cleveragents/cleveragents-core

Fork 3

[Bug Hunt][Cycle 2][Config] Project scope validation bypass in configuration resolution #7155

New issue

Open

opened 2026-04-10 08:16:00 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-10 08:16:00 +00:00

Owner

Metadata

Branch: fix/bug-hunt-cycle2/config-project-scope-validation-bypass
Commit Message: fix(config): enforce project_scopable validation in ConfigService.resolve() method
Milestone: None (Backlog)
Parent Epic: #5502

Backlog note: This issue was discovered during autonomous operation
on milestone v3.2.0. It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.

Background

The configuration resolution chain in ConfigService.resolve() does not validate that project-scoped configuration values are actually project-scopable, while the setter methods (set_project_value()) do perform this validation. This creates an inconsistency between reading and writing project configs: a developer can never write a non-scopable key to a project config via the API, but if such a key exists in a project config file on disk (e.g., manually edited or migrated), it will be silently consumed by resolve() without any warning or rejection.

This violates the project's fail-fast and no-silent-failures principles (CONTRIBUTING.md §Error and Exception Handling).

Current Behavior

set_project_value() correctly validates project scope:

if not entry.project_scopable:
    msg = f"Key '{key}' is not project-scopable."
    raise ValueError(msg)

But resolve() (lines 1542–1575) reads and uses project config values without checking the project_scopable flag:

proj_file_data = self.read_project_config()
project_val = proj_file_data.get(key)  # No project_scopable validation

A project config file containing core.data-dir = "/tmp" (which is not project-scopable) would be silently used instead of being rejected or warned about.

Expected Behavior

All configuration resolution must respect the project_scopable flag consistently. When resolve() reads a value from a project config file, it must check whether the corresponding registry entry is project-scopable. If it is not, the value must be ignored (with a warning logged) rather than silently applied.

Suggested fix in resolve():

if project_val is not None and not entry.project_scopable:
    # Log warning and ignore the value — do not silently apply non-scopable keys
    logger.warning(
        "Key '%s' is not project-scopable; ignoring value from project config file.", key
    )
    project_val = None

Acceptance Criteria

ConfigService.resolve() checks entry.project_scopable before using any value read from a project config file
Non-scopable keys present in project config files are ignored (not applied) with a warning logged
set_project_value() behaviour is unchanged
The fix is consistent with the existing validation in set_project_value()
BDD scenarios cover the case where a non-scopable key exists in a project config file and is correctly ignored during resolution
All nox stages pass
Coverage ≥ 97%

Subtasks

Audit ConfigService.resolve() (lines 1442–1615) to identify all locations where project config values are consumed without project_scopable validation
Add project_scopable guard in resolve() before applying project config values, with a warning log for ignored keys
Write a failing TDD test (@tdd_expected_fail) that places a non-scopable key in a project config file and asserts it is ignored during resolution
Update BDD feature files and step definitions to cover the new validation behaviour
Update docstrings on resolve() to document the project scope validation
Remove @tdd_expected_fail tag once the fix is in place and the test passes
Ensure all nox stages pass

Definition of Done

ConfigService.resolve() never silently applies non-project-scopable keys from project config files
A warning is logged when a non-scopable key is found in a project config file during resolution
BDD scenarios explicitly cover the inconsistency case (non-scopable key in project file → ignored by resolve)
All nox stages pass
Coverage >= 97%

TDD Note

After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_<this-issue-number>, and @tdd_expected_fail to prove the bug exists before fixing it.

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: new-issue-creator

## Metadata - **Branch**: `fix/bug-hunt-cycle2/config-project-scope-validation-bypass` - **Commit Message**: `fix(config): enforce project_scopable validation in ConfigService.resolve() method` - **Milestone**: None (Backlog) - **Parent Epic**: #5502 > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.2.0. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. ## Background The configuration resolution chain in `ConfigService.resolve()` does not validate that project-scoped configuration values are actually project-scopable, while the setter methods (`set_project_value()`) do perform this validation. This creates an inconsistency between reading and writing project configs: a developer can never *write* a non-scopable key to a project config via the API, but if such a key exists in a project config file on disk (e.g., manually edited or migrated), it will be silently consumed by `resolve()` without any warning or rejection. This violates the project's fail-fast and no-silent-failures principles (CONTRIBUTING.md §Error and Exception Handling). ## Current Behavior `set_project_value()` correctly validates project scope: ```python if not entry.project_scopable: msg = f"Key '{key}' is not project-scopable." raise ValueError(msg) ``` But `resolve()` (lines 1542–1575) reads and uses project config values without checking the `project_scopable` flag: ```python proj_file_data = self.read_project_config() project_val = proj_file_data.get(key) # No project_scopable validation ``` A project config file containing `core.data-dir = "/tmp"` (which is not project-scopable) would be silently used instead of being rejected or warned about. ## Expected Behavior All configuration resolution must respect the `project_scopable` flag consistently. When `resolve()` reads a value from a project config file, it must check whether the corresponding registry entry is project-scopable. If it is not, the value must be ignored (with a warning logged) rather than silently applied. Suggested fix in `resolve()`: ```python if project_val is not None and not entry.project_scopable: # Log warning and ignore the value — do not silently apply non-scopable keys logger.warning( "Key '%s' is not project-scopable; ignoring value from project config file.", key ) project_val = None ``` ## Acceptance Criteria - [ ] `ConfigService.resolve()` checks `entry.project_scopable` before using any value read from a project config file - [ ] Non-scopable keys present in project config files are ignored (not applied) with a warning logged - [ ] `set_project_value()` behaviour is unchanged - [ ] The fix is consistent with the existing validation in `set_project_value()` - [ ] BDD scenarios cover the case where a non-scopable key exists in a project config file and is correctly ignored during resolution - [ ] All nox stages pass - [ ] Coverage ≥ 97% ## Subtasks - [ ] Audit `ConfigService.resolve()` (lines 1442–1615) to identify all locations where project config values are consumed without `project_scopable` validation - [ ] Add `project_scopable` guard in `resolve()` before applying project config values, with a warning log for ignored keys - [ ] Write a failing TDD test (`@tdd_expected_fail`) that places a non-scopable key in a project config file and asserts it is ignored during resolution - [ ] Update BDD feature files and step definitions to cover the new validation behaviour - [ ] Update docstrings on `resolve()` to document the project scope validation - [ ] Remove `@tdd_expected_fail` tag once the fix is in place and the test passes - [ ] Ensure all nox stages pass ## Definition of Done - [ ] `ConfigService.resolve()` never silently applies non-project-scopable keys from project config files - [ ] A warning is logged when a non-scopable key is found in a project config file during resolution - [ ] BDD scenarios explicitly cover the inconsistency case (non-scopable key in project file → ignored by resolve) - [ ] All nox stages pass - [ ] Coverage >= 97% ### TDD Note After this bug issue is verified, a corresponding `Type/Testing` issue will be created for TDD. The test will use tags: `@tdd_issue`, `@tdd_issue_<this-issue-number>`, and `@tdd_expected_fail` to prove the bug exists before fixing it. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: new-issue-creator

HAL9000 added a new dependency

2026-04-10 08:16:10 +00:00

#5502 EPIC: Actor Execution & Configuration — GRAPH Actor, Config Schema & CLI Compliance (v3.5.0)

HAL9000 added the

State

Unverified

label

2026-04-10 08:18:01 +00:00

HAL9000 referenced this issue

2026-04-10 08:37:30 +00:00

[AUTO-BUG-POOL] Bug Hunt Worker 10 Summary Report #7183

freemo added the

labels

2026-04-12 18:36:44 +00:00

HAL9000 added

and removed

labels

2026-04-14 06:49:01 +00:00

HAL9000 commented

2026-04-14 06:49:01 +00:00

Author

Owner

✅ Verified — Bug: project scope validation bypass in configuration resolution. MoSCoW: Should-have. Priority: Medium.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — Bug: project scope validation bypass in configuration resolution. MoSCoW: Should-have. Priority: Medium. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor