Skip to content

docs: add REVIEW.md and Code Review Rules in AGENTS.md - #51

Merged
kurtseifried merged 2 commits into
mainfrom
docs/add-review-md
Oct 31, 2026
Merged

docs: add REVIEW.md and Code Review Rules in AGENTS.md#51
kurtseifried merged 2 commits into
mainfrom
docs/add-review-md

Conversation

@kurtseifried

@kurtseifried kurtseifried commented Oct 31, 2026

Copy link
Copy Markdown
Contributor

Agent: Gemini (SecID governing agent)

Summary

Implements independent review instructions for CloudSecurityAlliance/SecID-Service per CSA-Internal-Governance/SecID/AGENTS.md ("First tasks" #4) and CINO-Platform-Engineering#261:

  1. Add REVIEW.md:
    • Starts with @AGENTS.md (the documented root include for Claude Code Review on a protected default branch).
    • Provides a complete, self-contained 6-part review checklist covering:
      1. Authority, provenance, and CI/deploy guardrails (registry-kv-upload.yml, wrangler.toml).
      2. Recursive MCP output sanitization (src/sanitize.ts: sanitizeDict + capValue) and submit_feedback untrusted envelope isolation (src/feedback.ts).
      3. /mcp HTTP method gate parity with CSA-MCP-Core (src/method-gate.ts, ADR-015).
      4. Abuse-resistance and operational limits (secid ≤ 1024 chars, MCP body ≤ 64 KiB, batch ≤ 10 and no submit_feedback in batches, 20 writes/min/isolate budget).
      5. KV --sync 50-orphan safety threshold, 25 MiB per-key limit, stateless KV runtime reads, and TYPE_REGISTRY lockstep.
      6. Vitest unit coverage, release-train test guards (test/resolver.test.ts), and @third-party tagging on Playwright E2E tests (e2e/).
  2. Update AGENTS.md:
    • Adds a matching ## Code Review Rules section for OpenAI Codex (codex review / codex exec) and references REVIEW.md in the Repository Structure tree.

Verification

  • Verified no bare @ tokens outside backticks (except line 1 @AGENTS.md in REVIEW.md).
  • CI (ci.yml) runs on this PR.
  • Independent cross-vendor review by OpenAI Codex (gpt-6-astra) in a fresh context will be recorded on this PR before merge.

Closes #50

@kurtseifried
docs: add REVIEW.md and Code Review Rules in AGENTS.md
cd09bd3 
Add root REVIEW.md (with @AGENTS.md include and self-contained SecID-Service
review checklist for Claude Code Review and GitHub Copilot Code Review) and
add a matching `## Code Review Rules` section to AGENTS.md for OpenAI Codex
(`codex review`).

Closes #50

AI-Agent: Gemini
@kurtseifried
docs: address Codex review findings on REVIEW.md and Code Review Rules
0c1dbda 
- Match src/sanitize.ts exact symbols: sanitizeResponseForMcp(),
  sanitizeDict(), sanitizeValue(), UNTRUSTED_TEXT_KEYS,
  registry_text_untrusted._warning, capString(), capValue(),
  MAX_FIELD_CHARS = 4000, MAX_ARRAY_ITEMS = 64
- Clarify OPTIONS CORS 204 pass-through vs 405 Method Not Allowed on
  registered non-POST, non-OPTIONS methods in src/method-gate.ts
- Document exact isBrowserNavigation() predicate (rejects text/event-stream,
  Mcp-Protocol-Version, and Mcp-Session-Id first; accepts Sec-Fetch-Mode:
  navigate or Accept: text/html)
- Require cross-vendor review and decision record unconditionally for all
  CI/deploy gate and reviewer-instruction changes

Refs #50

AI-Agent: Gemini
@kurtseifried

kurtseifried commented Oct 31, 2026

Copy link
Copy Markdown
Contributor Author

Agent: Gemini (SecID governing agent)

Two-Review Summary

  1. Review 1 — Self-Review (Gemini, SecID governing agent):

    • Verified REVIEW.md starts with @AGENTS.md on line 1 followed by self-contained review rules for Claude Code Review, GitHub Copilot Code Review, and human/agent reviewers.
    • Verified ## Code Review Rules in AGENTS.md matches REVIEW.md.

  2. Review 2 — Independent Fresh-Context Cross-Vendor Review (OpenAI Codex gpt-6-astra, session 01a19334-40e8-7f92-a948-0cb17f0817e8):

    • Findings raised (2 P2, 1 P3, 0 P1):
      1. [P2] Align sanitizer contract with src/sanitize.ts: Replace sanitizeResult() / sanitizeEnvelope(), _untrusted_prose, _prose_warning, and MAX_STRING_LEN with the exact symbols in src/sanitize.ts: sanitizeResponseForMcp(), sanitizeDict(), sanitizeValue(), UNTRUSTED_TEXT_KEYS (description, notes, note, official_name, common_name, auth, contacts, contact, scope, policy, disclosure_policy, version_disambiguation, unversioned_behavior, parsing_instructions), registry_text_untrusted._warning, capString(), capValue(), MAX_FIELD_CHARS = 4000, and MAX_ARRAY_ITEMS = 64.
      2. [P2] Preserve OPTIONS exception to the 405 rule (src/method-gate.ts): Clarify that OPTIONS passes through to CORS middleware (204), while registered non-POST, non-OPTIONS methods (GET, HEAD, PUT, PATCH, DELETE, QUERY, TRACE, CONNECT) from non-browsers receive 405 Method Not Allowed with Allow: POST, OPTIONS.
      3. [P3] Document exact isBrowserNavigation() predicate: State that isBrowserNavigation() rejects MCP-client signals (Accept: text/event-stream, Mcp-Protocol-Version, Mcp-Session-Id) first and then accepts Sec-Fetch-Mode: navigate or Accept: text/html. Also require unconditional cross-vendor review + decision record for all gate/reviewer-instruction changes.
    • Resolution: All 3 findings addressed in commit 0c1dbda.

@kurtseifried
kurtseifried merged commit 174476e into main Oct 31, 2026
1 check passed
@kurtseifried
kurtseifried deleted the docs/add-review-md branch October 31, 2026 18:31
@kurtseifried kurtseifried mentioned this pull request Oct 31, 2026
Closed
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

docs: add REVIEW.md and Code Review Rules in AGENTS.md for independent review

1 participant

@kurtseifried