Deny-by-structure foundation: shim generator + sudo-floor doctor #80

New issue

Closed

opened 2026-06-06 05:12:02 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-06 05:12:02 +00:00

Owner

Foundation slice of #79 (deny-by-structure engine). The engine half of #79 already landed on main out-of-band (repocfg.Security, hook.Protected basename-deny, hookcfg.ProtectedFor, cmd/cli-guard-hook). This issue tracks the two remaining foundation pieces.

Scope

shim package: expand a []hook.Protected (the same set the PreToolUse engine denies, via hookcfg.ProtectedFor) into one deny shim per binary. POSIX-sh, single-quote-escaped, sh -n validated, sorted + deduped by basename. UX layer, not enforcement.
doctor package: verify the enforcement floor from a parsed repocfg.Security - no passwordless sudo (sudo.forbid_passwordless), real binary not agent-executable (expected_real_paths), credential env absent (credential_env). Injectable Probes; build-tagged unix exec-bit check.
docs: docs/deny-by-structure.md boundary-honesty walkthrough (shim is UX, sudo/ownership floor is enforcement); FEATURES + features-detail entries; regenerated godoc-current.txt.

Out of scope (stays on #79)

Retiring the rendered exhaustive deny path (claudeCodeRenderHookScript deny-prefix case).
Stripping the coily-specific binary list from lockdown/defaults.yaml.
These are the hard-delete retire, coordinated with the companion coily bump.

Acceptance

shim.For([]hook.Protected) returns sh -n-valid deny shims, table-tested.
doctor.Check(repocfg.Security, Probes) returns the three posture findings, table-tested.
make build / make test / make lint / go vet green; pre-commit clean.

Foundation slice of #79 (deny-by-structure engine). The engine half of #79 already landed on `main` out-of-band (`repocfg.Security`, `hook.Protected` basename-deny, `hookcfg.ProtectedFor`, `cmd/cli-guard-hook`). This issue tracks the two remaining foundation pieces. ## Scope - **shim** package: expand a `[]hook.Protected` (the same set the PreToolUse engine denies, via `hookcfg.ProtectedFor`) into one deny shim per binary. POSIX-sh, single-quote-escaped, `sh -n` validated, sorted + deduped by basename. UX layer, not enforcement. - **doctor** package: verify the enforcement floor from a parsed `repocfg.Security` - no passwordless sudo (`sudo.forbid_passwordless`), real binary not agent-executable (`expected_real_paths`), credential env absent (`credential_env`). Injectable `Probes`; build-tagged unix exec-bit check. - **docs**: `docs/deny-by-structure.md` boundary-honesty walkthrough (shim is UX, sudo/ownership floor is enforcement); FEATURES + features-detail entries; regenerated `godoc-current.txt`. ## Out of scope (stays on #79) - Retiring the rendered exhaustive deny path (`claudeCodeRenderHookScript` deny-prefix case). - Stripping the coily-specific binary list from `lockdown/defaults.yaml`. - These are the hard-delete retire, coordinated with the companion coily bump. ## Acceptance - `shim.For([]hook.Protected)` returns `sh -n`-valid deny shims, table-tested. - `doctor.Check(repocfg.Security, Probes)` returns the three posture findings, table-tested. - `make build` / `make test` / `make lint` / `go vet` green; pre-commit clean.

coilysiren referenced this issue

2026-06-06 05:18:17 +00:00

Deny-by-structure engine: expand a protectedCommands literal into shim + sudo-floor + hook deny, retire the generated denylist #79

coilysiren referenced this issue from a commit

2026-06-06 05:20:57 +00:00

feat: add deny-by-structure shim generator + sudo-floor doctor

coilysiren closed this issue

2026-06-06 05:20:57 +00:00