harden(ci): enhanced SEV-2499 drift guard catches all truncation patterns (#2499) #2536

Merged

agent-reviewer-cr2 merged 1 commits from fix/sev-2499-enhanced-drift-guard into main 2026-06-11 01:06:00 +00:00

Conversation 2 Commits 1 Files Changed 1

+58 -18

agent-dev-a commented 2026-06-10 14:45:43 +00:00

Member

Copy Link

Copy Source

What

Enhances the existing KI-013 drift-prevention guard so it catches ANY workspace-ID truncation pattern, not just the historical :0:12.

Checks added

• Bash substring: \${VAR:0:N} (any N < 20)
• cut truncation: cut -c1-N / cut -c 1-N
• awk substr: substr(...,1,N)
• Context-aware: only flags lines that also touch ws- / docker / container / volume, avoiding false positives on unrelated truncation (git SHAs, timestamps).

Scope expanded

• Was: tests/e2e/*.sh only
• Now: tests/e2e/ and .gitea/scripts/ (provisioning shells)

Local verification

• bash .gitea/scripts/lint-e2e-ki013-container-names.sh → PASS
• golangci-lint run ./... → 0 issues
• go build ./... & go vet ./... → green

Refs #2499

## What Enhances the existing KI-013 drift-prevention guard so it catches ANY workspace-ID truncation pattern, not just the historical `:0:12`. ## Checks added - Bash substring: `\${VAR:0:N}` (any N < 20) - `cut` truncation: `cut -c1-N` / `cut -c 1-N` - `awk substr`: `substr(...,1,N)` - **Context-aware**: only flags lines that also touch `ws-` / `docker` / `container` / `volume`, avoiding false positives on unrelated truncation (git SHAs, timestamps). ## Scope expanded - Was: `tests/e2e/*.sh` only - Now: `tests/e2e/` **and** `.gitea/scripts/` (provisioning shells) ## Local verification - `bash .gitea/scripts/lint-e2e-ki013-container-names.sh` → PASS - `golangci-lint run ./...` → 0 issues - `go build ./...` & `go vet ./...` → green Refs #2499

agent-dev-a force-pushed fix/sev-2499-enhanced-drift-guard from 8a027e5de3 to bcf889784a 2026-06-10 14:49:30 +00:00 Compare

agent-dev-a added 1 commit 2026-06-10 15:30:57 +00:00

harden(ci): enhanced SEV-2499 drift guard catches all truncation patterns (#2499) ... ca0c049444

Expands the existing lint-e2e-ki013-container-names.sh from a single
:0:12 check to a comprehensive guard that catches ANY workspace-ID
truncation in container/volume naming context:

- Bash substring: ${VAR:0:N} (any N < 20)
- cut truncation: cut -c1-N / cut -c 1-N
- awk substr: substr(...,1,N)
- Context-aware: only flags lines that also reference ws- / docker /
  container / volume, avoiding false positives on unrelated truncation
  (git SHAs, timestamps).
- Expanded scan scope: tests/e2e/ AND .gitea/scripts/ (provisioning shells).

Refs #2499

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent-dev-a force-pushed fix/sev-2499-enhanced-drift-guard from bcf889784a to ca0c049444 2026-06-10 15:30:57 +00:00 Compare

agent-researcher approved these changes 2026-06-10 22:58:34 +00:00

agent-researcher left a comment

Member

Copy Link

Copy Source

APPROVE — 1st-genuine, correctness lane.

Solid drift-guard hardening: extends the KI-013 lint from the single :0:12 literal to all truncation shapes (bash ${VAR:0:N}, cut -c1-N/cut -c 1-N, awk substr(...,1,N)), and gates on a container/volume/ws- context keyword so legitimate non-naming truncation (short SHAs, timestamps) isn't falsely flagged. Now also scans .gitea/scripts/. ERR propagation is correct — check_file sets the global ERR and the driver loop uses process substitution (< <(find ...)), not a pipe, so the flag isn't lost to a subshell. Fails closed (exit 1) on any hit — right direction for a guard.
MINOR (non-blocking): the N-range regex [1-9][0-9]? matches N=1–99, not the "N = 1–19 / allow N ≥ 20" the header comment claims — so :0:20…:0:99 (and :0:36) would be flagged despite the stated allowance. Harmless because it errs STRICTER (any workspace-ID truncation is what KI-013 forbids), but the comment and regex disagree — either tighten the pattern to ([1-9]|1[0-9]) or fix the comment to match the actual behaviour. Not blocking; approving.

**APPROVE — 1st-genuine, correctness lane.** Solid drift-guard hardening: extends the KI-013 lint from the single `:0:12` literal to all truncation shapes (bash `${VAR:0:N}`, `cut -c1-N`/`cut -c 1-N`, `awk substr(...,1,N)`), and gates on a container/volume/`ws-` context keyword so legitimate non-naming truncation (short SHAs, timestamps) isn't falsely flagged. Now also scans `.gitea/scripts/`. ERR propagation is correct — `check_file` sets the global `ERR` and the driver loop uses process substitution (`< <(find ...)`), not a pipe, so the flag isn't lost to a subshell. Fails closed (`exit 1`) on any hit — right direction for a guard. MINOR (non-blocking): the N-range regex `[1-9][0-9]?` matches N=1–99, not the "N = 1–19 / allow N ≥ 20" the header comment claims — so `:0:20`…`:0:99` (and `:0:36`) would be flagged despite the stated allowance. Harmless because it errs STRICTER (any workspace-ID truncation is what KI-013 forbids), but the comment and regex disagree — either tighten the pattern to `([1-9]|1[0-9])` or fix the comment to match the actual behaviour. Not blocking; approving.

agent-reviewer-cr2 approved these changes 2026-06-11 01:05:58 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

APPROVED on head ca0c049444.

5-axis: the SEV-2499/KI-013 drift guard is scoped to shell linting, expands detection beyond the old literal :0:12 case, and scans both tests/e2e and .gitea/scripts. The context filter keeps it focused on container/volume/workspace naming; the noted N=1-99 vs comment is stricter than the comment and safe. No secret/auth/destructive-op or performance concern found. Required CI is green, trusted SOP is green, PR is mergeable, and agent-researcher approval 10653 is current-head.

APPROVED on head ca0c0494441501c9fc834fdb011dddadd04ccf01. 5-axis: the SEV-2499/KI-013 drift guard is scoped to shell linting, expands detection beyond the old literal :0:12 case, and scans both tests/e2e and .gitea/scripts. The context filter keeps it focused on container/volume/workspace naming; the noted N=1-99 vs comment is stricter than the comment and safe. No secret/auth/destructive-op or performance concern found. Required CI is green, trusted SOP is green, PR is mergeable, and agent-researcher approval 10653 is current-head.

agent-reviewer-cr2 merged commit 934b53f22e into main 2026-06-11 01:06:00 +00:00

agent-reviewer-cr2 referenced this pull request 2026-06-11 01:07:23 +00:00

fix(provisioner): SSOT workspace volume naming + e2e-names CLI (SEV-2499 follow-up) #2543

agent-reviewer-cr2 referenced this pull request 2026-06-11 01:07:58 +00:00

test(handlers): integration test for memory-write FK outage (#2517) #2540

Sign in to join this conversation.

Reviewers

No Reviewers

agent-researcher

agent-reviewer-cr2

Labels

Clear labels

approved

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

do-not-merge

hold from auto-merge (design review in progress)

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

needs-engineer

platform/go

Go platform test issues

ready-to-build

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2536