Commit-gate reclassification, reshaped by its own security review: two land, three revert - #956
Merged
Merged
Conversation
To editable (same risk class as existing members): the raffle-win event toggle (the one toggle out of step with its 24 siblings — audit note added at both lists so the next new event checks both), monero.out_peers (performance knob, the prep-threads class), proxy.donate_level (the XVB_DONATION_LEVEL sibling). To confirm-gated: the two payout-scan metadata fields (wallet-creation restore points — a wrong value re-scans from a different height on the wallet's NEXT creation; recoverable, cheaper than the already-CONFIRM data-dir moves). DELIBERATELY EXCLUDED from the audit's proposal: telegram.control.confirm_timeout stays host-only. telegram.control.* is the approval channel's own trust anchor (never-approve as a block per the parity decision record), and the timeout is unbounded at validation — a compromised container could stretch a pending confirm's validity for days. A negative test pins the exclusion. Both drift-guard sides updated together; gate-table tier-1 rows added for every moved key; editor badges follow automatically from _editable_keys/_confirm_keys. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…revert The adversarial security pass killed three of the audit's five moves with the project's own documentation: - proxy.donate_level REVERTS to host-only: docs/privacy.md itself says donate traffic bypasses the Tor socks5, and a self-approving container could silently divert up to 99% of revenue — wallet-grade, and CONFIRM is explicitly UX friction, not a control. - monero.payout_scan_height + tari.payout_scan_birthday REVERT to host-only: a future-dated value lands at the NEXT wallet creation and silently defeats payout-confirmation tamper evidence — not the recoverable class the confirm tier documents, and unboundable offline. - monero.out_peers DOWNGRADES from editable to confirm-gated: bounded 8-1024 and instantly reversible, but the biggest steady-state knob on the shared Tor daemon's CPU. - telegram.events.raffle_win stays editable (clean sibling match). Both drift-guard sides, the gate-table tests, the pytest tier map and docs/dashboard.md all reworked to match; docs/dashboard.md reset to the current base first (the earlier edit had restored pre-merge rejection prose from a stale checkout). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
From the on-the-fly configurability audit — and the best argument this session for the adversarial pass. The audit proposed six reclassifications as "same risk class as existing members"; the dedicated security review killed three of them with the project's own documentation:
Landed:
telegram.events.raffle_win→ editable (the one event toggle out of step with its 24 siblings; audit-note comments at both lists so the next new event checks both).monero.out_peers→ confirm-gated, not free-commit (bounded 8-1024 and instantly reversible, but the biggest steady-state knob on the shared Tor daemon's CPU — the review's downgrade).Reverted to host-only, with the review's evidence:
proxy.donate_level(docs/privacy.md's own words: donate traffic bypasses the Tor socks5 — a self-approving container could silently divert up to 99% of revenue; wallet-grade, and CONFIRM is documented as UX friction, not a control);monero.payout_scan_height+tari.payout_scan_birthday(a future-dated value lands at the NEXT wallet creation and silently defeats payout-confirmation tamper evidence — not the recoverable class the confirm tier covers, and unboundable offline).telegram.control.confirm_timeoutwas also excluded at review (the approval channel's own trust anchor; unbounded at validation) with a negative test pinning it.Both drift-guard sides move together; gate-table rows per key; docs/dashboard.md reset to the current base first (an earlier edit had restored pre-merge prose from a stale checkout) then re-touched minimally. Solo suite 2188/0 + pytest clean. Ponytail: list edits + decision-record comments.
🤖 Generated with Claude Code