Skip to content

FUSI-036 - #31

Open
timoteo7 wants to merge 1 commit into
mainfrom
fusion/fusi-036
Open

timoteo7 wants to merge 1 commit into
mainfrom
fusion/fusi-036

Conversation

@timoteo7

Copy link
Copy Markdown
Owner

Automated PR for FUSI-036.

REGRESSION follow-up (FUSI-020 Step 5, family 7 of 7): lifecycle-transition-forbidden - 2 cases across 2 engine test files assert a lifecycle move that the FN-217 F2 rank rules now forbid. This is a policy-guard regression, not stale text: the test is asking the engine to perform a move the lifecycle containment contract deliberately blocks (e.g. an automatic path attempting a backward move out of a review lane or into intake). Fixing it by relaxing the guard is exactly the barred appeasement - the guard is correct and the test's expectation violates it. Read FN-207/FN-217 and the lifecycle containment rules in AGENTS.md, then rewrite the case to assert the correct contained behavior (the move is refused and the card holds or routes per the current lifecycle role). First red run: main push Runfusion#3158 (b37d0fe). Census: docs/solutions/test-failures/main-full-suite-census-2026-09-25.md (family lifecycle-transition-forbidden). Relevant files include src/tests/in-review-unmet-dependency-reconcile.test.ts and src/tests/workflow-node-execution-needs.test.ts. Reproduce: pnpm --filter @fusion/engine exec vitest run --silent=passed-only --reporter=dot. Per FN-5893 assert the containment invariant across every surface that attempts a forbidden move, not just these two files.

…rver-free

Census family lifecycle-transition-forbidden (2 cases, both @fusion/core):
the two cases asserted automatic backward moves the F2 rank rules forbid.

live-move-path-undeclared-target: archived -> todo is refused even with
recoveryRehome, which is an adjacency bypass and never a containment bypass.
The capability half moves to resolveContainedBackwardTargetForTask, so the
stranded-card reach the case was written to protect is still pinned.

renamed-board-reopen: the engine-sourced checking -> queued bounce is refused
and the card holds, which is what prevents the stale-passed-result hazard
rather than the reopen clear. The clear keeps its own user-sourced case.

New server-free policy test owns the invariant: F1-F5, the moveSource carve-out,
the reason partition, and every role-fixed reason authorizing no role change.
Verified by four mutations (F2 relaxed, scoping removed, F5 deleted, a recovery
reason widened) - each fails naming the rule and pair. No guard file changed.

Co-authored-by: Fusion <noreply@runfusion.ai>
Fusion-Task-Id: FUSI-036
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

4589 finding(s)

HIGH/CRITICAL: 43 | MEDIUM: 4035 | LOW: 511

Severity Rule Location
HIGH secret-database-url .github/workflows/full-suite.yml:55
HIGH secret-generic-credential .github/workflows/full-suite.yml:56
HIGH secret-database-url .github/workflows/full-suite.yml:284
HIGH secret-generic-credential .github/workflows/full-suite.yml:285
HIGH secret-database-url .github/workflows/full-suite.yml:324
HIGH secret-generic-credential .github/workflows/full-suite.yml:325
HIGH secret-database-url .github/workflows/pr-checks.yml:221
HIGH secret-generic-credential .github/workflows/pr-checks.yml:222
HIGH secret-generic-credential .github/workflows/release.yml:522
HIGH secret-generic-credential .github/workflows/release.yml:524
HIGH secret-generic-credential .github/workflows/test-release.yml:445
HIGH secret-generic-credential .github/workflows/test-release.yml:447
HIGH secret-generic-credential docs/cli-reference.md:80
HIGH secret-generic-credential docs/signals-connectors.md:34
HIGH secret-generic-credential docs/signals-connectors.md:77
HIGH secret-generic-credential docs/signals-connectors.md:94
HIGH secret-generic-credential docs/signals-connectors.md:117
HIGH secret-generic-credential docs/signals-connectors.md:159
HIGH secret-generic-credential packages/cli/STANDALONE.md:71
HIGH secret-database-url packages/core/src/postgres/credential-redact.ts:12
HIGH secret-database-url packages/core/src/postgres/credential-redact.ts:30
HIGH secret-database-url packages/core/src/postgres/credential-redact.ts:31
HIGH secret-database-url packages/core/src/postgres/credential-redact.ts:102
HIGH secret-database-url packages/core/src/postgres/credential-redact.ts:103
HIGH secret-generic-credential packages/core/src/postgres/embedded-lifecycle.ts:843
HIGH secret-database-url packages/core/src/postgres/embedded-lifecycle.ts:1574
HIGH secret-database-url packages/core/src/postgres/pg-backup.ts:756
HIGH js-ssrf-outbound-request packages/dashboard/app/public/sw.js:651
HIGH js-ssrf-outbound-request packages/dashboard/app/public/sw.js:727
HIGH js-host-header-trust packages/dashboard/src/cli-session-ws.ts:81
HIGH js-host-header-trust packages/dashboard/src/cli-session-ws.ts:115
HIGH js-ssrf-outbound-request packages/dashboard/src/routes.ts:1858
HIGH js-host-header-trust packages/dashboard/src/server.ts:2689
HIGH js-host-header-trust packages/dashboard/src/server.ts:2714
HIGH js-host-header-trust packages/dashboard/src/server.ts:3025
HIGH js-host-header-trust packages/dashboard/src/server.ts:3193
HIGH secret-slack-webhook plugins/examples/fusion-plugin-notification/README.md:46
HIGH secret-database-url scripts/pg-test-server.mjs:200
HIGH secret-database-url scripts/pg-test-server.mjs:231
HIGH secret-database-url scripts/pg-test-server.mjs:241
HIGH secret-generic-credential scripts/sync-fusion-skill-tools.mjs:550
HIGH secret-generic-credential scripts/verify-windows-elevated-restricted.mjs:81
HIGH secret-generic-credential scripts/verify-windows-encoding-recovery.mjs:41
MEDIUM redos-nested-quantifier docs/agents.md:1710
MEDIUM insecure-temp-file docs/solutions/test-failures/main-full-suite-census-2026-09-25.md:376
MEDIUM insecure-temp-file docs/solutions/test-failures/main-full-suite-census-2026-09-25.md:377
MEDIUM insecure-temp-file docs/solutions/test-failures/main-full-suite-census-2026-09-25.md:541
MEDIUM insecure-temp-file packages/cli/src/__tests__/bin.test.ts:136
MEDIUM insecure-temp-file packages/cli/src/__tests__/dev-with-memory-lib.test.ts:33
MEDIUM insecure-temp-file packages/cli/src/__tests__/dev-with-memory-lib.test.ts:34

…and 4539 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant