mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-25 01:01:29 +00:00
4e24dcb68a
The entropy redactor rewrites NAME=<hex> assignment pairs to a bare REDACTED, and the worker rehydrates its executable RunSpec from the projection folded from redacted stored events. Together these broke Daytona snapshot builds for any run definition whose inline Dockerfile pins a git SHA: the spec came back as `ARG REDACTED`, the build died on the unset variable under `set -eu`, and the environment's snapshot identity silently changed. Pin the intended contracts with red tests: - fabro-redact: an assignment whose value alone is below the entropy threshold survives redaction (pure hex cannot exceed 4.0 bits; only the name+value charset merge crosses 4.5), and a genuinely high-entropy value is redacted without destroying the key name. - fabro-workflow: the spec that load_from_store rehydrates round-trips byte-identical through the store, including content that looks like a secret — event redaction must not reach execution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| data | ||
| src | ||
| build.rs | ||
| Cargo.toml | ||