Repository navigation
Phase 0 (2/9): six blocking CI gates - #36
Closed
Pal Lakatos-Toth (pallakatos) wants to merge 1 commit into
Closed
Pal Lakatos-Toth (pallakatos) wants to merge 1 commit into
Pal Lakatos-Toth (pallakatos) wants to merge 1 commit into
Conversation
Gates (all fail-hard, no continue-on-error):
- ci/check-loc.sh — LOC budget per ci/loc-budget.yaml
on production paths. Override: // ci:stub-ok:
- ci/no-custom-crypto.sh — diff-only: no new hand-rolled Signal/X3DH/
ratchet, no manual nonce/base64 outside
providers/signing.rs, providers/mesh.rs,
vendor/, tests/
- ci/no-null-provider-prod.sh — Null*/noop/disabled provider in manifests
requires azureclaw.azure.com/dev-only=true
- ci/security-audit-required.sh — capability-introducing PRs need a
docs/security-audits/YYYY-MM-DD-<slug>.md
with two distinct Signed-off-by emails
- ci/vendored-patch-audit.sh — vendor/** or AGT SDK pin change requires a
today-dated row in
docs/agt-vendored-patch-audit.md
ci/loc-budget.yaml captures the 2026-04-24 baseline for the 12 hotspot files
and encodes the per-phase caps from implementation-plan §4.2.
.github/workflows/ci-gates.yml runs all six in a matrix, each as a separate
required check on PRs. BASE_REF defaults to origin/<base_branch> on PRs and
HEAD~1 on push-to-main.
Locally smoke-tested: all six pass on a clean HEAD against main; plugin.ts
grow-by-one-line negative test correctly fails the LOC gate with two
reasons (phase0 cap exceeded + touched-must-shrink violation).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Collaborator
Author
|
Closing in favor of an integrated validation on the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 0 · six blocking CI gates
Adds the CI enforcement layer for the Phase 0+ principles (§0.2 #1–#10 in the implementation plan).
Gates added under
ci/check-loc.sh— enforcesci/loc-budget.yamlper-file caps. operator.ts, plugin.ts, reconciler.rs etc. each have a Phase-specific ceiling.no-stubs.sh— rejects pseudo-impl markers (TODO: implement,unimplemented!(), stub return literals in capability paths).no-custom-crypto.sh— rejects hand-rolled crypto; onlysodium,ring,rustls,webpki, and the vendored Signal stack are allowed.no-null-provider-prod.sh— rejectsprovider: null|noop|disabled|nonein production manifests (docs/security-audits/ exempted).vendored-patch-audit.sh— ensures every vendored SDK change has a matching patch entry indocs/agt-vendored-patch-audit.md.security-audit-required.sh— when a PR touches capability paths (controller/reconcilers, router/governance|audit|trust|rate_limiter|safety, inference-router/src/providers), adocs/security-audits/YYYY-MM-DD-*.mdmust land in the same PR with two distinct Signed-off-by lines.ci/loc-budget.yamlInitial Phase 0 budget anchored from today's tree.
Verification
mainin a clean clone.BASE_SHA=<origin/main> HEAD_SHA=<HEAD> bash ci/<gate>.sh.Stack
PR 2/9 — bases on
phase0/foundation-docs(PR 1).