feat: add CI/CD pipeline policy template with intent fixtures - #110
feat: add CI/CD pipeline policy template with intent fixtures#1104444J99 wants to merge 1 commit into
Conversation
Add a starter policy template for AI agents operating inside CI/CD pipelines. The template covers five verdict paths: - allow: artifact reads, staging deploys - block: production deploys, infrastructure destruction - require_approval: secret access, infrastructure provisioning Includes five deterministic intent fixtures, CI validation cases in policy_compliance_ci.sh, and documentation in the policy README.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b5435747fc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| priority: 10 | ||
| effect: allow | ||
| match: | ||
| tool_names: [artifact.read, artifact.download, artifact.list, tool.read] |
There was a problem hiding this comment.
Including tool.read in the artifact-read rule allows any generic read call at low/medium risk, not just artifact access. In adapters that surface secret or vault retrieval as tool.read, those requests bypass the require-approval-secret-access rule and are approved as allow, which weakens the template’s stated secret-access guardrail. Restrict this rule to artifact-specific tool names (or add strict target/path constraints) so non-artifact reads do not auto-pass.
Useful? React with 👍 / 👎.
| tool_names: [deploy.apply, deploy.push] | ||
| risk_classes: [medium] | ||
| workspace_prefixes: [/ci/staging, /deploy/staging] |
There was a problem hiding this comment.
The staging deploy allow rule only checks tool name, risk class, and workspace prefix, so a request can still target production infrastructure while presenting workspace as /ci/staging and risk_class as medium, and it will be allowed. Because this rule does not validate destination/target scope, it can authorize production deploy behavior under a staging label; add destination constraints (allowlist/denylist) to enforce true staging-only deploys.
Useful? React with 👍 / 👎.
|
Hi — just checking in on this. Happy to rebase or address any feedback if needed. Let me know if there's anything I can do to move this forward. Thanks! |
…efault) The organ perfectly detects 14 protocol-due PR bumps but had no dispatch path — a sensor with no effector, so "not contributing outward" was structural. Add the one missing outward action, shipped dark: - `--bump` fires exactly ONE reversible `gh pr comment` on the OLDEST protocol-due PR — never a batch (the 2026-04-21 batch-bump is a codified LIFECYCLE violation; one-at-a-time is enforced by selecting due[0]). - DARK by default: with no arm it only previews and sends nothing, preserving the organ's "sends nothing by default" invariant. Arm with LIMEN_CONTRIB_BUMP=1 or --arm — arming an outward send stays a deliberate human decision. - Per-PR cooldown via an append-only bump-receipts.jsonl so no upstream is ever re-nagged. A bump comment is deletable — reversible. Verified: --bump preview correctly selects 1 of 14 (Clyra-AI/gait#110) and sends nothing; render()/--check untouched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* heal: stop the closeout loop — exclude daemon-owned churn, make BLOCKED terminal Two Codex sessions looped all day toward an unreachable "idempotent fixed point." Root cause is structural, not per-session: the tabularius heartbeat rewrites tasks.yaml every beat, so "clean tree = done" is a receding horizon, and a session blocked on one reserved human lever kept getting re-breathed instead of filed once and left alone. - verify-whole.sh: exclude daemon-OWNED tasks.yaml/tasks.yaml.lock from the final `git diff --check` (canonical list: capture.sh:46 RUNTIME_GLOBS), using git's long-form :(exclude) pathspec. The whole-system predicate no longer fails on churn it does not own. - quicken.py breathe(): in `all` mode, drop any session whose cascade landed on a reserved human lever (decision.residue set). hang_residue() already files its ONE irreducible atom; re-breathing cannot help and IS the endless loop the charter's "BLOCKED once, then stop" rule forbids. A NAMED sid still honors the operator's explicit choice. - closeout/SKILL.md: state the daemon-owned exclusion so the skill's fixed-point definition matches the now-achievable predicate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat: wire the contributions organ's outward bump effector (dark by default) The organ perfectly detects 14 protocol-due PR bumps but had no dispatch path — a sensor with no effector, so "not contributing outward" was structural. Add the one missing outward action, shipped dark: - `--bump` fires exactly ONE reversible `gh pr comment` on the OLDEST protocol-due PR — never a batch (the 2026-04-21 batch-bump is a codified LIFECYCLE violation; one-at-a-time is enforced by selecting due[0]). - DARK by default: with no arm it only previews and sends nothing, preserving the organ's "sends nothing by default" invariant. Arm with LIMEN_CONTRIB_BUMP=1 or --arm — arming an outward send stays a deliberate human decision. - Per-PR cooldown via an append-only bump-receipts.jsonl so no upstream is ever re-nagged. A bump comment is deletable — reversible. Verified: --bump preview correctly selects 1 of 14 (Clyra-AI/gait#110) and sends nothing; render()/--check untouched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: declare inherited undeclared LIMEN_ESTATE_* vars in no-hardcode baseline pr-gate's check-params (no-hardcode) gate was red: estate-closeout-audit.py introduced LIMEN_ESTATE_* vars via the CI-bypassing lane without declaring them, failing the gate for every PR. Recorded via the gate's own `--update` remedy. Un-blocks the required gate; same root cause as #872. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 participant
Context
AI agents operating inside CI/CD pipelines present distinct risk surfaces:
production deployments, secret access, infrastructure mutation. The existing
policy templates cover risk tiers (low/medium/high), knowledge workers,
endpoint constraints, and skill provenance, but no template addresses the
CI/CD pipeline domain specifically.
What this adds
A starter policy template (
examples/policy/ci_cd_pipeline.yaml) with fivedeterministic intent fixtures demonstrating all three verdict paths:
allow: artifact reads (artifact.readat low risk), staging deploys(
deploy.applyscoped to staging workspace prefixes)block: production deploys (deploy.applyat critical risk scoped toproduction workspaces), infrastructure destruction (
infra.destroy,db.drop, etc.)require_approval: secret/vault access (secret.read,vault.readathigh/critical risk), infrastructure provisioning (
infra.create,infra.updaterequiring 2 distinct approvers)The policy uses
fail_closedon critical risk class with required targetsand arg_provenance fields. Default verdict is
block.Files added:
examples/policy/ci_cd_pipeline.yamlexamples/policy/intents/intent_ci_read_artifact.jsonexamples/policy/intents/intent_ci_deploy_staging.jsonexamples/policy/intents/intent_ci_deploy_production.jsonexamples/policy/intents/intent_ci_secret_access.jsonexamples/policy/intents/intent_ci_infra_destroy.jsonFiles modified:
examples/policy/README.md(document new template and expected verdicts)scripts/policy_compliance_ci.sh(add 5 test cases + 1 validate case)Validation
go build -o ./gait ./cmd/gaitbash scripts/policy_compliance_ci.sh(all 21 cases pass)go test ./...(all packages pass)intent_ci_read_artifact.json=> exit0(allow)intent_ci_deploy_staging.json=> exit0(allow)intent_ci_deploy_production.json=> exit3(block)intent_ci_secret_access.json=> exit4(require_approval)intent_ci_infra_destroy.json=> exit3(block)gait policy validate examples/policy/ci_cd_pipeline.yaml --json=> exit0