Skip to content

Stamp Each Host With What It Carries, and Reject the Flags the Installer Ignored#665

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ptr727 merged 12 commits into from
Aug 11, 2026
Merged

Stamp Each Host With What It Carries, and Reject the Flags the Installer Ignored #665

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
0bd5d2d
Stamp Each Host With What It Carries, and Reject the Flags the Instal…
ptr727 Aug 11, 2026
f938b0e
Pin the New Test to LF, and Name It in the Line That Enumerates the Pins
ptr727 Aug 11, 2026
6583586
Compare the Installed Bytes, Not Just the Markers That Delimit Them
ptr727 Aug 11, 2026
f2986d1
Merge remote-tracking branch 'origin/develop' into feature/host-stamp
ptr727 Aug 11, 2026
065bbe6
Say Where These Gates Live, Now That Three of Seven Are Not in scripts/
ptr727 Aug 11, 2026
6ca851e
Digest What Gets Installed, Not the Bytes on Either Side of the Strip…
ptr727 Aug 11, 2026
bf5abb0
Validate the Stamp's Shape, Not Just Which Keys It Has
ptr727 Aug 11, 2026
dc0451a
Check That the Kit Is Wired In, Not Only That Its Bytes Are Right
ptr727 Aug 11, 2026
23e80ac
Judge Marker Corruption Against the File, and Collapse a Duplicate on…
ptr727 Aug 11, 2026
6894146
Normalize a Bare CR Too, Through One Helper Both Digests Share
ptr727 Aug 11, 2026
3894a87
Catch the Decode Error Too, at Both Reads That Parse a File
ptr727 Aug 11, 2026
25cf480
Derive the Payload List From the Block List, So a New Snippet Cannot …
ptr727 Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .gitattributes
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -18,13 +18,14 @@ catalog/snippets/husky/pre-commit text eol=lf

# Vanilla `.py` follows the CRLF default, since Python's universal newlines accept CRLF and it is commonly edited on Windows.
# Pin LF only for a `.py` executed directly via its shebang, by path.
# Those are the CI validation entry point, the fleet-audit runner, the agent-safety hook and its installer, and the repo lint and review scripts with their tests.
# Those are the CI validation entry point, the fleet-audit runner, the agent-safety hook and its installer with the installer's tests, and the repo lint and review scripts with their tests.
# Do not re-add a blanket `*.py text eol=lf`.
spec/validate.py text eol=lf
spec/audit.py text eol=lf
spec/fidelity_honesty.py text eol=lf
host-setup/agent-safety/gh-write-guard.py text eol=lf
host-setup/agent-safety/install.py text eol=lf
host-setup/agent-safety/test_install.py text eol=lf
scripts/prose_lint.py text eol=lf
scripts/repo_gate.py text eol=lf
scripts/pr_review.py text eol=lf
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/validate-task.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -60,7 +60,8 @@ jobs:
done
python3 spec/validate.py

# Each gate in scripts/ is proven by a case that reintroduces the fault it catches.
# Each gate here is proven by a case that reintroduces the fault it catches, wherever it lives.
# Three of these are host-setup/ rather than scripts/, since the agent-safety kit is gated the same way.
# Standard library only, so no install step and no dependency to pin.
# The audit engine self-test is offline, so it runs here rather than only on an owner sweep.
# The write-guard self-test is offline too, and it otherwise runs only when a host installs the hook, which is where a regression in it would surface as a broken machine.
Expand All@@ -73,6 +74,7 @@ jobs:
python3 scripts/test_pr_review.py
python3 spec/audit.py --selftest
python3 host-setup/agent-safety/gh-write-guard.py --selftest
python3 host-setup/agent-safety/test_install.py

- name: Check repo gates step
run: python3 scripts/repo_gate.py
Expand Down
Loading