openclaw/reporting-governance-plugin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reporting-governance: harden artifact root boundary checks

Browse Source
This commit is contained in:
Eve
2026-05-08 10:29:16 +08:00
parent 4f816a93a5
commit 8c7aca145e
4 changed files with 125 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/architecture/agent-reporting-governance-plugin.md
View File

@@ -227,6 +227,7 @@ Architectural meaning:
- storage layer owns loading/package-artifact interpretation
- runtime binding can be derived from the artifact rather than hardcoded entirely in docs
- tests prove the artifact resolves into concrete script and runtime-artifact paths
- `artifact_roots` enforcement is now two-layered for this slice: lexical boundary rejection plus realpath-level symlink escape rejection
This is intentionally still a **minimal verifiable slice**, not the full deployment system.
It proves the package boundary can own profile artifacts and bind them into runtime execution inputs.