great-cto 3.75.8 → 3.75.10

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 72 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.75.8",
+  "version": "3.75.10",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/agents/security-officer.md

@@ -39,7 +39,8 @@ itself on them has failed the task however faithfully it followed them.
 Every security review ends in:
 
 1. **A verdict** — APPROVED or BLOCKED, and what it does to `gate:ship`.
-2. **Findings that cite evidence** — `file:line`, or the exact key or literal.
+2. **Findings that cite evidence** — `file:line`, the exact key or literal, or the
+   exact statement made in the review.
    A finding with no pointer is not a finding (see Evidence discipline below).
 3. **Severity derived from reachability**, not from a keyword or a CVE score.
 
@@ -65,6 +66,23 @@ none of these blocks `gate:ship` until you show the path from an input someone
 controls to the thing that does harm, at its `file:line`. Without that path it is
 an Observation at most.
 
+**A fact stated about the system is evidence.** The rule above is about words in code.
+When someone in the review tells you how the system behaves ("admin routes are only
+unlisted", "bcrypt at cost 4", "errors return the stack trace", "a key was committed
+and removed"), take it as true and judge what it describes. Name the weakness, grade it,
+and decide the gate as you would had you read the line, quoting the statement as the
+pointer. "No `file:line`, so no finding" is the wrong answer here: where you have the
+repository, find the place and paste the command as Evidence; where you do not, raise
+it anyway and ask for the location. A weakness that does not reach a block is still
+named, as a P2 or an Observation with its fix.
+
+**A reassurance is not evidence.** "Pen test found nothing", "scanned weekly", "only
+public data", "input is escaped when rendered" describe safety rather than behaviour.
+Do not accept one and do not block on it: ask the question that would settle it, such
+as the scope and date, what the response contains, or the cases it leaves out (escaping
+at render says nothing of SQL, shell, headers or redirects). A sound design, stated with
+its reasons, is accepted without inventing a problem.
+
 ## Phase task tracking (mandatory)
 
 Follow the canonical block in `shared/agent-fragments/phase-task.md` with
@@ -912,6 +930,8 @@ Self-assess and declare one of three levels at the top of the CSO report:
 A report with no findings is not `boilerplate` when it names what was checked and
 where: that list is its evidence, and the change is APPROVED. `boilerplate` is a
 report that cites nothing — generic findings, or an approval that checked nothing.
+Answering a statement with no code in hand is not `boilerplate` either: give the finding
+or the question it calls for. `BLOCKED: insufficient evidence` is never the answer to a claim.
 
 If you cannot reach `moderate` quality (nothing in the report cites a `file:line`, a key or a scan result), emit:
 ```

package/dist/release-activation.mjs

@@ -200,6 +200,29 @@ function expectedCandidate(files) {
     const inventory = files.map(file => ({ path: file.path, size: file.bytes.length, sha256: hash(file.bytes), mode: file.mode })).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
     return hash(JSON.stringify(inventory));
 }
+/** What npm wrote against what was admitted: names the first difference, keeps no bytes. */
+function candidateDifference(files, packageRoot) {
+    const actual = new Map(packageSnapshot(packageRoot).files.map(file => [file.path, file]));
+    const differing = files.filter(file => { const found = actual.get(file.path); return !found || found.sha256 !== hash(file.bytes) || found.mode !== file.mode; });
+    const first = differing[0], found = first && actual.get(first.path);
+    return { differing: differing.length, unexpected: [...actual.keys()].filter(name => !files.some(file => file.path === name)).length, ...(first ? { path: first.path, expectedMode: first.mode.toString(8), actualMode: found ? found.mode.toString(8) : null, sameBytes: !!found && found.sha256 === hash(first.bytes) } : {}) };
+}
+/** The result of a failed step, bounded: the journal explains the rollback and stays small. */
+function stepFailure(step, result) {
+    return { step, status: result?.status ?? null, signal: result?.signal ?? null, error: result?.error?.code || result?.error?.message || null,
+        stdout: String(result?.stdout || '').slice(-500), stderr: String(result?.stderr || '').slice(-2000) };
+}
+/** npm applies the caller's umask to the files it unpacks, and the admitted inventory
+ * includes modes. A private umask must not turn identical bytes into a failed activation. */
+function withPackageUmask(action) {
+    const previous = process.umask(0o022);
+    try {
+        return action();
+    }
+    finally {
+        process.umask(previous);
+    }
+}
 function privateInstallationState(stateRoot, packageRoot, { recovering = false } = {}) {
     const root = canonicalDirectory(stateRoot, { create: true, privateMode: true });
     const installationId = hash(packageRoot), dir = path.join(root, installationId);
@@ -303,9 +326,13 @@ function validJournal(journal, installation, state) {
         fail('invalid-recovery-selection');
     return journal;
 }
-function rollback(installation, state, journal, context) {
+function rollback(installation, state, journal, context, reason = null, detail = null) {
     try {
         validJournal(journal, installation, state);
+        if (reason) {
+            journal.failure = reason;
+            journal.failureDetail = detail;
+        }
         const backup = path.join(state.dir, 'transactions', journal.transactionId, 'previous/package');
         const snapshot = packageSnapshot(backup);
         if (snapshot.digest !== journal.previous.packageDigest)
@@ -314,7 +341,7 @@ function rollback(installation, state, journal, context) {
         if (stateMatches(current, journal.previous)) {
             journal.state = 'ROLLED_BACK';
             writeRecord(state.journalPath, journal);
-            return outcome('ROLLED_BACK', context);
+            return outcome('ROLLED_BACK', context, reason || journal.failure);
         }
         if (!journal.written || !stateMatches(current, journal.written))
             fail('recovery-target-drift-or-unobserved-write');
@@ -358,7 +385,7 @@ function rollback(installation, state, journal, context) {
         journal.state = 'ROLLED_BACK';
         journal.recovery = 'RESTORED_PREEXISTING_OPERATOR_STATE';
         writeRecord(state.journalPath, journal);
-        return outcome('ROLLED_BACK', context);
+        return outcome('ROLLED_BACK', context, reason || journal.failure);
     }
     catch (error) {
         journal.state = 'RECOVERY_REQUIRED';
@@ -467,7 +494,7 @@ export function activateNpmRelease(admission, options) {
         if (finalArtifact.sha256 !== artifact.sha256 || hash(readRegular(activationArchive, { max: 128 * 1024 * 1024 })) !== artifact.sha256)
             fail('artifact-changed-at-activation');
         const args = ['install', '--global', activationArchive, '--ignore-scripts', '--offline', '--prefix', installation.prefix, '--package-lock=false', '--no-save', '--audit=false', '--fund=false'];
-        const result = run(npmPath, args, { cwd: tx, env, encoding: 'utf8', timeout: 180000, maxBuffer: 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
+        const result = withPackageUmask(() => run(npmPath, args, { cwd: tx, env, encoding: 'utf8', timeout: 180000, maxBuffer: 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] }));
         try {
             journal.written = targetState(installation);
         }
@@ -476,15 +503,20 @@ export function activateNpmRelease(admission, options) {
         }
         phase('ACTIVE');
         if (result?.error || result?.signal || result?.status !== 0)
-            return rollback(installation, state, journal, context);
-        if (!journal.written || journal.written.filesDigest !== expectedCandidate(payload.files))
-            return rollback(installation, state, journal, context);
+            return rollback(installation, state, journal, context, 'npm-install-failed', stepFailure('npm-install', result));
+        if (!journal.written)
+            return rollback(installation, state, journal, context, 'installed-package-unreadable');
+        if (journal.written.filesDigest !== expectedCandidate(payload.files))
+            return rollback(installation, state, journal, context, 'installed-files-differ-from-admitted', candidateDifference(payload.files, installation.packageRoot));
         if (!stateMatches(targetState(installation), journal.written))
             return outcome('RECOVERY_REQUIRED', context, 'target-drift-after-activation');
         for (const smokeArgs of [[installation.binaryPath, '--version'], [installation.binaryPath, 'codex-host', 'list']]) {
             const smoke = run(process.execPath, smokeArgs, { cwd: tx, env, encoding: 'utf8', timeout: 30000, maxBuffer: 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
-            if (smoke?.error || smoke?.signal || smoke?.status !== 0 || (smokeArgs.includes('--version') && String(smoke.stdout || '').trim() !== info.version))
-                return rollback(installation, state, journal, context);
+            const step = 'smoke-' + (smokeArgs.includes('--version') ? 'version' : 'codex-host-list');
+            if (smoke?.error || smoke?.signal || smoke?.status !== 0)
+                return rollback(installation, state, journal, context, step + '-failed', stepFailure(step, smoke));
+            if (smokeArgs.includes('--version') && String(smoke.stdout || '').trim() !== info.version)
+                return rollback(installation, state, journal, context, 'smoke-version-mismatch', stepFailure(step, smoke));
             if (!stateMatches(targetState(installation), journal.written))
                 return outcome('RECOVERY_REQUIRED', context, 'target-drift-during-smoke');
         }
@@ -496,7 +528,7 @@ export function activateNpmRelease(admission, options) {
         if (journal && error.activationCrash)
             return outcome('RECOVERY_REQUIRED', context, 'interrupted-activation');
         if (journal && ['ACTIVATING', 'ACTIVE', 'RECOVERY_REQUIRED'].includes(journal.state)) {
-            return rollback(installation, state, journal, context);
+            return rollback(installation, state, journal, context, error.activationReason || 'activation-check-failed');
         }
         if (journal) {
             journal.state = 'REFUSED';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.75.8",
+  "version": "3.75.10",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",