Дмитрий
b632bcbae6
spec(router-gate): v3 closes 10 holes from v2 adversarial audit
V2 audit found 10 new bypasses:
- Fatal: subagent inheritance via text-prefix (no enforcement)
- Critical: hook race conditions / DoS timeout / Bash script execution
- Serious: path-deny symlinks/case / AskUser fatigue / silence off-topic
- Edge cases: parallel subagents / coverage-verify interaction / sub-shells
V3 closes all 10:
- 3.2 rewritten: env-based subagent inheritance (env vars + inheritance file),
gate-on-subagent reads parent state via CLAUDE_GATE_INHERIT env
- 3.4 new: subagent constraints (no AskUser, no recursive Task, max 3 parallel)
- 3.5 new: atomic writes (tmp+rename) + proper-lockfile for race-free state
- 3.6 new: gate budget 2s + state cache TTL 5s + lazy transcript parsing
- 3.1 extended: path normalization (resolve + realpath + case-fold + env)
- 4.5 extended: max 2 AskUserQuestion per turn (fatigue exploit closed)
- 4.7 extended: off-topic at silence uses task_classification
- 5.1 extended: file-watcher for script execution + broad sweep sub-shell
blacklist (backticks, command sub, process sub, heredocs)
- 5.2 new: static content scan for node/python/vitest scripts before exec
- 7.1 new: coverage-hint coordination layer between gate and coverage-verify
Implementation cost: 8.5-12h (v2) to 13.5-20h (v3). +5-8h for architectural
fixes (env-inheritance, atomic writes, static scan) + infrastructure
(gate budget, path norm, askuser counter, coverage-hint).
V2 baseline preserved as commit b510a758. V1 as 7a43c175.
cspell-words.txt += shutil / rmtree.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-29 06:30:07 +03:00
..
2026-05-28 04:50:10 +03:00
2026-05-17 15:19:19 +03:00
2026-05-17 11:15:34 +03:00
2026-05-25 14:28:24 +03:00
2026-05-23 10:03:14 +03:00
2026-05-21 04:21:26 +03:00
2026-05-25 14:23:11 +03:00
2026-05-20 12:10:21 +03:00
2026-05-23 09:47:18 +03:00
2026-05-17 17:17:20 +03:00
2026-05-29 06:30:07 +03:00
2026-05-18 04:33:52 +03:00
2026-05-17 09:10:44 +03:00
2026-05-28 04:50:10 +03:00
2026-05-25 14:23:11 +03:00
2026-05-19 13:12:30 +03:00
2026-05-29 06:30:07 +03:00
2026-05-10 23:33:52 +03:00
2026-05-08 07:11:58 +03:00
2026-05-09 17:40:25 +03:00
2026-05-14 10:08:08 +03:00
2026-05-22 17:59:46 +03:00
2026-05-22 18:19:10 +03:00
2026-05-15 11:22:14 +03:00
2026-05-08 15:24:55 +03:00
2026-05-08 07:11:58 +03:00
2026-05-28 04:50:10 +03:00
2026-05-28 04:50:10 +03:00
2026-05-10 06:32:17 +03:00
2026-05-22 17:59:45 +03:00
2026-05-28 04:50:10 +03:00
2026-05-08 07:11:58 +03:00
2026-05-15 07:04:57 +03:00
2026-05-15 07:04:57 +03:00
2026-05-28 04:50:10 +03:00
2026-05-08 07:11:58 +03:00
2026-05-08 10:35:31 +03:00
2026-05-06 04:45:22 +07:00
2026-05-08 10:35:31 +03:00
2026-05-08 07:11:58 +03:00
2026-05-16 20:14:04 +03:00
2026-05-08 08:31:14 +03:00
2026-05-22 11:11:47 +03:00
2026-05-07 18:27:08 +03:00
