cleveragents/cleveragents-core

Fork 3

UAT: `SafetyProfile` missing `extra="forbid"` — extra YAML fields silently ignored, masking configuration errors #5633

New issue

Open

opened 2026-04-09 07:59:42 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-09 07:59:42 +00:00

Owner

Summary

SafetyProfile does not have extra="forbid" in its Pydantic model_config, while AutomationProfile correctly uses extra="forbid". This inconsistency means that typos or unknown fields in a SafetyProfile YAML configuration are silently ignored rather than raising a validation error.

What Was Tested

Code-level analysis of:

src/cleveragents/domain/models/core/safety_profile.py — SafetyProfile.model_config
src/cleveragents/domain/models/core/automation_profile.py — AutomationProfile.model_config

Expected Behavior

Both SafetyProfile and AutomationProfile should reject unknown fields with a clear validation error, since both are loaded from user-supplied YAML configuration files.

Actual Behavior

# safety_profile.py
model_config = ConfigDict(
    str_strip_whitespace=True,
    frozen=True,
    # Missing: extra="forbid"
)

# automation_profile.py
model_config = ConfigDict(
    str_strip_whitespace=True,
    validate_assignment=True,
    extra="forbid",  # Correctly rejects unknown fields
)

A user who writes:

safety:
  require_sandbox: true
  require_checkpoints: true
  allow_unsafe_toolz: false  # Typo: "toolz" instead of "tools"

Will get allow_unsafe_tools=False (the default) silently, with no error. The typo is invisible.

Impact

Configuration errors in SafetyProfile YAML are silently ignored
Users who mistype safety constraint field names get the default values instead of an error
This is particularly dangerous for security-critical fields like allow_unsafe_tools and require_sandbox

Code Location

src/cleveragents/domain/models/core/safety_profile.py — SafetyProfile.model_config (line 233)

Fix Required

Add extra="forbid" to SafetyProfile.model_config:

model_config = ConfigDict(
    str_strip_whitespace=True,
    frozen=True,
    extra="forbid",  # Add this
)

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Summary `SafetyProfile` does not have `extra="forbid"` in its Pydantic `model_config`, while `AutomationProfile` correctly uses `extra="forbid"`. This inconsistency means that typos or unknown fields in a `SafetyProfile` YAML configuration are silently ignored rather than raising a validation error. ## What Was Tested Code-level analysis of: - `src/cleveragents/domain/models/core/safety_profile.py` — `SafetyProfile.model_config` - `src/cleveragents/domain/models/core/automation_profile.py` — `AutomationProfile.model_config` ## Expected Behavior Both `SafetyProfile` and `AutomationProfile` should reject unknown fields with a clear validation error, since both are loaded from user-supplied YAML configuration files. ## Actual Behavior ```python # safety_profile.py model_config = ConfigDict( str_strip_whitespace=True, frozen=True, # Missing: extra="forbid" ) # automation_profile.py model_config = ConfigDict( str_strip_whitespace=True, validate_assignment=True, extra="forbid", # Correctly rejects unknown fields ) ``` A user who writes: ```yaml safety: require_sandbox: true require_checkpoints: true allow_unsafe_toolz: false # Typo: "toolz" instead of "tools" ``` Will get `allow_unsafe_tools=False` (the default) silently, with no error. The typo is invisible. ## Impact - Configuration errors in `SafetyProfile` YAML are silently ignored - Users who mistype safety constraint field names get the default values instead of an error - This is particularly dangerous for security-critical fields like `allow_unsafe_tools` and `require_sandbox` ## Code Location - `src/cleveragents/domain/models/core/safety_profile.py` — `SafetyProfile.model_config` (line 233) ## Fix Required Add `extra="forbid"` to `SafetyProfile.model_config`: ```python model_config = ConfigDict( str_strip_whitespace=True, frozen=True, extra="forbid", # Add this ) ``` --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 added the

labels

2026-04-09 08:00:12 +00:00

HAL9000 referenced this issue

2026-04-09 08:00:51 +00:00

[AUTO-WATCHDOG] System Health Report (Cycle 1) #5550

HAL9000 added

and removed

labels

2026-04-09 08:01:24 +00:00

HAL9000 referenced this issue

2026-04-09 08:01:58 +00:00

[AUTO-PROJ-OWN] Project Owner Report (Cycle 27) #5570

HAL9000 added this to the v3.5.0 milestone

2026-04-09 08:05:32 +00:00

HAL9000 commented

2026-04-09 08:07:20 +00:00

Author

Owner

Label compliance fix applied:

Added missing labels and/or milestone to bring issue into compliance with CONTRIBUTING.md

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: backlog-groomer

Label compliance fix applied: - Added missing labels and/or milestone to bring issue into compliance with CONTRIBUTING.md --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: backlog-groomer

HAL9000 added a new dependency

2026-04-09 08:16:54 +00:00

#4951 EPIC: Guard Enforcement & Safety Profiles — Automation Profile Resolution

HAL9000 referenced this issue

2026-04-09 08:20:03 +00:00

[AUTO-UAT-POOL] UAT Testing Report (Cycle 1) #5369

HAL9000 referenced this issue

2026-04-09 08:31:46 +00:00

[AUTO-EPIC] Epic Planning Health Report (Cycle 11) #5298

HAL9000 referenced this issue

2026-04-09 08:48:56 +00:00

[AUTO-ARCH] Architecture Review (Cycle 1) #5368