coulomb/activity-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Keep backup subprocess output out of workflow evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m22s
Details

Browse source 
Sanitize failures and returned summaries at the adapter boundary. Allowlist backup status values and preserve failure exit codes. Verify synthetic sensitive output cannot survive Python traceback or Temporal failure serialization.

Decision-Class: strengthen-existing-evidence-boundary

Delegation: explicit-user-task; Emergent-Security-A6

Evidence: full-suite-676-passed-1-skipped; final-focused-48-passed; no-new-lint-findings

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a100de-2e1c-7e23-9ae9-2da0e0499411
This commit is contained in:
tegwick 2026-10-03 14:57:31 +02:00
parent 1f9897addc
commit dcb5f7ddef
5 changed files with 158 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

12
tests/test_bounded_operations.py
View file

@ -165,3 +165,15 @@ def test_definition_cannot_combine_two_bounded_operations() -> None:
with pytest.raises(ValueError, match="at most one bounded operation"):
validate_bounded_operations([prune, backup], [])
@pytest.mark.parametrize("overall", ["sensitive-value", {"secret": "value"}, ["value"], None])
def test_backup_projection_does_not_copy_untrusted_status(overall):
result = normalize_operation_result("cnpg_option_a_backup", {"overall": overall})
assert result["overall"] == "unknown"
@pytest.mark.parametrize("overall", ["ok", "degraded", "error", "pass", "fail", "unknown"])
def test_backup_projection_preserves_supported_status(overall):
result = normalize_operation_result("cnpg_option_a_backup", {"overall": overall})
assert result["overall"] == overall