registry / metareview / 0.6.0

metareview@0.6.0

Go-based metaswarm-compatible internal review harness for plans, specs, decompositions, code, acceptance evidence, PR readiness, and post-merge learning

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.40 KB of source

Source & flagged code

2 flagged

internal/prready/evidence_test.goView file

Lines 40-80text

40 "GitHub context unavailable: gh-unavailable",

41 } {

42 if !strings.Contains(markdown, required) {

43 t.Fatalf("rendered evidence missing %q:\n%s", required, markdown)

44 }

45 }

46}

48func TestRenderEvidenceRedactsGitHubText(t *testing.T) {

49 credentialValue := "redaction-test-value"

50 markdown := RenderEvidence(EvidenceInput{

51 Summary: "Ready.",

52 Validation: []string{"go test ./... exited 0"},

53 GitHub: githubcontext.Context{

54 Available: true,

55 URL: "https://github.com/acme/repo/pull/9",

56 Title: "Contains token=" + credentialValue,

57 Comments: []githubcontext.Entry{{

58 Author: "alice",

59 URL: "https://github.com/acme/repo/pull/9#issuecomment-1",

60 Body: "password=" + credentialValue,

Medium

Secret Pattern

Package contains a possible secret pattern.

internal/prready/evidence_test.goView on unpkg · L60

61 }},

62 },

63 })

65 for _, forbidden := range []string{credentialValue} {

66 if strings.Contains(markdown, forbidden) {

67 t.Fatalf("rendered evidence leaked %q:\n%s", forbidden, markdown)

68 }

69 }

70 if !strings.Contains(markdown, "REDACTED") {

71 t.Fatalf("expected redaction marker:\n%s", markdown)

72 }

73}

75func TestRenderEvidenceIncludesAttemptCountsAndEscalation(t *testing.T) {

76 body := RenderEvidence(EvidenceInput{

77 Summary: "branch summary",

78 Validation: []string{"go test ./... exited 0"},

79 TaskReviews: []ReviewEvidence{{

80 Target: "task-1",

bin/metareviewView file

•path = bin/metareview kind = native_binary sizeBytes = 4906146 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/metareviewView on unpkg

Source & flagged code

2 flagged · loading source

internal/prready/evidence_test.goView file

60patternName = generic_password severity = medium line = 60 matchedText = Body: ...lue,

Medium

Secret Pattern

Package contains a possible secret pattern.

internal/prready/evidence_test.goView on unpkg · L60

bin/metareviewView file

•path = bin/metareview kind = native_binary sizeBytes = 4906146 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/metareviewView on unpkg

Findings

2 Medium2 Low

MediumSecret Patterninternal/prready/evidence_test.go

MediumShips Native Binarybin/metareview

LowScripts Present

LowFilesystem

Source & flagged code

2 flagged

internal/prready/evidence_test.goView file

Lines 40-80text

40 "GitHub context unavailable: gh-unavailable",

41 } {

42 if !strings.Contains(markdown, required) {

43 t.Fatalf("rendered evidence missing %q:\n%s", required, markdown)

44 }

45 }

46}

48func TestRenderEvidenceRedactsGitHubText(t *testing.T) {

49 credentialValue := "redaction-test-value"

50 markdown := RenderEvidence(EvidenceInput{

51 Summary: "Ready.",

52 Validation: []string{"go test ./... exited 0"},

53 GitHub: githubcontext.Context{

54 Available: true,

55 URL: "https://github.com/acme/repo/pull/9",

56 Title: "Contains token=" + credentialValue,

57 Comments: []githubcontext.Entry{{

58 Author: "alice",

59 URL: "https://github.com/acme/repo/pull/9#issuecomment-1",

60 Body: "password=" + credentialValue,

Medium

Secret Pattern

Package contains a possible secret pattern.

internal/prready/evidence_test.goView on unpkg · L60

61 }},

62 },

63 })

65 for _, forbidden := range []string{credentialValue} {

66 if strings.Contains(markdown, forbidden) {

67 t.Fatalf("rendered evidence leaked %q:\n%s", forbidden, markdown)

68 }

69 }

70 if !strings.Contains(markdown, "REDACTED") {

71 t.Fatalf("expected redaction marker:\n%s", markdown)

72 }

73}

75func TestRenderEvidenceIncludesAttemptCountsAndEscalation(t *testing.T) {

76 body := RenderEvidence(EvidenceInput{

77 Summary: "branch summary",

78 Validation: []string{"go test ./... exited 0"},

79 TaskReviews: []ReviewEvidence{{

80 Target: "task-1",

bin/metareviewView file

•path = bin/metareview kind = native_binary sizeBytes = 4906146 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/metareviewView on unpkg