Restructured after concluding the architecture was wrong, not the rules.
The CI gate protected the REPOSITORY. The threat for autonomous work is
an agent reading attacker-controlled text and being persuaded by it --
and there, the agent is the target, so enforcement belongs at the point
of consumption rather than at a checkpoint. A checkpoint also only ever
saw content arriving through a pull request to us; the read path covers
every issue, comment and discussion an agent touches anywhere.
REMOVED: ci-integrity.yml. With enforcement at the read path, a pull
request disabling its own checks matters far less, and that workflow was
carrying the entire cost -- pull_request_target, a required-check
registration, a branch-protection dependency, and break-glass friction on
every CI or tooling contribution. It was also the one piece that could
not be tested the way CI actually runs it.
KEPT: the Layer 0 file scan, gating. It is 23 seconds with no false
positives and it stops a payload LANDING in main, where it would be read
by every agent afterwards and indexed into the product's own graph. The
read-path scanner cannot substitute for that: by the time main is being
read, the payload is already shipped. Prevention and detection, not one
instead of the other.
ADDED: scripts/fetch-scanned.sh, which pulls every agent-readable surface
of an issue or pull request -- title, body, comments, reviews, inline
review comments, commit messages -- scans the lot, and prints it only if
nothing is concealed. Five API calls become one command, so the safe path
is also the shorter path. That is the only kind of safety measure that
gets used.
SEVERITY, added because the binary model was unusable. An HTML comment is
a hiding MECHANISM, not an attack SIGNATURE, and our own acknowledgement
bot posts one into nearly every thread -- refusing on it rejected 28 of
40 recent pull requests. A tool that refuses 70% of real content is
switched off within a day. Signatures now refuse; mechanisms are noted.
A payload hidden INSIDE a downgraded comment still refuses, because the
phrase rules fire on the text wherever it sits, and the selftest pins
exactly that.
Re-measured end to end across 40 recent pull requests: 1 refused, 28
noted, 11 clean. The single refusal is this pull request, whose commit
messages document the markers the scanner looks for.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Martin Vogel
fbfd90ab89