6bd2e10e6b
All checks were successful
ci / validate (push) Successful in 1m15s
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0233b-178d-7162-b92f-31a31ea8ca9b
70 lines
2.3 KiB
Markdown
70 lines
2.3 KiB
Markdown
---
|
|
id: GLAS-WP-0010
|
|
type: workplan
|
|
title: "Harden SSH transport and profile refusal coverage"
|
|
domain: infotech
|
|
repo: glas-harness
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: transport-and-resolution-hardening
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
state_hub_workstream_id: "a0b73575-fd0d-5884-9b46-45ed94679049"
|
|
---
|
|
|
|
# Harden SSH transport and profile refusal coverage
|
|
|
|
## Reject option-like SSH targets
|
|
|
|
```task
|
|
id: GLAS-WP-0010-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "f768993e-9edc-5890-8127-000b76654b44"
|
|
```
|
|
|
|
Require the optional SSH user and host components to begin with an
|
|
alphanumeric character, terminate SSH option parsing explicitly, and cover
|
|
both descriptor validation and direct transport construction with regression
|
|
tests.
|
|
|
|
**Completed 2026-08-23:** SSH user and host components must now start with an
|
|
alphanumeric character, the constructed command includes the `--` option
|
|
terminator, and both factory-created and directly constructed transports reject
|
|
option-like targets. Focused transport tests pass.
|
|
|
|
## Pin multi-revision profile selection semantics
|
|
|
|
```task
|
|
id: GLAS-WP-0010-T02
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "6d6577af-9d15-5cca-9c39-7d33a7419a24"
|
|
```
|
|
|
|
Retain the safer resolver behavior in which every revision, including a
|
|
disabled revision, makes an unpinned selector ambiguous. Correct the profile
|
|
documentation and add mixed enabled/disabled coverage.
|
|
|
|
**Completed 2026-08-23:** documentation now matches the existing fail-closed
|
|
resolver: every revision participates in unpinned ambiguity, while a pinned
|
|
disabled revision refuses. A mixed enabled/disabled catalog test locks in both
|
|
properties.
|
|
|
|
## Prove pre-sandbox refusal and publish
|
|
|
|
```task
|
|
id: GLAS-WP-0010-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "cd0e14e9-816d-55fe-837e-55bc8bec65bc"
|
|
```
|
|
|
|
Add gateway tests proving disabled and ambiguous selections cannot call
|
|
sand-boxer, run the full suite and catalog validation, synchronize the
|
|
workplan, publish, and retain any actionable leftovers as live residuals.
|
|
|
|
**Completed 2026-08-23:** real-catalog gateway tests prove disabled and
|
|
ambiguous selectors return normalized resolution refusals without calling
|
|
sand-boxer. All 72 tests, catalog validation, and whitespace checks pass. No
|
|
actionable leftover was discovered, so no residual was created.
|