Repository navigation
fix(rulesets): bypassable rulesets are not floor cover (D106, D235) - #1103
Conversation
D106: a ruleset carrying any bypass actor no longer counts toward the repo-level or org-level cover union. A repo whose only cover is bypassable is WOULD-CREATE and --apply writes the standalone zero-bypass Branch-Floor alongside; nothing existing is modified. The report detail names how many bypassable rulesets were discounted. D235: hyperpolymath/claude-config-vault joins the gcrypt-vault class (already on Gcrypt-Vault-Guard 24256082), so the applier never writes non_fast_forward to it. Tests: 57 passed, 0 failed. New fixtures bypassed-twin (repo) and org-bypassed-repo (org) with one killed mutant each; richer-repo stays the zero-bypass negative control. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (4)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (25)
🔇 Additional comments (7)
📝 SummarySummary by CodeRabbit
WalkthroughRepository and organisation rulesets with bypass actors no longer count as protection-floor coverage. The script reports discounted rulesets and creates standalone floors when required. The gcrypt-vault exclusion class adds a repository. ChangesFloor coverage
Gcrypt vault exclusion class
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~10 minutes Change: Bug fix Suggested reviewers: Merge Risk: ⚪ Minimal · up to The change stops rulesets with bypass actors from counting as protection-floor cover and excludes one more vault repository from floor writes. No merge-blocking risk is evident from the supplied context. Security Architecture ReviewSecurity architecture risk: 🔵 Low · up to The change strengthens protection by discounting bypassable rulesets while preserving existing rulesets and the added backup vault. No introduced security weakness was established. Runtime credential permissions, trusted target selection, and overlapping execution remain unverified. Retained concerns Security review detailsSecurity Blast Radius
Trust Boundaries and Controls
Resilience and Maintainability Implications
Hardening Proposals
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches: 💡 1📝 Generate docstrings: 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the rulesets with care, Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
❌ Failed to create Coding Agent finishing-touch task. Please try again. |
|
Add Carrot credits or activate Agent usage billing to use Autofix |
1 participant
What
Implements owner rulings D106 and D235 (standards#787) in
scripts/apply-protection-floor.sh.bypass_actorsentry no longer counts toward the repo-level or the org-level cover union. A repo whose only cover is bypassable now reportsWOULD-CREATE, and--applyPOSTs the standalone zero-bypassBranch-Flooralongside. No existing ruleset is modified. The report detail counts the bypassable rulesets discounted.hyperpolymath/claude-config-vaultjoinsconfig/rulesets/gcrypt-vault-class.txt(it already carriesGcrypt-Vault-Guard24256082), so the applier will never writenon_fast_forwardto a force-pushing vault.config/rulesets/README.adocdocuments the new state rule.Tests
bash scripts/tests/apply-protection-floor-test.sh→ 57 passed, 0 failed.bypassed-twin(repo-level floor + always-bypass) andorg-bypassed-repo(org-level floor + always-bypass) — bothWOULD-CREATEin report mode andCREATEDunder--apply. Apply-mode write count goes from 2 to 4, asserted both ways.bypassed-twinflips toCOVERED-BY-RICHER; "bypassable org ruleset counted as cover" →org-bypassed-repoflips toORG-INHERITED.richer-repo(zero bypass) staysCOVERED-BY-RICHER. That is the negative control: genuine cover is still honoured.claude-config-vaultassertedEXCLUDED-D50, with no write in apply mode.Scripts remain
100755.🤖 Generated with Claude Code
https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR