Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[mimosa] Git gate blocks on pre-existing findings; policy exclusions not honored — request staged-scope gate / exclusions / findings baseline

Abierto
  • ¿Algo no está bien?
#43 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 3 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
45/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
python
Área
devtools, security

Línea de trabajo

Start with the pre-commit git gate, the MCP normal-depth scan, and .mimosa/security-policy.json; inspect how threatModel.exclusions are processed. Review findings-import.json, verdictEffect, and the security-scan compare normalized identities before choosing among staged-scope scanning, honored exclusions, or a findings baseline. Done means the selected behavior is documented and the gate no longer blocks on unaffected or explicitly excluded pre-existing findings.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Environment
  • mimosa 1.0.3 from the zcode-plugins-official marketplace, ZCode on macOS (Apple Silicon)
Use case

Our repository is an evidence/audit archive. It intentionally retains: quarantined credential material (kept for an Owner rotation decision), historical controller snapshots, and test fixtures containing deliberately vulnerable patterns.

Observed (v1.0.3)
  1. The pre-commit git gate scans the whole working tree on every commit and hard-blocks on pre-existing findings (~1.1k), including files untouched by the commit. For archive-style repos this means every commit is blocked regardless of its content.
  2. .mimosa/security-policy.json → threatModel.exclusions does not appear to be honored: after adding directory-level globs, results were byte-identical for the git gate, and a normal-depth MCP scan still attributes ~90% of findings (817/904) to the excluded directories.
  3. findings-import.json / verdictEffect seem to be MCP reporting semantics only (contract doc: "verdictEffect remains none until the product adopts a separate reviewed policy"); there is no documented mechanism to feed a findings baseline into the gate.
Requests (any one would resolve it)
  1. Git gate scope option — scan staged/changed files only (classic pre-commit semantics); keep the full-tree scan for the explicit deep-audit path.
  2. Honor threatModel.exclusions in both the git gate and normal-depth scan decisions.
  3. Findings baseline — let a sealed scan be imported as "acknowledged/baselined" so the gate only reports new finding identities; the security-scan compare normalized identities look like a natural fit.

Happy to test a pre-release against our repo.

Lenguaje dominante
Python
Estrellas
39
Forks
20
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de zai-org/zcode-plugins

Todos los issues de zai-org/zcode-plugins

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.