feat(tools): make RiskChainAccumulator cross-turn window configurable - #6680
Merged
Conversation
github-actions
Bot
added
enhancement
bug-ops
force-pushed
the
feat/issue-6603/risk-chain-window-config
branch
from
July 28, 2026 02:30
0431e36 to
c6d8366
Compare
bug-ops
enabled auto-merge (squash)
July 28, 2026 02:30
CROSS_TURN_WINDOW_TURNS was a hardcoded constant with no stated rationale relative to the sibling `[security] window_turns` config. Expose it as `[tools.shell] risk_chain_window_turns`, threaded through &ShellConfig (matching risk_chain_threshold's resolution pattern) instead of a per-call-site parameter, with --init wizard and --migrate-config support. Default stays at 3 (unchanged behavior); 0 is a documented, logged opt-out that disables cross-turn detection. Module docs and specs/010-security/spec.md now state the threat-model rationale and the accepted, bounded residual evasion window.
bug-ops
force-pushed
the
feat/issue-6603/risk-chain-window-config
branch
from
July 28, 2026 02:40
c6d8366 to
e372b60
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RiskChainAccumulator's hardcodedCROSS_TURN_WINDOW_TURNS = 3with a real config field,[tools.shell] risk_chain_window_turns, mirroring the sibling[security] window_turnspattern incrates/zeph-config/src/security.rs.RiskChainAccumulator::newnow takes&ShellConfigand resolves the window internally (matching howrisk_chain_thresholdalready works), instead of a bare parameter each of the 4 wiring call sites (runner, daemon, acp, serve) would otherwise have to remember to fill correctly.0is a documented, logged opt-out that disables cross-turn detection entirely —wire_risk_chain's tracing span now logs the resolvedwindow_turns, plus awarn!naming RiskChainAccumulator (exfil_read_then_send / cred_then_egress) is turn-scoped and its cross-turn fallback is unwired #6561 when it's 0.--initwizard prompt and a--migrate-configstep for existing configs.specs/010-security/spec.md(prose + Key Invariants) with the threat-model rationale: narrower than the sibling's default of 8 because this window feeds a hard block decision rather than a soft score, and the residual evasion (attacker controls leg spacing beyond the window) is an accepted, bounded risk — unchanged from the pre-existing fix(security): close RiskChainAccumulator cross-turn and cross-session gaps #6602 behavior.Closes #6603
Test plan
cargo +nightly fmt --checkcargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warningscargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins(15149/15149 passed)RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features ...)gitleaks protect --staged— no leaks.local/testing/playbooks/risk-chain-accumulator.mdand.local/testing/coverage-status.mdupdated (main repo root)CHANGELOG.mdupdated under[Unreleased]