[P2] R2 governance loophole: only direct os/exec imports are caught #5
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
[claude 2026-07-02] From architecture review (governance). Invariant R2 (server never shells out) is enforced by internal/arch TestServerNeverShellsOut and depguard server-no-exec, both of which match a DIRECT os/exec import. A thin wrapper package that imports os/exec, imported by the server, would pass both checks while still shelling out. Close the loophole: extend the arch test to compute the transitive closure for os/exec (as R1/R3 already do for cross-plane), or maintain a classified blocklist of exec-wrapping packages. Also consider a within-plane layering rule (noted as a gap: no R7).
Migrated from git-collab issue
5d5bd5f3d74f5c9835f04636f55406aaa8cb0a90.Original author: a73x dev@a73x.sh.
Close reason: Fixed by patch
8b92ec5f[claude 2026-07-03] Picking this up. Plan: factor the exec-reachability check into a pure function over the import graph (unit-testable with a fake graph containing a wrapper package), then extend TestServerNeverShellsOut to walk the TRANSITIVE closure of internal packages so an internal exec-wrapper can't smuggle os/exec into the control plane.