fix(security): pin fixed conformance jobs, lift codex off cryptography 49, harden OCSF and state parsing - #225
Merged
Conversation
…y 49, harden parsers - aeoess-aps and chap fixed jobs install from hashed locks (requirements/aeoess-aps-fixed.txt, chap-fixed.txt), then the integration with --no-deps -e. Floating jobs stay unpinned on purpose. - agentrust-codex: agent-manifest==0.3.0 capped cryptography below 50 (PYSEC-2026-3552); now >=0.12.0, matching claude-code. - OpenShell OCSF parser splits on "\n" only, rejects NaN/Infinity and duplicate keys, maps RecursionError to ValueError, and serializes with allow_nan=False so the committed transcript is always JSON. - capture-core load_state treats invalid UTF-8, over-long integers and deep nesting as corrupt (None) instead of raising. - build_record uses fullmatch so a trailing newline no longer passes the digest and subject patterns. - Add ClusterFuzzLite targets over the OCSF transcript, the OpenShell bundle verifier and the capture state loader. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- tested_against in claude-code, scheduled-agents, agentrust-codex and ramen-ai-cmcp named versions below their own requirement floors. Each now names what a clean install resolves and the tests pass on. - .gitattributes: fixtures/action-receipt/*.json text eol=lf, like delegation-chain/. Without it a Windows checkout rewrote receipt.json to CRLF and test_fixture_is_the_committed_bytes failed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scorecard alerts, plus three parser bugs that a new ClusterFuzzLite target reproduced on main.
Pinned dependencies (#175, #173, #170, #174). The
fixedjobs inaeoess-aps-conformance.ymlandchap-conformance.ymlnow install fromrequirements/aeoess-aps-fixed.txtandrequirements/chap-fixed.txt(uv,--generate-hashes --universal, floor 3.11) with--require-hashes, then the integration with--no-deps -e. The version check againstintegration.yamlstill runs. #171 and #172 are thefloatingjob, unpinned on purpose for drift detection. Verified locally on 3.12: chap 19 passed, aeoess 86 passed,trace-tests --level 0PASS on both emitted records.Fixture line endings.
test_fixture_is_the_committed_bytesfailed on any Windows checkout:fixtures/action-receipt/*.jsonhad no.gitattributesrule, socore.autocrlfrewrotereceipt.jsonto CRLF and its SHA-256 moved. Addedtext eol=lf, the ruledelegation-chain/already has.Stale
tested_against. Four manifests named versions below their own requirement floors. Each now names the versions a clean install resolves, and its tests pass on them: claude-code (agent-manifest 0.12.0, agentrust-trace 0.10.0, trace-tests 0.5.1, 61 passed), scheduled-agents (0.10.0, 0.5.1, 26 passed), agentrust-codex (agentrust-trace 0.10.0, 30 passed), ramen-ai-cmcp (0.10.0, 0.5.1, which its pyproject pins exactly, 23 passed, Level 0 PASS).OSV (#34). PYSEC-2026-3552 came from
plugins/agentrust-codex/requirements.txt:agent-manifest==0.3.0capscryptography<50. Nowagent-manifest>=0.12.0, same as claude-code; resolves cryptography 50.0.1 and codex tests pass (30). GHSA-8mgp-746c-j5xp is nltk viaintegrations/llamaindex/requirements-interop.txt; nltk 3.10.3 is the latest release and still affected, so there is nothing to bump to.OCSF parser (
openshell.py).str.splitlines()split one JSONL line on\f,\v,\x1cor U+2028 into two accepted events, and rejected a valid event with U+2028 inside a string. NaN and duplicate keys were accepted, so the committed transcript could carryNaN, which is not JSON. Deep nesting raisedRecursionError. Now splits on\nonly, rejects both, and serializes withallow_nan=False.load_state(capture-core). Invalid UTF-8, a 5,000 digit integer or deep nesting in the baseline raised instead of reading as absent.build_record.DIGEST_RE.matchaccepted a trailing newline onworkload_digest,model_weights_digestandsubject. Nowfullmatch.Fuzzing (#36).
.clusterfuzzlite/with three targets andcflite_pr.yml/cflite_batch.ymlon agent-manifest's action SHAs. Driven over 3,000 inputs each: clean now; on main the state and transcript targets raise the errors above.Tests: adapters 122 passed (17 new), capture-core 48 passed (3 new), capture engines 149, validate 28 with 41 manifests and 0 failures, ruff and actionlint clean.
#31 and #1 are repository settings.
Generated with Claude Code