I3152 — Every known route around the preflight and the edit guard is a case or a stated limit
Enumerate the routes around entry and the edit guard (hooks disabled, a client without hooks, raw git, MAJORDOMUS_NO_BUILD, a missing executable, another machine) and give each a case that proves the refusal or a line in SECURITY.md's limits, held together by a structure check.
BLOKOVÁNO vlna 0 · p3 · profil ověřování · bezpečné paralelně
Blocked. This issue cannot start until milestone:entry-proves-what-it-handed is done. The status is derived from that, not declared.
Cíl
Enumerate the routes around entry and the edit guard (hooks disabled, a client without hooks, raw git, MAJORDOMUS_NO_BUILD, a missing executable, another machine) and give each a case that proves the refusal or a line in SECURITY.md's limits, held together by a structure check.
Proč
The 2026-09-10 governance pack asked for a red-team bypass hunt. SECURITY.md lists three limits; the inventory records the edit-guard shim fails open on a missing executable and on MAJORDOMUS_NO_BUILD=1, which SECURITY.md does not list. Sources: chatgpt-majordomus:c103#5.
Aktuální stav
Cases exist for some refusals (I2735 edit guard, I2289 off-mesh task); the list is not joined to SECURITY.md.
Cílový stav
A declared route list where each route names its case or its limit line.
Rozsah
- SECURITY.md
- .ai/repo/ci/gates.yaml
- apps/majordomus-cli/tests/guard_hook.rs
- .ai/repo/automation/inventory.jsonl
Mimo rozsah
- Closing a limit that a local tool cannot close
Závislosti
Žádné. Tento úkol je kořenem grafu.
Kritéria přijetí
- Each route names a case or a SECURITY.md line
- A route with neither fails the check
- Each new case named here takes its number from `scripts/case-numbers next` and is announced on the board before the file is written (ADR 0053); a case number written in this record before that is provisional
Validace
- cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test guard_hook
- bash test/run.sh 365_new_shell_is_refused
Požadované důkazy
- case_bypass_routes_are_declared
Důkazy
Nic nezaznamenáno. Za každým tokenem výše musí stát příkaz nebo artefakt, než lze tento úkol dokončit; vyprávění se odmítá.
Časová osa
- zahájeno
- —
- ověřeno
- —
- dokončeno
- —
Tato tři pole, důkazy výše a stav závislostí jsou vše, z čeho se stav skládá. Neexistuje žádné pole stavu, které by s nimi mohlo být v rozporu.
Canonical record: .ai/repo/project/issues/I3152.yaml. Read it back with majordomus plan show I3152.