ci: Mind-side tenant-firewall gate over the checker itself - #200
Merged
Conversation
…e-block identity leg The repos_sync.py third of PyAutoMind#198 (tenant-firewall drift): - FIREWALL_ALLOWLIST: extend the _intake.py entry with autofit_workspace (measured-noise docstring — the names are the evidence) and add tests/test_intake_reconcile_ranking.py (assertions pin resolution against the live body map). Net +1 entry / +1 token, vs +8 entries for the rejected allowlist-all clear; both audited with negative probes (a wrong token in these files still fails). - check_heart: validate the new smoke: block in Heart's config the same way the repos: groups are checked (soft-skip while absent, so this merges ahead of the PyAutoHeart extraction PR). - --only <label>: run a single check leg, so an organ's PR CI gate fails only on the leg that PR can cause. Unknown labels fail loudly naming the valid set.
The last of the PR-time firewall gates (issue #198): Brain/Heart gate their own code with --only legs, and this workflow verifies the CHECKER — path-filtered to scripts/repos_sync.py, it checks Mind out beside the organ mains and runs the full drift check, so an allowlist over-grant is itself caught in the PR that authors it. PyAutoHands checkout is deferred behind PyAutoHands#235 (see the #198 checklist). Stacked on the repos_sync.py PR; merges LAST — after the PyAutoBrain and PyAutoHeart gate PRs — so its first run sees organ mains already clear.
Jammy2211
pushed a commit
that referenced
this pull request
Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The last of the PR-time firewall gates for #198. Stacked on #199 (the diff shows both until it merges; this PR's own change is only
.github/workflows/firewall_gate.yml) and merges LAST — after the PyAutoBrain (PyAutoLabs/PyAutoBrain#229) and PyAutoHeart (PyAutoLabs/PyAutoHeart#147) gate PRs — so its first run sees organ mains already clear of their findings.Changes
.github/workflows/firewall_gate.yml(new): the organ repos gate their own code with--onlylegs; this closes the remaining hole — an edit to the checker itself (an allowlist grant, a token-pattern change, an--onlyregression) is otherwise verified by nothing. Path-filtered toscripts/repos_sync.py(plus the workflow file), it checks Mind out beside the PyAutoBrain/PyAutoHeart mains and runs the full drift check, so an allowlist over-grant fails the PR that authors it. Registry/prompt pushes — the bulk of Mind traffic — never trigger it.Why a separate PR (from the #198 execution review)
A single Mind PR carrying both the checker changes and this workflow could never have a green firewall job at merge time: the workflow checks organ mains, which stay drifted until the organ PRs merge — and those need #199's
--onlyselector first. Splitting keeps every PR in the arc green at its merge: #199 → organ gate PRs → this.Verification
The exact CI command (
repos_sync.py --check --root <workspace>) run locally against the Mind + Brain + Heart branch trio → all legs OK, exit 0 — the same three-repo layout this workflow assembles.Generated by Claude Code