tegwick
695438019c
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b
2 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated |
|---|---|---|---|---|---|---|---|---|---|
| GLAS-WP-0010 | workplan | Harden SSH transport and profile refusal coverage | infotech | glas-harness | finished | codex | transport-and-resolution-hardening | 2026-08-23 | 2026-08-23 |
Harden SSH transport and profile refusal coverage
Reject option-like SSH targets
id: GLAS-WP-0010-T01
status: done
priority: high
Require the optional SSH user and host components to begin with an alphanumeric character, terminate SSH option parsing explicitly, and cover both descriptor validation and direct transport construction with regression tests.
Completed 2026-08-23: SSH user and host components must now start with an
alphanumeric character, the constructed command includes the -- option
terminator, and both factory-created and directly constructed transports reject
option-like targets. Focused transport tests pass.
Pin multi-revision profile selection semantics
id: GLAS-WP-0010-T02
status: done
priority: medium
Retain the safer resolver behavior in which every revision, including a disabled revision, makes an unpinned selector ambiguous. Correct the profile documentation and add mixed enabled/disabled coverage.
Completed 2026-08-23: documentation now matches the existing fail-closed resolver: every revision participates in unpinned ambiguity, while a pinned disabled revision refuses. A mixed enabled/disabled catalog test locks in both properties.
Prove pre-sandbox refusal and publish
id: GLAS-WP-0010-T03
status: done
priority: high
Add gateway tests proving disabled and ambiguous selections cannot call sand-boxer, run the full suite and catalog validation, synchronize the workplan, publish, and retain any actionable leftovers as live residuals.
Completed 2026-08-23: real-catalog gateway tests prove disabled and ambiguous selectors return normalized resolution refusals without calling sand-boxer. All 72 tests, catalog validation, and whitespace checks pass. No actionable leftover was discovered, so no residual was created.