Skip to content

feat(sc10): detect direct dependency-source redirection - #430

Draft
Spectorian wants to merge 34 commits into
mainfrom
codex/sc10-core-config-coverage
Draft

feat(sc10): detect direct dependency-source redirection#430
Spectorian wants to merge 34 commits into
mainfrom
codex/sc10-core-config-coverage

Conversation

@Spectorian

@Spectorian Spectorian commented Aug 24, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Add deterministic HIGH findings for supported direct dependency-source configuration files.
  • Report recognized executable surfaces as partial coverage pending a syntax-aware parser follow-up.
  • Preserve sanitized deterministic evidence across terminal, JSON, Markdown, SARIF, and optional provider analysis.

Boundary

The rule is local and static-only. It does not execute content, make network, DNS, or reputation
requests, maintain user-managed trust lists, add telemetry, decide whether to install, or change
risk scoring or recommendation policy. Command and generated-configuration analysis are not part
of this change.

Verification

  • Focused dependency-source, corpus, coverage, output, meta-analysis, report, and MCP suites passed.
  • make lint and make format-check passed.
  • make test-ci: 3,307 passed, 13 skipped, 38 deselected, and 5 expected xfails.
  • The source distribution and wheel built successfully with python -m build.

@Spectorian
test(sc10): add permanent dependency source corpus
a87e027 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
test(sc10): tighten direct corpus contracts
c54dfbc 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
test(sc10): add truthful coverage and output contracts
4f3ce6b 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
test(sc10): tighten public output contracts
6429e85 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
test(sc10): derive coverage renderer assertions
0a6b357 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
test(sc10): define dependency source contracts
d2d2da8 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
feat(sc10): add dependency source contracts
3d7a454 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): harden dependency source contracts
18a1600 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): simplify bounded source redaction
15b71b7 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): sanitize scheme-relative sources
d1024ba 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): harden proportional URL redaction
d766463 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
feat(sc10): add dependency source contracts
7ad7410 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): harden redaction boundaries
65e27ca 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): require code-owned evidence mappings
0e708cb 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
feat(sc10): detect npm and pip config redirects
942b820 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): honor pip config inheritance
e2d9754 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): preserve pip section identity
3892997 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
perf(sc10): bound pip option lookups
93e83e0 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
feat(sc10): parse yarn and Python tool sources
4a56c34 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): harden structured config parsing
f1c4396 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
feat(sc10): parse cargo and Maven sources
eb4dca7 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): reject ambiguous Cargo and Maven config
df14608 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
feat(sc10): disclose unscanned executable source changes
0d1b07b 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
test(sc10): cover executable config ledger limits
cc38a79 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): preserve and redact deterministic evidence
470709e 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): bound report evidence redaction
9fca98b 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
docs(sc10): document direct config coverage
f7be0c6 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
docs(sc10): clarify Cargo reporting scope
a8a0fe3 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): harden redaction and parser bounds
0f37541 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@Spectorian
fix(sc10): redact scheme-relative markup URLs
6fe96c4 
Signed-off-by: Nir Paz <npaz@nvidia.com>
@mohgupta-ship-it

mohgupta-ship-it commented Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Powered by Codex: PR council review result.

This is a triage signal, not a maintainer approval.

  • Rating: new feature
  • Confidence: medium
  • Status read: Draft, CI green, no approval observed
  • Review method: fresh GitHub metadata/body/files/reviews/checks plus selected diffs; council lenses were spec fit, dead-code/reachability, YAGNI/scope, design/coupling, and code standards/tests.
  • Council assessment: Large SC10 dependency-source parser/redaction/reporting surface. The PR body explicitly leaves command/generated-configuration analysis and some executable-surface coverage out of scope.
  • Recommended action: Keep draft and require focused security/parser review before any ready-to-merge signal.

@mohgupta-ship-it
mohgupta-ship-it self-requested a review August 26, 2026 18:35
@Spectorian Spectorian mentioned this pull request Aug 26, 2026
Draft
SanHsien added a commit to SanHsien/SkillSpector that referenced this pull request Sep 5, 2026
@SanHsien @claude
docs(upstream): 36 個繼承分支逐筆判定，並修正水位的假宣稱
975fff1 
水位修正（tools/upstream_baseline.json）：

reviewed_pr_through 483 → 462、reviewed_issue_through 482 → 0。原本那組數字等於
宣稱「上游 PR 與 issue 都審過了」，但沒有人看過那 8 個仍開啟的 PR，一個上游 issue
也還沒對本 fork 分診過。462 是誠實的：本 fork 的 HEAD 就是 PR NVIDIA#462 的合併點，
合併到 NVIDIA#462 為止的每個 PR 都字面存在於這棵樹裡，不需要移植；NVIDIA#462 以上的都是未合併、
未審。issue 那一軸據實寫 0。

判定記錄（docs/UPSTREAM.md，新增）：

fork 繼承的 36 個分支全部給出書面判定——「刪掉」不等於「處理過」，判定要寫下來
才算。分四組：

- A（22 個）：commits 已 patch-id 相同地在 main 裡，內容已在樹上。
- B（4 個）：上游 PR 已定案。NVIDIA#332／NVIDIA#306 已合併＝已在樹上；NVIDIA#155／NVIDIA#235 關閉未合併，
  由同期的 -2 後續分支取代（此為依命名慣例與關閉時間的推論，檔內已標明不是上游明說）。
- C（8 個）：上游 PR 仍開啟，逐筆四點評估（缺陷是什麼／本樹是否有這段程式／判定／
  回頭再看的觸發點）。本樹與上游逐字元相同，所以這些缺陷在這裡全部存在——問題是
  「現在移植」還是「等上游合併」，不是「適不適用」。八筆全部判「等上游合併」，
  但各有各的理由與觸發點：NVIDIA#470 的 letter-spaced P3/P4 是純靜態路徑就能繞過的真實
  安全缺口，優先序最高；NVIDIA#383/NVIDIA#430/NVIDIA#442 是同一個 dependency-source redirection 能力的
  三個疊加嘗試，提前選邊會造成合併衝突白工。
- D（2 個）：從未成為 PR，任何水位都追不到。已從上游 fetch 回來評估後判「不適用」
  （NIM provider 是功能擴充非缺陷修正、且無使用情境；revert-306 是上游自己開了又
  放棄的提案），判定寫入後才刪除。

驗證：pwsh -NoProfile -File tools/dev_check.ps1 → WINDOWS DEV CHECK GREEN、exit 0
（3953 passed、39 skipped、4 xfailed）。python 驗過 baseline JSON 可解析。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mohgupta-ship-it mohgupta-ship-it Awaiting requested review from mohgupta-ship-it

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Spectorian @mohgupta-ship-it