Fix 10 audit bugs: path prefix matching, verdict parsing, CORS, stale-task detection, phase mapping

Batch 1 (High severity): - Bug 1: --audit cat3 now checks .automaton/tasks/ paths - Bug 4: Verdict PASS/FAIL uses structured ## Status: line parsing - Bug 5: register-guards.sh checks .json/.jsonc, writes plugin key, strips comments - Bug 7: --can-edit/--scope-check path prefix uses os.sep boundary Batch 2 (Medium/Low severity): - Bug 2: migrate-project.sh find command parentheses for -prune binding - Bug 3: vram_detect model prefix matching with known-suffix whitelist - Bug 6: dashboard reads .state file before artifact heuristic fallback - Bug 8: removed wildcard CORS, added security headers (nosniff, DENY) - Bug 9: stale-task detection uses .state.lastedit instead of .state mtime - Bug 10: TEST_PLAN.md maps to test_design (was implement) 249 tests pass (up from 235). All 10 tasks driven through full workflow to completion.
2026-06-22 10:40:58 -04:00
parent f32f98575b
commit 81ccf548e5
106 changed files with 1643 additions and 436 deletions
@@ -0,0 +1 @@
+complete
@@ -0,0 +1,2 @@
+research:approved|2026-06-22T13:56:13.755971+00:00|user
+code_review:approved|2026-06-22T14:06:36.914334+00:00|user
@@ -0,0 +1,18 @@
+# Adversarial Bug Report: fix-verdict-pass-inference
+
+## Summary
+Adversarial review of the verdict parsing fix. One minor edge case noted (already in bug report).
+
+## Bugs Found
+No additional bugs beyond Bug 1 in BUG_REPORT.md (substring match within status value — Low severity, consistent with dashboard).
+
+## Analysis
+- **Consistency with dashboard**: The new `_parse_verdict_status_line()` mirrors `task.py:parse_verdict_status()` — both use the same `label in after_colon.upper()` pattern. This is deliberate alignment, not a bug.
+- **Fallback behavior**: Unparseable verdicts now return `"human_intervention"` instead of the old implicit behavior. This is safer — a verdict that can't be parsed should never be assumed PASS.
+- **Edge case — multiple status lines**: If a verdict has both `## Status: FAIL` and later `## Status: PASS`, the first match wins (FAIL). This is correct — the first status declaration is the authoritative one.
+- **Edge case — case variations**: `## status: pass` (lowercase) is handled by `low.startswith("## status")` and `after_colon.upper() == "PASS"` — correct.
+
+## Score
+0
+
+ADVERSARIAL_BUG_FIND_COMPLETE
@@ -0,0 +1,15 @@
+# Bug Report: fix-verdict-pass-inference
+
+## Summary
+The fix replaces substring search with structured-line parsing, correctly matching the dashboard's approach.
+
+## Bugs Found
+
+### Bug 1: Substring match within status line value
+- **Severity**: Low
+- **Location**: scripts/status.py:316
+- **Description**: `_parse_verdict_status_line()` uses `label in after_colon.upper()` which is a substring match within the status value. A status like `## Status: FAILURE` would match `FAIL` (since `"FAIL" in "FAILURE"` is True). However, this is consistent with the dashboard's `parse_verdict_status()` (task.py:82) which has the same pattern, and verdict status values are always exactly "PASS", "FAIL", or "NEEDS_REVIEW" per the referee prompt template.
+- **Suggested Fix**: Use exact match only: `if after_colon.upper() == label`. However, this would diverge from the dashboard's behavior and could break existing verdicts with extra text on the status line.
+
+## Score
+1 (Low)
@@ -0,0 +1,13 @@
+# Code Review: fix-verdict-pass-inference
+
+## Summary
+Replaces fragile substring search with structured-line parsing, matching the dashboard's existing `parse_verdict_status()` approach.
+
+## Findings
+- **Correctness**: `_parse_verdict_status_line()` correctly looks for `## Status:` and `- **Status**:` headers, extracting the value after the colon. The `after_colon.upper()` comparison handles case variations.
+- **Consistency**: The new helper mirrors `automaton/dashboard/core/task.py:parse_verdict_status()` — good alignment between enforcement layers.
+- **Fallback**: Unparseable verdicts now return `"human_intervention"` instead of the old behavior (which would have returned `human_intervention` for anything without "PASS"). This is a safe default.
+- **Edge case**: A verdict with `## Status: PASS` and "FAIL" in body correctly returns `complete` — the structured parse only looks at the status line.
+
+## Verdict
+APPROVED — no issues found.
@@ -0,0 +1,12 @@
+# Doc Review: fix-verdict-pass-inference
+
+## Summary
+No documentation updates needed. The verdict parsing is an internal heuristic used only for pre-v2.0 task upgrades.
+
+## Findings
+- The `--upgrade` command is documented in AGENTS.md and README.md, but the inference logic itself is not documented.
+- The fix aligns `status.py` with the dashboard's `parse_verdict_status()` — no API change.
+- No user-facing behavior change for v2.0 tasks (which use `.state` files, not artifact inference).
+
+## Verdict
+No doc changes required.
@@ -0,0 +1,8 @@
+# Implementation: fix-verdict-pass-inference
+
+## Changes
+- **scripts/status.py**: Added `_parse_verdict_status_line()` helper (~line 301) that parses `## Status:` and `- **Status**:` header lines for PASS/FAIL/NEEDS_REVIEW, mirroring the dashboard's `parse_verdict_status()`.
+- **scripts/status.py** `_infer_state_from_artifacts()` (~line 326): Replaced `if "PASS" in content:` substring search with structured-line parsing via `_parse_verdict_status_line()`. Returns `"complete"` only for exact PASS, `"human_intervention"` for FAIL/NEEDS_REVIEW, and falls back to `"human_intervention"` for unparseable verdicts.
+
+## Test
+- `tests/test_status.py::TestVerdictPassInference` — 3 tests: FAIL with "PASS" in body → human_intervention, PASS → complete, NEEDS_REVIEW → human_intervention.
@@ -0,0 +1,15 @@
+# Spec: fix-verdict-pass-inference
+
+## Problem
+`_infer_state_from_artifacts()` in `scripts/status.py:311` uses `if "PASS" in content:` (substring search) to determine if a VERDICT.md is PASS. A FAIL or NEEDS_REVIEW verdict containing "PASS" in its body (e.g., "All unit tests PASS") is misclassified as `complete`.
+
+The dashboard's `parse_verdict_status()` (`automaton/dashboard/core/task.py:63`) already has the correct structured-line parsing — status.py should use the same approach.
+
+## Fix
+Replace the substring check at `scripts/status.py:311` with structured-line parsing: look for `## Status:` or `- **Status**:` header lines and check the value after the colon. Return `"complete"` only for exact `PASS` match, `"human_intervention"` for `FAIL`/`NEEDS_REVIEW`, and keep the current fallback for unparseable verdicts.
+
+## Acceptance Criteria
+- A VERDICT.md with `## Status: FAIL` and "tests PASS" in the body is classified as `human_intervention`, not `complete`
+- A VERDICT.md with `## Status: PASS` is classified as `complete`
+- A VERDICT.md with no parseable status header falls through to the current behavior
+- Add a test in `tests/test_status.py` covering the FAIL-with-PASS-in-body case
@@ -0,0 +1,27 @@
+# Verdict: fix-verdict-pass-inference
+
+## Status: PASS
+**Completion Date**: 2026-06-22
+
+## Summary
+The fix replaces fragile substring search with structured-line parsing, aligning status.py with the dashboard's existing approach. One Low-severity edge case noted but consistent with dashboard behavior.
+
+## Findings
+- `_parse_verdict_status_line()` correctly parses `## Status:` and `- **Status**:` header lines.
+- Bug Finder noted a Low-severity edge case: `label in after_colon.upper()` is a substring match within the status value (e.g., "FAILURE" matches "FAIL"). This is consistent with the dashboard's `parse_verdict_status()` and not a practical issue since verdict statuses are always exactly "PASS", "FAIL", or "NEEDS_REVIEW".
+- Adversarial Bug Finder confirmed no additional issues.
+- No contradictions between the two reports.
+- Test coverage added: `TestVerdictPassInference` (3 tests).
+- All 242 tests pass.
+
+## Tasks for Review / Tie-Breaks
+None.
+
+## Remaining Issues
+- Low-severity substring match within status value (noted in bug report, consistent with dashboard, not blocking).
+
+## Score
+10 (PASS)
+
+## Reviewer Comments
+