ADR 0027: residual-risk wording understates the dir= filing boundary (host-scoped, not clone-scoped) #263

New issue

Closed

opened 2026-07-19 03:19:16 +00:00 by hexajon · 0 comments

hexajon commented

2026-07-19 03:19:16 +00:00

(Migrated from codeberg.org)

Security-audit follow-up. docs/adr/0027 L131-132 describes the report carve-out's residual risk as filing junk "to trackers of repos the operator has cloned and authed". The actual boundary is wider: the clone-on-disk is fabricable. git init plus git remote add origin <any repo on an authed forge> makes ANY repo on any forge with a host-keyed credential a valid filing target - newSvcForDir resolves owner/repo from the fabricated origin and GetConfigForDir supplies the host-keyed token.

This is consistent with the declared accident-detector posture (the agent has shell and the unguarded CLI anyway), so no behavior change is required - but the ADR's residual-risk section should state the boundary honestly: host-scoped by credential, not clone-scoped, with the on-disk clone acting only as friction. The deferred requiresUserInteraction belt mentioned in the ADR remains the real fix if a harder boundary is ever wanted.

Acceptance: ADR 0027 residual-risk paragraph amended to describe the host-scoped boundary and the fabricable-clone caveat.

Security-audit follow-up. `docs/adr/0027` L131-132 describes the report carve-out's residual risk as filing junk "to trackers of repos the operator has cloned and authed". The actual boundary is wider: the clone-on-disk is fabricable. `git init` plus `git remote add origin <any repo on an authed forge>` makes ANY repo on any forge with a host-keyed credential a valid filing target - `newSvcForDir` resolves owner/repo from the fabricated origin and `GetConfigForDir` supplies the host-keyed token. This is consistent with the declared accident-detector posture (the agent has shell and the unguarded CLI anyway), so no behavior change is required - but the ADR's residual-risk section should state the boundary honestly: host-scoped by credential, not clone-scoped, with the on-disk clone acting only as friction. The deferred `requiresUserInteraction` belt mentioned in the ADR remains the real fix if a harder boundary is ever wanted. Acceptance: ADR 0027 residual-risk paragraph amended to describe the host-scoped boundary and the fabricable-clone caveat.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#263

No description provided.

Rows
Columns