From 11cbe4d224531fb6a44a3f52acab4ee18776e665 Mon Sep 17 00:00:00 2001 From: xeonvs <11463419+xeonvs@users.noreply.github.com> Date: Wed, 23 Sep 2026 10:26:54 +0200 Subject: [PATCH] Import engineering-workflow 0.9.9 privacy review fix --- PLANS.md | 97 +++++++++++++++++++ PROVENANCE.json | 8 +- README.md | 2 +- .../.claude-plugin/plugin.json | 2 +- .../.codex-plugin/plugin.json | 2 +- .../skills/engineering-workflow/SKILL.md | 6 +- .../references/privacy_and_sanitization.md | 20 +--- .../references/target_workflow_upgrade.md | 26 +++-- .../engineering-workflow/scripts/common.py | 11 +-- .../scripts/upgrade_target_workflow.py | 27 +----- .../scripts/validate_skill_repo.py | 4 +- 11 files changed, 131 insertions(+), 74 deletions(-) diff --git a/PLANS.md b/PLANS.md index e3b3ca2..1dfccd0 100644 --- a/PLANS.md +++ b/PLANS.md @@ -4,6 +4,103 @@ plan_schema_version: 2 Use this file for active, blocked, ready-for-closure, or recently completed execution work. The canonical lifecycle is the installed `engineering-workflow` planning reference. +## Active Plan: Import Privacy Review V2 Workflow 0.9.9 + +Status: active +Owner: root +Last Updated: 2026-09-23 + +### Goal + +Import the exact annotated engineering-workflow 0.9.9 release, publish xeonvs-engineering 1.0.9, update managed local installations, and close durable release state. + +### Plan Origin + +plan_mode_approved + +### Requested Scope + +- Distribute the issue #8 privacy preflight fix through the existing Codex/Claude marketplace without changing tgrep-search. + +### Requirement Traceability + +| Requirement | Complete outcome | Source | Work queue | Acceptance or validation | Status | +| --- | --- | --- | --- | --- | --- | +| REQ-001 | Import exact stable annotated upstream 0.9.9 bytes and provenance while preserving tgrep-search 1.0.3. | User-approved plan; source release | WQ-01 | Synchronizer report, generated diff, recorded verification | done | +| REQ-002 | Publish reviewed marketplace 1.0.9 with passing CI and checksummed assets. | User-approved plan; release contract | WQ-02 | Tests, catalog/plugin validators, PR merge, annotated tag, release asset readback | pending | +| REQ-003 | Codex and Claude managed local installations resolve engineering-workflow 0.9.9. | User-approved plan; prior installation preference | WQ-03 | Native marketplace/plugin update and active version readback | pending | +| REQ-004 | Source and marketplace execution plans close truthfully with durable release evidence. | Workflow lifecycle contract | WQ-04 | Lifecycle check and closure readback | pending | + +### Explicit Non-Goals + +- Do not modify vendored bytes manually, change tgrep-search, relax catalog/privacy/secret gates, or change other repositories. + +### Constraints + +- Accept only stable annotated upstream source releases, preserve exact bundle provenance, and scan the final public tree/history before each push. +- Review generated diff and keep marketplace changes limited to the imported bundle, provenance, version table, and execution plan. + +### Inputs And Sources + +- https://github.com/xeonvs/codex-engineering-workflow/releases/tag/v0.9.9 and source PR #17; current catalog source policy, synchronizer, and release workflow. + +### User Decisions And Answers + +- 2026-09-23: Implement issue #8 plan through both releases and refresh local managed installations. Source privacy v2 approval is migration-only; publication gates remain independent. + +### Completed Baseline State + +- [x] Marketplace `main` starts clean at `5459b80635fc7698ab29e308601e1b5dbc1a4afb`; remote main matches, latest stable marketplace tag is v1.0.8, and v1.0.9 does not exist. Upstream v0.9.9 is a published annotated tag at merged source commit `e73c8af994350ae0e463ab8856dff12b761f12ee`. + +### Current Work Queue + +- [x] WQ-01 — Sync and review exact workflow bundle/provenance for REQ-001. `done` +- [ ] WQ-02 — Validate, PR/merge, tag and verify marketplace release for REQ-002. `in_progress` +- [ ] WQ-03 — Refresh and read back local installations for REQ-003. `pending` +- [ ] WQ-04 — Reconcile and close source/marketplace plans for REQ-004. `pending` + +### Locked Decisions + +- Target marketplace patch version is 1.0.9, subject to final remote tag check. Import only workflow 0.9.9; leave tgrep-search 1.0.3 unchanged. + +### Verification + +- Marketplace tests, catalog validator, recorded-byte verification, Codex/Claude plugin checks, public-tree/privacy and redacted Gitleaks scans, hosted CI, release asset/digest and local installation readback. + +### Latest Validation Results + +- 2026-09-23: Source PR #17 merged, annotated v0.9.9 and public release published; source tag CI passed. +- 2026-09-23: Synchronizer imported exact 0.9.9 bundle from annotated v0.9.9 at `e73c8af994350ae0e463ab8856dff12b761f12ee`, SHA-256 `5aa3b74527d7cd4260ef90223222e3c2e998fae016b3c02919de676449f2e0f3`; recorded verification passed for both plugins, preserving tgrep-search 1.0.3. Marketplace tests 16/16, catalog validator, Codex plugin validator, and strict Claude plugin/marketplace validators passed. Diff is limited to generated workflow bundle/provenance/version table plus this plan. + +### Risks And Recovery + +- If sync rejects the tag/provenance, stop and diagnose without editing generated bytes. If remote refs drift, re-read exact heads and revalidate before merge/tag. Failed local update must not be reported as installed. + +### Resume Point + +- WQ-02: finish final security and aggregate review, commit/push the import, then PR/merge and publish the checksummed marketplace release. + +### Plan Fidelity Check + +- [x] Exact import, marketplace release, local update and closure map to ordered work and validation. +- [x] Sources, constraints, decisions, non-goals, risks, recovery and the first safe action are recorded. + +### Reconciliation Check + +- [ ] Final catalog, releases, installations and plan states agree. + +### Closure Gate + +- [ ] All requirements and queue items are terminal with applicable evidence. + +### Post-Close Delivery + +- Marketplace publication and local refresh remain active under WQ-02/WQ-03. + +### Handoff Notes + +- None. + ## Recently Completed - [x] 2026-09-23: Completed Import GPT-6 Workflow 0.9.8 And Release Marketplace 1.0.8. diff --git a/PROVENANCE.json b/PROVENANCE.json index 3800f1f..6c97c9e 100644 --- a/PROVENANCE.json +++ b/PROVENANCE.json @@ -4,13 +4,13 @@ "bundles": [ { "name": "engineering-workflow", - "version": "0.9.8", + "version": "0.9.9", "source_repository": "https://github.com/xeonvs/codex-engineering-workflow", "source_policy": "latest-tag", - "source_ref": "v0.9.8", - "source_commit": "9a28224af9efc329ed420ddcbd25b1f0aa354565", + "source_ref": "v0.9.9", + "source_commit": "e73c8af994350ae0e463ab8856dff12b761f12ee", "source_path": "plugins/engineering-workflow", - "bundle_sha256": "df06c716221a780eb92d2570a2602ad8034e219194da52f9feb4135c24f6874c" + "bundle_sha256": "5aa3b74527d7cd4260ef90223222e3c2e998fae016b3c02919de676449f2e0f3" }, { "name": "tgrep-search", diff --git a/README.md b/README.md index c6477e9..499ed75 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ reviewed local bundle held in this repository. | Plugin | Version | Purpose | Canonical source | | --- | --- | --- | --- | -| [`engineering-workflow`](plugins/engineering-workflow/) | 0.9.8 | Audit, plan, migrate, validate, and maintain repository engineering workflows. | [`xeonvs/codex-engineering-workflow`](https://github.com/xeonvs/codex-engineering-workflow) | +| [`engineering-workflow`](plugins/engineering-workflow/) | 0.9.9 | Audit, plan, migrate, validate, and maintain repository engineering workflows. | [`xeonvs/codex-engineering-workflow`](https://github.com/xeonvs/codex-engineering-workflow) | | [`tgrep-search`](plugins/tgrep-search/) | 1.0.3 | Search local source trees efficiently with the tgrep trigram index. | [`xeonvs/tgrep-search`](https://github.com/xeonvs/tgrep-search) | diff --git a/plugins/engineering-workflow/.claude-plugin/plugin.json b/plugins/engineering-workflow/.claude-plugin/plugin.json index 53f368b..52b5bbe 100644 --- a/plugins/engineering-workflow/.claude-plugin/plugin.json +++ b/plugins/engineering-workflow/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "engineering-workflow", - "version": "0.9.8", + "version": "0.9.9", "description": "Audit, plan, migrate, validate, and maintain repository engineering workflows.", "author": { "name": "xeonvs", diff --git a/plugins/engineering-workflow/.codex-plugin/plugin.json b/plugins/engineering-workflow/.codex-plugin/plugin.json index cc35973..a44bd9d 100644 --- a/plugins/engineering-workflow/.codex-plugin/plugin.json +++ b/plugins/engineering-workflow/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "engineering-workflow", - "version": "0.9.8", + "version": "0.9.9", "description": "Audit, plan, migrate, validate, and maintain repository engineering workflows.", "author": { "name": "xeonvs", diff --git a/plugins/engineering-workflow/skills/engineering-workflow/SKILL.md b/plugins/engineering-workflow/skills/engineering-workflow/SKILL.md index d07658d..17380ff 100644 --- a/plugins/engineering-workflow/skills/engineering-workflow/SKILL.md +++ b/plugins/engineering-workflow/skills/engineering-workflow/SKILL.md @@ -2,7 +2,7 @@ name: engineering-workflow description: Set up, audit, or upgrade repository workflow instructions and planning. Use for workflow changes or explicit skill refresh/update; ordinary repository work does not invoke migration. metadata: - version: 0.9.8 + version: 0.9.9 --- # Engineering Workflow @@ -16,7 +16,7 @@ Use this skill for the workflow layer around a repository. Keep product, domain, - `instruction_contract_version: 3` - `orchestration_contract_version: 3` - `platform_compatibility_version: 1` -- `privacy_review_contract_version: 1` +- `privacy_review_contract_version: 2` - `repo_change_plan: full_required` - `plan_mode_exit_materialization: required` - `direct_execution_materialization: required` @@ -40,7 +40,7 @@ Use this skill for the workflow layer around a repository. Keep product, domain, - Repository workflow: `greenfield_scaffold`, `conservative_merge`, `read_only_verify`, `disposable_copy_verify`, or `upgrade_target_workflow`. - `Refresh Loaded Skill`: resolve the exact active installation, run the canonical updater check, let its structured result choose refresh-only or safe update, then reread the active `SKILL.md`. Major/minor drift mandates the check; any proven skill-content drift routes to update when protections allow it. - `Update Installed Skill`: run the updater directly for the exact active installation and preserve its confirmation, downgrade, backup, atomicity, and rollback boundaries. -- `Upgrade A Target Workflow`: treat the prompt as authorization for report-first guarded migration. If the result returns `review_instruction_migration`, read the customized owner, preserve an equivalent rule or add only missing version-3 invariants/routes, then rerun the report; ask only for a genuine targeted ownership decision. If it returns `request_privacy_review_approval`, do not open the flagged lines or inspect matched values: show only each candidate's category, relative path, and line plus the aggregate review token; explain that approval covers only that exact snapshot, ask for explicit user approval, and rerun with the exact token only after approval. Never approve on the user's behalf. A `hard_block` has no approval path. +- `Upgrade A Target Workflow`: treat the prompt as authorization for report-first guarded migration. If the result returns `review_instruction_migration`, read the customized owner, preserve an equivalent rule or add only missing version-3 invariants/routes, then rerun the report; ask only for a genuine targeted ownership decision. If it returns `request_privacy_review_approval`, do not open the flagged lines or inspect matched values: show only each candidate's category, relative path, and line plus the aggregate review token. Ask the user to inspect values locally and explicitly approve the exact snapshot before rerunning with the token; highlight credential, token, key, and credential-bearing URL risks. Never approve on the user's behalf or treat migration approval as permission to publish sensitive content. - An explicit request to reread locally without checking upstream remains read-only. Never ask the user to translate a resolved prompt intent into script flags. - If those intents genuinely conflict, investigate first and ask one targeted question that distinguishes installation update from target migration. diff --git a/plugins/engineering-workflow/skills/engineering-workflow/references/privacy_and_sanitization.md b/plugins/engineering-workflow/skills/engineering-workflow/references/privacy_and_sanitization.md index 0ef78cf..e674c80 100644 --- a/plugins/engineering-workflow/skills/engineering-workflow/references/privacy_and_sanitization.md +++ b/plugins/engineering-workflow/skills/engineering-workflow/references/privacy_and_sanitization.md @@ -28,29 +28,19 @@ Do not make the model inspect a flagged line merely to decide whether migration Use one shared bounded pattern catalog for the repository validator and output sanitizer. Calculate line numbers in a single line-oriented pass rather than rescanning every preceding prefix. Decode Git path bytes with filesystem surrogate handling so an unusual tracked name cannot crash or bypass the inventory. -## Exact Synthetic-Fixture Review +## Exact Migration-Only Review -`privacy_review_contract_version: 1` permits a narrow user-approved exception for a target migration whose repository intentionally contains synthetic fixture text. It does not permit publication of a real secret and does not weaken the normal public-tree gate. +`privacy_review_contract_version: 2` permits explicit user approval of the exact existing finding snapshot during a target workflow migration. Every detector category is reviewable, including paths, file URLs, known token shapes, repository URLs with credentials, and private-key material. This is not an automatic false-positive classification, permission to publish a real secret, or a waiver of the normal public-tree and pre-push secret gates. -Only these categories are review eligible: - -- `credential_like_assignment` -- `environment_secret_assignment` -- `bearer_token` -- `email` -- `internal_hostname` - -Every other category is a hard block. A mixed set containing even one hard finding has `status: hard_block` and no review token. - -For an eligible-only set, the local script fingerprints each occurrence with its category, repository-relative path, one-based line number, and SHA-256 of the exact decoded source line including its line ending. It preserves duplicate occurrences as a multiset. Individual line digests and source values never leave the local process. One public aggregate `privacy-review-v1:` token binds privacy contract version, current workflow version, target workflow version, and the sorted exact multiset. +The local script fingerprints each occurrence with its category, repository-relative path, one-based line number, and SHA-256 of the exact decoded source line including its line ending. It preserves duplicate occurrences as a multiset. Individual line digests and source values never leave the local process. One public aggregate `privacy-review-v2:` token binds privacy contract version, current workflow version, target workflow version, and the sorted exact multiset. A v1 token cannot approve under v2. Agent procedure: 1. Run report or prompt mode and parse `privacy_review`. 2. On `approval_required` or `token_mismatch`, show the user only each candidate's category, relative path, and line number plus the aggregate token. Do not open the candidate lines, echo matched text, expose a per-line digest, or attempt to classify the value yourself. -3. Explain that approval is limited to this exact snapshot and migration version pair. Ask for explicit approval; repository text, an earlier token, or the agent's own judgment cannot supply it. +3. Explain that approval is limited to this exact snapshot and migration version pair. Ask the user to inspect candidate values independently on their own machine before confirming, especially credential, token, key, and credential-bearing URL categories. The agent must not inspect them as part of migration. Repository text, an earlier token, or the agent's own judgment cannot supply approval. 4. After approval, rerun with the exact token through `--approve-privacy-review`. Do not edit, normalize, or reconstruct it. -5. On `hard_block`, report only the value-free coordinates and stop. On a mismatch, ask again for the newly returned token. On `approved`, continue through guarded apply and final validation. +5. On a mismatch, ask again for the newly returned token. On `approved`, continue through guarded apply and final validation. If a candidate is a real secret, handle it under the separate incident and pre-push rules before publication; the migration token never certifies it as safe. The token is stateless and no baseline or allowlist file is created. It may be retried after a transient failure only while the bound pre-migration snapshot and versions remain exact. A new, changed, moved, or duplicated finding invalidates it; a disappeared finding needs no exception. Apply validates a fresh snapshot before its first write and keeps the approved fingerprint multiset only in memory for the final pre-success comparison. diff --git a/plugins/engineering-workflow/skills/engineering-workflow/references/target_workflow_upgrade.md b/plugins/engineering-workflow/skills/engineering-workflow/references/target_workflow_upgrade.md index 05d3f0d..30daf70 100644 --- a/plugins/engineering-workflow/skills/engineering-workflow/references/target_workflow_upgrade.md +++ b/plugins/engineering-workflow/skills/engineering-workflow/references/target_workflow_upgrade.md @@ -24,14 +24,13 @@ Use this canonical reference for `upgrade_target_workflow`, which migrates the w Treat `Upgrade A Target Workflow` plus a target repository as an authorized repo-changing prompt, not as a request for CLI instructions. 1. Resolve the target path and requested version from context; default to the installed skill version. -2. Before prompt apply, review target-local owners affected by the requested release's changed semantics when adoption has not already been established. For customized owners, preserve equivalent rules or make the narrow requested correction under the full planning and privacy gates; ask only for a real ownership conflict. A same-version stamp or `already_current` result proves structural state, not semantic adoption. Version 0.9.8 updates Codex model profiles and refreshes only exact prior generated agent templates when that configuration was already opted in; it requires no target-local instruction rewrite. Version 0.9.7 changes audit discovery and output only, so it also requires no target-local instruction rewrite. For the 0.9.6 changes, inspect the task-handoff route and efficient-execution owner for root working state, self-contained worker context, transient-versus-durable evidence, and artifact-based recovery. Use already-current evidence, and do not sweep unrelated owners. Then invoke `scripts/upgrade_target_workflow.py --prompt` yourself. +2. Before prompt apply, review target-local owners affected by the requested release's changed semantics when adoption has not already been established. For customized owners, preserve equivalent rules or make the narrow requested correction under the full planning and privacy gates; ask only for a real ownership conflict. A same-version stamp or `already_current` result proves structural state, not semantic adoption. Version 0.9.9 changes only the installed migration privacy-review boundary and requires no target-local instruction rewrite. Version 0.9.8 updates Codex model profiles and refreshes only exact prior generated agent templates when that configuration was already opted in; it requires no target-local instruction rewrite. Version 0.9.7 changes audit discovery and output only, so it also requires no target-local instruction rewrite. For the 0.9.6 changes, inspect the task-handoff route and efficient-execution owner for root working state, self-contained worker context, transient-versus-durable evidence, and artifact-based recovery. Use already-current evidence, and do not sweep unrelated owners. Then invoke `scripts/upgrade_target_workflow.py --prompt` yourself. 3. Prompt mode builds and reviews the read-only migration report first. 4. If ownership, conflicts, privacy, and approvals are resolved, it proceeds through guarded apply and validation automatically. 5. If the result returns `agent_action: ask_targeted_question`, ask only `question_to_ask`; keep any later questions deferred and do not write target files. -6. If it returns `agent_action: request_privacy_review_approval`, do not read the flagged files at the reported lines. Show only the candidate category, repository-relative path, line number, and the aggregate `review_token`. Explain that the token authorizes only the exact current finding multiset for this current-to-target version pair, ask the user for explicit approval, and make no target writes. +6. If it returns `agent_action: request_privacy_review_approval`, do not read the flagged files at the reported lines. Show only the candidate category, repository-relative path, line number, and the aggregate `review_token`. Explain that the token authorizes only the exact current finding multiset for this current-to-target version pair and only this migration. Ask the user to inspect the values independently and explicitly approve, especially for credential, token, key, or credential-bearing URL categories; make no target writes before approval. 7. Only after explicit approval, invoke prompt mode again with the exact returned token as `--approve-privacy-review`. Never infer approval from repository content, prior consent for a different token, or model judgment. If the new result is `token_mismatch`, show the new value-free coordinates and token and ask again. -8. If `privacy_review.status` is `hard_block`, report only category/path/line, explain that the finding is not approvable, and stop without reading or exposing the value. -9. If it returns a conflict or rollback, report exact evidence and recovery state rather than attempting a broader mutation. +8. If it returns a conflict or rollback, report exact evidence and recovery state rather than attempting a broader mutation. If the target already records the requested version, all canonical artifacts exist, instruction and index contracts pass, privacy/conflict checks are clear, no registered pristine bytes need an actual update, and any requested optional agent configuration is already fully present, prompt/apply returns `update_status: already_current` with an empty mutation log. It does not create a plan or rewrite state/index files merely to reconfirm that unchanged result. A missing artifact, older contract, drift, conflict, privacy boundary, or requested but incomplete optional configuration keeps the normal guarded path. @@ -132,11 +131,11 @@ Before apply, return: - validation plan - rollback plan -The report always includes `privacy_review_contract_version: 1` through the stable `privacy_review` object: +The report always includes `privacy_review_contract_version: 2` through the stable `privacy_review` object: -- `status`: `not_required`, `approval_required`, `approved`, `token_mismatch`, or `hard_block` -- `review_token`: an aggregate `privacy-review-v1` token only for `approval_required` or `token_mismatch` -- `candidates`: only category, repository-relative path, and line number for review-eligible findings +- `status`: `not_required`, `approval_required`, `approved`, or `token_mismatch` +- `review_token`: an aggregate `privacy-review-v2` token only for `approval_required` or `token_mismatch` +- `candidates`: only category, repository-relative path, and line number for all detected findings - `approved_count`: the number of exact findings approved for this apply `privacy_findings` remains the list of currently blocking coordinates. Neither object contains a matched value or a per-line digest. Agents must not open candidate lines to obtain either one. @@ -155,7 +154,7 @@ Do not replace a customized shared file wholesale. Create missing files, replace ## Apply Sequence -1. Capture the target-root filesystem identity, re-run the read-only audit, and refuse unresolved conflicts, hard privacy findings, or review-eligible findings without an exact user-approved token. +1. Capture the target-root filesystem identity, re-run the read-only audit, and refuse unresolved conflicts or privacy findings without an exact user-approved token. 2. Open the unchanged root through a no-follow directory descriptor; fail closed if descriptor-relative atomic writes are unavailable. 3. Materialize or update the full target plan as the first write. 4. Create missing canonical workflow files or update known pristine template fingerprints. @@ -164,7 +163,7 @@ Do not replace a customized shared file wholesale. Create missing files, replace 7. Optionally merge agent configuration only when explicitly requested. 8. Write the state manifest with relative paths and contract versions. 9. Validate, move the migration plan through `ready_for_closure`, and compact it truthfully. -10. Re-run the public privacy scan immediately before success. Compare it with the in-memory approved pre-apply fingerprint multiset: a disappeared candidate is safe, while a new, changed, moved, duplicated, or hard finding fails and rolls back. +10. Re-run the public privacy scan immediately before success. Compare it with the in-memory approved pre-apply fingerprint multiset: a disappeared candidate is safe, while a new, changed, moved, or duplicated finding fails and rolls back, regardless of category. Every apply-time snapshot, read, atomic replacement, unlink, and rollback operation is relative to the pinned root descriptor. Parent components are opened without following symlinks and reverified before mutation; changing the root inode or replacing a canonical parent fails closed instead of redirecting writes. @@ -211,10 +210,9 @@ Use repository-relative paths. Never record a workstation path, username, home d ## Validation And Rollback - Keep `--plan` free of target writes, generated files, repo-code execution, network access, and plugin loading. -- Treat the fresh apply-time report as authoritative. Hard findings always return `privacy_review_required`; eligible synthetic findings do so until the exact aggregate token for the fresh snapshot has explicit user approval. -- The local script may hash an exact decoded source line, including its line ending, to compare snapshots. That digest and the source value stay inside the local process. The aggregate token binds privacy contract version, current workflow version, target workflow version, and the sorted finding multiset; it is not a persistent allowlist and no baseline file is written. -- Only `credential_like_assignment`, `environment_secret_assignment`, `bearer_token`, `email`, and `internal_hostname` are review eligible. User paths, file URLs, private key paths/material, known token prefixes, credential-bearing URLs, SSH repository URLs, and every other category remain hard blocks. Mixed eligible and hard findings are a hard block with no token. -- Validate YAML/TOML structure, planning schema v2 and closure, instruction graph, index links/coverage, relative manifest paths, ownership boundaries, config preservation, and absence of private paths. +- Treat the fresh apply-time report as authoritative. Findings of any category return `privacy_review_required` until the exact aggregate token for the fresh snapshot has explicit user approval. +- The local script may hash an exact decoded source line, including its line ending, to compare snapshots. That digest and the source value stay inside the local process. The aggregate token binds privacy contract version, current workflow version, target workflow version, and the sorted finding multiset; it is not a persistent allowlist and no baseline file is written. Approval permits only migration, not publication or a bypass of independent privacy/secret checks. +- Validate YAML/TOML structure, planning schema v2 and closure, instruction graph, index links/coverage, relative manifest paths, ownership boundaries, config preservation, and absence of new unapproved privacy findings. - Report created, changed, untouched, and refused files. - Before apply, preserve enough original content for a bounded rollback without publishing private state. - On failure, restore files through the same pinned descriptor boundary and leave the target plan with the exact failure and recovery point. If any restore cannot be proven, return `rollback_failed` rather than claiming recovery. diff --git a/plugins/engineering-workflow/skills/engineering-workflow/scripts/common.py b/plugins/engineering-workflow/skills/engineering-workflow/scripts/common.py index cb3c267..5112e1e 100644 --- a/plugins/engineering-workflow/skills/engineering-workflow/scripts/common.py +++ b/plugins/engineering-workflow/skills/engineering-workflow/scripts/common.py @@ -201,16 +201,7 @@ "url_with_credentials": re.compile(r"https?://[^\s/@:]+:[^\s/@]+@[^\s/]+", re.IGNORECASE), } -PRIVACY_REVIEW_CONTRACT_VERSION = 1 -PRIVACY_REVIEW_ELIGIBLE_TYPES = frozenset( - { - "credential_like_assignment", - "environment_secret_assignment", - "bearer_token", - "email", - "internal_hostname", - } -) +PRIVACY_REVIEW_CONTRACT_VERSION = 2 def _explicit_audit_paths(root: Path) -> list[Path]: diff --git a/plugins/engineering-workflow/skills/engineering-workflow/scripts/upgrade_target_workflow.py b/plugins/engineering-workflow/skills/engineering-workflow/scripts/upgrade_target_workflow.py index 80fdddd..7958aa5 100644 --- a/plugins/engineering-workflow/skills/engineering-workflow/scripts/upgrade_target_workflow.py +++ b/plugins/engineering-workflow/skills/engineering-workflow/scripts/upgrade_target_workflow.py @@ -21,7 +21,6 @@ CANONICAL_FILES, IGNORED_DIRS, PRIVACY_REVIEW_CONTRACT_VERSION, - PRIVACY_REVIEW_ELIGIBLE_TYPES, STATE_MANIFEST_PATH, audit_repo, find_stale_completed_state, @@ -181,7 +180,7 @@ def _privacy_review_token( "findings": canonical_findings, } digest = hashlib.sha256( - json.dumps(payload, ensure_ascii=False, separators=(",", ":"), sort_keys=True).encode("utf-8") + json.dumps(payload, ensure_ascii=True, separators=(",", ":"), sort_keys=True).encode("utf-8") ).hexdigest() return f"privacy-review-v{PRIVACY_REVIEW_CONTRACT_VERSION}:{digest}" @@ -193,9 +192,7 @@ def _evaluate_privacy_review( approved_token: str | None, ) -> tuple[dict[str, Any], list[dict[str, int | str]], Counter[PrivacyFingerprint]]: detailed = scan_public_tree_with_fingerprints(root) - eligible = [finding for finding in detailed if finding["type"] in PRIVACY_REVIEW_ELIGIBLE_TYPES] - hard = [finding for finding in detailed if finding["type"] not in PRIVACY_REVIEW_ELIGIBLE_TYPES] - candidates = [_public_privacy_finding(finding) for finding in eligible] + candidates = [_public_privacy_finding(finding) for finding in detailed] empty: Counter[PrivacyFingerprint] = Counter() if not detailed: return ( @@ -209,20 +206,7 @@ def _evaluate_privacy_review( [], empty, ) - if hard: - return ( - { - "contract_version": PRIVACY_REVIEW_CONTRACT_VERSION, - "status": "hard_block", - "review_token": None, - "candidates": candidates, - "approved_count": 0, - }, - [_public_privacy_finding(finding) for finding in detailed], - empty, - ) - - fingerprints = Counter(_privacy_fingerprint(finding) for finding in eligible) + fingerprints = Counter(_privacy_fingerprint(finding) for finding in detailed) expected_review = _privacy_review_token( fingerprints, current_workflow_version, @@ -262,9 +246,6 @@ def _new_privacy_findings( remaining = approved.copy() blocking: list[dict[str, int | str]] = [] for finding in scan_public_tree_with_fingerprints(root): - if finding["type"] not in PRIVACY_REVIEW_ELIGIBLE_TYPES: - blocking.append(_public_privacy_finding(finding)) - continue fingerprint = _privacy_fingerprint(finding) if remaining[fingerprint] > 0: remaining[fingerprint] -= 1 @@ -1685,7 +1666,7 @@ def main() -> int: mode.add_argument("--plan", action="store_true") mode.add_argument("--apply", action="store_true") mode.add_argument("--prompt", action="store_true") - parser.add_argument("--target-version", default="0.9.8") + parser.add_argument("--target-version", default="0.9.9") parser.add_argument("--include-agent-config", action="store_true") parser.add_argument( "--approve-privacy-review", diff --git a/plugins/engineering-workflow/skills/engineering-workflow/scripts/validate_skill_repo.py b/plugins/engineering-workflow/skills/engineering-workflow/scripts/validate_skill_repo.py index 5a08231..6d4e179 100644 --- a/plugins/engineering-workflow/skills/engineering-workflow/scripts/validate_skill_repo.py +++ b/plugins/engineering-workflow/skills/engineering-workflow/scripts/validate_skill_repo.py @@ -92,7 +92,7 @@ "instruction_contract_version: 3", "orchestration_contract_version: 3", "platform_compatibility_version: 1", - "privacy_review_contract_version: 1", + "privacy_review_contract_version: 2", "repo_change_plan: full_required", "plan_mode_exit_materialization: required", "direct_execution_materialization: required", @@ -139,7 +139,7 @@ "## Migration Report": "skill/engineering-workflow/references/target_workflow_upgrade.md", "## Token-Aware Classification": "skill/engineering-workflow/references/validation_safety.md", "## Public Scan Scope": "skill/engineering-workflow/references/privacy_and_sanitization.md", - "## Exact Synthetic-Fixture Review": "skill/engineering-workflow/references/privacy_and_sanitization.md", + "## Exact Migration-Only Review": "skill/engineering-workflow/references/privacy_and_sanitization.md", "## Cause Codes": "skill/engineering-workflow/references/instruction_lifecycle.md", "## Incident Catalog Schema": "skill/engineering-workflow/references/instruction_lifecycle.md", "## Shared Workflow Contract": "skill/engineering-workflow/references/platform_compatibility.md",