Kjell Tore Guttormsen
f820081bdc
Quality only, no behaviour change (four cleanup reviewers, one implementer; npm test 2480/0 on the working tree): - threat-model.mjs splitBacked(): the one known_outside backing check of plan-gate (record and bare gate), verdict-gate and review-finalize, with one why-text; the engines' security keys derived from ENGINES; isSecurity. - coordinator-contract: "not a security engine" read from ENGINES (a string engine only), not the code-review literal. - review-rounds owns trailingBlock, findingsBlockSha, isMajor, isBlocker; review-answers imports them (review-rounds still imports nothing from it). prepare keeps the archive bytes it read instead of reading the previous archive again. - engine-compare exports rowIn and payloadEngine; finalize uses them. - plan-gate: one accepted_open builder; the stop-rule check hoisted; one top-level lookup for --record --brief. - security-engine: notFullShas(), runCli's usage flag, readScopeList shared with engine-findings; findReport and reviewRoundSummary module-private; two dead defaults gone. - tests: shared plan-gate harness and threat-model brief helpers; the [CNV] table cases call convertReport in-process, one CLI case per exit path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
41 lines
1.1 KiB
JavaScript
41 lines
1.1 KiB
JavaScript
// tests/helpers/threat-model-brief.mjs
|
|
// The brief fixture of the threat-model tests (tests/lib/threat-model and
|
|
// tests/validators/brief-threat-model): a brief_version 2.2 brief with an
|
|
// optional `## Threat Model` section before its Success Criteria.
|
|
|
|
export const OUTSIDE = "a local user who can already edit the repo's hooks";
|
|
export const INSIDE = 'a crafted file name in a pull request reaches the shell';
|
|
export const TM = `## Threat Model\n\n- Inside: ${INSIDE}\n- Outside: ${OUTSIDE}\n`;
|
|
|
|
/** The brief with `threat` (a `## Threat Model` section, or '') before its Success Criteria, of frontmatter `type`. */
|
|
export const briefWith = (threat, type = 'trekbrief') => `---
|
|
type: ${type}
|
|
brief_version: "2.2"
|
|
created: 2026-11-08
|
|
task: "Add an upload hook"
|
|
slug: upload-hook
|
|
project_dir: .claude/projects/2026-11-08-upload-hook/
|
|
research_topics: 0
|
|
research_status: complete
|
|
framing: new-direction
|
|
---
|
|
|
|
# Task
|
|
|
|
## TL;DR
|
|
|
|
An upload hook.
|
|
|
|
## Intent
|
|
|
|
Uploads arrive from strangers.
|
|
|
|
## Goal
|
|
|
|
A hook that checks each upload.
|
|
|
|
${threat}
|
|
## Success Criteria
|
|
|
|
- It checks.
|
|
`;
|