coulomb/activity-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Keep backup subprocess output out of workflow evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m22s
Details

Browse source 
Sanitize failures and returned summaries at the adapter boundary. Allowlist backup status values and preserve failure exit codes. Verify synthetic sensitive output cannot survive Python traceback or Temporal failure serialization.

Decision-Class: strengthen-existing-evidence-boundary

Delegation: explicit-user-task; Emergent-Security-A6

Evidence: full-suite-676-passed-1-skipped; final-focused-48-passed; no-new-lint-findings

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a100de-2e1c-7e23-9ae9-2da0e0499411
This commit is contained in:
tegwick 2026-10-03 14:57:31 +02:00
parent 1f9897addc
commit dcb5f7ddef
5 changed files with 158 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

31
workplans/ACTIVITY-WP-0042-platform-backup-restore-evidence-scheduling.md
View file

@ -178,3 +178,34 @@ focused recovery-contract/bounded-operation suite **43 passed**; Ruff and
`git diff --check` clean. No runtime wiring, new operation registration,
credential fetch, or live restore was performed. Decision receipt:
`5ec92a02-cb0b-466d-9aaf-9da5ffc6c92d` (codex scope clarification; D2 unchanged).
## Harden the existing backup evidence boundary
```task
id: ACTIVITY-WP-0042-T06
status: done
priority: high
```
User requested the follow-up backup error-handling fix. Enforce ACT-ADR-007's
existing non-secret evidence constraint and Emergent Security C2/C6/C9 without
changing execution scope: discard raw subprocess stderr/targets/errors at the
adapter boundary, suppress unsafe exception causes, and allowlist status values.
Exercise malformed output, timeout/launch/decode failures, failure exit codes,
and Temporal failure serialization with synthetic secret canaries. Preserve
normal/degraded backup summaries and surface negative signal exit codes.
Decision class: task-scoped code/tests; delegation: explicit user task and
Emergent Security A6; no credentials, live effects, or policy widening.
T06 result: the resolver returns the existing allowlisted evidence shape directly;
raw output never escapes in returned results or serialized Temporal failures.
Known status values are preserved; unknown status content becomes `unknown`.
Unexpected exit codes cannot claim success, and negative signal codes survive.
Validation: **676 passed, 1 skipped** in the full suite; final focused backup,
bounded-operation and evidence-sink checks **48 passed**. Ruff baseline comparison
shows no introduced findings (five pre-existing findings remain across the
changed files); `git diff --check` passes. This is source hardening only, not a
worker rollout or execution-authority change.