cgalo5758
5829091881
The contained runner that drove the 2026-09 security audit, the README review and four rounds of design ideation lived only inside the ignored notebook. It moves to scripts/agent-runner/: the prepare, tools, audit, ideation and teardown scripts, the compose and container files, the allowlist proxy and the prompt templates, with the paths that assumed the notebook fixed and findings written to a caller-named directory. Run outputs, transcripts and the round-specific sheet scripts stay behind. docs/agent-runner.md states the method: the disposable git archive copy and the fail-closed proxy, how a task is shaped, union rather than intersection of findings across models, separate adjudication of every finding against the source, and the evidence a finding must carry.
1.4 KiB
1.4 KiB
T08 — Scanner triage and dependency posture
Threat model. Not a boundary. This task converts deterministic tool output into a short list of things that are actually true.
Slice. The scanner output in /out/tools/ (gosec, govulncheck, semgrep,
staticcheck, gitleaks), plus go.mod, go.sum, the repository root
Dockerfile, NOTICE, and internal/embeds/static/.
Questions.
- For every gosec and semgrep hit: is it real in context, or a false positive? Give the reason. Group identical patterns rather than listing each line.
- For every govulncheck finding: the tool already filtered by reachability, so treat these as real unless you can show otherwise. What does the call path look like and what is the exposure?
- Does gitleaks flag anything outside the known
test/fixtures? - Do the versions in
NOTICEmatch the vendored assets actually ininternal/embeds/static/? A mismatch means an unpatched asset is shipping. - The root
Dockerfilebuilds on a pinned Go image but runs onalpine:latest, and setsCGO_ENABLED=1. What is the practical risk of each choice for a released image? - What did the scanners NOT cover? Say so plainly.
Rules. Do not restate a scanner's message as a finding. A tool hit becomes a vulnerability only when you show it is reachable and exploitable, with the same evidence toll as any other finding.