- Fix timingSafeCompare to pad buffers to equal length before comparing,
closing the content timing side-channel on length mismatch
- Replace innerHTML with textContent for error messages to prevent XSS
- Extract inline script from dashboard/index.html into dashboard/app.js
- Remove 'unsafe-inline' from script-src CSP directive
- Update security test to match new CSP policy
https://claude.ai/code/session_01GfwUNbgeMgXreFDbsNQMsS
- Updated `src/utils.mjs` to detect 'claude' platform via `CLAUDE_API_KEY`, `ANTHROPIC_API_KEY`, or `CLAUDE_SESSION_ID`.
- Updated `scripts/agent/scheduler-utils.mjs` `getSafeEnv` to preserve `JULES_`, `CODEX_`, `CLAUDE_`, `ANTHROPIC_`, and `GOOSE_` environment variables when spawning child processes.
- Updated `scripts/agent/run-scheduler-cycle.mjs` to use `detectPlatform()` as a fallback for `AGENT_PLATFORM` instead of hardcoding `'codex'`, ensuring the correct platform is used for lock creation.
- Added unit tests for `detectPlatform` in `test/utils.test.mjs`.
This resolves the issue where lock cards displayed "Unknown" or incorrect platforms.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `.github/workflows/ci.yml` to run build, lint, and test on PRs/push to main.
- Updated `.github/workflows/ci-resilience-nightly.yml` to use Node.js 22.
- Fixed lint errors in `src/services/governance/index.js` (no-empty, preserve-caught-error).
- Added `governance-agent` to daily roster and scheduler prompt to fix `npm test` scheduler validation failure.
Co-authored-by: PR0M3TH3AN <[email protected]>
Implement a comprehensive governance system to manage agent prompt changes safely.
Key features:
- **Proposal Workflow:** Prompt changes are now "proposals" stored in `src/proposals/` with metadata and diffs.
- **Governance Agent:** A new `governance-agent` reviews and applies proposals using `scripts/governance/process-proposals.mjs`.
- **Validation:** Strict validation ensures changes are limited to allowed directories (`src/prompts/daily|weekly`) and preserve required headers.
- **Lock Enhancements:** Lock events now include `promptHash`, `promptPath`, and `gitCommit` for full auditability.
- **Rollback:** New `torch-lock rollback` command restores prompts from local history (`.torch/prompt-history/`) or git.
- **CLI:** Added `proposal` (create, list, show, apply, reject) and `rollback` commands.
This establishes a "Stage -> Evaluate -> Apply" gate for prompt evolution, preventing silent drift and ensuring constitutional stability.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Optimized `RelayHealthManager.rankRelays` to use O(M log M) lookup for small subsets instead of O(N) filter.
- Added `byRelay` Map to `_sortedCache` for O(1) access.
- Fixed `NaN` bug in `buildRelayHealthConfig` when `minActiveRelayPool` is undefined.
- Updated `perf/benchmark-lock-ops.mjs` to measure subset performance.
- Added performance report `reports/performance/weekly-perf-report-2026-02-18.md`.
- Achieved ~6.8x speedup in benchmark.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Refactored `test/memory-scheduler.test.mjs` to use `mock.timers` for deterministic execution, replacing flaky `wait` logic.
- Strengthened `test/lock-ops.test.mjs` with edge case tests for `parseLockEvent` handling invalid JSON and missing fields.
- Fixed a security vulnerability in `src/dashboard.mjs` where sensitive configuration (e.g., rosters, auth) was exposed in `/torch-config.json`.
- Updated `src/prompts/daily/test-audit-agent.md` to comply with the canonical prompt contract.
- Added `reports/test-audit/test-integrity-note-2025-02-14.yaml` detailing test changes and anti-cheat measures.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added "Clean Repo Standard" to `AGENTS.md` and `CLAUDE.md`, explicitly forbidding root-level logs/artifacts.
- Moved clutter files (`test_output_full.txt`, `benchmark-after.txt`, `dashboard.log`, etc.) to `test_logs/`, `task-logs/`, and `reports/performance/`.
- Moved `INITIAL_BASELINE.md` and other baseline files to `reports/performance/`.
- Updated `src/prompts/daily/perf-agent.md` and `src/prompts/daily/const-refactor-agent.md` to reference the new location of `INITIAL_BASELINE.md`.
- Updated `.gitignore` to ignore logs and temporary artifacts in the new directories.
- Moved `DIAGNOSIS.md` to `reports/performance/`.
- Moved `perf/` data files to `reports/performance/`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Created `reports/` directory with subdirectories for each category (audit, performance, security, etc.).
- Moved existing reports to the new `reports/` structure.
- Updated `AGENTS.md` to define the "Report Location Standard".
- Updated all agent prompts in `src/prompts/` to:
- Output reports to the new locations.
- Fix incorrect script paths (replaced `torch/scripts/` with `scripts/`).
- Updated `load-test-agent.md` to produce a Markdown summary report.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Created `AGENTS.md` and `CLAUDE.md` to define test integrity rules and behavior-based validation.
- Updated `TORCH.md` to include "Scenario-First Tests & Test Integrity" and the "Test Integrity & Scenario Spec Agent" role.
- Updated `src/prompts/daily/test-audit-agent.md` to adopt the new "Enforcer" role, prioritizing test fidelity over CI green state.
- Preserved existing scheduler contract headers in the agent prompt.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added JSDoc to exported functions and classes in src/lock-ops.mjs
- Added inline comments to complex logic areas
- Created docs/lock-ops-overview.md
- Created task log for daily docs-code-investigator agent
Co-authored-by: PR0M3TH3AN <[email protected]>
- Update `package.json` to include `TORCH.md` and `scripts/memory/` in distribution.
- Update `README.md` to reference `TORCH.md` correctly.
- Update `src/ops.mjs` to robustly handle memory policy paths in `torch-config.json` generation.
- Update `.gitignore` to exclude `.scheduler-memory/`.
- Update `torch-config.example.json` to include memory policy with standard defaults.
Co-authored-by: PR0M3TH3AN <[email protected]>
thePR0M3TH3AN