47ed26a01b
* fix(#3120): add register_authored_at_plan_time guard to secure-phase Root cause: Step 3 short-circuit used threats_open: 0 as the sole condition to skip directly to Step 6 (write clean SECURITY.md). It did not distinguish empty-by-all-mitigated from empty-by-no-planning. Legacy phases authored before <threat_model> blocks were canonical received a rubber-stamped clean SECURITY.md with no audit performed. Fix: Step 2c: track register_authored_at_plan_time (true iff >=1 PLAN file contained a parseable <threat_model> block) Step 3: two-condition short-circuit: - threats_open:0 AND register_authored_at_plan_time:true -> skip to Step 6 (legitimate, all mitigated) - threats_open:0 AND register_authored_at_plan_time:false -> retroactive-STRIDE mode in Step 5 (build register from implementation, then verify) Step 5: auditor constraint varies by mode: planned -> Verify mitigations exist, do not scan retroactive -> Build STRIDE register first, then verify Suite: 7039/7039. Closes #3120. * fix(lint+changeset): allow-test-rule, drop dead regex branches, fix pr field to 3142
59 lines
2.3 KiB
JavaScript
59 lines
2.3 KiB
JavaScript
'use strict';
|
|
// allow-test-rule: reads product workflow markdown (secure-phase.md) to verify structural guard contract — not a source-grep test
|
|
|
|
// Regression guard for bug #3120.
|
|
//
|
|
// secure-phase.md Step 3 short-circuited to Step 6 (write SECURITY.md)
|
|
// whenever threats_open: 0, without distinguishing between:
|
|
// Case A: All plan-time threat_model threats are CLOSED (legitimate skip)
|
|
// Case B: No threat_model blocks were written at plan time (legacy phases)
|
|
// → rubber-stamps a clean SECURITY.md with zero audit performed
|
|
//
|
|
// Fix: Step 2c tracks `register_authored_at_plan_time` (true iff ≥1 PLAN
|
|
// file contained a parseable <threat_model> block). Step 3 now requires BOTH
|
|
// threats_open: 0 AND register_authored_at_plan_time to skip. If only
|
|
// threats_open: 0 and NOT register_authored_at_plan_time, Step 5 runs in
|
|
// retroactive-STRIDE mode.
|
|
|
|
const { test, describe } = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
|
|
const ROOT = path.join(__dirname, '..');
|
|
const src = fs.readFileSync(
|
|
path.join(ROOT, 'get-shit-done', 'workflows', 'secure-phase.md'),
|
|
'utf8',
|
|
);
|
|
|
|
describe('bug #3120: secure-phase short-circuit guards', () => {
|
|
test('Step 2c tracks register_authored_at_plan_time', () => {
|
|
assert.ok(
|
|
src.includes('register_authored_at_plan_time'),
|
|
'secure-phase.md does not track register_authored_at_plan_time in Step 2c',
|
|
);
|
|
});
|
|
|
|
test('Step 3 short-circuit requires both conditions', () => {
|
|
assert.ok(
|
|
src.includes('threats_open: 0 AND register_authored_at_plan_time'),
|
|
'Step 3 short-circuit does not gate on both threats_open:0 AND register_authored_at_plan_time',
|
|
);
|
|
});
|
|
|
|
test('retroactive-STRIDE mode is documented for legacy phases', () => {
|
|
assert.ok(
|
|
src.includes('retroactive') || src.includes('Retroactive'),
|
|
'secure-phase.md does not document retroactive-STRIDE mode for legacy phases (no <threat_model> blocks)',
|
|
);
|
|
});
|
|
|
|
test('Step 5 auditor constraint varies by mode', () => {
|
|
assert.ok(
|
|
(src.includes('Verify mitigations') || src.includes('verify mitigations')) &&
|
|
(src.includes('Retroactive') || src.includes('retroactive')),
|
|
'Step 5 does not distinguish planned vs retroactive-STRIDE auditor constraint',
|
|
);
|
|
});
|
|
});
|