Development record
one committed symlink at the admissions root stands down the widening leg for every run while record_schema stays silent
one committed symlink at the admissions root stands down the widening leg for every run while record_schema stays silent
Found by the round-2 adversarial security review of build/itd-189. A NEW
INSTANCE of a pre-existing, accepted pattern: the dispositions root behaves
identically on 932629f9.
Committing .abcd/work/issues/admissions -> .adm-real makes realDir (an
Lstat) return false, so tree.rootUnreadable is true, unknown(run) is true
for every run, and both the widening Undispositioned branch and the
Unadmitted leg break for every proposal in the repository. Reproduced: with
two unanswered proposals in different runs, output collapsed to one line and
exit 0.
Meanwhile the GATE's os.ReadDir FOLLOWS the symlink, and its parent-store
loop sees admissions as a non-.md entry and skips it -- so record_schema says
nothing.
Assessment, and why it is minor: this is documented intent (rootUnreadable is the whole-tree verdict), the report is info by construction, and the Unsafe
line names the path. The report is loud about standing down. What is wrong is
the GATE's silence, and that is the same os.ReadFile/ReadGuarded asymmetry as
iss-2608301203521317 -- it closes with it.
Grounds
- declined: the finding is carried whole by iss-2608301203521317; this would be wrong if iss-2608301203521317 were closed without answering it
Frontmatter
| id | iss-2608301308368922 |
|---|---|
| type | issue |
| lifecycle | wontfix |
| severity | minor |
.abcd/work/issues/wontfix/iss-2608301308368922-one-committed-symlink-at-the-admissions.md
open on GitHub ↗ · commit history ↗
mentions2
- iss-2608301203521317record_schema's store walk reads every record with os.ReadDir and os.ReadFile, with no symlink refusal and no size cap, while the sibling reading walk in readingoutstanding.go reads the same trees through fsutil.ReadGuarded — so a symlinked or oversized record is followed by the gate and declined by the report, and a symlink's target frontmatter can surface in lint output. Pre-existing across all four original stores; noted during the itd-189 security review and left out of that branch's scope. Read the store walk through the same guarded read the report uses.
- itd-189What the widening reading proposes is admitted or declined on the record — grounds on admission, dispositions on declines, and surprises as their own entries