Repository-controlled titles are live Markdown in report.md, and the fleet surfaces drop the gauge qualifier

Aperta
  • Qualcosa non va?
#44 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
json, markdown, python
Ambito
backend, devops, security

Direzione di ricerca

Start with render.py lines 284-285 and 315-320, then inspect fleet.py line 47, cli.py lines 332, 342 and 355, and the referenced history-and-reports.md and gauges.md. Check the renderer and fleet schema versions plus the bundle verification behavior. Done when source controlled text is safely rendered and degraded gauge qualifiers appear on each named fleet surface, with the versioning and outputs updated.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Found by the review of 2026-09-30. Two presentation defects; neither changes a band, both change what a reader believes.

1. Titles from the observed repository are live Markdown and HTML in report.md

history-and-reports.md: "Titles are reproduced as source facts and never interpreted." The renderer writes pull-request and issue titles into the activity section as they are (render.py:284-285; the adapter's _title only truncates). Anyone who can open a pull request or an issue in an observed repository controls those bytes. Reproduced (and the bundle verifies):

- OPENED #40 ![All checks passed](https://example.invalid/fake-green-badge.svg) (…)
- OPENED #41 [Integrity is CLEAN - see details](https://example.invalid/phish)

and a raw <img src=…> is kept. report.md is what people read in the store, in the fleet README's links and in the observe-self job summary, so a title can put a fake green badge or a link that looks like the engine's own verdict next to the real one. Titles are also the only free text in the report, which makes this the one place a report can be made to lie without touching the evidence.

Repair: escape Markdown and HTML metacharacters in every source-controlled string at the presentation boundary (titles, branch and label names, locators). The report is byte-replayed by verify, so this is a new renderer version (render.v5); earlier bundles keep render.v4. The 0.2.0 candidate already names this (R020-S067, package W15).

2. The bound qualifier of a DEGRADED gauge is dropped on the fleet surfaces

gauges.md: a DEGRADED bound renders with ≥, ≤ or ~. The status card does that; three other surfaces print the bare number:

  • the fleet README cell (render.py:315-320): LIGHT 21;
  • the fleet index projects/index.json (fleet.py:47), which consumers read as data;
  • the actions-summary table and outputs (cli.py:332/342/355): | 3 | clutter | LOW | LIGHT | 21 | while the card above it in the same summary says ≥21 … [DEGRADED].

The fleet's store has 63 non-exact gauges today, so this is not hypothetical. Repair: use the qualified text (value_text) in the Markdown surfaces, and add the qualifier as a field of each gauge in fleet.v1 rows and in the step outputs. The field addition changes the fleet document, so it needs a schema version, or at least an additive field the schema declares.

🤖 Generated with Claude Code

Lingua principale
Python
Stelle
4
Fork
1
Merge medio
4m
PR unite (30g)
3

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di drevendev/Devostasis

Tutte le issue di drevendev/Devostasis

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.