feat(harness): protected-paths guard (issue #94 Layer 2) - #179
Merged
Conversation
…#94 Layer 2) Add a deterministic protectedPaths guard: an adapter-declared glob array (GATES_FILE-aware) that merge-ready.sh checks against a PR's changed files before merging. Any match flips an otherwise-MERGE verdict to SKIP:protected-paths, labels the PR needs-human, and never auto-merges it, even with owner approval and green CI. The root adapter ships a protective default (.claude/**, .github/workflows/**, gates.json); the self-hosted adapter overrides it to empty since reCode's harness files are the product. Reviewers get the same hard-reject rule under the correctness lens. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
… guard (issue #94 Layer 2) Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
robercano-ghbot
added
the
needs-human
Collaborator
Author
|
feat(harness): protected-paths guard (issue #94 Layer 2) (not yet reviewed) |
robercano
approved these changes
Jul 21, 2026
robercano-ghbot
removed
the
needs-human
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security: prompt-injection hardening — Layer 2 (protected-paths guard)
Implements Layer 2 of issue #94 (follow-up #164): a deterministic guard so no
agent-authored PR can auto-merge if its diff touches the loop's own control plane.
This does not close #94 — Layers 3 (#165) and 4 (#166) remain.
What changed
protectedPathsadapter config — a new top-level glob array ingates.json..claude/gates.jsonships a protective default for downstream adopters:.claude/**,.github/workflows/**,gates.json,**/gates.json..claude/self/gates.jsonoverrides it to[](disabled) — in thisself-hosted repo the harness files under
.claude/ARE the product, solegitimate slices of Security: prompt-injection hardening — fence untrusted issue/PR text, protected-paths guard, pre-merge threat scan #94 (this very PR edits
.claude/scripts/merge-ready.sh)must stay mergeable. Empty array = disabled (same empty-means-skip convention
as
gates/notify).merge-ready.shenforcement — now resolves its adapter viaGATES_FILE(falls back to the root adapter), and before merging computes the PR's changed
files (
gh pr view --json files) against the adapter'sprotectedPathsglobs(deterministic glob→regex, no LLM). A hit blocks the merge and flags the PR
needs-human(via the sharedneeds_human_flagseam), skipping only that PR.Empty/absent list = no-op.
.claude/agents/reviewer.mdnow rejects any diff touching a
protectedPathspath (with the self-host emptyoverride as the documented exception).
merge-ready.test.shgains scenarios D (protected path blocked +labeled), E (clean diff merges), F (empty override disables the guard), and G
(proves
GATES_FILEactually selects the self-adapter override vs. the rootdefault — G1 merges vs. G2/G3 block on the SAME fixture, relative + absolute
path branches).
docs/HARDENING.mdgains a Protected-paths guard section (fullerwriteup deferred to docs: bot-token blast-radius verification + HARDENING.md prompt-injection section (issue #94 Layer 4) #166).
Acceptance (from #94)
Gates & review
merge-ready.test.sh).(approve, high — mutation-tested that scenario G is sensitive to a
root-relative-resolution regression).
🤖 Generated with Claude Code