Open
fix(ci): add missing migration artifacts and fix CodeQL path-traversal alerts in a2a_router#588
Conversation
…d failed-turn repro bundle - FU-002 CLOSED: make ab-harness now passes --mock-mode neutral; reports record mock_mode and mock_mode_interpretation; HARNESS008 enforces the target contract - FU-004 CLOSED: scripts/agent_repro_bundle.py with required-fields contract; make repro-bundle is the standard workflow entry; HARNESS009 enforces both script existence and Makefile target - 41 tests pass (test_agent_harness_contract, test_agent_repro_bundle, test_ab_harness) - audit/follow-up.md marks FU-002 and FU-004 as closed 2026-04-30
…ty package (ADR-100)
…oring/ingestion/pipeline/analyzer, ADR-100)
…at in tests - brief.py: save/restore drift.commands.console in try/finally to prevent stream corruption after CliRunner.invoke() in test environments - tests/test_brief.py: update _extract_json() to strip JSON-lines progress events (type=progress) before parsing; handles Click 8.3+ where stderr merges into stdout in CliRunner - tests/test_calibration_cli.py: remove mix_stderr kwarg (removed in Click 8.2+)
…outcome/reward, ADR-100) - Extract session.py, session_handover.py, session_queue_log.py, session_writer_lock.py, outcome_tracker.py, reward_chain.py and outcome_ledger/ into packages/drift-session - Convert src/drift session and outcome files to compat re-export stubs - Register drift-session as workspace member in pyproject.toml
…gration and CLI - adds scripts/outcome_first_validation.py: standalone 14-day outcome-first study runner - implements TaskManifestEntry, TaskRecord, CohortMetrics, Go/No-Go evaluator - session_summary_to_task_record() derives TaskRecord from DriftSession.summary() - CLI subcommands: validate, report, ingest-session - 16 tests passing in tests/test_outcome_first_validation.py - adds docs/concepts/outcome-first-validation.md metric contract spec - evidence: benchmark_results/v2.50.0_outcome-first-validation_feature_evidence.json
…er stubs (ADR-100)
…dge conflict) Co-authored-by: mick-gsk <270290541+mick-gsk@users.noreply.github.com>
…* paths (ADR-100)
Co-authored-by: mick-gsk <270290541+mick-gsk@users.noreply.github.com>
…nstall-dependencies [WIP] Fix CI test job missing packages/drift in dependencies
- Add -e packages/drift to test job and smoke-pr job Install dependencies steps (was present in version-check but missing elsewhere) - Add shell: bash to 'Run tests with coverage', 'Ensure deterministic coverage.xml', 'Validate coverage.xml structure' and 'Pre-Codecov diagnostics' steps (used $PYTHON_BIN bash syntax without explicit shell)
…ft/src/drift Agent-Logs-Url: https://github.com/mick-gsk/drift/sessions/aa0b8761-2f7f-4c84-9486-7085ca967017 Co-authored-by: mick-gsk <270290541+mick-gsk@users.noreply.github.com>
…rts in a2a_router Agent-Logs-Url: https://github.com/mick-gsk/drift/sessions/b6800ee1-f13d-45b5-97c0-91277a1776d2 Co-authored-by: mick-gsk <270290541+mick-gsk@users.noreply.github.com>
Agent-Logs-Url: https://github.com/mick-gsk/drift/sessions/b6800ee1-f13d-45b5-97c0-91277a1776d2 Co-authored-by: mick-gsk <270290541+mick-gsk@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
mick-gsk
May 2, 2026 22:30
View session
github-actions
Bot
added
documentation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
mick-gsk
marked this pull request as ready for review
May 3, 2026 15:26
github-actions
Bot
added
the
agent-review-requested
mick-gsk
approved these changes
May 3, 2026
sauremilk
self-requested a review
May 3, 2026 15:27
sauremilk
approved these changes
May 3, 2026
mick-gsk
added
release:fix
github-actions
Bot
added
the
has-conflicts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes all 8 failing CI checks on PR #576 (
feat/adr100-phase7a-cleanup).Root Causes & Fixes
1. Test failures (6× matrix + "Required checks passed")
Root cause: Two required migration tracking artifacts were missing from the repo:
work_artifacts/vsa_migration_inventory.md— required bytests/migration/test_migration_contract.py::test_migration_inventory_existswork_artifacts/vsa_import_mapping.csv— required bytests/migration/test_migration_models.py::test_import_mapping_csv_exists(second failure, previously hidden by--maxfail=1)Both files were also excluded from git tracking by the
work_artifacts/.gitignorerule.Fix:
work_artifacts/vsa_migration_inventory.mdwith VSA migration inventory documenting all completed capability packages and phaseswork_artifacts/vsa_import_mapping.csvwith 320 legacy→canonical import mappings (T002 artifact)!work_artifacts/vsa_migration_inventory.md,!work_artifacts/vsa_import_mapping.csv) so the files are tracked2. CodeQL check failure (1 critical + 5 high alerts)
Root cause:
packages/drift-mcp/src/drift_mcp/serve/a2a_router.pyexposed a CWE-22 path traversal vulnerability. Three FastAPI A2A handlers passed user-controlled HTTP request parameters (path,artifact_path) directly to file-system operations without sanitization:_handle_capture_intent— userpath→save_intent(repo_root=Path(path))(file write)_handle_verify_intent— userartifact_path→Path(artifact_path).read_text()(arbitrary file read — critical)_handle_feedback_for_agent— userartifact_path→ same sinkWhile 13 other handlers in the same file correctly called
_validate_repo_path(), these 3 were missed.Fix:
_validate_artifact_path(path: str) -> strhelper (mirrors_validate_repo_pathbut accepts files, not just dirs)_validate_repo_path()to thepathparameter of all 3 handlers_validate_artifact_path()to theartifact_pathparameter of_handle_verify_intentand_handle_feedback_for_agentVerification
All 18 migration tests pass locally: