registry / rfc2119 / 0.2.0

rfc2119@0.2.0

Spec-driven test enforcement for coding agents: RFC 2119 requirements docs, requirement-to-test traceability, and judgment reviews that are hard to cheat.

AI Security Review

scanned 19h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `2119 init --agent ...`, `--git-hook`, `--ci`, or `2119 check` on specs containing [verify].

Impact

Can enforce or block agent workflow and execute repository-trusted verify commands.

Mechanism

Explicit project configuration and user-defined shell-command execution.

Rationale

Source shows a real explicit-user-command AI-agent control-surface mutation and repository-defined command execution, so it warrants a warning under policy. No concrete malicious behavior or unconsented lifecycle mutation was found.

Evidence

package.jsondist/init.jsdist/adapters.jsdist/hook.jsdist/verify.js.codex/hooks.json.claude/settings.json.gemini/settings.json.claude/agents/2119-reviewer.md.git/hooks/pre-commit.github/workflows/2119.ymlAGENTS.md.2119.yml.2119/verdicts/

rfc2119@0.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code