Lap Tran
4a2301b077
CI / build (push) Has been cancelled
- Archive 79 completed framework-dev tasks from tasks/ -> tasks/complete/ - status.py: add --cleanup-done and --install-cleanup-schedule commands - Add scripts/automaton-cleanup.sh for periodic task archiving - Dashboard: rename 'Background' tab -> 'Agent', 'Cleanup' agent -> 'Completed Task Archiver', remove redundant group headers and pill badges, dim inactive agent placeholders - .rules.md: add Self-Documenting UI Names rule - New tests: test_cleanup_done.py, expanded test_app.py and test_task.py
702 B
702 B
Adversarial Bug Report — plug-stale-task-hole
Attack Vectors
- Clock reset bypass: Can an attacker manipulate the activity clock to bypass stale detection?
- False positives: Can legitimate activity be misclassified as stale?
- Race condition: What happens if --touch and --can-edit race on the task's timestamp?
Findings
- The activity clock uses filesystem mtime, which IS manipulable by
touch— but this is by design (the--touchcommand is the official way to reset) - The 30-minute threshold gives reasonable headroom for long-running work
- Race conditions are minimal since status.py uses atomic file operations
Verdict
No exploitable vulnerabilities found.