Skip to content
Cockpit0.29.0
A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live

I1207

No credential reaches any output, and hostile provider metadata renders safely

Where it stands

devtask.issue
Readiness
blocked 1 of its dependencies is not DONE
Status
BLOCKED
Can start
not now
Milestone
web-sign-in
Milestone status
PLANNED
Wave
4
Waiting on
I1204
Holds back
none
Behind it in all
0
Evidence
0 of 3
In the waySubjectDetail
issueI1204I1204 is not DONE

Moves

plan.transition
A move writes the repository: it stamps one field of this issue's record and appends one event to the ledger, and a commit will carry both.
The same moves from a terminal

majordomus plan start I1207

majordomus plan verify I1207

majordomus plan done I1207

What it is

Objective
Prove the negatives. Place sentinel values in the client-secret and signing-key environment variables and exercise every output this repository produces — API responses, the Cockpit's HTML, the generated site, OpenAPI and its examples, MCP answers, the artifact manifest, the caches, the logs and the doctor report — asserting no sentinel appears anywhere. Separately, give a provider object a display name carrying control characters, ANSI sequences and markup, and assert it renders as text in the terminal, in the HTML and in the JSON.
Why
Every other guarantee of this milestone is a claim until a test tries to break it, and a credential that leaks once has leaked permanently.
Now
No credentials exist yet, so no test can leak one.
Wanted
A sentinel test runs in CI and fails loudly if any future change routes a credential into an output.
Done when
unknown: the record declares no `completion`
Risk
A sweep that enumerates outputs by hand will miss the surface added after it. Where the registry can enumerate them, it does.

Acceptance

  • The sentinel sweep covers every output surface the repository produces, enumerated from the registry rather than listed by hand where that is possible
  • A deliberate regression that renders a secret is caught by the test, proved by a negative case
  • Hostile provider metadata renders as text on every surface, with no escape and no truncation that hides it
  • The gate runs in CI on every change
Validation
bash test/run.shcargo test --workspace --all-features
Evidence required
sentinel_sweepnegative_casehostile_metadata
Evidence present
unknown: the record carries no `evidence` entries

Scope

Touches
apps/majordomus-cli/teststest/cases.ai/repo/ci/gates.yaml
Not
Weakening the assertion to the outputs that happen to pass today
Depends on
I1204
Priority
p0
Profile
implementation
Parallel safe
true
Owner
unknown: the record declares no `owner`

The work so far

Branches
none
Merged
none
Commits
0
Trunk
master
Sessions
none
Created
2026-09-08
Updated
2026-09-08
Started
unknown: the record declares no `started_at`
Verified
unknown: the record declares no `verified_at`
Completed
unknown: the record declares no `completed_at`

Synchronisation

Adapter
scripts/github-sync
Repository
unknown: the derived plan's header carries no repository
External issue
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
State there
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.