Files

T

veronica f0d2dd9920 docs(W4): stamp kind and status front matter on 104 live documents

Applies the document contract from
docs/plans/2026-08-20_stack-docs-flatten-and-alignment.md section 3, partially:
`kind` and `status` only. `parent` is deliberately held until the flatten in
section 4 lands, so that 127 documents do not have to be re-pointed by hand
when docs/fleet/NORTH_STAR.yaml moves to docs/NORTH_STAR.yaml.

Scope, measured on origin/next at 63069149:

  127 live docs   = all *.md under docs/ minus docs/archive/ minus docs/_old_structure/
  104 stamped     here
   19 held        operator judgement (plan section 9), worklist in the same PR
    3 held        the SUPERSEDED TASKS.md stamps, which cite the moving path
    1 untouched   docs/fleet/FLEET-DOCTRINE.md, already stamped in W1

Kinds applied: 54 guide, 34 record, 9 spec, 6 tracking, 1 projection.
Every row carries a confidence and a one-line rationale in the worklist.

Two collisions with the existing state, both flagged rather than resolved:

1. docs/README.md:150-160 already documents a front-matter convention
   (title/type/audience/status/source_of_truth) with its own allowed values.
   It is applied to 4 of 127 files. Its `status` vocabulary is
   current|draft|deprecated|historical; the new contract's is active|superseded-by.
   The key collides. This commit lets the new contract win and rewrites
   `status: current` to `status: active` on those 4 files, keeping their other
   legacy keys untouched. No code reads any of them: `git grep source_of_truth`
   outside docs/ returns nothing. docs/README.md still prescribes the old
   convention and is an operator row, so it is not edited here.

2. Two of the plan's 20 operator rows are YAML files, not markdown
   (docs/fleet/examples/roster-v2.yaml, docs/openapi-tess.yaml), and the
   contract's front-matter form has no defined meaning for a .yaml document.
   That gap also applies to docs/fleet/NORTH_STAR.yaml, the source of truth
   itself. Raised in the worklist.

A third row from the plan, docs/fleet/north-star.md, no longer exists: W1
renamed it to docs/fleet/FLEET-DOCTRINE.md.

Verification: 104/104 parse with the expected kind and status in front matter;
the check was shown to reject a wrong kind before it was trusted. The diff
removes 4 lines total, all of them `status: current`.

2026-08-20 19:30:25 -05:00

3.5 KiB

Raw Blame History

kind, status

kind	status
record	active

#1179 — Required security DI wiring

Objective

Eliminate the shared fail-open defect class absence read as permission:

FL-01: missing CommandAuthorizationService must refuse Nest startup and must not permit command effects.
FL-11: missing SystemOverrideService must refuse Nest startup and must not omit stored instruction authority while allowing provider/session effects.

Tracking

Issue: #1179, child of #1156
Branch: fix/1179-required-security-di
Base: origin/next at 216cd72226cd9ee17eea461cfe7cd0e010a22f02

Plan

RED: compile the real AppModule graph with each required provider independently removed, with a positive control for each intact binding.
RED: directly exercise each malformed absence path and assert zero command/provider/session effects.
Stop and report RED to the coordinator before production implementation.
After authorization, make both constructor injections required, remove absence-as-permission branches, and update explicit legitimate optional test seams.
Run focused Gateway tests, typecheck, lint, format, build, independent exact-head verification, and focused security review.

Immutable path fence

Production changes are confined to:

apps/gateway/src/commands/command-executor.service.ts
apps/gateway/src/agent/agent.service.ts

Tests and task evidence are confined to:

apps/gateway/src/__tests__/required-security-wiring.test.ts
existing direct-constructor specs that require explicit required arguments
docs/scratchpads/1179-required-security-di.md

No files in #1178, #1072, #1080, or #1054 lanes are in scope. docs/TASKS.md is orchestrator-owned and will not be modified.

Budget

No explicit token ceiling was provided. Working assumption: one narrow Gateway security packet; split and stop if either arm requires unrelated module rewiring.

Progress

Intake read from #1179 and parent #1156.
Base independently resolved from the issue's pre-native-stage ordering and repository origin/next ref; branch HEAD verified byte-for-byte against the remote ref.
Real consumers and direct constructors inventoried.

Tests

RED

required-security-wiring.test.ts: 4 failed, 2 passed before implementation.
Both real-graph negative controls showed module compilation accepted the missing target binding.
Direct FL-01 showed one unauthorized command effect; direct FL-11 showed one provider prompt and one session counter mutation.

GREEN

required-security-wiring.test.ts: 6/6 passed.
FL-01-only production revert: exactly the two FL-01 test cases failed; all four other cases, including FL-11, passed.
FL-11-only production revert: exactly the two FL-11 test cases failed; all four other cases, including FL-01, passed.
Full Gateway suite: 74 files passed, 7 skipped; 831 tests passed, 17 skipped.
Gateway typecheck: passed.
Gateway lint: passed.
Gateway build: passed.
Changed-file Prettier check: passed.

Review

Codex code review: APPROVE, 0 findings.
Codex focused security review: risk none, 0 findings.
Independent exact-head review remains assigned to Scrappy through the coordinator.

Risks / blockers

AgentModule / CommandsModule / ChatModule contain a production cycle; the module test therefore uses the real top-level AppModule and replaces only storage/network leaves, preserving the target service in each arm while isolating the separate required consumer that would otherwise mask that arm's defect.
No broad module rewrite was required.

3.5 KiB Raw Blame History