Conversation
clawbot is a public repository, but two workspace files published the
private ecosystem's internal layout.
TOOLS.md was a complete map of six containers, their ports and the shared
bridge network they sit on. todo.md is an internal build roadmap carrying
absolute local filesystem paths into every private repo, internal auth
routes, .local hostnames and MCP token variable names.
Neither is a credential — .mcp.json correctly uses ${MCP_GATEWAY_TOKEN}
substitution and no secret was ever committed — but together they hand an
attacker the internal topology for free.
Both are gitignored rather than deleted: workspace/ is bind-mounted (see
docker-compose.yml), not baked into the image, so the agent keeps reading
its local copies and only the tracking changes. TOOLS.md.example ships the
same structure with placeholder container names.
Skill docs are left alone. They name sibling projects, but the names alone
expose no topology and are already public via README — stripping them would
gut the agent's functional documentation for no security gain.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ClawBot is told to log its hours in SOUL.md and USER.md, but the playbook they point at was never tracked here — the container read it from the bind mount while the repository had no copy of it at all. This copy is deliberately narrower than the canonical one in Luděk's monorepo: this repository is public, so the stack's endpoints and ports, the compose service names and the admin Rails-runner procedure stay out of it, the same way f8ff9a5 untracked TOOLS.md and todo.md. ClawBot loses nothing — it reaches Redmine through the gateway's redmine__* tools, and anything the Agent role can't do needs host access it doesn't have anyway. What it does document, found while using it: the Agent role's writes to status_id and parent_issue_id are dropped silently (Redmine still answers 204), so the playbook requires reading the issue back instead of trusting the response. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Plymovent moved to lkv/customers/plymovent (Redmine LKV #13), so the directory column has to name the new path or the container resolves nothing and falls through to lkv. Also carries the pending sync of the clawbot and drupal-cz rows, which the canonical copy at ai/skills/redmine-time-tracking/SKILL.md already had. The two copies are required to agree. Refs LKV #13 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits that both answer the same question: what a public agent repository should and shouldn't carry.
f8ff9a5— untrack internal topology (committed earlier, unpushed until now).TOOLS.mdwas a full map of six containers, their ports and the shared bridge network;todo.mdcarried absolute local paths into every private repo, internal auth routes,.localhostnames and MCP token variable names. Neither is a credential —.mcp.jsonuses${MCP_GATEWAY_TOKEN}substitution — but together they hand over the internal layout for free. Both are gitignored rather than deleted:workspace/is bind-mounted, so the agent keeps reading its local copies and only the tracking changes.TOOLS.md.exampleships the same structure with placeholder names.a75f2b7— add the Redmine time-tracking playbook.SOUL.mdandUSER.mdalready tell ClawBot to log its hours toskills/redmine-time-tracking/SKILL.md, but that file was never tracked here — the container read it from the bind mount while the repository had no copy at all.This copy is deliberately narrower than the canonical one in the monorepo, following the same rule as
f8ff9a5: no stack endpoints or ports, no compose service names, no admin Rails-runner procedure. ClawBot loses nothing by that — it reaches Redmine through the gateway'sredmine__*tools, and anything the RedmineAgentrole can't do needs host access the container doesn't have.What the playbook does document, found while using it: the
Agentrole's writes tostatus_idandparent_issue_idare dropped silently — the API still answers204— so the procedure requires reading the issue back rather than trusting the response.Review notes
ai/skills/redmine-time-tracking/SKILL.mdand the two need to stay in sync when the procedure changes.AGENTS.md,SOUL.md,USER.md,HEARTBEAT.mdandTOOLS.md.exampleare not in this PR — they are uncommitted work from another session and were left untouched.🤖 Generated with Claude Code