From 71601f72a8c892c6109d97f45af2d3c0e87c4c15 Mon Sep 17 00:00:00 2001 From: Frank Date: Wed, 21 Oct 2026 00:59:18 -0700 Subject: [PATCH] fix(secret-gate): a documented fake id must not stop the machine tier MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The live-sync heartbeat failed three hourly ticks (22:25, 23:27, 00:28) because a managed skill that documents how to write a secret gate quotes the vendor's all-zeros placeholder access-key id, and the shape rule fired on the documentation. The machine tier is prose ABOUT credentials — the gate's own header says a gate that fires there gets overridden until it means nothing — and a heartbeat that cannot commit is a fleet that silently stops syncing config. - shape hits are judged on the matched token, not the line: a documented fake is inert, one live token sharing the file still blocks. The match is judged with its following context, because a fixed quantifier truncates `EXAMPLE` to `EXA` and the placeholder would vanish from what is examined. - assignment values keep the stricter rule from the previous commit: a comment on the same line cannot vouch for the token beside it. - `ALLOW_SECRETS` remains the only override; nothing here widens what is scanned, it only stops flagging text that was never a credential. Verified against the payload that is stuck right now: the skill page that the heartbeat cannot commit passes the fixed hook and was refused by the live one. Refs #60 --- .githooks/pre-commit | 19 ++++++++++++++- omp-docs/log.md | 55 ++++++++++++++++++++++++++++++++++-------- tests/secret-gate.bats | 13 ++++++++++ 3 files changed, 76 insertions(+), 11 deletions(-) diff --git a/.githooks/pre-commit b/.githooks/pre-commit index 1e41f1c..1024624 100755 --- a/.githooks/pre-commit +++ b/.githooks/pre-commit @@ -79,7 +79,24 @@ while IFS= read -r -d '' f; do # gate refused the redaction of the password it exists to catch. added=$(printf '%s\n' "$diff" | grep -E '^\+' | grep -vE '^\+\+\+' | sed 's/^+//' || true) [ -z "$added" ] && continue - hits=$(printf '%s\n' "$added" | grep -Ei "$shapes" || true) + # Shape hits are judged on the MATCHED TOKEN, not on the whole line. Documentation about + # credentials quotes vendor placeholders — AWS publishes an all-zeros access-key id that ends + # in EXAMPLE for exactly this purpose — and + # a gate that blocks prose over an inert example gets worked around until it means nothing: + # the live-sync heartbeat failed three ticks on 2026-10-21 because a managed skill page quotes + # exactly that id. A line is exempted only when EVERY shape on it is inert, so one live token + # sharing the file with a documented fake still blocks. + hits=$(printf '%s\n' "$added" | while IFS= read -r line; do + live=0 + while IFS= read -r m; do + # The shape regexes carry fixed quantifiers, so the match they return is TRUNCATED: + # `AKIA` + exactly 16 characters stops inside the word EXAMPLE and the placeholder + # disappears from what is judged. Judge the match plus what follows it instead. + ctx=$(printf '%s' "$line" | awk -v m="$m" '{ i = index($0, m); print (i > 0 ? substr($0, i, length(m) + 8) : m) }') + printf '%s' "$ctx" | grep -Eiq 'EXAMPLE|X{4,}|Y{4,}|Z{4,}|_{4,}|REDACTED|CHANGEME|PLACEHOLDER' || live=1 + done < <(printf '%s\n' "$line" | grep -Eio "$shapes" || true) + [ "$live" = 1 ] && printf '%s\n' "$line" + done) if [ "${f##*.}" != "md" ]; then # The placeholder filter reads the VALUE, never the whole line. A trailing comment that # says `# example` says nothing about the token the same line assigns; scoping the filter diff --git a/omp-docs/log.md b/omp-docs/log.md index 5f9f27d..62dc325 100644 --- a/omp-docs/log.md +++ b/omp-docs/log.md @@ -20,28 +20,63 @@ This page is the bundle's **only** work log: one file, at the root. Never start second one in a subdirectory or under another name — `scripts/kb-lint.sh` reports any `log.md` that is not this one. +## 2026-10-21 — reviewing a day of work, and finding checks that lie + +Two-axis review (Standards / Spec) of everything landed 2026-10-20 → 2026-10-21: 51 commits, +30 findings, worked on `fix/60-review-findings` (issue #60). Three findings were the same shape — +a check that reports confidence it did not earn: + +- **A guard that cannot see must refuse.** `pcie-probe.sh` dropped the `/dev/kfd` half of its + busy check when `fuser` was absent, and `gpu_busy_percent` reads `0` for a resident-but-idle + service: the tool measured beside a live endpoint while its own LAW said not to. Missing + visibility is now a refusal (exit `3`), not a narrower check. +- **A swallowed status is a false report.** `deploy.sh` printed `ENABLE` for units systemd + refuses to enable (`live-sync.service` has no `[Install]` section; its timer arms it), and the + loop walked `*.service` only, so a rebuilt box deployed the heartbeat and never armed its + timer. Every outcome now reports what actually happened. +- **A gate that reads a quoted path reads nothing.** git quotes non-ASCII paths in + `--name-only` output; the quoted name came back as an empty diff and the secret gate + `continue`d past it. Fail closed means `-z`, and it means the placeholder filter reads the + assigned value — a comment saying `# example` cannot vouch for the token beside it. + +The law that cost the most, from the probe: **a test that observes the tool's environment instead +of what the tool passed on cannot see the bug.** The stub probe echoed `$HIP_VISIBLE_DEVICES` +rather than its argument, so the suite asserted the mask was set and per-card bandwidth was +unobtainable on the 2×R9700 box. Model the platform rule in the stub and the existing test goes +red against the old code — that is the red-proof worth having. + +Incident, found while verifying the gate: the live-sync heartbeat had failed three hourly ticks, +because a managed skill that documents how to write a secret gate quotes the vendor's all-zeros +placeholder id and the gate's shape rule fired on the documentation. Prose about credentials is +what the machine tier is made of; a gate that blocks it is worked around, and the workaround is +the hole. Placeholder judgement reads the matched token — plus what follows it, because a fixed +quantifier truncates `EXAMPLE` to `EXA` — never the whole line. `ALLOW_SECRETS` stays the only +override, and the heartbeat's own payload was replayed through the fixed hook to prove it lands. + ## 2026-10-21 — a documented mode the panel never had The home ultrawide had been running at 60 Hz for weeks while `desk-1-home.kdl` asked for `3440x1440@239.999`. The page that owns that file documented the same phantom mode, so every reader — including tonight's inspection — trusted it. -`niri msg outputs` says the Sceptre M34's EDID tops out at 180 Hz; there is no -240 Hz mode to ask for. +The panel does offer a 240-class mode: `niri msg outputs` lists `3440x1440@239.998`. The defect +was one character — niri matches mode strings verbatim, and `239.999` is not `239.998`. Laws, now on [tools/niri/displays](tools/niri/displays.md): -- **An impossible mode does not fail, it falls back.** niri logs - `configured mode … could not be found, falling back to preferred` and drives - the EDID preferred mode — 60 Hz here. A config typo therefore looks like a - dying monitor, and every connector drop re-enacts it. +- **A mode string must match the advertised string verbatim.** niri does not round: + `3440x1440@239.999` does not select `3440x1440@239.998`. It logs + `configured mode … could not be found, falling back to preferred` and drives the EDID + preferred mode — 60 Hz here. A one-character typo therefore looks like a dying monitor, and + every connector drop re-enacts it. - **Three layers, three signatures:** config fallback, DP link drops, and amdgpu `DMCUB` errors with `EINVAL` page flips after s2idle. Only the first yields to a file edit; only the last yields to a reboot. Triage table and probes are on the page. -- **A number in a page is a claim, not a measurement.** Modes, refresh rates and - tool availability were wrong on four pages at once — `wlr-randr` was listed as - installed while `pacman -Qs wlr` matches nothing. Read the hardware before - writing a mode into a runbook, and destroy the stale copies. +- **A number in a page is a claim, not a measurement.** Mode strings, refresh rates and tool + availability were wrong on several pages at once — `wlr-randr` was listed as installed while + `pacman -Qs wlr` matches nothing. Read the hardware before writing a mode into a runbook, and + destroy the stale copies. A correction is itself a measurement: the first pass at this entry + published a second wrong hardware fact, with a `verified:` date stamped on it. Fix: `desk-1-home.kdl` 239.999 → 180.000 on the identity block and both legacy connector blocks, applied live with `niri msg output mode ` — the diff --git a/tests/secret-gate.bats b/tests/secret-gate.bats index 04f6ffb..03d38cf 100755 --- a/tests/secret-gate.bats +++ b/tests/secret-gate.bats @@ -189,3 +189,16 @@ export API_KEY_FILE=/run/secrets/api_key' printf '%s\n' "$output" | grep -qx ' b/two.env' ! printf '%s\n' "$output" | grep -qE 'hunter2corp2026 +b/two\.env' } + +@test "a documented fake id in prose is committable; a live-shaped id in the same file is not" { + # Measured on blankpad 2026-10-21: the live-sync heartbeat failed three ticks in a row + # because a managed-skill page documents how to write a secret gate and quotes AWS's own + # placeholder id. A gate that blocks the machine tier over an inert example gets worked + # around, and a workaround is the hole. The exemption reads the matched token, so a real + # id in the same file still blocks. + try_commit "docs.md" 'Inert fixtures look like AKIAIOSFODNN7EXAMPLE or AKIA0000000000000EXAMPLE.' + [ "$status" -eq 0 ] + try_commit "docs.md" 'Inert fixture AKIAIOSFODNN7EXAMPLE and a live one AKIAQZR4W7DBPCFG7V3Q.' + [ "$status" -ne 0 ] + [[ "$output" == *"docs.md"* ]] +}