fix: close R2/R6 governance loophole — transitive os/exec reachability #15

New issue

Closed

opened 2026-07-03 12:41:37 +00:00 by a73x · 1 comment

a73x commented

2026-07-03 12:41:37 +00:00

(Migrated from git.a73x.sh)

[claude 2026-07-03] Fixes 5d5bd5f3. The R2/R6 fitness tests matched only direct os/exec imports; an internal exec-wrapper imported by the guarded plane passed both the test and depguard. execViolations() walks the transitive internal closure (skipping the sanctioned cloudhv for R6); unit-tested on a fake graph containing the wrapper case (TDD: build-fail RED, then behavioral green). docs/architecture.md R2/R6 rows updated. make ci green.

Migrated from git-collab patche 8b92ec5f65d24cbbd78136a17d42b85610f5436f.

Original author: a73x dev@a73x.sh.

Fixes git-collab issue 5d5bd5f3

Historical merged patch. The original head and merge commits were not recorded. Forgejo cannot display a pull request without a head commit, so this record is preserved as a closed issue. The original diff is unavailable; no commit was guessed.

Original branches: fix/arch-transitive-exec → main.

[claude 2026-07-03] Fixes 5d5bd5f3. The R2/R6 fitness tests matched only direct os/exec imports; an internal exec-wrapper imported by the guarded plane passed both the test and depguard. execViolations() walks the transitive internal closure (skipping the sanctioned cloudhv for R6); unit-tested on a fake graph containing the wrapper case (TDD: build-fail RED, then behavioral green). docs/architecture.md R2/R6 rows updated. make ci green. --- Migrated from git-collab patche `8b92ec5f65d24cbbd78136a17d42b85610f5436f`. Original author: a73x <dev@a73x.sh>. Fixes git-collab issue `5d5bd5f3` **Historical merged patch.** The original head and merge commits were not recorded. Forgejo cannot display a pull request without a head commit, so this record is preserved as a closed issue. The original diff is unavailable; no commit was guessed. Original branches: `fix/arch-transitive-exec` → `main`.

a73x commented

2026-07-03 12:49:29 +00:00

(Migrated from git.a73x.sh)

Original review: comment (revision not recorded)

[claude 2026-07-03] Fresh-context reviewer verdict: ready to merge after gofmt (Important). Applied in follow-up commit: gofmt; offender-identity assertions (pins the 'via %s' diagnostics); multi-hop chain case; through-cloudhv sanction case pinned as a test (was prose); doc.go un-staled. Reviewer confirmed: allowed-skip semantics correct with no bypass, perf non-issue, _test.go placement right for the test-only package, docs accurate. make ci green. Merging per session goal.

**Original review: comment** (revision not recorded) [claude 2026-07-03] Fresh-context reviewer verdict: ready to merge after gofmt (Important). Applied in follow-up commit: gofmt; offender-identity assertions (pins the 'via %s' diagnostics); multi-hop chain case; through-cloudhv sanction case pinned as a test (was prose); doc.go un-staled. Reviewer confirmed: allowed-skip semantics correct with no bypass, perf non-issue, _test.go placement right for the test-only package, docs accurate. make ci green. Merging per session goal.