chore: feat(healthcheck): ping the heartbeat before each `security_gate` call, capping tick silence at ~30m instead of ~55m #362

Merged

joshtronic merged 1 commit from agent/360-feat-healthcheck-heartbeat-before-the-security into master

2026-07-06 20:25:55 +00:00

igor commented

2026-07-06 20:22:06 +00:00

Collaborator

What this PR does

feat(healthcheck): ping the heartbeat before each security_gate call, capping tick silence at ~30m instead of ~55m
Add hc_ping heartbeat immediately before the tier-1 issue-flow security gate (bin/tick.sh, security-gate-issue)
Add hc_ping heartbeat immediately before the PR-review security gate (bin/tick.sh, security-gate-pr-review)
Add bin/test-heartbeat-before-security-gate.sh, a source-assertion (grep-based, in the spirit of check-sync.sh) that fails if a future edit adds/moves a security_gate call site without a preceding heartbeat

Test plan

make test passes, including the new source-assertion test
make lint (shellcheck + markdownlint) passes clean
/security-review run on the diff: no findings (the change only adds a hardcoded-argument hc_ping heartbeat call plus comments; no new input paths or attack surface)

Closes #360

## What this PR does - [x] feat(healthcheck): ping the heartbeat before each `security_gate` call, capping tick silence at ~30m instead of ~55m - [x] Add `hc_ping heartbeat` immediately before the tier-1 issue-flow security gate (`bin/tick.sh`, `security-gate-issue`) - [x] Add `hc_ping heartbeat` immediately before the PR-review security gate (`bin/tick.sh`, `security-gate-pr-review`) - [x] Add `bin/test-heartbeat-before-security-gate.sh`, a source-assertion (grep-based, in the spirit of `check-sync.sh`) that fails if a future edit adds/moves a `security_gate` call site without a preceding heartbeat ## Test plan - [x] `make test` passes, including the new source-assertion test - [x] `make lint` (shellcheck + markdownlint) passes clean - [x] `/security-review` run on the diff: no findings (the change only adds a hardcoded-argument `hc_ping heartbeat` call plus comments; no new input paths or attack surface) Closes #360

igor added 1 commit

2026-07-06 20:22:06 +00:00

chore: feat(healthcheck): ping the heartbeat before each security_gate call, capping tick silence at ~30m instead of ~55m

Lint / check-sync (pull_request) Successful in 5s

Details

Lint / check-sync (push) Successful in 5s

Details

6362b9b714

igor commented

2026-07-06 20:24:36 +00:00

Author

Collaborator

🤖 Review — `APPROVE` (automated)

CI for 6362b9b7: success

Small, focused change: adds hc_ping heartbeat immediately before each of the two security_gate call sites in bin/tick.sh, plus a grep-based source-assertion test enforcing that invariant. CI is green.

Verification against the checklist (all honest):

The two hc_ping heartbeat insertions are present in the diff, one before security-gate-pr-review (line ~3588) and one before security-gate-issue (line ~4308). ✓
bin/test-heartbeat-before-security-gate.sh is added and does what the description says: greps security_gate " call sites and asserts an hc_ping heartbeat within the preceding LOOKBACK=8 lines. ✓

Correctness of the new test:

The grep pattern security_gate " matches call sites (which pass a quoted worktree arg) but not the function definition (security_gate() {), so it won't self-trip on the def.
Both real call sites sit 2 lines below the new hc_ping heartbeat (one intervening comment), comfortably inside the 8-line window. ✓
Guards for the empty-match case (no security_gate call sites found) and clamps start to line 1. ✓
set -uo pipefail (not -e) is appropriate here since it accumulates failures and exits explicitly.

Scope/safety: ~51 new lines + 12 in tick.sh, well under the size bar, no unrelated changes. hc_ping heartbeat takes only a hardcoded argument — no new input path or attack surface, consistent with the "security-review: no findings" claim.

Minor notes (non-blocking):

The test only asserts a heartbeat precedes each gate, not that it's the closest preceding model-affecting call — a future edit inserting another long call between the heartbeat and the gate would slip through. Acceptable for the stated intent (catch a moved/added gate that drops the heartbeat entirely).
Nothing verifies the heartbeat is actually reached at runtime (source-assertion only), but that's explicitly the design, in the spirit of check-sync.sh.

No blocking issues. Correct, in scope, honestly described, CI success.

_{Independent review by the harness on claude-opus-4-8 (effort: high). The human reviewer is requested once Igor has reviewed; a human still merges.}

### 🤖 Review — `APPROVE` _(automated)_ CI for `6362b9b7`: **success** Small, focused change: adds `hc_ping heartbeat` immediately before each of the two `security_gate` call sites in `bin/tick.sh`, plus a grep-based source-assertion test enforcing that invariant. CI is green. **Verification against the checklist (all honest):** - The two `hc_ping heartbeat` insertions are present in the diff, one before `security-gate-pr-review` (line ~3588) and one before `security-gate-issue` (line ~4308). ✓ - `bin/test-heartbeat-before-security-gate.sh` is added and does what the description says: greps `security_gate "` call sites and asserts an `hc_ping heartbeat` within the preceding `LOOKBACK=8` lines. ✓ **Correctness of the new test:** - The grep pattern `security_gate "` matches call sites (which pass a quoted worktree arg) but not the function definition (`security_gate() {`), so it won't self-trip on the def. - Both real call sites sit 2 lines below the new `hc_ping heartbeat` (one intervening comment), comfortably inside the 8-line window. ✓ - Guards for the empty-match case (`no security_gate call sites found`) and clamps `start` to line 1. ✓ - `set -uo pipefail` (not `-e`) is appropriate here since it accumulates failures and exits explicitly. **Scope/safety:** ~51 new lines + 12 in `tick.sh`, well under the size bar, no unrelated changes. `hc_ping heartbeat` takes only a hardcoded argument — no new input path or attack surface, consistent with the "security-review: no findings" claim. **Minor notes (non-blocking):** - The test only asserts a heartbeat *precedes* each gate, not that it's the *closest* preceding model-affecting call — a future edit inserting another long call between the heartbeat and the gate would slip through. Acceptable for the stated intent (catch a moved/added gate that drops the heartbeat entirely). - Nothing verifies the heartbeat is actually reached at runtime (source-assertion only), but that's explicitly the design, in the spirit of `check-sync.sh`. No blocking issues. Correct, in scope, honestly described, CI success. --- <sub>Independent review by the harness on `claude-opus-4-8` (effort: high). The human reviewer is requested once Igor has reviewed; a human still merges.</sub>

igor added spent time

2026-07-06 20:24:36 +00:00

32 seconds

igor requested review from joshtronic

2026-07-06 20:24:37 +00:00