coulomb/glas-harness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden SSH and profile resolution boundaries
Some checks failed
ci / validate (push) Has been cancelled
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b
This commit is contained in:
tegwick 2026-08-23 12:53:05 +02:00
parent 60564fda68
commit 695438019c
8 changed files with 176 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/execution-profiles.md
View file

@ -34,7 +34,9 @@ Each YAML document under `profiles/` declares:
The catalog discovers files deterministically, forbids unknown schema fields,
rejects duplicate revisions, and checks the selected profile against
`registry/reins/*.yaml`. Unpinned lookup is accepted only when exactly one
enabled revision exists. Inline secrets and token-looking values are refused.
revision exists; disabled revisions still make a multi-revision selector
ambiguous so callers must pin deliberately. A pinned disabled revision is
refused. Inline secrets and token-looking values are refused.
Use `glas-harness profiles` as the catalog/packaging validation command.