[brujack]

Summary

PR A of the CI and release hardening plan (docs/superpowers/plans/2026-10-27-ci-release-hardening.md, spec R1-R4).

• Scans can fail again. continue-on-error is removed from the gitleaks and Snyk steps, so the required Secret Scan and Snyk Security Scan checks report what the tools find. SNYK_TOKEN was unset until 2026-10-27, so every Snyk run had failed authentication behind the mask.
• Snyk false positives excluded. .snyk excludes tests/test_automerge_bot_hold.py and scripts/test_metrics.py, whose three LOW Snyk Code findings were false positives. Snyk Code cannot ignore a single finding from a repo file (only via the web UI), so this is the path-exclusion fallback the spec approved.
• Every direct download is pinned and verified. gitleaks 8.30.1, Snyk CLI v1.1308.0 (was cli/latest) and mdbook 0.5.3 (was piped into tar) now download to a file, pass sha256sum -c against the publisher's digest, and check the installed version.
• Two text-scanning tests enforce it. tests/test_continue_on_error.py fails on any continue-on-error not in its ALLOWED list (or listed but gone, or unrecognised spellings). tests/test_workflow_downloads.py fails on any curl/wget without a pinned https URL, an output file and a fail-capable checksum before use.

Test Plan

• make test: nextest 1145 passed; pytest 119 passed (42 in the two new modules)
• Both new tests fail against main's ci.yml (the two masks; the three unpinned downloads)
• Mutation checks on every scanner fix (killed), and a 200,000-block differential for the C901 refactor of check_block (0 divergences)
• CI: Secret Scan and Snyk Security Scan pass unmasked; Snyk log shows Open issues: 0; install steps print OK from sha256sum -c
• Coverage: no Rust change; Python floor 87 applies to scripts/ and .claude/scripts/, untouched

Code review

reviewed-sha: c761064
diff-hash: 3ba680acd9d68d5b78a9e72ba06ac9b9bd8c602b35ec53244d490406e255d31c
reviewers: 5/5

Round 1 (cbfca98): 5/5 reviewers, two informational findings on tests/test_continue_on_error.py docstrings (fixed in fc4fa16). Security-review then found env-var-to-open() in both new test modules (Snyk Code path-traversal shape, now blocking); fixed in 97a53d8.
Round 2 (97a53d8): 5/5 reviewers. Required, all fixed in 7e84a47: a curl/wget with no literal https URL was skipped; the checksum matched the path as a substring; a sha256sum -c that cannot fail the step counted as verification; a "used before checksum" problem suppressed a later download's missing checksum.
Round 3 (verification, 1 reviewer, bug lens; the other four lenses were clean twice on unchanged ground): two further bypasses fixed in 90c1647 (a comment or echoed text counted as the checksum; ./-relative output paths unmatched) plus the || exit 1 false positive.
Round 4 (verification): every fix holds; 5 of 6 line mutations killed. The surviving mutant (comment strip) is now covered by b8d2900, mutation-checked.
Round 5 (verification of later test-only commits: empty-input tests, the C901 split of check_block, a docstring line): no issues; old vs new check_block agree on 8 hand-built cases and 200,000 fuzzed blocks.

Informational

• https://github.com/brujack/etch-cli/blob/c761064e8ca6182ade2ac2aaa86464f2b453623b/tests/test_continue_on_error.py (score 60) The Commit CHANGELOG ALLOWED reason is a schedule note, not a safety reason; PR B removes the entry with the step.
• https://github.com/brujack/etch-cli/blob/c761064e8ca6182ade2ac2aaa86464f2b453623b/tests/test_workflow_downloads.py (score 50) The scanner fails closed on unusual but correct shapes (sha256sum -c - 2>&1, --check, here-strings, $TMP vs ${TMP}, cd && ..., apt-get install curl). None occurs in the workflows; the module docstring states the expected download form.

RESOLVED: 9 fixed, 0 kept

Spec alignment (2026-10-27)

• spec: docs/superpowers/specs/2026-10-27-ci-release-hardening-design.md
• anchor: 7aed051
• in scope: R1, R2, R3, R4, R5, R6, R7, R8, R9
• out of scope: none

Findings

ID	Reviewer	Verdict	Reason	Amendment
R5	both	NOT-BUILT	Looked for changes to release.yml that validate version as MAJOR.MINOR.PATCH against both Cargo.toml files, check for an existing tag and the refs/heads/main ref, ahead of other steps. release.yml does not appear in the diff.	- R5 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR B (plan Task 4) of the same plan — the spec delivers in four ordered PRs
R6	both	NOT-BUILT	release.yml is unchanged in the diff. The 'Commit CHANGELOG' push step is still present (ALLOWED keeps it, 'removed by PR B'), and no notes range using git merge-base <previous tag> HEAD appears.	- R6 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR B (plan Task 4) of the same plan — the spec delivers in four ordered PRs
R7	both	NOT-BUILT	The diff neither deletes CHANGELOG.md nor adds an ADR reversing ADR-0009's committed-changelog clause.	- R7 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR B (plan Task 5) of the same plan — the spec delivers in four ordered PRs
R8	both	NOT-BUILT	The diff has no taiki-e/install-action step, no removal of cargo install, and no test enforcing tool: <name>@<X.Y.Z> / fallback: none.	- R8 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR C (plan Task 6) of the same plan — the spec delivers in four ordered PRs
R9	both	NOT-BUILT	The Makefile is not in the diff, so there is no change to build or build-linux output locations and no make install target writing to ${XDG_BIN_HOME:-$HOME/.local/bin}/etch.	- R9 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR D (plan Task 7) of the same plan — the spec delivers in four ordered PRs

Reviewed

• R5 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR B (plan Task 4) of the same plan — the spec delivers in four ordered PRs
• R6 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR B (plan Task 4) of the same plan — the spec delivers in four ordered PRs
• R7 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR B (plan Task 5) of the same plan — the spec delivers in four ordered PRs
• R8 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR C (plan Task 6) of the same plan — the spec delivers in four ordered PRs
• R9 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR D (plan Task 7) of the same plan — the spec delivers in four ordered PRs

Verifications

• none

🤖 Generated with Claude Code

https://claude.ai/code/session_019xRsBqwrPLVSCJ1hXnhotg