Security regression: dedicated security test suite from commit 7109410 missing from codebase

Mark commented

2026-07-22 18:18:48 +00:00

Owner

Finding from post-deploy probe of mesh-seed #46 (kanban card t_714d1965)

Description

The security hardening commit 7109410 ("feat(security): implement multi-wave security hardening for deploy skills") originally introduced three dedicated security test files to validate the mitigation measures for issue #46:

test_secrets_manager.py
test_skill_secrets_redaction.py
test_node_provision_skill_integration.py

These files no longer exist in the codebase. Only a stale .pyc bytecode file remains for test_node_provision_skill_integration. The only remaining test coverage for the security hardening lives in tests/unit/test_skill_runtime.py (34 tests), which covers the runtime integration but lacks the dedicated attack-surface tests (command injection probes, secret redaction edge cases, node provision security boundaries).

Impact

Security-specific tests that validated hard-won mitigations (host key pinning, bootstrap integrity, champion gate enforcement, secret redaction) have been lost. Future refactors or regressions in these areas will not be caught by the existing test suite.

Steps to Reproduce

Clone mesh-seed at master
Search for test files matching test_secrets_manager*, test_skill_secrets_redaction*, or test_node_provision_skill_integration*
Observe no source files exist (only stale .pyc for test_node_provision_skill_integration)

Expected Behavior

Security tests shipped with the hardening commit should remain in the codebase to provide regression coverage. Specifically, these files should exist at test paths matching tests/security/* or similar.

Actual Behavior

The security-specific test files have been removed from the source tree. Only generic runtime tests remain.

References

Original issue: #46
Fix commit: 7109410
Kanban card: t_714d1965 (QA board)

## Finding from post-deploy probe of mesh-seed #46 (kanban card t_714d1965) ### Description The security hardening commit `7109410` ("feat(security): implement multi-wave security hardening for deploy skills") originally introduced three dedicated security test files to validate the mitigation measures for issue #46: - `test_secrets_manager.py` - `test_skill_secrets_redaction.py` - `test_node_provision_skill_integration.py` **These files no longer exist in the codebase.** Only a stale `.pyc` bytecode file remains for `test_node_provision_skill_integration`. The only remaining test coverage for the security hardening lives in `tests/unit/test_skill_runtime.py` (34 tests), which covers the runtime integration but lacks the dedicated attack-surface tests (command injection probes, secret redaction edge cases, node provision security boundaries). ### Impact Security-specific tests that validated hard-won mitigations (host key pinning, bootstrap integrity, champion gate enforcement, secret redaction) have been lost. Future refactors or regressions in these areas will not be caught by the existing test suite. ### Steps to Reproduce 1. Clone mesh-seed at master 2. Search for test files matching `test_secrets_manager*`, `test_skill_secrets_redaction*`, or `test_node_provision_skill_integration*` 3. Observe no source files exist (only stale `.pyc` for `test_node_provision_skill_integration`) ### Expected Behavior Security tests shipped with the hardening commit should remain in the codebase to provide regression coverage. Specifically, these files should exist at test paths matching `tests/security/*` or similar. ### Actual Behavior The security-specific test files have been removed from the source tree. Only generic runtime tests remain. ### References - Original issue: #46 - Fix commit: 7109410 - Kanban card: t_714d1965 (QA board)

Mark added the

bug

security/medium

labels

2026-07-22 18:18:48 +00:00

Mark added the

triage-approved

label

2026-07-26 14:47:12 +00:00

Mark added the

blocked:preflight

label

2026-07-31 04:26:40 +00:00

Mark commented

2026-08-04 11:37:58 +00:00

Author

Owner

Reopened by QA reconciliation sweep (2026-08-04).

The closure of this issue at 2026-08-04T04:34:57Z was a false-positive from a kanban reconciliation sweep that bulk-closed multiple open issues without verifying whether fixes had landed. No fix has actually landed for this issue.

Independent verification on master (92521ce956):

tests/unit/test_secrets_manager.py → 404
tests/unit/test_skill_secrets_redaction.py → 404
tests/unit/test_node_provision_skill_integration.py → 404
tests/unit/test_skill_runtime.py (referenced in the original issue body as containing 34 tests) → 404

No PR contains these files. The fixit kanban card t_75eb6327 (kilo-gsd-runner assignee) never produced a fix — the runner crashed at 70 seconds (kilo-crash: kilo-gsd.py exited with code 1) and the card sat blocked for ~120 hours before being auto-completed by the reconciliation sweep with empty result.

The underlying claim of this issue remains valid: the dedicated security regression tests added in commit 7109410 are absent from master. Fix is still required.

**Reopened by QA reconciliation sweep (2026-08-04).** The closure of this issue at 2026-08-04T04:34:57Z was a false-positive from a kanban reconciliation sweep that bulk-closed multiple open issues without verifying whether fixes had landed. No fix has actually landed for this issue. **Independent verification on master (`92521ce956`):** - `tests/unit/test_secrets_manager.py` → **404** - `tests/unit/test_skill_secrets_redaction.py` → **404** - `tests/unit/test_node_provision_skill_integration.py` → **404** - `tests/unit/test_skill_runtime.py` (referenced in the original issue body as containing 34 tests) → **404** No PR contains these files. The fixit kanban card `t_75eb6327` (kilo-gsd-runner assignee) never produced a fix — the runner crashed at 70 seconds (`kilo-crash: kilo-gsd.py exited with code 1`) and the card sat blocked for ~120 hours before being auto-completed by the reconciliation sweep with empty result. The underlying claim of this issue remains valid: the dedicated security regression tests added in commit `7109410` are absent from `master`. Fix is still required.

Mark referenced this issue

2026-08-04 12:05:39 +00:00

@dataclass on MigrationError breaks drift error reporting (TypeError instead of MigrationDriftError) #245

Mark referenced this issue from a commit

2026-08-04 14:27:48 +00:00

test(security): restore security regression tests from commit 7109410

Mark referenced this issue from a pull request that will close it,

2026-08-04 14:28:58 +00:00

test(security): restore security regression tests from commit 7109410 #265

Mark closed this issue

2026-08-04 14:30:23 +00:00

Mark referenced this issue

2026-08-04 14:40:58 +00:00

Discord Bot Foundation #231

Mark reopened this issue

2026-08-04 17:31:36 +00:00

Mark commented

2026-08-04 17:31:57 +00:00

Author

Owner

Reopened by QA verification — false-close detected.

Evidence:

Issue was closed at 2026-08-04T14:30:23Z during reconciliation sweep
PR #265 (restore-security-tests-252) is open but NOT merged
Commit b44120a exists on branch restore-security-tests-252 but is NOT on master
The test files (test_secrets_manager.py, test_skill_secrets_redaction.py, test_node_provision_skill_integration.py) do NOT exist on master
Additionally, the fix in PR #265 has a bug: skill_executor.py passes capability_id to record_secret_access() but the method expects contract_id

Status: PR #265 needs to be fixed (use contract_id instead of capability_id) and merged.

**Reopened by QA verification** — false-close detected. **Evidence:** - Issue was closed at 2026-08-04T14:30:23Z during reconciliation sweep - PR #265 (restore-security-tests-252) is **open but NOT merged** - Commit b44120a exists on branch `restore-security-tests-252` but is NOT on master - The test files (`test_secrets_manager.py`, `test_skill_secrets_redaction.py`, `test_node_provision_skill_integration.py`) do NOT exist on master - Additionally, the fix in PR #265 has a bug: `skill_executor.py` passes `capability_id` to `record_secret_access()` but the method expects `contract_id` **Status:** PR #265 needs to be fixed (use `contract_id` instead of `capability_id`) and merged.

Mark referenced this issue from a commit

2026-08-04 23:50:22 +00:00

fix: capability_id -> contract_id in ledger calls (skill_executor.py)

Mark closed this issue

2026-08-07 14:45:25 +00:00

Mark removed the

labels

2026-08-14 01:00:32 +00:00