Repository navigation
fix: render the challenged file in judge receipt examples - #71
Merged
Merged
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Package judges can correctly read the inspection challenge and hash
package.json, then reportartifact/*orartifact/ package.jsonand fail the required-file check. Render the receipt example from the actual challenged file and ask for literal, separate paths.Scope
Security / Trust Impact
Challenge, SHA-256, and exact required-file validation are unchanged. The prompt supplies only the path; the judge must still read the random challenge and hash the real file. No scanner, sandbox, or publication check is bypassed.
Verification
go test -count=1 ./...go vet ./...go run ./cmd/clawscan --helpBefore: the CLI test's package case failed because its receipt example named
SKILL.md. On the exact affected archives, Codex 0.160.0 returnedartifact/*for consumer-product-recall-coordinator andartifact/ package.jsonfor learning-program-manager; both receipts failed despite correct manifest hashes.After: the package and skill examples pass. Both identical archives returned the exact
artifact/package.jsonpath and completed under unchanged validation. Regression cases still reject both malformed paths and a wrong hash. The live proof used scanner fixtures to isolate the judge, so it is not publication approval or a reliability benchmark.Independent Sol/high/Standard review through P3: scoped-clean.
Notes
The optional manual
verify-clawhub-promptaudit compares static ClawHub and ClawScan sources; this per-artifact prompt update needs coordination when refreshing that audit. Neither repository's CI nor the worker installation runs it. No deployed ClawHub pin is changed here.Merge Danger
Door: two-way
Blast Radius: judge
Changes the built-in ClawHub judge's example and path instructions; output schema and receipt enforcement remain intact.