docs(self-hosting): fix stale blockedPaths and hardGuardrailGlobs claims - #5240
Merged
Conversation
Two config example files (.gittensory.yml.example, config/examples/gittensory.full.yml)
still described legacy blockedPaths as enforceable ("yields a manifest_blocked_path
finding... enforceable when gate.manifestPolicy: block") -- that mechanism was
retired in #2974 in favor of settings.hardGuardrailGlobs as the single authoritative
path-hold control, and manifest_blocked_path is no longer even a valid finding code.
An operator copying either example would believe they had protection they don't have.
Also fixes a second, related staleness: both example files and two docs pages
(docs.self-hosting-configuration.tsx, docs.tuning.tsx) claimed an omitted/empty
settings.hardGuardrailGlobs means "no path guardrails, never a hidden engine
fallback" -- but #3943 (three days after the comment was written) added
DEFAULT_HARD_GUARDRAIL_GLOBS, a fixed set of built-in invariant guardrails
(config-as-code files, CI workflows/scripts, core engine-decision paths) that
always apply regardless of repo settings. The docs never caught up.
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
gittensory-ui | 78a35bc | Commit Preview URL Branch Preview URL |
Jul 12 2026, 10:42 AM |
loopover-orb
Bot
added
the
gittensor:bug
github-project-automation
Bot
moved this to Todo
in Self-Hosted Review Stack (LoopOver Orb)
github-project-automation
Bot
moved this from Todo
to Done
in Self-Hosted Review Stack (LoopOver Orb)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two documentation-drift bugs found while investigating a security-scanner finding ("Legacy blockedPaths guardrails are silently disabled") about commit f13d95c / #2974:
blockedPathsenforcement was a deliberate, well-reasoned architecture decision (single authoritative path-hold control:settings.hardGuardrailGlobs), not an accidental regression — so the security finding's proposed patch (re-adding a compatibility shim) is not being applied; it would reintroduce the exact dual-system drift fix(selfhost): make hard guardrails authoritative #2974 eliminated..gittensory.yml.exampleandconfig/examples/gittensory.full.ymlstill describeblockedPathsas producing an "enforceable... finding" — false, and contradicts the already-correct prose docs page. An operator copying either example would believe they have protection they don't have.docs.self-hosting-configuration.tsx,docs.tuning.tsx) claimed an empty/omittedsettings.hardGuardrailGlobsmeans "no path guardrails, never a hidden engine fallback" — but fix(review): preserve invariant guardrails #3943 (3 days after that comment was written) addedDEFAULT_HARD_GUARDRAIL_GLOBS, a fixed set of built-in invariant guardrails that always apply regardless of repo settings. The docs never caught up.Changes
.gittensory.yml.example+config/examples/gittensory.full.yml: corrected theblockedPathsandhardGuardrailGlobscomments to match actual runtime behavior and the already-correct prose docs.docs.self-hosting-configuration.tsx+docs.tuning.tsx: corrected the "never a hidden engine fallback" claim.Validation
npx vitest run test/unit/focus-manifest.test.ts test/unit/check-docs-drift-script.test.ts test/unit/selfhost-config-examples.test.ts test/unit/prompt-injection.test.ts test/unit/focus-manifest-validation.test.ts test/unit/config-templates.test.ts— 730/730 passingnode scripts/check-docs-drift.mjs— cleannpm run ui:typecheck/npm run ui:lint— clean (only pre-existing, unrelated warnings)npm run cf-typegen:check— cleansrc/**production code changed; docs/config-example only.