix(gitleaks): suppress Token routing false positive; sync allowlists; update roadmap MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gitleaks false positive (U1, Gitea issue #2): - 'Token routing: Haiku/Sonnet/Opus' in ai-coding-factory-session.md:90 triggers generic-api-key on entropy match of "Token". Not a credential. - ROADMAP.md now documents this pattern and triggers the same rule. - Both .gitleaks.toml (deployed, read by hook) and scripts/gitleaks.toml (source for setup-gitleaks.sh deploys) updated and aligned. Previously out of sync — deployed file had docs/research/.* already; source did not. ROADMAP.md: governance workstream Phase 2 expanded with 7 immediately- actionable test suite gaps and 5 Chunk 6 CI gaps, all mapped to CONTROLS.md requirements. Housekeeping updated with audit entry. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01Gv5iNACZxumtF2k6TsK18q --- .gitleaks.toml | 10 ++++++++-- docs/ROADMAP.md | 20 +++++++++++++++++++- scripts/gitleaks.toml | 20 ++++++++++---------- 3 files changed, 37 insertions(+), 13 deletions(-) diff --git a/.gitleaks.toml b/.gitleaks.toml index f740e1d..7877201 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -23,5 +23,11 @@ useDefault = true # stopwords = ["example", "placeholder", "changeme"] [allowlist] -description = "research session notes — no secrets, high-entropy text from terminal captures" -paths = ['''docs/research/.*'''] +description = "Known false positives — prose patterns and research session notes" +# docs/research/: high-entropy text from terminal captures in session notes +# docs/ROADMAP.md: documents known false positives, triggering the same rules +# ai-coding-factory-session.md:90 specifically: 'Token routing: Haiku/Sonnet/Opus' +paths = [ + '''docs/research/.*''', + '''docs/ROADMAP\.md''', +] diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index 8bdc15a..60de79d 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -41,6 +41,22 @@ A parallel workstream (not a numbered chunk) that runs alongside the chunk seque - Pre-commit hooks, CI gates, secret scanning, licence scanning, audit logging infrastructure, human approval gates in CI/CD - Specification: `docs/research/governance_principles/CONTROLS.md` +**Pre-Chunk 6 test suite work** (no CI required — can be done now; see Gitea issue #2 for full context): +- Fix U1 first: add gitleaks.toml allowlist entry for `docs/research/ai-coding-factory/ai-coding-factory-session.md:90` (`Token routing: Haiku/Sonnet/Opus` triggers `generic-api-key` false positive; pre-commit hook blocks commits on all machines with gitleaks installed) +- `tests/test-plugin-validate.sh` — run `claude plugin validate --strict` on all plugins and marketplace manifests; add the same check to the pre-push hook alongside `check-manifests.sh` +- `tests/test-hook-integrity.sh` — verify `.git/hooks/pre-commit` is installed, executable, and contains the expected idempotency markers; distinct from `test-setup-hooks.sh` which tests the setup script, not the installed artifact +- `tests/test-gitleaks-scan.sh` — run `gitleaks detect` against the repo and assert exit 0; validates `gitleaks.toml` allowlist correctly suppresses known false positives (requires U1 fix first) +- `tests/test-inventory-crossrefs.sh` — run `inventory.sh` against the live repo; assert zero `../` cross-reference warnings in post-refactor skills; triage the 11 current warnings (U4: determine which are in Chunk 3 rebuild targets vs. post-refactor skills that should be self-contained) +- `tests/run-all-tests.sh` — single entry point that runs every test in `tests/`; needed for both developer use and future CI integration +- Extend `test-governance-layer.sh` — add structural checks that CONTROLS.md-required controls are in place (gitleaks wired to pre-commit, hook executable, plugin validation passes strict mode); current checks verify governance files exist but not that controls are enforced + +**Chunk 6 CI gaps** (require CI pipeline; implement during Chunk 6 grill): +- Secret scanning in CI — CONTROLS.md: "Pre-commit hooks can be bypassed; CI cannot. Both layers are required." +- Dependency/security scanning in CI pipeline +- Licence scanning in CI pipeline (must cover code content, not just declared deps — relevant for AI-generated/adopted code) +- Human approval gate in CI/CD for any pipeline applying production changes +- Audit logging for agentic workflows (every state-modifying workflow must produce a tamper-evident log per CONTROLS.md) + ## Chunk table | Chunk | Scope | Why this order | @@ -107,13 +123,15 @@ Items consciously not resolved — to be addressed in the relevant chunk PRD or - **AI coding factory integration** — grill complete. Decision record: `docs/notes/factory-integration-decisions.md`. ADRs: 0008 (factory boundary), 0009 (flat taxonomy), 0010 (role skills vs subagents). Follow-on issues: ~~0013 (LESSONS.md)~~ ✅, ~~0014 (docs/spec/ + VISION.md refactor)~~ ✅. Chunk 3 scope substantially expanded — skills rebuild, new skills, IaC/Gitea skills. See updated chunk table above. -- **`.gitkeep` files** — placeholder files exist in `core/agents/`, `core/workflows/`, `core/prompts/`, `docs/ard/`, `docs/bug/`. Remove each when the first real file is added to that directory. Each `.gitkeep` names the chunk that will populate it. (`docs/notes/.gitkeep` already removed — directory has real content.) +- **`.gitkeep` files** — placeholder files exist in `core/agents/`, `core/workflows/`, `core/prompts/`. Remove each when the first real file is added to that directory. Each `.gitkeep` names the chunk that will populate it. (`docs/notes/.gitkeep` already removed — directory has real content. `docs/ard/.gitkeep` and `docs/bug/.gitkeep` removed 2026-06-21, commit `34c93d9` — directories pending first real ARD and Bug Brief.) - **Skills pipeline verified** — `install.sh` deploys 13 skills directly to `~/.agents/skills/` and creates `~/.claude/skills/ → ~/.agents/skills/` symlink adapter. Tested idempotent. `skills-lock.json` removed (was a manual artifact). 4 additional skills (`write-eval`, `write-skill`, `create-plugin`, `marketplace-architect`) are in the `kyberforge` plugin — install separately via `claude plugin install kyberforge@holocron`. If `~/.claude/skills/` exists as a real directory on a machine being migrated, remove it manually and re-run install. - **Chunk 2 behavioral tests** — run and fully resolved 2026-05-17. 7/8 pass; scenario 4 (push confirmation) inconclusive — no remote in test environment, rule tightened but unverified. All fixable failures addressed: rule specificity in `providers/claude-code/CLAUDE.md`; context-loading guarantee via `@import CONTEXT.md` in repo CLAUDE.md; standing rule in CONTEXT.md to check `docs/adr/` and ROADMAP resolved entries before answering design questions. Chunk 2 ✅ complete. - **Governance Phase 1 behavioral tests** — run 2026-05-17. 3/4 testable scenarios pass. Secrets rule gap fixed (2026-05-17): extended to cover credential reproduction in response text and examples, with placeholder requirement added to `core/instructions/governance.md`. HITL scenario not testable in this environment (Nginx not installed); HITL gap evidenced by instructions test scenario 4 — push confirmation rule fix addresses the same root cause. Governance Phase 1 ✅ complete. - **AI ethics/security workstream** — `docs/notes/ai-ethics-security-principles.md` exploration note is superseded. Governance Phase 1 (`core/instructions/governance.md`) covers all planned scope: credentials, data classification, HITL, scope discipline, agent autonomy, transparency, and security code review. Tier-placement architectural question resolved by the `@import` always-on model. No separate workstream needed. - **Chunk 3 grill complete** — 2026-05-17. PRD at `docs/prd/chunk-3-skills-library.md`. Key decisions: 42-skill target library, AGENTS.md refactor as prerequisite issue (both CLAUDE.md files become thin adapters), git-cliff for changelog, provider-agnostic issue tracker abstraction, grill-me/grill-lean design phase split, factory bootstrap order (write-eval → write-skill → write-docs phase 2 → write-adr → remaining factory → design → parallel category groups). ADRs written: 0011 (provider-agnostic issue tracker), 0012 (AGENTS.md governance entry point, partially supersedes ADR-0005). Upstream review cadence: per-skill + quarterly post-roadmap (per-chunk-start changed to per-skill by issue 0016 grill). **Issues created 0015–0028** — all HITL; ~~0015 (AGENTS.md refactor, prerequisite)~~ ✅, ~~0016 (skill workflow grill, produces conventions for 0017–0028)~~ ✅, ~~0017 (bootstrap skill: write-eval)~~ ✅ HITL complete (HOTL 2026-05-26), ~~0018 phase 1 (write-skill)~~ ✅ HITL complete (HOTL 2026-05-26), ~~0018 phase 2 (write-docs — first factory-authored skill)~~ ✅ HITL complete (HOTL 2026-05-26), **0018 phase 3** (doc convention — open, do before 0019), 0019 (remaining factory skills), 0020–0027 (design/implement/test/review/deploy/operate/iac/cross-cutting), 0028 (chunk closure). ~~Acceptance criteria for 0017–0028 to be refined after 0016 grill session.~~ ✅ Refined 2026-05-17 — see `docs/notes/skill-implementation-workflow.md`. +- **Test suite audit (2026-06-21)** — full automated check run via 6 parallel subagents. All 77 existing test cases pass. Three fixes applied and committed (`ce7dd15`, `247bd4a`, `a3ff72c`): shellcheck `-x` flag + `source=` path correction in `install.sh` (SC2115 + SC1091 pre-hook blocker), kyberforge plugin version field, `agents/README.md` moved to `docs/adding-agents.md`. One additional gap found and fixed during commit flow: `setup-hooks.sh` was calling `shellcheck` without `-x`. Four untracked issues remain (U1–U4) and seven test-suite structural gaps identified against `docs/research/governance_principles/CONTROLS.md` — none blocking Chunk 3 work. Full details in Gitea issue #2. Pre-Chunk 6 test work itemised in the Governance workstream section above. + - **Pre-0019 cleanup (do before starting 0019):** Three items from 0018 open threads that must be resolved before the remaining factory skills are built with `write-skill`: 1. **0018 phase 3** — `/grill-me` → `docs/notes/doc-convention.md` → update `write-docs` output format → `CONTEXT.md` if convention becomes a standing principle. Tracked in `docs/issues/0018-factory-write-skill.md` acceptance criteria. 2. **write-eval refactor** — bring `write-eval` to the 6-section / META.md standard (currently follows the old 8-section format with provenance fields in SKILL.md frontmatter). Now lives at `plugins/kyberforge/skills/write-eval/SKILL.md`. Open thread from 0018 handoff note #4. Use `write-skill` (also in `kyberforge` plugin) to author the refactored version. diff --git a/scripts/gitleaks.toml b/scripts/gitleaks.toml index 97b8fa8..ab7c8d8 100644 --- a/scripts/gitleaks.toml +++ b/scripts/gitleaks.toml @@ -12,13 +12,13 @@ useDefault = true # Global allowlist — applies to all rules. # Note: uses [allowlist] (v8 syntax). v8.25.0+ uses [[allowlists]] (array of tables). # Add path regexes or stopwords to suppress known false positives. -# -# Example: ignore test fixtures -# [allowlist] -# description = "test fixtures" -# paths = ['''tests/fixtures/.*'''] -# -# Example: ignore a known false-positive secret value -# [allowlist] -# description = "placeholder values in docs" -# stopwords = ["example", "placeholder", "changeme"] + +[allowlist] +description = "Known false positives — prose patterns and research session notes" +# docs/research/: high-entropy text from terminal captures in session notes +# docs/ROADMAP.md: documents known false positives, triggering the same rules +# ai-coding-factory-session.md:90 specifically: 'Token routing: Haiku/Sonnet/Opus' +paths = [ + '''docs/research/.*''', + '''docs/ROADMAP\.md''', +]