gstack2: inferred execution profiles + capability readiness + CI hardening#12
Closed
time-attack wants to merge 8 commits into
Closed
gstack2: inferred execution profiles + capability readiness + CI hardening#12time-attack wants to merge 8 commits into
time-attack wants to merge 8 commits into
Conversation
Add public-infrastructure security baseline for GStack 2 CI/release: - Dependency Review on PRs to main (fail-on-severity: high) - Weekly OSV vulnerability scan with SARIF upload - OpenSSF Scorecard (weekly + push), publish_results disabled - Concurrency controls on the four workflows that lacked them Preserves immutable SHA action pins and least-privilege permissions. Extends release-hardening.test.ts to pin these invariants. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…/Add-inferred-execution-profiles-2
…/Add-capability-readiness-process-2 # Conflicts: # scripts/gstack2/generate-skill-tree.ts # skills/debug/references/RUNTIME.md # skills/design/references/RUNTIME.md # skills/plan/references/RUNTIME.md # skills/qa/references/RUNTIME.md # skills/review/references/RUNTIME.md # skills/ship/references/RUNTIME.md
…eadiness A capability whose binary launches while the managed runtime hard-fails (e.g. skill-API mismatch) was reported as `degraded`/ok:true/exit 0, diverging from plain `gstack doctor` (ok:false/exit 1) for the identical report. Split the branch so runtime `warn` stays `degraded` and runtime `fail` maps to `failed`, and add a regression test for the runtime-fail + capability-pass case. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…me-attack/gstack2-readiness-and-ci-hardening
…-attack/gstack2-readiness-and-ci-hardening
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
Owner
Author
|
Superseded by #10. Profiles + capability readiness + CI/security hardening are all in the consolidated PR, which also carries the execution-result contract and dependency-security upgrades this PR lacked. Closing to keep a single mergeable PR into codex/gstack-2. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Combined GStack 2 branch bundling three independent pieces of work onto
codex/gstack-2. No version bump or CHANGELOG entry — this is intended to fold into a larger change later.Inferred execution profiles (
feat: infer execution profiles)readiness/standard/deepdepth inference across all six skills, keyed on structured operating conditions (risk, blast radius, irreversibility, mutation authority, deployment/release state, evidence need, scope) — never prompt keywords.EXECUTION-PROFILES.mdcontract per skill defining mandatory modules, legal skips, artifacts, and allowed claims. Readiness must state "Readiness profile — not a complete review." and cannot claim comprehensive/verified/production-safe results, so smoke can never masquerade as a complete review.Capability readiness process (
feat: add capability readiness process,fix: treat hard runtime failure as not-ready)gstack doctorcapability readiness axes plusruntime/doctor.js,RUNTIME.mdguidance across the six skills, anddocs/gstack-2/CAPABILITY-READINESS.md.GitHub Actions hardening (
chore(security): harden GitHub workflows).github/workflows/+ one test).Test Coverage
bun run test:gstack2: 226 pass, 0 fail (includes routing, UX, parity, and capability-readiness suites).bun test test/release-hardening.test.ts: 11 pass, 0 fail.bun testsuite: exit 0.bun run gen:gstack2produces no diff on the combined tree.Pre-Landing Review
No issues found. Changes are additive: pure inference functions + deterministic generated contracts + runtime readiness axes + CI workflow files. No SQL/data-safety or LLM-trust-boundary surface; no frontend. The two GStack 2 features share one generator file (
scripts/gstack2/generate-skill-tree.ts) and auto-merged on separate lines.Notes
codex/gstack-2. No version bump / CHANGELOG by request.Summary by cubic
Adds inferred execution profiles and a capability readiness flow to GStack 2, and hardens CI/security to prevent false greens and improve safety. This standardizes depth across all skills, upgrades
gstack doctor, and pins security workflows.New Features
readiness/standard/deepdepth across all six skills; generated per-skillEXECUTION-PROFILES.md; SKILL headers now say “Depth: <readiness, standard, or deep>” with binding claims/skip rules.gstack doctor --capability browser|design|diagram|pdf|iosreturns non‑mutating readiness with separate axes (judgment, platform, preview consent, install consent, readiness); adds human and JSON output; iOS marked unsupported off macOS; docs atdocs/gstack-2/CAPABILITY-READINESS.md.actions/dependency-review-action, weeklygoogle/osv-scanner-action, andossf/scorecard-actionwithgithub/codeql-action/upload-sarif; enforces least-privilege and workflow concurrency.Bug Fixes
gstack doctor.Written for commit 1e5071a. Summary will update on new commits.