euthyna 0.4.0 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -131,6 +131,14 @@ node <euthyna 仓库>/bin/euthyna.js coverage --coverage <覆盖率文件绝对
|
|
|
131
131
|
|
|
132
132
|
操作手册（命令、真实输出样例、失效情形）：`references/fact-producers.md`。
|
|
133
133
|
|
|
134
|
+
### 执行纪律（复现命令与 PoC）
|
|
135
|
+
|
|
136
|
+
`--verify` 与 PoC 会在**用户的机器**上执行命令。跑任何复现/验证命令前：
|
|
137
|
+
|
|
138
|
+
- **先取得用户明确批准**，把要跑的命令原文列出来——不跑没报备的命令
|
|
139
|
+
- 能在沙箱/临时容器里跑的（如 Docker），**优先沙箱**；无法沙箱时说明风险再跑
|
|
140
|
+
- 报告里的 PoC 是给「拿到报告的人」复现用的；裁定过程中 agent 自己执行的每条命令同样适用本节
|
|
141
|
+
|
|
134
142
|
---
|
|
135
143
|
|
|
136
144
|
## 事实契约（测量与判定之间的接口）
|
|
@@ -144,6 +144,18 @@ evaluable" — never fill the gap with a hand estimate.**
|
|
|
144
144
|
|
|
145
145
|
Operations manual (commands, real output samples, failure modes): `references/fact-producers.md`.
|
|
146
146
|
|
|
147
|
+
### Execution discipline (reproduce commands and PoCs)
|
|
148
|
+
|
|
149
|
+
`--verify` and PoCs execute commands **on the user's machine**. Before running any
|
|
150
|
+
reproduce/verification command:
|
|
151
|
+
|
|
152
|
+
- **Get the user's explicit approval first**, listing the exact commands — never run
|
|
153
|
+
an unannounced command
|
|
154
|
+
- Prefer a sandbox or throwaway container (e.g. Docker) whenever one can run the
|
|
155
|
+
command; when sandboxing is impossible, state the risk before running
|
|
156
|
+
- A report's PoC is written for whoever receives the report; every command the agent
|
|
157
|
+
itself runs during adjudication follows this same rule
|
|
158
|
+
|
|
147
159
|
---
|
|
148
160
|
|
|
149
161
|
## The fact contract (the interface between measurement and adjudication)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "euthyna",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.1",
|
|
4
4
|
"description": "Deterministic fact producers for security auditing: which deleted code came from a security fix, and which changed symbols no test ever executed.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./plugin/index.js",
|
package/plugin.yaml
CHANGED