Commit History
5 days ago
-
security: extend the pillow 12.3.0 acceptances to 2026-12-18
avoigt1121 +1: Claude Opus 5.5The project lead decided 2026-11-03 ("Yes, extend", to "Extend the pillow acceptances to Fri 18 Dec?"): the 39 pillow 12.3.0 advisories accepted by id under fleet decision A (batches 1-8) now expire 2026-12-18, not 2026-11-20. Declined: forcing pillow 13 past gradio's pin, and freezing pushes (which would also block fixes like the 2026-11-01 joserfc bump). Only the expiry moves. security/accepted-vulns.txt changes the date on its 39 entries and nothing else (no id added or removed); tests/test_accepted_vulns.py raises its cap to 2026-12-18; security/ACCEPTED-FINDINGS.md gains one dated entry, earlier entries unchanged. The security addendum (docs/security/addendum-knowledge-specialist.md) states the expiry, and tests/test_host_table.py pins that statement: both now say 2026-12-18. Exposure re-check, 2026-11-03, on dev 9462c78 (44 commits since 2026-10-21): nil, unchanged. Inputs are identifiers only; no application code imports PIL, calls an image reader or reads a workbook (openpyxl…abc4da6
10 days ago
-
docs(plans): Phase 3 s3 done — the smoke Job exists and its first run came back 6/6
avoigt1121 +1: Claude Opus 5.5Slice: phase3-review-hardening/s3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>7f95498 -
security: accept pillow 12.3.0 batch 8 (PYSEC-2026-4332)
avoigt1121 +1: Claude Opus 5.5One more pillow 12.3.0 advisory, found by the pre-push pip-audit on 2026-10-29 when it blocked the dev push of 39d4cd3 (Phase 3 smoke harness): - PYSEC-2026-4332 (CVE-2026-112403, GHSA-8g5g-8vmr-9782): a heap write in the JPEG decoder's draft()/thumbnail() path; fixed only in 13.0.0, which gradio does not allow (pillow<13). Not reachable here: no application code imports PIL, calls draft() or thumbnail(), or takes an image or file input. Accepted by id until 2026-11-20 as batch 8 under the project lead's 2026-10-28 decision (each Space repo at its next push after its own reachability check); 39 accepted, the addendum's count 38 -> 39. Security scan clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>943ab70 -
feat(smoke): the scheduled smoke Job, and the plan's decisions
avoigt1121 +1: Claude Opus 5.5scripts/smoke_job.py creates, lists, fetches and deletes the Phase 3 smoke Job as decided 2026-10-29 (D1-D4): an HF Scheduled Job on cpu-basic in the project lead's organisation namespace (her user namespace holds lit-agent's Monday job, whose recreate script aborts on a second scheduled Job), every 3 hours, ending itself after 7 days (SMOKE_END_EPOCH), with no secret: each run clones the dev Space at a pinned sha, runs smoke_live.py in-process and prints its counts-only record behind RECORD_MARKER (new --print-record), and fetch reads the records back from the Job logs into .smoke/hf-job.jsonl. tests/test_smoke_job.py pins the spec (no secret, cpu-basic, org namespace, one Job at a time, the end guard, the pinned sha) and the log parsing. The addendum gets one sentence on the scheduled runs (plan C8); the plan records D1-D4. Slice: phase3-review-hardening/s3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>814e741 -
docs(plans): Phase 3 review and hardening — plan, D1-D4 open
avoigt1121 +1: Claude Opus 5.5Smoke week, cost and latency report. D1 where scheduled runs execute, D2 cadence, D3 cost cap and D4 where results go are the project lead's; s1 (harness) done, s2 (report) drafted outside this repo, s3/s4 blocked on the decisions. Slice: phase3-review-hardening/s1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>cbcabf5
11 days ago
-
docs(sources): confirm UniProt, ClinicalTrials.gov and DGIdb licences
avoigt1121 +1: Claude Opus 5.5All three pages are script-rendered; read in a browser on 2026-10-27. - UniProt: uniprot.org/help/license applies CC BY 4.0. Stamped string unchanged. - ClinicalTrials.gov: the Terms and Conditions page names no open licence; it asks redistributors to attribute, keep current, show the processing date and state changes, and notes copyright outside the U.S. Stamped string unchanged; licence_checked says "Public" means free of charge. - DGIdb: no data licence of its own (code is MIT); each interaction keeps its source's licence, several non-commercial. licence becomes "Per source: ...", licence_url moves to /browse/sources (/about is a 404). The no-endpoint guard now covers "Per source" as well as "Unconfirmed". No DGIdb endpoint is added or proposed. Host table regenerated with scripts/render_host_table.py. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>8f6c965 -
security: accept pillow 12.3.0 batch 7 (PYSEC-2026-4327)
avoigt1121 +1: Claude Opus 5.5One more pillow 12.3.0 advisory, found by the pre-push pip-audit on 2026-10-27 when it blocked the dev push of the UI OAuth fix (f8902cf): - PYSEC-2026-4327 (CVE-2026-112394): the P;2L/P;4L raw decoder reads up to three heap bytes past the buffer; fixed only in 13.0.0, which gradio does not allow (pillow<13). Not reachable here: no application code imports PIL or decodes an image a caller supplies. Accepted by id until 2026-11-20 as batch 7 (the project lead, 2026-10-27, in this session; already accepted that day in the other six Space repos); 38 accepted. Security scan clean; 267 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>2d3c377
13 days ago
-
security: accept pillow 12.3.0 batch 6 (CVE-2026-114501, CVE-2026-112398)
avoigt1121 +1: Claude Opus 5.5Two pillow 12.3.0 advisories published by 2026-10-26, fixed only in 13.0.0, which gradio does not allow (pillow<13): - CVE-2026-114501: Arrow export returns uninitialised heap memory when PILLOW_ALIGNMENT > 1. No PILLOW_ALIGNMENT here (code, README, HF Space variables) and no image is exported to Arrow. - CVE-2026-112398: FlashPix decoder heap overflow via Image.open on an OLE2 file; needs the optional olefile, which is not in the lock. Accepted by id until 2026-11-20 as batch 6 (the project lead, 2026-10-26, after a per-repo reachability check; ACCEPTED-FINDINGS.md has this repo's exposure statement); 37 accepted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>1ed7f10 -
docs(plan): s5 is on orchestrator prod (46f8006, 2026-10-23)
avoigt1121 +1: Claude Opus 5.5Status cell brought in line with git on 2026-10-26. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>1eefa35
17 days ago
-
docs: the security-review addendum is to be filed now (decided 2026-10-22, the project lead)
avoigt1121 +1: Claude Opus 5.5Recorded at the source: the plan's s4 row, its D2 note and s4 bullet, and ADR-0001's consequence line. The project lead files it; nothing is sent from a session. Slice: phase1-knowledge-specialist-s4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>aa10ca2 -
security: accept 1 more pillow 12.3.0 advisory until 2026-11-20 (batch 5)
avoigt1121 +1: Claude Opus 5.5GHSA-78g4-xqwv-q3g8 (high, no CVE id yet), published 2026-10-22 17:01 UTC after batch 4 and fixed only in pillow 13.0.0 (gradio 6.30 still requires pillow<13): a heap-buffer-overflow write in the libopenjp2 2.5.4 bundled in pillow wheels, reached by opening and loading a crafted JPEG 2000 file. No application code here opens JPEG 2000 or decodes a caller-supplied image. Accepted by id by the project lead (2026-10-22), same expiry and format as batches 1-4. Security files only; 35 pillow ids accepted; acceptance tests pass. The security-review addendum says 35, and tests/test_host_table.py now counts every accepted id (CVE, GHSA, PYSEC), not only CVE ids, so a GHSA-only advisory is counted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>bd00037 -
security: accept 10 more pillow 12.3.0 advisories until 2026-11-20 (batch 4)
avoigt1121 +1: Claude Opus 5.5CVE-2026-96636 to -96644 and CVE-2026-96778, published 2026-10-22 after batch 3 and fixed only in pillow 13.0.0 (gradio 6.30 still requires pillow<13); they blocked the subtype dev push. None is reachable here: five need a crafted image from a caller decoded in a way no code does (multi-frame seek, SPIDER, BMP RLE, PNG EXIF parse), four need a Pillow call no application code makes (PDF append, JPEG save with ICC profile plus comment, bitmap-font text, TarIO), one is Windows-only. Accepted by id by the project lead (2026-10-22), same expiry and format as batches 1-3. Security files only; 34 pillow ids accepted; acceptance tests pass. The security-review addendum's pillow count goes 24 -> 34 (tests/test_host_table.py pins it to accepted-vulns.txt). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>8016795 -
docs(plans): s5 on orchestrator dev 62e1e23 (C10-C12 met; C1 is the project lead's); the name scrub
avoigt1121 +1: Claude Opus 5.5Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>a145232 -
docs: name no institution in the public repo (the client's Tech Transfer rule)
avoigt1121 +1: Claude Opus 5.5Both Spaces are public. The client's sponsoring lab ruled 2026-10-21 that its technology-transfer office looks before anything public carries the institution's or the centre's name, and the contract needs written consent for either. Ten mentions in docs, docstrings and comments now say "the client" or "this agent's endpoints"; the title, card, README and UI never named either. tests/test_no_institution_name.py fails if a tracked file names them again. The paste-ready addendum in the business folder is unchanged. Comments and docs only: no behaviour change. 246 passed; host table current. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>081f1c7
18 days ago
-
docs(plans): s3 on prod f1bf43d, s6 done, s5 merged on orchestrator dev (dev push blocked by KNO-006)
avoigt1121 +1: Claude Opus 5.5Slice: phase1-knowledge-specialist-s3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>92fb816 -
security: accept 2 more pillow 12.3.0 advisories until 2026-11-20 (batch 3)
avoigt1121 +1: Claude Opus 5.5CVE-2026-112393 and CVE-2026-112396, both in TIFF encoding to an in-memory buffer, reached PyPI's feed after batch 2 and blocked s3's first dev-Space push. This Space encodes no image. The project lead accepted them the same day; the addendum now states 24 (its test reads the count from accepted-vulns.txt). Slice: phase1-knowledge-specialist-s3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>cc8a03e -
security: accept 14 more pillow 12.3.0 advisories until 2026-11-20 (batch 2)
avoigt1121 +1: Claude Opus 5.5Published 2026-10-21 after batch 1 (D5-A), all fixed only in pillow 13.0.0. Same exposure: identifiers only, no image input. The addendum now states 22, and tests/test_host_table.py reads the count from security/accepted-vulns.txt instead of pinning it, so the next change cannot leave the addendum stale. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>e436d30 -
docs(plans): s4 on dev; C13 drafted
avoigt1121 +1: Claude Opus 5.5Slice: phase1-knowledge-specialist/s4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>b67e00e -
docs(security): the knowledge specialist's security-review addendum (s4)
avoigt1121 +1: Claude Opus 5.5docs/security/addendum-knowledge-specialist.md, in the review's own language: the eighth component, the hosts it calls (a table generated from config/sources.yaml by scripts/render_host_table.py), identifiers-only egress, the honest no-egress-filter sentence, and the controls. tests/test_host_table.py fails if the table is stale or any number the addendum states (tools, rates, timeouts, caps, TTLs, the pinned version, the accepted findings) stops matching the code, or if a person is named. A paste-ready version for the OHSU form lives beside the review in the business folder; filing it is the project lead's. Slice: phase1-knowledge-specialist/s4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>a8943e8 -
docs(plans): s2 on dev at af3e3ac; s3 open; what s2 changed
avoigt1121 +1: Claude Opus 5.5Slice: phase1-knowledge-specialist/s2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>e84baa9 -
security: D5-A — accept the 8 pillow 12.3.0 CVEs here until 2026-11-20
avoigt1121 +1: Claude Opus 5.5The project lead decided D5-A (2026-10-20): a justified acceptance in this repo only. This Space takes identifiers only and opens no caller-supplied image; the fix needs a fleet-wide gradio move (gradio 6.28.0 requires pillow<13). security/accepted-vulns.txt feeds pip-audit --ignore-vuln; the scan fails on an expired entry, and tests/test_accepted_vulns.py fails once the lock moves pillow off 12.3.0, so the acceptance cannot outlive its reason. Scan green. Slice: phase1-knowledge-specialist/s2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>17acd0c -
security: accept one gitleaks false positive by fingerprint; record the open pillow CVEs as D5
avoigt1121 +1: Claude Opus 5.5The s1 security record quoted the docstring phrase it called a false positive, so it tripped the same rule; reworded, and the never-pushed commit is ignored by its exact fingerprint. pillow 12.3.0 (via gradio 6.28.0, pillow<13) has 8 new CVEs fixed only in 13.0.0, fleet-wide: not accepted, raised as plan D5. Slice: phase1-knowledge-specialist/s2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>e119adb
19 days ago
-
docs(plans): s1 on dev at 5b9f592; s2 and s4 open
avoigt1121 +1: Claude Opus 5.5Slice: phase1-knowledge-specialist/s1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>8444397 -
feat: governed ToolUniverse core for the knowledge specialist (s1)
avoigt1121 +1: Claude Opus 5.5The repo from the pdac-spatial-agent template, plus the core every endpoint will sit on (ADR-0001, accepted 2026-10-20): - config/tools_allowlist.yaml: the memo's 28 tools by exact 1.5.6 name; the 12 the five endpoints use are the only ones loaded. - config/sources.yaml: 8 sources with hosts, licences checked 2026-10-20 (Reactome is CC0, not CC BY 4.0; DGIdb unconfirmed, so no DGIdb endpoint), TTLs, rate limits, timeouts, coverage notes. - src/tu_client.py, the only importer of tooluniverse: loads with keep_default_tools=False and load_workspace=False, refuses startup on any model-provider key, a version other than 1.5.6, an extra or forbidden tool, or ToolUniverse's own cache being on. load_workspace=False matters: with any workspace present, 1.5.6 seeds a profile that loads all 2,691 tools and reads workspace and ~/.tooluniverse .env files (found by these tests). - provenance (10 fields per row), pinned output schemas (drift = no rows), SQLite cache that keeps retr…377417d