2026-10-14

2026-10-14

school-core README ecosystem update

  • Added an ## Ecosystem section to README.md covering: worst-day-ever-skill (8 dimensions / 6 safeguards), wde-mcp-server (SEP-2640 skill + tool + resources over rmcp; stdio + HTTP :3001/mcp), school-core-skills (16 skills, outer grill-me→vision→nose-up→to-prd→to-spec→to-tickets + inner Prime→Plan→Implement→Validate→Review→PR, install npx skills add branben/school-core-skills), and OmniRoute contributions.
  • Committed as a80d100 on working branch openhands-workspace-42FTExBqUGJehgGkuMQKzG.

Verifiable ecosystem facts (from GitHub API)

  • branben/OmniRoute fork of diegosouzapw/OmniRoute. Upstream merged PRs by branben: #2959 Notion MCP, #2958 enforceScopes guard, #3077 Obsidian MCP (24 tools), #9940 virtual admission lanes, #10322 process-wide budget, #10039 combo-lane awareness, #10575 GitHub skill tools discovery, #15498 PII IPv6 fix. Open: #15983 [defer] MCP v2 server sidecar (base release/v3.8.52).
  • school-core-skills layout: skills/{outer,inner,shared} — outer: grill-me, nose-up, spawn-whymage, to-prd, to-spec, to-tickets, vision; inner: chunked-writing, design-artifact, html-diagram, html-plan, html-prototype, html-wireframe, html, plannotator-guide, round-based-hook, think-tank; shared: implement. Credits live in the repo README (to-prd/to-spec/ to-tickets/grill-me from mattpocock; vision from kunchenguid; html* + plannotator-guide from plannotator).
  • wde-mcp-server: main branch, cargo bins wde-mcp-stdio + wde-mcp-http, tool name worst_day_ever_assess, skill root ./skills, HTTP 127.0.0.1:3001/mcp.

school-core audit findings (2026-10-14, read-only audit)

  • Test suite: python3 -m pytest -m "not live" → 2371 passed, 29 skipped (env-gated: macOS/Orca/opt-in), 16 deselected. README's "942 tests" claim is STALE. GIT_TERMINAL_PROMPT=0 GIT_ASKPASS=/bin/true needed — one test (test_issue_bridge.py::test_skips_already_processed) does a REAL network git clone and hangs on credential prompt.
  • PII: data/last_run.json on public main (HEAD af0c8d9) contains 51x /Users/brandonbennett (absolute trajectory paths). sanitize_data.py scrubs to ~ only in the school-loop board-publish checkpoint, not on main.
  • git ls-files includes .local/state/gh/device-id (a gh OAuth device ID, dead artifact, referenced nowhere) and .DS_Store x2.
  • codex-security.yml: scan runs --fail-on-severity medium + continue-on-error; the final "Check scan exit status" step ONLY echoes — never exits non-zero, so the red gate is decorative.
  • No ruff/mypy/black config; compileall clean. CONTRIBUTING says CI is "3.9 + 3.12" but ci.yml matrix is 3.9/3.11/3.12. No git tags, no CODEOWNERS, no issue/PR templates. Orphan scripts (no refs anywhere): patch_papers.py, regenerate_budgets.py, school_md_generator.py.
  • Badges: .github/animated-badge.svg referenced by README as src="/.github/animated-badge.svg" (repo-relative — renders only on GitHub, breaks on raw/self-hosted). .github/badge.svg is actually MARKDOWN with a badge.entire.rip link, not an SVG.
  • Env-gated skips are fine (darwin/Seatbelt, ORCA running, smolvm pack set, trailing data dir, entire CLI installed).

school-core audit remediation — completed (2026-10-14)

  • All 8/8 audit findings remediated + committed (3838b76, branch openhands-workspace-42FTExBqUGJehgGkuMQKzG). Full suite 2372 pass / 28 skip / 16 deselect.
  • ruff.toml added: F-class only, py39, excludes data/.beads/.openhands/school-output/scripts/prior_solutions. CI lint step lints issue_bridge/director/conductor/repo_reader + PR-changed .py (fetches base sha for diff). Note: ruff F401 flags a module-level import ALSO function-scope imported later (conductor.list_bookbags) — function-scope one wins (tests patch bookbag.list_bookbags).
  • bd gotchas: bd comment takes positional text not –message; bd close accepts multiple ids; bd writes root-level .beads.gate.lock → *.gate.lock added to .gitignore; chmod 700 .beads per recommendation.
  • Governance (ky1) partially done: CODEOWNERS + issue/feature templates + PR template; git tags deferred (don't tag unmerged branch).
  • Remaining open beads: 21l (OmniRoute admission lanes, pre-existing), ky1 (tags decision).
  • Utility scripts documented in README (regenerate_budgets/patch_papers/school_md_generator all work — audit's "orphaned" was a docs gap, not dead code). patch_papers.py edits tracked docs/site/leaderboard.html — don't run unless that diff is wanted.

codex-security CI gate — debugging journey (2026-10-14, PR #146)

  • Goal (audit bpx): make the scan gate actually fail on findings instead of being decorative/echo-only.
  • Three env constraints discovered, in order:
    1. --output-dir MUST be outside the scanned git worktree ("Scan artifacts cannot be written inside the protected scan root", exit 2). Was results/ → moved to ${{ runner.temp }}/codex-security-results.
    2. runner.temp is NOT available in workflow-level env — parse-fail signature is workflow run with 0 jobs, status=failure, created==updated same second. Resolve the path per-step instead.
    3. Output dir must be chmod 700 (private) — runner.temp dirs are created with broader perms.
    4. State dir (CODEX_SECURITY_STATE_DIR) ALSO must be outside the worktree — was github.workspace/.codex-security-state.
    5. ubuntu-latest (24.04) blocks codex's Bubblewrap sandbox: kernel.apparmor_restrict_unprivileged_userns=1 → "bwrap: loopback: Failed RTM_NEWADDR". MUST use ubuntu-22.04.
  • After all that: scan RUNS and authenticates, but fails with "Quota exceeded. Check your plan and billing details." — OpenAI billing on the OPENAI_API_KEY secret. The gate is real now; it's red for billing reasons, not code. PR #146 notes this for the maintainer.
  • Practical: to debug a GH Actions step failure, fetch the raw log via GET /repos/{o}/{r}/actions/jobs/{job_id}/logs (job id from the run's jobs endpoint). Watch for workflow "0 jobs" runs = YAML/parse error.
  • The scan check was ALWAYS red pre-fix too (quota/preflight) — no regression; the gate is now meaningful.

Later session: bot-findings triage for PR #146 (CI value question)

  • User asked "does the CI provide any value? review greptile findings". Audited CI config + Sourcery(9)/Greptile(4) inline comments.
  • 4 REAL bugs fixed (commit ab5ccb3, pushed) — all had silently disabled or gated CI:
    1. ci.yml lint: git fetch origin <sha> → FETCH_HEAD, not origin/; diff was empty → lint gate did nothing. Now diffs FETCH_HEAD.
    2. scripts/sanitize_data.py unsafe_text(): missed quoted JSON keys, repo-root paths, PEM keys. Now mirrors sanitize_file indicators + structured JSON/YAML walk (redacted/empty/null exempt). --verify passes on real data. 7 new regression tests in TestUnsafeTextGaps.
    3. recovery.py _beads_remote(): only parsed flat sync.remote:; .beads/config.yaml uses nested sync: block (my audit commit 3838b76 changed it). Now parses both. NOTE: git identity had to be set (openhands@all-hands.dev) in this container.
    4. tests/test_issue_bridge.py test_successful_bridge: real git clone on cold cache (no clone mock). Mocked clone_repo+cleanup.
  • 2 robustness hardening: codex-security gate fails loudly on unexpected findings.json shape (was ?? [] → green-light); scan job skips fork PRs (github.event.pull_request.head.repo.fork != true) since forks can't get OPENAI_API_KEY.
  • 22 pre-existing dead imports/vars cleaned from tests/test_issue_bridge.py (now that ruff actually lints changed files) + removed import tempfile (recovery.py) and unused _archival_context (test_sanitize_data.py).
  • Full suite 2379 passed / 44 skipped; scan gate still red = OpenAI billing quota (maintainer action), not workflow defect.
  • PR comment posted: https://github.com/branben/school-core/pull/146#issuecomment-6174834367
Built with LogoFlowershow