dev → main: v0.2.0 release promotion#17
Open
gnanirahulnutakki wants to merge 627 commits into
Open
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
gnanirahulnutakki
added a commit
that referenced
this pull request
May 26, 2026
…o/sigs.k8s.io/controller-runtime-0.24.0 deps(go)(deps): bump sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.0 in /go
gnanirahulnutakki
changed the title
This was referenced Jun 23, 2026
This was referenced Jun 29, 2026
Upstream govulncheck DB now flags golang.org/x/text v0.38.0 via the StatusClient.fetchStatusList -> http.Client.Get -> norm.Form.String call chain in go/pkg/credential/status.go. This blocks the 'tests' required dev-branch CI context. Bump to v0.39.0 (patched). go mod tidy also updates the transitive golang.org/x/tools v0.46.0 -> v0.47.0 for consistency. No code changes. All Go tests pass.
Claude Code treats exit code 1 as a non-blocking error, which means the
tool call proceeds without a policy decision. The previous main() returned
exit code 1 on malformed JSON, oversized input, and handler crashes,
silently bypassing governance on any of those paths.
The handler-crash path was especially exploitable: map_tool_call runs
before the try/except block in handle_pre_tool_use, so unusual tool_input
that triggers an unhandled exception would escape to main()'s catch-all
and silently allow the tool call.
Fix: every PreToolUse error path now emits a protocol-valid deny
(hookSpecificOutput/permissionDecision=deny) on stdout with exit code 0.
PostToolUse and subagent phases emit {"continue": true} since they cannot
block. Diagnostic detail (structured input-error JSON, crash message)
moves to stderr for operator troubleshooting.
Also wraps json.dumps(output) in try/except to fall back to deny if the
handler returns a dict containing a non-serializable value.
Regression tests: handler-crash deny, post-crash continue,
non-serializable-output deny, updated malformed-input and oversize-stdin
tests for the new fail-safe behavior.
…ench-label auditbench-oracle: refactor main() to testable run(args, stdout, stderr) with exit-code constants matching ardur-agent-recognition-eval/benchmark pattern; replace bare == "" checks with strings.TrimSpace() for -in/-out. auditbench-label: replace bare == "" checks with strings.TrimSpace() in runBundle (-study-id/-view/-source/-out) and runAdjudicate (-study-id/-annotations/-out). Add table-driven whitespace/positional-arg rejection tests for both commands. Mirrors the Python CLI type=str + not value.strip() guard. Verified: go test + go vet green for both packages and full ./cmd/... tree.
…hmark, ardur-agent-recognition-eval, ardur-exec-shim ardur-agent-recognition-benchmark: replace bare == "" with strings.TrimSpace() for the six required flags (daemon-bin, reference-daemon-bin, workload-bin, source-sha, reference-source-sha, output-dir) in the run() validation block. ardur-agent-recognition-eval: replace bare path == "" with strings.TrimSpace() in loadCorpus and loadThresholds so a whitespace-only -corpus/-thresholds value falls back to the embedded corpus/thresholds instead of attempting to open a file literally named " ". ardur-exec-shim: extract validateArguments(sessionID, args) helper and replace the bare *sessionID == "" guard in main() with a strings.TrimSpace() check, mirroring the auditbench-oracle testable-run refactor pattern. Add table-driven whitespace rejection tests for all three commands. exec-shim tests are //go:build linux to match the package; they compile+vet under GOOS=linux and execute in CI's Linux environment. Verified: go test + go vet green for the three packages (exec-shim via GOOS=linux compile/vet; benchmark+eval run natively).
Wrap all required path/string flag checks with strings.TrimSpace() across seal/verify/score subcommands (8 studyPaths fields + seal/sealed-at/seal/ result/out). Adds table-driven tests covering every required flag × 3 whitespace variants. Matches landed siblings: auditbench-oracle, auditbench-label, ardur-agent-recognition-benchmark/eval, ardur-exec-shim.
…hcheck ardur-seccomp-smoke: extract validateRequiredPaths(daemonBin, shimBin) helper and replace the bare *daemonBin == "" || *shimBin == "" guard in main() with a strings.TrimSpace() check, mirroring the exec-shim validateArguments refactor pattern from commit 23047fb. benchcheck: extract shouldUseDefaultPackDir(arg) helper and replace the bare packDir == "" fallback with strings.TrimSpace() so a whitespace-only positional argument (e.g. " ") falls back to the detected default instead of being passed to live.EvaluatePack as a literal directory name. Add table-driven whitespace rejection tests for both commands. The seccomp-smoke test is //go:build linux to match the package; it compiles+ vets under GOOS=linux and executes in CI's Linux environment, matching the exec-shim test discipline. Verified: go vet ./... clean; go test ./cmd/benchcheck/... passes (8 subtests); GOOS=linux go vet ./cmd/ardur-seccomp-smoke/... clean and GOOS=linux go test -c compiles the test binary. Matches landed siblings: auditbench-oracle, auditbench-label, ardur-agent-recognition-benchmark/eval, ardur-exec-shim, auditbench-score.
Behavior-preserving cleanup of 7 CodeQL quality-level alerts (zero security severity) across 5 test files: - test_doctor_claude_code_paths.py: remove unused import subprocess and unused captured = capsys.readouterr() in one function - test_preflight_tool_server_paths.py: remove unused rc assignment - test_personal_native_host_paths.py: remove unused rc assignment - test_personal_firewall_demo_paths.py: remove unused rc and rendered assignments - test_anchor_paths.py: remove unused rendered assignment All 5 files focused tests pass (33/33) and the full Python suite passes (2065/25-skip).
7 tasks
Close the v0.2.0 release-readiness gaps with auditable dependency evidence, reproducible verification, package policy tests, and synchronized documentation. Signed-off-by: Gnani Rahul Nutakki <gnani.nutakki@gmail.com>
Resolve all pre-existing Ruff and ShellCheck findings, add a regression for the selected-Python graph compile path, and retain mandatory formatter output only in affected files. CodeRabbit-adjacent pre-existing findings are tracked separately in #366 and #367. Signed-off-by: Gnani Rahul Nutakki <gnani.nutakki@gmail.com>
Inherit and validate the closed MIC policy bundle on supported child derivation, and enforce exact parent-aware verification. Keep the DRP mapping inventory synchronized with the newly signed child claims. Tests: 217 passed across passport, delegation, MIC, proxy, HTTP, and DRP mapping suites. Signed-off-by: Gnani Rahul Nutakki <gnani.nutakki@gmail.com>
…gated-mic-claims fix(security): preserve MIC claims across delegation
Issue signed MIC-State and MIC-Evidence passports, assert exact fail-closed outcomes, and prove downgraded profiles cannot satisfy the showcase assertions. Reflect annotated setup, call, and teardown failures in the human-readable showcase footer so pytest failures cannot be reported as ALL GOOD. Signed-off-by: Gnani Rahul Nutakki <gnani.nutakki@gmail.com>
…showcase test: make MIC showcase exercise signed enforcement
Preserve each original assistant turn around its ordered tool calls, emit current Ollama tool result fields, and fail honestly when a follow-up request is rejected. Tests: 21 passed, 10 skipped, 5 pre-existing PytestRemovedIn10Warning warnings tracked by #371. Signed-off-by: Gnani Rahul Nutakki <gnani.nutakki@gmail.com>
Only an explicit PERMIT now produces a successful simulated tool result. DENY is reported as denied, while missing, unusable, or non-200 evidence is reported as unknown without changing the existing HTTP-200 evaluation counter. Tests: 29 passed, 10 skipped, 5 pre-existing PytestRemovedIn10Warning warnings tracked by #371. Signed-off-by: Gnani Rahul Nutakki <gnani.nutakki@gmail.com>
…i-tool-turn test: preserve multi-tool assistant turns
Hoist tracker/operator_id initialization before the if/else block so both variables are always defined. Remove the now-redundant else branch that set them to None — identical behavior, but CodeQL no longer flags operator_id as potentially unbound. Closes CodeQL alert #289 (py/unused-local-variable at proxy.py:3842).
Convert all seven class-scoped autouse showcase fixtures to pytest supported class methods so their setup remains class-wide after pytest 10 removes instance-method support. Tests: 29 passed, 10 skipped with PytestRemovedIn10Warning promoted to an error. Checkpoint: architect/sessions/release-v0.2.0-qualification/2026-07-22-journal.md Signed-off-by: Gnani Rahul Nutakki <gnani.nutakki@gmail.com>
…st-fixtures test: migrate showcase class fixtures for pytest 10
Checkpoint: architect/sessions/release-v0.2.0-qualification/2026-07-22-journal.md Signed-off-by: Gnani Rahul Nutakki <gnani.nutakki@gmail.com>
…ma-transcripts test: normalize Ollama tool-call transcripts
This was referenced Jul 23, 2026
…[Unreleased] Document 8 non-merge commits landed since v0.2.0 (2026-07-22): - MIC conformance claim inheritance and validation across delegation (aae73be) — governance behavior change, fail-closed rule - CodeQL unused-local-variable fix in proxy.py (a5faae9) - Ruff/ShellCheck lint hygiene restoration (430ec3a) - Test hardening: MIC showcase signed enforcement, multi-tool turn preservation, evaluation fail-closed semantics, @classmethod fixture conversion for pytest 10, Ollama transcript normalization All entries under Fixed (Keep-a-Changelog). No overclaims. Signed-off-by: Hermes <hermes@ardur.dev>
…nt modules
Change type=Path to type=str for 8 argparse declarations across 4
sibling entry-point modules so empty ('') and whitespace (' ')
strings are caught by pre-validation before Path() conversion.
Before this fix, type=Path normalized '' to Path('.') (the current
directory), silently resolving to CWD and causing fixture artifact
pollution or misleading error messages.
Modules fixed:
- receiver_attestation_fixture (--output)
- provider_adapter_fixture (--out-dir, --mission)
- drp_conformance (--bundle, --output)
- policy_conformance (--bundle, --output)
Each module now emits structured JSON with a stable condition field
on empty/whitespace input. provider_adapter_fixture main() also
gains exception handling it previously lacked.
22 new focused tests cover empty and whitespace inputs for all 8 args.
…private keys
Ardur's protect command writes runtime artifacts (active_mission.jwt,
keys/, claude-code-pre_tool_use, etc.) to the project root, but .gitignore
only covered .ardur/ and .vibap/ state dirs. A recursive 'git add' could
accidentally stage a signed mission JWT or passport private key.
Additionally, the gitleaks rule only matched the SEC1 'EC PRIVATE KEY' PEM
header, but passport.py serialises keys as PKCS#8 ('BEGIN PRIVATE KEY').
A committed Ardur private key would silently pass secret scanning.
Changes:
- .gitignore: add active_mission.jwt, keys/, claude-code-hook-python,
claude-code-pre_tool_use, claude-code-pre_tool_use.sha256
- .gitleaks.toml: add ardur-pkcs8-private-key rule for PKCS#8 PEM blocks
- test_gitignore_policy.py: add regression test for root runtime artifacts
…s, governance log, state, daemon socket, seccomp markers) Rahul's 862cb71 added 5 root-level protect artifacts to .gitignore, but ardur protect claude-code + the hook lifecycle write MORE artifacts to CWD when --home . is used. These carry signed receipts and session state and must never be accidentally staged. Add root-anchored patterns for: - /claude-code-hook/ (signed receipt chain directory) - /governance_log.jsonl (session decisions) - /state/ (budget/session snapshots) - /claude-code-hook-daemon.sock (daemon Unix socket) - /seccomp-ready-* (seccomp readiness markers) Root-anchoring ensures tracked source like examples/claude-code-hook/ is preserved. Extend test_gitignore_policy.py to cover all 11 runtime artifacts and prove root-anchoring with a VISIBLE_FILES entry.
sync_source_docs.py used REPO_ROOT.rglob('*.md') without excluding git
worktree directories. Contributors using local worktrees would get 1000+
stale Hugo mirror files and a broken sync_source_docs.py --check gate.
Add 'worktrees' to PUBLIC_MARKDOWN_EXCLUDED_DIR_NAMES and both
'worktrees/' + '.worktrees/' to PUBLIC_MARKDOWN_EXCLUDED_PREFIXES.
Add both patterns to .gitignore. Add test_sync_excludes_worktrees.py
with 3 tests verifying the exclusion.
…nforce-verify benchcheck -out "" gave a raw mkdir error; -out " " silently created a whitespace-named directory in CWD with results files (CWD pollution). enforce-verify "" and " " gave raw os.Open errors. Both now use strings.TrimSpace() to reject empty/whitespace before any filesystem operation, matching the established Go CLI validation pattern. Adds subprocess-based table tests for both commands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promotes the current
devbranch tomainas the human-gatedv0.2.0release candidate. At the current head,devis 524 commits ahead ofmain;mainis an ancestor ofdev, with zero reverse-only commits, so this remains a forward-only promotion.The existing immutable
v0.1.0tag remains at00c8d7eb88b0cc98cc8f65f8bfcca94491db5b9a. It will not be moved or rewritten. PR #245 prepared package, runtime, proxy, lock, and OCI documentation metadata at0.2.0. A freshv0.2.0tag and GitHub Release remain deferred to #147 after this promotion.Current release scope
This release does not claim universal kernel enforcement for unknown or uncooperative agents. Remaining unknown-agent attach and independent-corpus work stay explicitly tracked.
Current evidence — 2026-07-12
dev/ PR head:eb63d22361c45621df7c04884ee978b9bf0195c3.origin/mainatce7ac316320b7b37ad03bf21a045c95126e45becis an ancestor oforigin/dev; 524 forward commits and zero reverse-only commits.devSHA verification: all 17 workflows successful, including Python 3.10/3.13, Go, CodeQL, package/wheel smoke, OCI, docs/links/formats/secrets, Linux governance benchmark, BPF generation, KVM kernel smoke, seccomp smoke, and strictardur run --enforceseccomp E2E.proxy.golang.orgHTTP/2 reset during module download; failed-job attempt 2 passed on the unchanged SHA.v0.1.0tag is unchanged; nov0.2.0tag or GitHub Release exists.Promotion gates
devcontains prepared0.2.0release metadata.mainancestry is clean and forward-only.CHANGELOG.md[0.2.0]section on the actual release date and adds the matching-version validation before final approval.devupdate.mainchecks are green.v0.2.0tag and GitHub Release at the promotedmainSHA.Approval boundary
Branch protection requires one human approving review. Automated work must not supply or bypass that approval. Stale reviews are dismissed when
devadvances, so approval must apply to the final head after #272 is stamped on the real release date. Current headeb63d22361c45621df7c04884ee978b9bf0195c3has zero approvals.Related: #140, #147, #189, #191, #272, #79.