feat: enforce cloud banking agent skills - #13
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 45710fa2ed
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| import { spawnSync } from "node:child_process"; | ||
|
|
||
| export const canonicalAgentFiles = Object.freeze([ | ||
| ".agents/AGENTS.md", |
There was a problem hiding this comment.
With AGENTS.md scoping semantics, requiring .agents/AGENTS.md only applies these instructions to files under .agents/, so the guardian can pass while normal edits in src/, scripts/, or prisma/ never receive the MAVULA skill-routing rules this change is meant to enforce. Require a repository-root AGENTS.md here, or update the policy to enforce a root-scoped entry point, so the instructions cover ordinary code changes.
Useful? React with 👍 / 👎.
| for (const file of required) { | ||
| if (!trackedFiles.has(file)) failures.push(`${file} must be tracked`); |
There was a problem hiding this comment.
Because this check only requires each canonical path to be tracked, a PR can replace .agents/skills/mavula-review/SKILL.md or the banking references with arbitrary text and node scripts/guardian.mjs still passes; I verified this by temporarily replacing the review skill content. In that scenario the guardian no longer enforces the regulated review/engineering gates even though the policy claims canonical skill synchronization, so compare these files to an approved digest/source copy or assert the required hard-rule markers before passing.
Useful? React with 👍 / 👎.
| if (file.startsWith(".cursor/rules/") && file !== canonicalAgentAdapters[0]) { | ||
| failures.push(`${file} is not part of the canonical Cursor policy`); |
There was a problem hiding this comment.
GitHub supports path-specific .github/instructions/*.instructions.md files with an applyTo field for Copilot Chat and the cloud agent (https://docs.github.com/en/copilot/tutorials/customization-library/custom-instructions/your-first-custom-instructions), but this loop only rejects extra Cursor rules. I verified that staging .github/instructions/override.instructions.md with applyTo: "**" still lets node scripts/guardian.mjs pass, so a PR can add conflicting Copilot instructions while the guardian claims the canonical adapter is enforced; reject tracked .github/instructions/*.instructions.md unless they are explicitly canonical.
Useful? React with 👍 / 👎.
|
As observações de revisão foram incorporadas. A política agora exige AGENTS.md na raiz, valida digests dos ficheiros canónicos, inclui CLAUDE.md canónico e rejeita .cursorrules, regras .claude, instruções Copilot por path, entrypoints aninhados e overrides de instruções no VS Code. O guardian executa quatro testes de mutação e passou localmente.\n\n@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 27bcd557e2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const tracked = spawnSync("git", ["ls-files"], { cwd: root, encoding: "utf8" }); | ||
| if (tracked.status !== 0) return ["git ls-files failed for agent policy"]; | ||
| const trackedFiles = new Set(tracked.stdout.split("\n").filter(Boolean)); |
There was a problem hiding this comment.
Quando alguém cria localmente um src/AGENTS.md, .cursorrules ou .claude/... antes de pedir alterações, essas instruções alternativas ainda podem ser carregadas pelas ferramentas, mas a guardian passa porque as regras de rejeição só iteram sobre git ls-files, que omite ficheiros não rastreados e ignorados. Reproduzi com uma .cursorrules não rastreada: node scripts/guardian.mjs continuou a passar, deixando uma forma prática de contornar a política local que esta alteração pretende impor.
Useful? React with 👍 / 👎.
| (["AGENTS.md", "AGENTS.override.md"].includes(basename) && file !== "AGENTS.md") | ||
| || (basename === "CLAUDE.md" && file !== "CLAUDE.md") |
There was a problem hiding this comment.
Se alguém commitar REVIEW.md ou nested/GEMINI.md, a guardian continua a passar porque esta condição só trata AGENTS.md, AGENTS.override.md e CLAUDE.md; reproduzi ambos os casos com git add antes de node scripts/guardian.mjs. Esses ficheiros ainda são fontes de instruções para ferramentas cobertas pela política — a documentação do Claude Code menciona REVIEW.md para reviews e a documentação do GitHub Copilot lista GEMINI.md como instrução de agente — portanto eles permitem instruções paralelas rastreadas apesar do objetivo de manter um ponto de entrada canónico.
Useful? React with 👍 / 👎.
| } | ||
| if (file === ".vscode/settings.json") { | ||
| const settings = readFileSync(join(root, file), "utf8"); | ||
| if (/"(?:chat\.instructionsFilesLocations|github\.copilot\.chat\.[^"]*\.instructions)"\s*:/.test(settings)) { |
There was a problem hiding this comment.
Um .vscode/settings.json rastreado ainda pode definir chat.agentSkillsLocations, chat.agentFilesLocations, chat.promptFilesLocations ou chat.hookFilesLocations e a guardian passa, porque esta regex só bloqueia duas chaves de instruções explícitas; reproduzi com {"chat.agentSkillsLocations": {".github/skills": true}}. A referência oficial de AI settings do VS Code lista essas chaves como fontes de customizações de agentes, prompts, skills e hooks, então elas permitem reintroduzir comportamento de agente fora da política canónica mesmo com a validação atual.
Useful? React with 👍 / 👎.
1 participant
Summary
Scope
The policy covers module ownership, real banking operations, security and regulation, governed no-code configuration, cloud-native scale, and TypeScript, Go, Java, COBOL, Python, PostgreSQL, and Redis engineering rules.
Validation