Repository navigation
[AAASM-6352] 🐛 (core): Deny redact verdict under enforce instead of allowing it - #359
Merged
Merged
Conversation
The native query returns only (decision, reason); no redacted payload crosses the ABI, so mapping redact to allow ran the tool with the original, secret-bearing args. Under enforce it now denies; observe/disabled keep the fail-open posture. Fix the comments/docs that claimed the runtime redacts in place (AAASM-1920 tracks real redacted-payload support). Refs AAASM-6352 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M2jR4NNxxSWJokWJqTu4nd
test_runtime_interceptor.py pinned redact as an allow; that pinned the bug. Replace with enforce-deny / observe-allow tests, plus adapter-level tests (shared governed-tool flow, LangChain handler) asserting the tool is not invoked on redact under enforce, with allow controls. Refs AAASM-6352 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M2jR4NNxxSWJokWJqTu4nd
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
The env-gated native runtime tests (AAASM_RUN_NATIVE_CORE_TESTS) used a mock that never issued the handshake challenge the shared client now requires, so every mock-backed test timed out. Issue the challenge and consume the proof like the Node mock does. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M2jR4NNxxSWJokWJqTu4nd
…O3 client
Drive the real built agent_assembly._core RuntimeClient against a mock runtime
answering CheckActionResponse{REDACT}: the native layer surfaces "redact", the
production interceptor denies under enforce, stays advisory without it, and an
ALLOW control on the same path proceeds. Mutating the interceptor to allow on
redact fails the redact cases.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M2jR4NNxxSWJokWJqTu4nd
|
Contributor
Author
|
Owner self-review record (owner-only admin-merge exception, condition 9: same-identity REVIEW_REQUIRED). Verified identity: Chisanan232, org role |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Under enforce, a gateway
redactverdict no longer lets the tool run with the original (secret-bearing) arguments.Jira: https://lightning-dust-mite.atlassian.net/browse/AAASM-6352 (found via AAASM-6351)
What this means
No redacted payload crosses the native ABI (AAASM-1920), so the SDK cannot apply redaction client-side. Previously
redactwas folded into allow, so the tool received the raw secret while the audit trail said Redact. It now denies under enforce (as the Go SDK does by erroring); observe/disabled keep their advisory behaviour. False claims that redact "strips secrets" are corrected.This turns Redact into a hard deny until redacted payloads cross the ABI; it does not make redact_only work.
Evidence
Tests assert the tool is NOT invoked on Redact under enforce, with an Allow control and an observe-mode test; a mutation restoring the old mapping fails the new tests. Counts are in the commit messages and the Jira comment.
🤖 Generated with Claude Code
https://claude.ai/code/session_01M2jR4NNxxSWJokWJqTu4nd