Skip to content

fix: UI build, MCP test, and governance gate template drift #89

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chitcommit merged 1 commit into from
Apr 14, 2026
Merged

fix: UI build, MCP test, and governance gate template drift #89

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/governance-gates.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ on:
jobs:
gates:
uses: ./.github/workflows/reusable-governance-gates.yml
with:
audit_omit_dev: true
secrets: inherit

notify-org-control-loop:
Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/reusable-governance-gates.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ on:
required: false
type: boolean
default: true
audit_omit_dev:
required: false
type: boolean
default: false

permissions:
contents: read
Expand Down Expand Up @@ -90,7 +94,7 @@ jobs:
run: npm ci
- name: Dependency Audit (High+)
if: ${{ steps.lockfile.outputs.present == 'true' }}
run: npm audit --audit-level=high
run: npm audit --audit-level=high ${{ inputs.audit_omit_dev && '--omit=dev' || '' }}
- name: Skip Dependency Audit (no package-lock.json)
if: ${{ steps.lockfile.outputs.present != 'true' }}
run: echo "No package-lock.json found; skipping dependency audit."
4 changes: 2 additions & 2 deletions CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ Three modes:
- `src/lib/dispute-sync.ts` — Dispute ↔ Notion ↔ TriageAgent sync coordinator
- `src/routes/bridge/index.ts` — Inter-service bridge (scrape, ledger, finance, Plaid)
- `src/routes/bridge/disputes.ts` — Dispute-Notion manual sync bridge
- `src/routes/mcp.ts` — MCP server for Claude integration (48 tools)
- `src/routes/mcp.ts` — MCP server for Claude integration (50 tools)
- `src/routes/meta.ts` — Public canon/schema/beacon + authenticated whoami
- `src/routes/connect.ts` — ChittyConnect discovery proxy (rate-limited)
- `src/routes/ledger.ts` — ChittyLedger evidence/custody passthrough
Expand Down Expand Up @@ -137,7 +137,7 @@ Example client-side MCP configuration (conceptual):
}
```

The server exposes 48 tools across 12 domains:
The server exposes 50 tools across 12 domains:

**Core meta** — `get_canon_info`, `get_registry_status`, `get_schema_refs`, `whoami`, `get_context_summary`
**Financial** — `query_obligations`, `query_accounts`, `query_disputes`, `get_recommendations`, `get_cash_position`, `get_cashflow_projections`, `query_revenue_sources`, `get_payment_plan`
Expand Down
10 changes: 7 additions & 3 deletions templates/governance-baseline/.github/workflows/reusable-governance-gates.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ on:
required: false
type: boolean
default: true
audit_omit_dev:
required: false
type: boolean
default: false

permissions:
contents: read
Expand All @@ -20,8 +24,8 @@ jobs:
shell: bash
run: |
set -euo pipefail
secrets_in_use="$(grep -RhoE 'secrets\.[A-Za-z_][A-Za-z0-9_]*' .github/workflows \
| sed -E 's/.*secrets\.([A-Za-z_][A-Za-z0-9_]*).*/\1/' \
secrets_in_use="$(grep -RhoE '\$\{\{\s*secrets(\.[A-Za-z_][A-Za-z0-9_]*|\['"'"'\"[A-Za-z_][A-Za-z0-9_]*'"'"'\"\])\s*\}\}' .github/workflows \

@chatgpt-codex-connector chatgpt-codex-connector Bot Apr 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Detect secret references inside full GitHub expressions

The new grep regex only matches when secrets.<NAME> is the entire ${{ ... }} expression, because it requires the secret token to be followed directly by optional spaces and }}. That misses valid usages such as ${{ secrets.API_TOKEN != '' }} or ${{ someFn(secrets.API_TOKEN) }}, so disallowed secrets can bypass the allowlist check in repos generated from this template. The previous secrets\.<NAME> scan still caught those forms, so this change narrows policy coverage.

Useful? React with 👍 / 👎.

| sed -E "s/.*secrets[.\['\"]([A-Za-z_][A-Za-z0-9_]*).*/\1/" \
| sort -u || true)"

if [[ -z "${secrets_in_use}" ]]; then
Expand Down Expand Up @@ -90,7 +94,7 @@ jobs:
run: npm ci
- name: Dependency Audit (High+)
if: ${{ steps.lockfile.outputs.present == 'true' }}
run: npm audit --audit-level=high
run: npm audit --audit-level=high ${{ inputs.audit_omit_dev && '--omit=dev' || '' }}
- name: Skip Dependency Audit (no package-lock.json)
if: ${{ steps.lockfile.outputs.present != 'true' }}
run: echo "No package-lock.json found; skipping dependency audit."
4 changes: 2 additions & 2 deletions tests/mcp.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,13 +141,13 @@ describe('MCP — tools/list', () => {
expect(tools.length).toBeGreaterThanOrEqual(1);
});

it('exposes exactly 48 tools', async () => {
it('exposes exactly 50 tools', async () => {
const { post } = buildApp();
const res = await post({ jsonrpc: '2.0', id: 1, method: 'tools/list' });
const json = await res.json() as Record<string, unknown>;
const result = json.result as Record<string, unknown>;
const tools = result.tools as unknown[];
expect(tools.length).toBe(48);
expect(tools.length).toBe(50);
});

it('each tool has a name and inputSchema', async () => {
Expand Down
10 changes: 5 additions & 5 deletions ui/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions ui/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
"react": "^18.3.0",
"react-dom": "^18.3.0",
"react-grid-layout": "^2.2.2",
"react-is": "^19.2.5",
"react-router-dom": "^6.23.0",
"recharts": "^3.7.0",
"tailwind-merge": "^2.3.0"
Expand Down
Loading