Skip to content

track: 2026-08-18 — 40 tracked, 44 case-study ready, 2 rule-adopted #916

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
xiaolai wants to merge 1 commit into
base: main
Choose a base branch
from
Open

track: 2026-08-18 — 40 tracked, 44 case-study ready, 2 rule-adopted #916

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions auditor/disagreements.jsonl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,6 +250,9 @@
{"event":"maintainer_rejected","pr":"nicobailon/visual-explainer#45","fingerprints":["sha256:92b81b560bcdefebd5c7c00180ee5cfb34843731ce5033d6fddd8fc7b9979885","sha256:6359292c71ed77518913d6a07aabe986e1400417c3c23baf0ec4dc10835175be","sha256:1558f7793581c26a7db2fa00f6c80449c6d637f6e960836c550eca0be1329436"],"rule_ids":["SEC-network-fetch-external-code","SEC-network-deploy-public","SEC-path-delimiter-injection"],"dissent_type":"context_missed","quote":"the target share script was intentionally removed, and the installer path-patching change no longer applies","commenter_role":"maintainer","classifier_model":"haiku-4-5","classifier_confidence":"medium","comments_hash":"sha256:1c36a1bc81d6c776af53f84592e8eced2b85b2c34e746ae6d759ca0a012fc635","timestamp":"2026-08-15T03:48:11Z"}
{"event": "downstream_suppression", "timestamp": "2026-08-16T00:05:17Z", "repo": "xiaolai/cc-suite", "commit_sha": "6d02d7540acba055eda79c8355e85275a0451a3d", "rule_id": "R31", "suppression_type": "threshold_adjustment", "fingerprint": "sha256:479c2103b7d8dd2532b6af6c514e5d3b95f364db6503416633bba4b838612fde", "file_fingerprint": "sha256:0973eb2098961d7d60ac66c4217a6974abac61cd366b713ee9f4ac626fe6fb59", "path": ".claude/nlpm.local.md", "override_value": {"threshold": 900}, "reason_given": ""}
{"event": "downstream_suppression", "timestamp": "2026-08-16T00:05:17Z", "repo": "xiaolai/cc-suite", "commit_sha": "6d02d7540acba055eda79c8355e85275a0451a3d", "rule_id": "R51", "suppression_type": "rule_override", "fingerprint": "sha256:6eb255100e953a537daab93747608eb544524e9e41b5c095b0cafe48079486a2", "file_fingerprint": "sha256:0973eb2098961d7d60ac66c4217a6974abac61cd366b713ee9f4ac626fe6fb59", "path": ".claude/nlpm.local.md", "override_value": {"enabled": true, "vocabulary_skill": "skills/cc-suite/vocabulary/"}, "reason_given": ""}
{"event":"pr_comments_snapshot","timestamp":"2026-08-18T08:19:30Z","pr":"sangrokjung/claude-forge#32","pr_state":"closed_unmerged","comments_hash":"sha256:39c743c7cfedfca1c4a347fb3b69543a89613aed1c893a302e83db982c83c221","fingerprints":[],"rule_ids":[],"comments":[{"id":"IC_kwDORWl5zc8AAAABPVyEwA","author":{"login":"sangrokjung"},"authorAssociation":"OWNER","body":"Superseded by #61, which is now merged. Thank you for finding these — all three were real, and all three landed.\n\n**#32** — you were right that `tools` and the \"security-reviewer subagent\" wording disagreed. Tracing it further, the inconsistency points the other way than the PR assumed: the agent's `<Role>` already states it performs security review directly, and the live `handoff-verify` pipeline dispatches `security-reviewer` as an independent sibling reviewer in a parallel fan-out, never as a child of `verify-agent`. So the prose at line 53 was the wrong half. It has been reworded rather than granting `Task`, which keeps `verify-agent` from becoming the only agent in the repo holding it.\n\n**#35 / #36** — the finding was right: `>=0.8.11` and `>=1.23.0` were far too low, and unbounded ranges are a real hazard. Adopting the `==` pins as written would have had a cost of its own by now, freezing these scripts on releases chosen four months ago. Your floors were kept and major-version ceilings added instead:\n\n```\npython-docx>=1.1.2,<2\nlxml>=5.2.2,<7\nPyMuPDF>=1.24.3,<2\n```\n\nEach ceiling was checked against live PyPI so it admits the current stable (1.2.0 / 6.1.1 / 1.28.2) — a first attempt used `<6` for lxml, which review caught as excluding lxml's current major entirely.\n\nClosing as superseded, not rejected. Your commits are credited in the merged work.","createdAt":"2026-08-18T06:25:24Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/sangrokjung/claude-forge/pull/32#issuecomment-5324440768","viewerDidAuthor":false}]}
{"event":"pr_comments_snapshot","timestamp":"2026-08-18T08:19:32Z","pr":"sangrokjung/claude-forge#35","pr_state":"closed_unmerged","comments_hash":"sha256:9e888c8ac944cf0f0a529bd12b84fa792ce2feaeb83af53fb9c4e122c0fb9250","fingerprints":[],"rule_ids":[],"comments":[{"id":"IC_kwDORWl5zc8AAAABPVyFtg","author":{"login":"sangrokjung"},"authorAssociation":"OWNER","body":"Superseded by #61, which is now merged. Thank you for finding these — all three were real, and all three landed.\n\n**#32** — you were right that `tools` and the \"security-reviewer subagent\" wording disagreed. Tracing it further, the inconsistency points the other way than the PR assumed: the agent's `<Role>` already states it performs security review directly, and the live `handoff-verify` pipeline dispatches `security-reviewer` as an independent sibling reviewer in a parallel fan-out, never as a child of `verify-agent`. So the prose at line 53 was the wrong half. It has been reworded rather than granting `Task`, which keeps `verify-agent` from becoming the only agent in the repo holding it.\n\n**#35 / #36** — the finding was right: `>=0.8.11` and `>=1.23.0` were far too low, and unbounded ranges are a real hazard. Adopting the `==` pins as written would have had a cost of its own by now, freezing these scripts on releases chosen four months ago. Your floors were kept and major-version ceilings added instead:\n\n```\npython-docx>=1.1.2,<2\nlxml>=5.2.2,<7\nPyMuPDF>=1.24.3,<2\n```\n\nEach ceiling was checked against live PyPI so it admits the current stable (1.2.0 / 6.1.1 / 1.28.2) — a first attempt used `<6` for lxml, which review caught as excluding lxml's current major entirely.\n\nClosing as superseded, not rejected. Your commits are credited in the merged work.","createdAt":"2026-08-18T06:25:26Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/sangrokjung/claude-forge/pull/35#issuecomment-5324441014","viewerDidAuthor":false}]}
{"event":"pr_comments_snapshot","timestamp":"2026-08-18T08:19:33Z","pr":"sangrokjung/claude-forge#36","pr_state":"closed_unmerged","comments_hash":"sha256:103d4b88e9450859843d3a9a509d415a0ac863b87d50e0eaa98b1ff04991fb2c","fingerprints":[],"rule_ids":[],"comments":[{"id":"IC_kwDORWl5zc8AAAABPVyGyg","author":{"login":"sangrokjung"},"authorAssociation":"OWNER","body":"Superseded by #61, which is now merged. Thank you for finding these — all three were real, and all three landed.\n\n**#32** — you were right that `tools` and the \"security-reviewer subagent\" wording disagreed. Tracing it further, the inconsistency points the other way than the PR assumed: the agent's `<Role>` already states it performs security review directly, and the live `handoff-verify` pipeline dispatches `security-reviewer` as an independent sibling reviewer in a parallel fan-out, never as a child of `verify-agent`. So the prose at line 53 was the wrong half. It has been reworded rather than granting `Task`, which keeps `verify-agent` from becoming the only agent in the repo holding it.\n\n**#35 / #36** — the finding was right: `>=0.8.11` and `>=1.23.0` were far too low, and unbounded ranges are a real hazard. Adopting the `==` pins as written would have had a cost of its own by now, freezing these scripts on releases chosen four months ago. Your floors were kept and major-version ceilings added instead:\n\n```\npython-docx>=1.1.2,<2\nlxml>=5.2.2,<7\nPyMuPDF>=1.24.3,<2\n```\n\nEach ceiling was checked against live PyPI so it admits the current stable (1.2.0 / 6.1.1 / 1.28.2) — a first attempt used `<6` for lxml, which review caught as excluding lxml's current major entirely.\n\nClosing as superseded, not rejected. Your commits are credited in the merged work.","createdAt":"2026-08-18T06:25:28Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/sangrokjung/claude-forge/pull/36#issuecomment-5324441290","viewerDidAuthor":false}]}
{"event":"pr_comments_snapshot","timestamp":"2026-08-18T12:18:09Z","pr":"sangrokjung/claude-forge#32","pr_state":"closed_unmerged","comments_hash":"sha256:39c743c7cfedfca1c4a347fb3b69543a89613aed1c893a302e83db982c83c221","fingerprints":[],"rule_ids":[],"comments":[{"id":"IC_kwDORWl5zc8AAAABPVyEwA","author":{"login":"sangrokjung"},"authorAssociation":"OWNER","body":"Superseded by #61, which is now merged. Thank you for finding these — all three were real, and all three landed.\n\n**#32** — you were right that `tools` and the \"security-reviewer subagent\" wording disagreed. Tracing it further, the inconsistency points the other way than the PR assumed: the agent's `<Role>` already states it performs security review directly, and the live `handoff-verify` pipeline dispatches `security-reviewer` as an independent sibling reviewer in a parallel fan-out, never as a child of `verify-agent`. So the prose at line 53 was the wrong half. It has been reworded rather than granting `Task`, which keeps `verify-agent` from becoming the only agent in the repo holding it.\n\n**#35 / #36** — the finding was right: `>=0.8.11` and `>=1.23.0` were far too low, and unbounded ranges are a real hazard. Adopting the `==` pins as written would have had a cost of its own by now, freezing these scripts on releases chosen four months ago. Your floors were kept and major-version ceilings added instead:\n\n```\npython-docx>=1.1.2,<2\nlxml>=5.2.2,<7\nPyMuPDF>=1.24.3,<2\n```\n\nEach ceiling was checked against live PyPI so it admits the current stable (1.2.0 / 6.1.1 / 1.28.2) — a first attempt used `<6` for lxml, which review caught as excluding lxml's current major entirely.\n\nClosing as superseded, not rejected. Your commits are credited in the merged work.","createdAt":"2026-08-18T06:25:24Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/sangrokjung/claude-forge/pull/32#issuecomment-5324440768","viewerDidAuthor":false}]}
{"event":"pr_comments_snapshot","timestamp":"2026-08-18T12:18:13Z","pr":"sangrokjung/claude-forge#35","pr_state":"closed_unmerged","comments_hash":"sha256:9e888c8ac944cf0f0a529bd12b84fa792ce2feaeb83af53fb9c4e122c0fb9250","fingerprints":[],"rule_ids":[],"comments":[{"id":"IC_kwDORWl5zc8AAAABPVyFtg","author":{"login":"sangrokjung"},"authorAssociation":"OWNER","body":"Superseded by #61, which is now merged. Thank you for finding these — all three were real, and all three landed.\n\n**#32** — you were right that `tools` and the \"security-reviewer subagent\" wording disagreed. Tracing it further, the inconsistency points the other way than the PR assumed: the agent's `<Role>` already states it performs security review directly, and the live `handoff-verify` pipeline dispatches `security-reviewer` as an independent sibling reviewer in a parallel fan-out, never as a child of `verify-agent`. So the prose at line 53 was the wrong half. It has been reworded rather than granting `Task`, which keeps `verify-agent` from becoming the only agent in the repo holding it.\n\n**#35 / #36** — the finding was right: `>=0.8.11` and `>=1.23.0` were far too low, and unbounded ranges are a real hazard. Adopting the `==` pins as written would have had a cost of its own by now, freezing these scripts on releases chosen four months ago. Your floors were kept and major-version ceilings added instead:\n\n```\npython-docx>=1.1.2,<2\nlxml>=5.2.2,<7\nPyMuPDF>=1.24.3,<2\n```\n\nEach ceiling was checked against live PyPI so it admits the current stable (1.2.0 / 6.1.1 / 1.28.2) — a first attempt used `<6` for lxml, which review caught as excluding lxml's current major entirely.\n\nClosing as superseded, not rejected. Your commits are credited in the merged work.","createdAt":"2026-08-18T06:25:26Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/sangrokjung/claude-forge/pull/35#issuecomment-5324441014","viewerDidAuthor":false}]}
{"event":"pr_comments_snapshot","timestamp":"2026-08-18T12:18:14Z","pr":"sangrokjung/claude-forge#36","pr_state":"closed_unmerged","comments_hash":"sha256:103d4b88e9450859843d3a9a509d415a0ac863b87d50e0eaa98b1ff04991fb2c","fingerprints":[],"rule_ids":[],"comments":[{"id":"IC_kwDORWl5zc8AAAABPVyGyg","author":{"login":"sangrokjung"},"authorAssociation":"OWNER","body":"Superseded by #61, which is now merged. Thank you for finding these — all three were real, and all three landed.\n\n**#32** — you were right that `tools` and the \"security-reviewer subagent\" wording disagreed. Tracing it further, the inconsistency points the other way than the PR assumed: the agent's `<Role>` already states it performs security review directly, and the live `handoff-verify` pipeline dispatches `security-reviewer` as an independent sibling reviewer in a parallel fan-out, never as a child of `verify-agent`. So the prose at line 53 was the wrong half. It has been reworded rather than granting `Task`, which keeps `verify-agent` from becoming the only agent in the repo holding it.\n\n**#35 / #36** — the finding was right: `>=0.8.11` and `>=1.23.0` were far too low, and unbounded ranges are a real hazard. Adopting the `==` pins as written would have had a cost of its own by now, freezing these scripts on releases chosen four months ago. Your floors were kept and major-version ceilings added instead:\n\n```\npython-docx>=1.1.2,<2\nlxml>=5.2.2,<7\nPyMuPDF>=1.24.3,<2\n```\n\nEach ceiling was checked against live PyPI so it admits the current stable (1.2.0 / 6.1.1 / 1.28.2) — a first attempt used `<6` for lxml, which review caught as excluding lxml's current major entirely.\n\nClosing as superseded, not rejected. Your commits are credited in the merged work.","createdAt":"2026-08-18T06:25:28Z","includesCreatedEdit":false,"isMinimized":false,"minimizedReason":"","reactionGroups":[],"url":"https://github.com/sangrokjung/claude-forge/pull/36#issuecomment-5324441290","viewerDidAuthor":false}]}
Expand Down
6 changes: 6 additions & 0 deletions auditor/logs/events.jsonl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3995,6 +3995,12 @@
{"timestamp":"2026-08-17T22:38:12Z","workflow":"dashboard","event":"dashboard_rendered","run_id":"32076876643","run_number":92,"data":{"repos":291,"findings":5338,"advisories":22}}
{"timestamp":"2026-08-18T00:24:40Z","workflow":"track","event":"status_check","run_id":"32083814311","run_number":730,"data":{"contributed":54,"tracked":39,"case_study_ready":43,"rule_adopted":2}}
{"timestamp":"2026-08-18T04:24:04Z","workflow":"track","event":"status_check","run_id":"32098432176","run_number":731,"data":{"contributed":54,"tracked":39,"case_study_ready":43,"rule_adopted":2}}
{"timestamp":"2026-08-18T08:19:30Z","workflow":"track","event":"finding_outcome","run_id":"32115146701","run_number":732,"data":{"pr":"sangrokjung/claude-forge#32","pr_state":"closed_unmerged","fingerprints":[],"rule_ids":[]}}
{"timestamp":"2026-08-18T08:19:31Z","workflow":"track","event":"finding_outcome","run_id":"32115146701","run_number":732,"data":{"pr":"sangrokjung/claude-forge#33","pr_state":"merged","fingerprints":[],"rule_ids":[]}}
{"timestamp":"2026-08-18T08:19:32Z","workflow":"track","event":"finding_outcome","run_id":"32115146701","run_number":732,"data":{"pr":"sangrokjung/claude-forge#34","pr_state":"merged","fingerprints":[],"rule_ids":[]}}
{"timestamp":"2026-08-18T08:19:32Z","workflow":"track","event":"finding_outcome","run_id":"32115146701","run_number":732,"data":{"pr":"sangrokjung/claude-forge#35","pr_state":"closed_unmerged","fingerprints":[],"rule_ids":[]}}
{"timestamp":"2026-08-18T08:19:33Z","workflow":"track","event":"finding_outcome","run_id":"32115146701","run_number":732,"data":{"pr":"sangrokjung/claude-forge#36","pr_state":"closed_unmerged","fingerprints":[],"rule_ids":[]}}
{"timestamp":"2026-08-18T08:21:47Z","workflow":"track","event":"status_check","run_id":"32115146701","run_number":732,"data":{"contributed":53,"tracked":40,"case_study_ready":44,"rule_adopted":2}}
{"timestamp":"2026-08-18T08:20:06Z","workflow":"case-study","event":"no_narrative","run_id":"32115807071","run_number":296,"data":{"repo":"sangrokjung/claude-forge","reason":"thin narrative: score=82, security=REVIEW, merged=0, applied_separately=0, rejected=0, rule_adopted=False"}}
{"timestamp":"2026-08-18T12:18:09Z","workflow":"track","event":"finding_outcome","run_id":"32135417350","run_number":733,"data":{"pr":"sangrokjung/claude-forge#32","pr_state":"closed_unmerged","fingerprints":[],"rule_ids":[]}}
{"timestamp":"2026-08-18T12:18:10Z","workflow":"track","event":"finding_outcome","run_id":"32135417350","run_number":733,"data":{"pr":"sangrokjung/claude-forge#33","pr_state":"merged","fingerprints":[],"rule_ids":[]}}
Expand Down
Loading
Loading