Repository navigation
release: v0.8.0 门禁硬化（14 项实弹审计修复） - #27
Merged
Merged
Conversation
- 整调用声明：exit 2 拒绝的是完整 Bash 调用（前序步骤未执行），指令要求拆分调用 - is_guarded 覆盖一层解释器间接（脚本/-c 内联），封堵 runner.sh 式绕过 - 缓存键纳入工作区内容指纹；git 仓缺省 delta 作用域 + gate_scope 项目级覆盖 - exit 2 归未验证（hook skipped / CLI-MCP unverified）；节选附总量+完整日志 - scope 层（scripts/scope.py）：ruff 默认配置注入、单文件物化、全量剔除 vendor - PostToolUse 单文件 format + 波及清单注入；fix 缺省 delta、--all 全仓 - UPS 非 git 跳过、与硬门共享 skipGate、否定语境不触发；bypass 记账 + Stop 告警 - 状态迁 ~/.codeguard + 条目归一化（修 KeyError-fail-open 潜伏炸弹） - 双副本 SessionStart 告警 + 事件去重；shell.lint 对齐 --severity=warning - __protocol__.md 符号定位；OpenSpec 2026-09-22-harden-commit-gate 三份 delta 已归档 - 测试：run_all 140/1（优于基线 139/2）+ unittest 73 + 新增 29 例硬编码回归
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
14 项 codeguard 门禁审计发现的全量修复（详见归档的 OpenSpec change
2026-09-22-harden-commit-gate，三份 spec delta 已并入主 specs）。拦截语义：整调用声明（修复与提交须拆分）；一层解释器间接（脚本/-c）静态扫描；skipGate 双门一致 + bypass 记账 + Stop 告警。
作用域：git 仓缺省 delta（存量不拦新提交，
gate_scope可回退）；全量剔除 vendor；缓存键含工作区内容指纹；UPS 非 git 目录不回退扫描。诚实判定：exit 2 归未验证；节选附总量+完整日志；ruff 默认配置注入可复现；PostToolUse 单文件 format + 波及清单。
治理：状态迁 ~/.codeguard + 条目归一化；双副本告警 + 事件去重；
shell.lint对齐 severity；__protocol__.md符号定位。验证
版本 0.7.1 → 0.8.0；市场仓 catalog + 三平台清单已 scoped 同步。