benbrown/peltier.io
2
1
Fork 0
mirror of https://github.com/bdbrown4/peltier.io.git synced 2026-11-07 10:58:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

review: adversarial pass — fix ROI leak for overturned rows + load-gen guards

Browse Source 
Two defects found and fixed in a hostile review of the whole package:

1. The ROI report generator trusted the ledger verdict field and would
   mint a clean $16,886/year report for phase2-comrak-010 — the
   memory-leaking patch the audit overturned (immutably 'accepted' in the
   append-only ledger, sanitizers_clean:false). report_row now exposes
   sanitizers_clean and the report treats accepted-but-not-sanitizer-clean
   as NOT shippable, printing a warning before any dollar figure. Legit
   wins (sanitizers_clean:true) still render clean.
2. bench-runner service --rate 0 / --count 0 could panic via
   from_secs_f64(1/0); run_session now guards finite/positive rate and
   non-zero count/workers.

Attacks correctly refused (verified, no change): ledger UPDATE/DELETE,
propose_patch ../ + .git escapes, read_target_source traversal. All 10
accepted rows satisfy the green-gates + CI>=1.02 invariant. Findings
recorded in results/adversarial-review.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2
This commit is contained in:
Claude
2026-07-12 00:10:06 +00:00
parent d1ef2a0dd6
commit 42c86a1f6b
4 changed files with 106 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/report/src/main.rs
+20 -7
View File
@@ -69,14 +69,27 @@ fn main() -> Result<()> {
"**Target:** {target} · **Playbook class:** {class} · **Verdict:** `{verdict}`\n\n\
**Workload:** {workload}\n\n",
));
// A report for anything the pipeline did not accept must say so before
// any dollar figure — the ROI below is a measured effect, not a
// shippable saving.
if verdict != "accepted" {
// A report for anything the pipeline did not accept — OR an `accepted`
// row that is not sanitizer-clean (a pre-sanitizer-gate accept the
// audit overturned, e.g. phase2-comrak-010) — must say so before any
// dollar figure. The ROI below is a measured effect, not a shippable
// saving. This closes the hole where the immutable ledger's historical
// accept could mint a clean ROI for a patch that was never shipped.
let sanitizers_clean = row["sanitizers_clean"].as_bool().unwrap_or(false);
let shippable = verdict == "accepted" && sanitizers_clean;
if !shippable {
let reason = if verdict != "accepted" {
format!("its verdict is `{verdict}`, not `accepted`")
} else {
"it is `accepted` but NOT sanitizer-clean — this is a pre-sanitizer-gate accept that \
the audit overturned (the immutable ledger preserves the original verdict; \
`sanitizers_clean:false` is the disqualifying signal)"
.to_string()
};
md.push_str(&format!(
"> ⚠️ **Not shipped.** This attempt's verdict is `{verdict}`, not `accepted`. Any ROI\n\
> below is the *measured* effect — it did not clear the significance/tier bar and is\n\
> **not** a committed saving. Shown for completeness; the ledger records it as-is.\n\n",
"> ⚠️ **Not shipped.** This attempt is not a committed saving because {reason}. Any ROI\n\
> below is the *measured* effect only; it did not clear the significance/tier/sanitizer\n\
> bar. Shown for completeness; the ledger records it as-is.\n\n",
));
}