cayce/cayce-ops
1
0
Fork 0
Code Issues 1 Pull Requests 25 Actions 5 Packages Projects Releases 2 Wiki Activity

audit: round-2 response — finding -> commit -> test table (audited: post-merge)
ci / lint-test-leaks (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
cayce
2026-10-20 02:22:36 +00:00
parent aba42a4210
commit 13db3996d9
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AUDIT.md
+28
View File
@@ -175,3 +175,31 @@ issues. All criticals and all mediums are fixed in **c9bd441** (PR #9):
New audited commit: **c9bd441**. Gate at that commit: ruff 0 · 56/56 tests · New audited commit: **c9bd441**. Gate at that commit: ruff 0 · 56/56 tests ·
alembic 0001→0002 · gitleaks `--all` clean · `make check` exit 0. alembic 0001→0002 · gitleaks `--all` clean · `make check` exit 0.
Still open (declared): apply `roles.sql` on production, provision CI runner. Still open (declared): apply `roles.sql` on production, provision CI runner.
---
## Response to audit round 2 — 2026-10-20 (PR #10)
Round-2 audit closed findings 2, 3, 5 and the mediums; the remaining points
were re-implemented in PR #10, one commit per point:
| Punto | Hallazgo | Commit | Test que lo prueba |
|---|---|---|---|
| 1a/1b/1c | firmas obligatorias atadas a contenido+deployment, completas en fila y audit | `40453aa` audit-1 | `test_signed_approval_mandatory_and_content_bound` |
| 1d | verificación al ejecutar/enviar/publicar; SQL-directo se rechaza y revierte | `40453aa` audit-1 | `test_sql_approved_row_is_refused_at_execution`, `test_unsigned_sql_approved_draft_is_refused`, `test_unsigned_sql_approved_item_not_published` |
| 1d | to_addr cambiado tras aprobar bloquea envío | `40453aa` audit-1 | `test_changed_to_addr_after_approval_blocks_send` |
| 1d | firma de otro deployment/contenido rechazada | `40453aa` audit-1 | `test_foreign_deployment_signature_refused` (executor+maild), `test_foreign_deployment_signature_refused` (publisher) |
| 1e | sin ramas `if approved_hash and ...`: binding obligatorio | `40453aa` audit-1 | cubierto por los tests de firma obligatoria |
| 1f | fallos de firma auditados desde el CLI | `40453aa` audit-1 | `test_approve_fails_audited_from_cli_wrapper` |
| 2 | clasificador: negación en el mail veta approval → needs_review | `903c591` audit-2 | `test_negated_approvals_never_classify_approval` (las 6 oraciones mandadas + 4 extra) |
| 3 | roles.sql: mínimo privilegio por daemon, trigger de aprobación, cayce_approver único, sin contraseñas literales | `d774091` audit-3 | `tests/integration/test_pg_roles.py` (PG real, ciclo completo por rol) |
| 4 | escrituras serializadas; génesis documentado; anclaje Nostr diario | `ffe4253` audit-4 | `test_concurrent_writers_keep_chain_verifiable`; legacy-genesis en `verify_audit_chain`; `test_anchor_signs_and_logs_once_per_day` |
| 5 | CLI de envío usa el código testeado; fallos auditados + daemon_runs; exit ≠ 0 | `56b35d3` audit-5 (nota: refactor dentro de audit-1, commit marcador) | `test_send_failures_audited_and_exit_code` |
| 6 | migraciones upgrade/downgrade contra Postgres 16 en CI | `c855f01` audit-6 | job "Migrations upgrade/downgrade round-trip (Postgres 16)" en ci.yml; ejecutado localmente contra Postgres 18.6 (reportado en PR) |
| 7 | unidad systemd para `publisher plan` | `3bde785` audit-7 | `deploy/systemd/cayce-ops-plan.{service,timer}` (diaria) |
Gate en el commit auditado: ruff 0 · 65 unit tests + 1 integración PG ·
alembic 0001→0003 con round-trip PG · gitleaks `--all` limpio · `make check` exit 0.
Declarados abiertos (no resueltos aquí): aplicar `roles.sql` en producción y
provisionar el runner de CI — decisión y ejecución del operador.