feat: research template workflows + fins/storage phase, with post-merge integrity fixes#168
Open
KUIGE22 wants to merge 4 commits into
Open
feat: research template workflows + fins/storage phase, with post-merge integrity fixes#168KUIGE22 wants to merge 4 commits into
KUIGE22 wants to merge 4 commits into
Conversation
Replicate the conversation_memory phase setup pattern to fins/storage, producing 3 methodology documents and 3 spec-test files plus one production-code fix surfaced by the new tests. Documents - docs/fins_storage_design.md (~750 lines): 6 protocol × 30 invariants, 4-phase batch journal state machine, cross-document accounting, config knobs and known test gaps. - docs/fins_storage_test.md (~450 lines): 8 hands-on test groups with A-N=A-M consistency assertions matching test_doc pattern from conversation_memory phase. - docs/fins_storage_code_review.md (~500 lines): deepreview prompt template with 12 categories, grep -rn executable checks, and back-references to existing + new test names. Spec tests - tests/fins/test_blob_handle_path_traversal.py: 19 tests covering 6 path traversal attacks against read/store/delete + 1 reverse assertion that no attack degrades to FileNotFoundError. - tests/fins/test_storage_spec_gaps.py: 9 tests filling P0/P1/P2 gaps from design_doc (processed clear idempotency, blob delete edge cases, maintenance cleanup count semantics, clear-filing isolation, missing handle behavior). - tests/fins/test_storage_cross_process_recovery.py: cross-process crash + auto recovery — worker subprocess exits via os._exit(7) after writing staging, main process build_fs_repository_set triggers ensure_batch_recovery, asserting orphan cleanup + target isolation. Finding 001 fix - dayu/fins/storage/_fs_blob_core.py: store_file now validates filename via _normalize_entry_name, matching read/delete which go through _resolve_handle_child_path. Without this, 5/6 path traversal attacks bypassed normalization (`..` even caused PermissionError when .part tried to replace the filings dir). One-line semantic fix plus docstring Raises clause for ValueError. Test results: 1899 passed, 2 skipped in 95s (no regressions).
…st-merge review Independent Opus 4.8 review of the research-template workflows (7579e0d) found no P0 but several integrity gaps where validation trusted embedded/self-reported state instead of recomputing from source. Fixes, each with regression tests: - validate-bundle recomputes monitoring integrity from the referenced rules/source-map files and requires binding_approval provenance on any bound source, so a hand-flipped unbound->bound source-map no longer reports healthy. - validate-monitoring-plan cross-checks task bound_data_sources against the fingerprint-matched source-map, rejecting forged ready_for_review tasks that claim an unbindable placeholder is bound. - write --research-template auto keys the infer bootstrap off company-facet presence, not manifest existence, so a null-facets manifest re-infers instead of failing SystemExit(2). - Portfolio materialize and write --materialize-research record degenerate target failures (RuntimeError/AssertionError) as failed targets / exit 2 instead of aborting with an uncaught traceback. - Workbook: index section/item positions into IDs (no collisions on duplicate lines); read templates/reports as utf-8-sig (BOM no longer drops sections); count only well-formed items in live_summary; rollback authenticates against the backup so it recovers a corrupt current file, and does not save corrupt bytes as a junk redo backup. - refresh-workspace writes status snapshots inside the rollback boundary rather than a re-derived path that can diverge for non-canonical bundle depths. Full repository suite: 5410 passed, 83 skipped. Affected-source Ruff/Pyright clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…tions Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
KUIGE22
marked this pull request as ready for review
July 9, 2026 08:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概述
本分支在上游
main基础上引入三部分内容(共 4 个 commit):4d19f69feat(fins):对fins/storage应用 phase 方法论7579e0dfeat:可复用的研究模板工作流(research-template)e981cb2fix:研究模板 bundle/plan/workbook 完整性加固(评审后修复)f9fb224docs:记录 Opus 4.8 评审与修复结论评审后修复(本次新增)
对
7579e0d做了一轮独立代码评审(Claude Opus 4.8),无 P0,但发现多处“校验信任内嵌/自报状态、而非从源头重算”的完整性缺口,已逐条修复并补回归测试:validate-bundle改为从引用的 rules/source-map 文件重算监控完整性,并要求任何bound数据源携带binding_approval授权凭据——手动把unbound翻成bound的篡改不再报“健康”。validate-monitoring-plan将任务bound_data_sources与指纹匹配的 source-map 交叉核对,拒绝伪造的ready_for_review(例如声称不可绑定的外部占位源market_data已绑定)。write --research-template auto的 infer 引导改为按“公司级 facet 是否存在”判断,而非仅看manifest.json是否存在;company_facets: null的历史 manifest 现在会重新推断,而不是SystemExit(2)硬失败。write --materialize-research现在把单目标的退化失败(RuntimeError/AssertionError)记为失败目标 / 返回退出码 2,而不是整批中断抛 traceback。utf-8-sig读取(BOM 不再吞掉首个 section);live_summary只统计良构条目;回滚改为对备份做鉴权,当前文件损坏时也能恢复,且不再把损坏字节存成无法回滚的“垃圾 redo 备份”。refresh-workspace把状态快照写到回滚边界内的路径,而非一个在非规范 bundle 深度下会偏离的重新推导路径。验证
7579e0d为 5397,净增 13 条测试)。materialize → validate-bundle → source-bindings 审批 → refresh-workspace → validate-bundle/validate-monitoring-plan,合法审批后仍健康、篡改被拒。说明
评审与修复由 Claude Opus 4.8 辅助完成,相关 commit 带有
Co-Authored-By标注。研究模板功能全程保持本地、只读、dry-run 语义,不启用外部 provider,也不放开自动化执行(scheduler job 恒为enabled=false)。