Repository navigation
WEB-PRIVACY-001AB — Contain Netlify release child diagnostics #596
Description
Outcome
Prevent Git, npm, tar, and frontend-build subprocesses from writing their own diagnostics into the temporary Netlify release builder's stdout or stderr. Preserve the fixed parent failure marker and the existing parent-owned success evidence. This is the dependency-ready privacy follow-up explicitly left by #582 and an atomic child of #105.
Defect
Exact released main 3ac4acee407220f34ef5ced1f43efe69279dfa09 contains two output paths that bypass #582's fixed outer catch:
run()executes child commands withstdio: 'inherit', so child stdout and stderr reach the retained build log before the parent can emitnetlify_release_build_failed.- the
git rev-parseandgit showreads pipe required stdout but inherit stderr.
A child diagnostic can contain command detail, a path, URL, token-shaped value, source excerpt, or other private material. The builder already supplies a minimum credential-free environment, but that does not make arbitrary child output safe to retain.
Priority and dependency state
- Priority: P1 privacy/security. Provider build logs may be retained and visible to provider users.
- Higher priority: read-only audit found no dependency-ready P0 implementation. Remaining P0 work is tracker-, policy-, owner-, provider-, IAM-, or protected-deployment-gated.
- Dependencies: WEB-PRIVACY-001AA — Redact caught Netlify release-build failures from build logs #582 is complete, closed, and claim-released. It deliberately named inherited child/Git diagnostics as the next residual.
- Conflicts: draft Rollback: prepare exact pre-header Netlify artifact #462 owns only
config/netlify-production-release.jsonandtests/release-workflow.test.js; both are excluded. Active AUTH-MAIL-002C2A — Bind verification results to the current identity service #571 and all other claimed paths are excluded.
Security invariant
No child-owned byte reaches the executable builder's stdout or stderr.
- Generic child commands receive ignored stdin, stdout, and stderr.
- The two Git identity reads capture only the required stdout internally and discard stderr.
- A child exit failure, signal, or invalid captured commit/tree produces empty parent stdout, exact stderr
netlify_release_build_failed\n, and process status 1. - The parent never logs the child exception.
- Existing parent-owned successful release evidence remains unchanged.
This does not claim that Netlify/platform logs outside this process are sanitized.
Allowed behavior and failure cases
- Successful source fetch, identity verification, install, build, artifact verification, publication, cleanup, and final parent evidence keep their current semantics.
- Child progress and diagnostics are intentionally silent.
rev-parseandshowstill return their captured stdout for exact commit/tree comparison.- Every synthetic child output canary is absent on failure.
- Failure stays fail-closed.
- The inactive manifest remains inactive.
Exact implementation scope
scripts/netlify-release-build.js- change only child-process stdio projection: ignore generic command streams; capture required Git stdout and ignore Git stderr.
tests/test-artifact-safety.test.js- add minimum fake-
git/synthetic-PATH black-box fixtures and one separately namedWEB-PRIVACY-001ABblock; - cover a generic
run()failure,rev-parsefailure, andshowfailure after valid syntheticrev-parse; - assert no inherited stdio remains.
- add minimum fake-
OPERATIONS_RUNBOOK.md- add one separately named source-only boundary beside WEB-PRIVACY-001AA — Redact caught Netlify release-build failures from build logs #582.
docs/officers/PUBLISH_AND_CHECK.md- extend the source-only backup-officer procedure with the child-output boundary, a small log-flow Mermaid diagram, and a one-sentence text alternative.
Explicit exclusions
No change to release policy, authorization, source pins, artifact rules, cleanup, manifest/configuration, tests/release-workflow.test.js, workflows, packages/locks, Netlify settings, Firebase, providers, website publication, production data, migration, or live behavior. No real credentials, member data, payment data, production provider call, or network call in tests.
Verification
- Record trustworthy test-only RED on untouched runtime using fake local executables that emit made-up stdout/stderr canaries.
- Prove each failure returns status 1, no signal, empty stdout, exact fixed stderr, and no canary.
- Prove required Git stdout capture and existing successful parent evidence remain compatible.
- Run the complete artifact-safety and unchanged release-workflow suites, then relevant repository gates.
- Review the exact diff for output flow, secrets/PII, authorization, cleanup, artifact compatibility, and production fallback.
- Obtain independent exact-head security/test and backup-officer reviews before merge.
- After merge, verify exact-main CI and record website, Firebase, Netlify/provider, data, and live states separately.
Compatibility and migration
No schema, API, dependency, configuration, workflow, artifact-format, data, or migration impact. Build progress and child error detail disappear intentionally. Troubleshooting uses safe local synthetic reproduction and bounded non-sensitive evidence. Exit detection, captured Git values, artifact behavior, cleanup, and the final Prepared … evidence line remain compatible.
Officer impact: Backup officers receive a clearer source-review boundary. On failure they may retain only the fixed parent code and bounded metadata, not raw child output.
Officer documentation: docs/officers/PUBLISH_AND_CHECK.md; engineering boundary in OPERATIONS_RUNBOOK.md.
Deployment evidence: None at issue creation. Source/tests/merge will not be described as website publication, runmprc.com verification, Firebase deployment, Netlify/provider configuration, production-data change, or live-behavior proof.
Activity
daliu commentedon Aug 2, 2026
CLAIMED by
/rootat2026-08-02T03:41:22Zon branchcodex/issue-596-netlify-child-output, exact released base3ac4acee407220f34ef5ced1f43efe69279dfa09.Exact ownership:
scripts/netlify-release-build.jstests/test-artifact-safety.test.jsWEB-PRIVACY-001ABblack-box block for generic-run,rev-parse, andshowchild output/failure;OPERATIONS_RUNBOOK.mdWEB-PRIVACY-001ABsource-only paragraph beside WEB-PRIVACY-001AA — Redact caught Netlify release-build failures from build logs #582.docs/officers/PUBLISH_AND_CHECK.mdInvariant: no child-owned byte reaches wrapper stdout or stderr. Every child failure remains unsuccessful with empty parent stdout and exact
netlify_release_build_failed\nstderr. Required Git stdout stays internal. Existing parent-owned finalPrepared …evidence remains unchanged.Immutable exclusions: release policy/authorization/source pins/artifact/cleanup semantics; manifest/configuration;
config/netlify-production-release.json;tests/release-workflow.test.js; draft #462; workflows; packages/locks; Netlify/Firebase/provider settings; website publication; production data; migrations; live behavior; active #571 and every other claimed path.The empty remote branch was pushed from exact main before this marker. #582 is COMPLETE/CLOSED/CLAIM RELEASED. Exact issue/PR/branch/path searches and three read-only audits found no competing claim. No source, test, or documentation edit preceded this claim.
Claim remains active through trustworthy RED, implementation, independent exact-head review, hosted CI, merge, exact-main/deployment truth audit, closure, and explicit release.
Officer impact: source-review clarity only. A backup officer retains the fixed parent code and bounded metadata, not raw child diagnostics.
Officer documentation: only the named section in
docs/officers/PUBLISH_AND_CHECK.md; the subprocess-output data-flow change will include Mermaid and a text alternative.Deployment evidence: none at claim time. No website,
runmprc.com, Firebase, Netlify/provider, production-data, or live-behavior state will be inferred from source or tests.daliu commentedon Aug 2, 2026
TRUSTWORTHY RED — before runtime or documentation edits
3ac4acee407220f34ef5ced1f43efe69279dfa09.tests/test-artifact-safety.test.js.8d817f86e153f952a5514f99f45d44688076ff2ec11985d2ec9d948c48d16760.v20.20.2.node --test --test-name-pattern='WEB-PRIVACY-001AB' tests/test-artifact-safety.test.js.Expected RED observed: 5 intended nested subtest failures.
git rev-parsewrote its made-up token-shaped stderr canary before the fixed parent marker.git showwrote its made-up token-shaped stderr canary before the fixed parent marker.The invalid captured-Git-value case already passed: required stdout stayed internal and the mismatch produced only the fixed parent marker. Every synthetic wrapper process exited unsuccessfully with no wrapper-level signal.
The fake executable intercepted the first relevant local Git command. No network, Netlify, Firebase, provider, credential, production data, website, deployment, or live action occurred. Runtime and both documentation paths remained byte-identical.
fix(release): contain child process diagnostics (#596)
docs(officers): clarify release helper output flow (#596)
daliu commentedon Aug 2, 2026
IMPLEMENTATION CANDIDATE — corrected exact clean head
Outcome: the executable Netlify release builder now discards generic child stdin/stdout/stderr and captures only required Git commit/tree stdout internally while discarding Git stderr. Child exit failure, signal termination, Git-read failure, and invalid captured identity produce empty parent stdout, exact fixed parent stderr, and status 1. Authorization, environment allowlist, source pins, artifact behavior, cleanup, and final parent Prepared evidence are unchanged.
Trustworthy RED on exact old runtime produced five intended nested failures: generic stdout escaped on exit and signal; both Git reads leaked stderr; inherited stdio remained. The invalid captured-value path was already safely fixed. Fake local Git intercepted all exercised commands before network/provider work.
Pinned Node 20 / Java 21 verification:
Review:
Delivery truth:
Officer impact: source-review clarity only. A backup officer can distinguish internal commit/tree checks, discarded helper output, the fixed parent failure code, and outside-provider logging.
Officer documentation: docs/officers/PUBLISH_AND_CHECK.md; engineering boundary in OPERATIONS_RUNBOOK.md.
WEB-PRIVACY-001AB — Contain Netlify release child diagnostics (#597)
daliu commentedon Aug 2, 2026
COMPLETE / CLOSED / CLAIM RELEASED
PR #597 was admin-squash-merged only after ordinary merge failed solely on the repository's one-approval rule, the user's standing maintainer instruction to self-review and merge, a hosted self-review GO, three independent exact-head GO reviews, and all five required hosted checks.
Exact identities:
Verification:
Delivery truth:
Officer impact: source-review clarity only. A backup officer can distinguish internal commit/tree values, discarded helper output, fixed parent failure, and outside-provider logging.
Officer documentation: docs/officers/PUBLISH_AND_CHECK.md; engineering boundary in OPERATIONS_RUNBOOK.md.
The assignee and status:in-progress label are being cleared. The remote work branch is absent, the local worktree is clean, and all four #596 path/hunk claims are RELEASED.