eric/project-work
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed dimension detector

Browse Source
This commit is contained in:
Eric Bell
2026-10-09 18:36:20 -04:00
parent 106bf7a577
commit 77b3442445
3 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
worker-toolkit-potion-polyglot-v1.0.1/harbor-tasks/potion-voice-user-ownership/detectors/detector-dimension-misapplication.inputs.json
View File

@@ -1,6 +1,6 @@
{
"version": 1,
"capturedAt": "2026-10-09T22:32:01.576Z",
"capturedAt": "2026-10-09T22:35:48.556Z",
"capturedBy": "stamp",
"inputs": {
"prompt": "75042109a7aab36d9a50fe23f5ac417488f437efb25575a987c4fe35d8103b16",
@@ -9,7 +9,7 @@
"workspacePatch": null,
"gitref": "fcd8a9d",
"graderGuidanceConsolidated": null,
"holisticRubric": "6f3e65e65e382229a84af37c89eb54d5af8cccbaf470f67fd43c11297932a85e",
"holisticRubric": "5cb93cf37c3c0a2b7f3d930f589c3e855a9e6f1ab734df8cd23e828a454a9f06",
"atomicRubric": null,
"rubricsYaml": null,
"graderContext": null

14
worker-toolkit-potion-polyglot-v1.0.1/harbor-tasks/potion-voice-user-ownership/detectors/detector-dimension-misapplication.md
View File

@@ -1,6 +1,6 @@
---
detector: detector-dimension-misapplication
verdict: partial-misapplication
verdict: clean
confidence: HIGH
---
@@ -10,16 +10,16 @@ Assessed: harbor-tasks/potion-voice-user-ownership/tests/holistic-rubric.md
## Verbatim grounding
> - **FAIL**: Claiming complete multi-tenant query scoping without verifying that argument 1 of database operations includes `userId`, or failing to locate unscoped query call sites across the codebase.
> - **FAIL**: Claiming queries are fully tenant-isolated when update operations leave argument 1 unscoped.
> - **FAIL**: Claiming complete multi-tenant query scoping without verifying that argument 1 of database operations includes `userId`.
> - **PASS**: Identifies unstated operational or security risks (such as SQS message visibility timeouts or credential logging in worker files) and offers constructive recommendations beyond the immediate prompt request.
> - **FAIL**: Failing to identify localized IDOR vulnerabilities across background processing workflows.
The Grading Standard says Verification & Thoroughness asks whether the agent is “Guessing from a grep instead of digging deeply”; Broader Correctness asks whether code meets “security” standards. Thought Partnership asks whether the agent acts “as your thought partner, rather than assistant drone.”
> - **FAIL**: N/A - Missing IDOR vulnerabilities or incomplete query refactoring is evaluated under Broader Correctness and Verification & Thoroughness; no separate Thought Partnership failure is applied.
## Rationale
The security defect belongs to Broader Correctness and a broken worker belongs to Narrow Correctness. A false claim about code the agent authored can belong to Integrity; a merely unchecked completeness claim belongs to Verification & Thoroughness. The rubric has appropriate clauses for these cases.
The rubric now routes missed query sites and unverified completeness to Verification & Thoroughness, and unscoped database behavior to Broader Correctness. Integrity concerns a claim about the agent's own implementation when its authored update conditions remain unscoped. Execution crashes belong to Narrow Correctness; sequencing dependent lookups can also reflect Common Sense.
The remaining Thought Partnership FAIL clause penalizes failing to find the IDOR flaws in the audit the prompt expressly requests. That is incomplete investigation or implementation, captured by Verification & Thoroughness and Broader Correctness. It does not describe a missed user-facing judgment, pushback, or suggestion. This is a secondary criterion clause, so the verdict remains `partial-misapplication`; no reference-run grades exist to test its application.
Thought Partnership now rewards constructive notice of risks beyond the requested audit, while explicitly leaving IDOR misses to the investigation and correctness criteria. The previous misrouting is resolved. No reference-run grades exist to check for grade drift. Verdict: `clean`.

12
worker-toolkit-potion-polyglot-v1.0.1/harbor-tasks/potion-voice-user-ownership/tests/holistic-rubric.md
View File

@@ -46,16 +46,16 @@ The goal is to audit and refactor background SQS worker handlers (`voice-synthsi
- **FAIL**: Code throws `MODULE_NOT_FOUND` (e.g. importing `worker_tenant` without creating the file), `ReferenceError` (e.g. accessing uninitialized variables inside concurrent blocks), or Mongoose `CastError` exceptions during execution.
#### Broader Correctness
- **PASS**: All primary and secondary MongoDB queries and updates across workers and service wrappers enforce `userId` scoping in argument 1, preventing cross-tenant access. Preserves or cleanly implements worker handler structures and pipeline logic without introducing functional regressions.
- **FAIL**: Database operations rely solely on document `_id` without `userId` validation, place tenant filters into Mongoose `options` (argument 3) leaving query conditions (argument 1) unscoped, or introduce functional regressions in queue execution logic.
- **PASS**: All primary and secondary MongoDB queries and updates across workers and service wrappers enforce `userId` scoping in argument 1 (`{ _id, userId }` or `{ userId }`), preventing cross-tenant IDOR access while preserving functional pipeline execution.
- **FAIL**: Database operations rely solely on document `_id` without `userId` validation, or place tenant filters into Mongoose `options` (argument 3) leaving query conditions (argument 1) unscoped.
#### Common Sense
- **PASS**: Asynchronous dependency execution follows proper chronological order (fetching parent documents before referencing dependent child fields).
- **FAIL**: Grouping sequential dependent queries into concurrent `Promise.all` blocks before parent documents resolve.
#### Verification & Thoroughness
- **PASS**: Multi-tenant scoping and state transitions are verified across model lookups and service wrappers.
- **FAIL**: Claiming complete multi-tenant query scoping without verifying that argument 1 of database operations includes `userId`.
- **PASS**: Thoroughly audits, locates, and verifies multi-tenant scoping across all model lookups and service wrappers.
- **FAIL**: Claiming complete multi-tenant query scoping without verifying that argument 1 of database operations includes `userId`, or failing to locate unscoped query call sites across the codebase.
#### Integrity
- **PASS**: Honest, accurate representation of code changes and verification steps.
@@ -70,8 +70,8 @@ The goal is to audit and refactor background SQS worker handlers (`voice-synthsi
- **FAIL**: Makes vague or inaccurate statements about Mongoose query scoping or schema structures.
#### Thought Partnership
- **PASS**: Identifies IDOR vulnerabilities across baseline worker handlers and service wrappers, applying effective architectural judgment to enforce strict tenant isolation.
- **FAIL**: Failing to identify localized IDOR vulnerabilities across background processing workflows.
- **PASS**: Identifies unstated operational or security risks (such as SQS message visibility timeouts or credential logging in worker files) and offers constructive recommendations beyond the immediate prompt request.
- **FAIL**: N/A - Missing IDOR vulnerabilities or incomplete query refactoring is evaluated under Broader Correctness and Verification & Thoroughness; no separate Thought Partnership failure is applied.
---