[compiler-threat-spec] spec: update CTR-004 for sandbox.agent:false breaking change (v1.0.9)#32731
Merged
pelikhan merged 1 commit intoMay 17, 2026
Conversation
- T-CTR-004 detection trigger updated from removed 'sandbox: false' field to 'sandbox.agent: false' in strict mode; clarifies that the old top-level 'sandbox: false' now fails schema validation, not CTR-004 detection - CTR-004 Section 7.1 mapping extended with strict_mode_permissions_validation.go, the concrete enforcement site for sandbox.agent:false rejection in strict mode - Spec-to-implementation sync table updated with 1.0.9 row noting the field change - Version bumped to 1.0.9, publication date updated to 2026-05-17 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Author
|
|
Contributor
Author
|
Please summarize the remaining blockers and rerun validation after the review feedback is handled.
|
pelikhan
deleted the
spec/ctr-004-sandbox-agent-false-update-f8f1b1a5f1b7813e
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Daily compiler threat spec optimizer run for 2026-05-17.
Threats Reviewed
sandbox: falsein favor ofsandbox.agent: falseAlready-Covered Threats
All CTR-001 through CTR-018 rules remain implemented. No new threat classes were discovered requiring new rules.
Spec Corrections Required (CTR-004)
The breaking change in
.changeset/minor-disable-agent-sandbox-only.mdremoved the top-levelsandbox: falsefield. That field now triggers a schema validation error rather than being detected via CTR-004. The spec had not been updated to reflect this.Changes made:
sandbox: false(removed field) tosandbox.agent: falsein strict modestrict_mode_permissions_validation.go— the concrete enforcement site forsandbox.agent: falserejectionRule IDs Changed
Files Changed
specs/compiler-threat-detection-spec.mdReferences: