docs: Define trusted-computer boundary - #59
Open
BenWestgate wants to merge 1 commit into
Open
BenWestgate wants to merge 1 commit into
BenWestgate wants to merge 1 commit into
Conversation
Make the secret-output invariant literal about intentional recovery/export output, define the trusted-computer boundary consistently, and warn that shell command text can be retained even when stdin is safe from argv exposure. Update the shared CLI safety footer and its exact-help regression. Validation: focused help regression; Ruff check/format; strict mypy for the parser; git diff --check. The full generic-HRP module still reaches the pre-existing bip32 test dependency tracked by #3/#6 and fixed by #7. fixes #4
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
BenWestgate
added
area: cli
BenWestgate
commented
Sep 25, 2026
BenWestgate
left a comment
BenWestgate
left a comment
Owner
Author
There was a problem hiding this comment.
AI-generated review (Claude), posted at the maintainer's request.
ACK b06aedb, nits only.
- Invariant 6 now matches what
create/secret/share/correct/xprvactually do. - Nit: the trusted-computer definition is written out three times (SECURITY.md, model.md, guide.md). Consider one definition in model.md and links elsewhere so they can't drift.
| "Enter it when prompted. Some commands also accept piped input.", | ||
| epilog="Never put a secret or share in command arguments or shell command text.\n" | ||
| "Enter it when prompted; some commands also accept redirected standard input.\n" | ||
| "Protect redirected sources separately: shells, terminals, and wrappers may retain text.", |
Owner
Author
There was a problem hiding this comment.
Nit: this renders at 87 columns, the only --help line over 80; the guide assumes an 80-column terminal. The reason clause also describes shell command text more than redirected sources. Maybe: "Protect redirected files; shells and terminals may keep text."
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Why
The current invariant literally says secrets stay out of ordinary output even though
create,secret,share,correct, andxprvintentionally display secret-bearing material. The documentation also uses “trusted computer” without one operational definition. This makes the normative contract literal without changing any secret-handling channel.Validation
tests/test_generic_hrp.py::test_cli_split_and_unknown_neutral_summary— pass_cli_parser.py— passgit diff --check— passThe full
test_generic_hrp.pymodule still reaches the pre-existingbip32test-oracle dependency missing from.[dev]; that base defect is #3/#6 and is fixed by #7. No assertion was weakened or skipped here.Fixes #4.
Disclosure: AI tools were used while implementing and checking this user-requested branch-to-branch contribution.