agents: strip leftover stash markers in SOW audit script and template (#22388)
agents: sync SOW audit script and template from canonical bootstrap-sow Removes leftover `<<<<<<< Updated upstream` / `>>>>>>> Stashed changes` markers that landed in PR #22386 in `.agents/sow/audit.sh` and `.agents/sow/SOW.template.md`, by re-syncing both files from the canonical sources under `~/.agents/skills/bootstrap-sow/`.
Costa Tsaousis committed
May 2, 2026 at 23:46 UTC
355706cb02e45e95b8e8bf4fc374b8a71afadebf
2 files changed
+60
-26
.agents/sow/SOW.template.md
+15
-3
@@ -62,6 +62,7 @@ Problem / root-cause model:
62
Evidence reviewed:
63
64
- <Specs, code, docs, tests, logs, traces, prior SOWs, issues, external references.>
65
+- <For mirrored open-source repositories: cite `owner/repo @ commit` and repository-relative paths; never paste `/opt/baddisk/monitoring/repos/...` absolute paths.>
66
67
Affected contracts and surfaces:
68
@@ -75,13 +76,10 @@ Risk and blast radius:
76
77
- <Regression, compatibility, performance, security, data loss, migration, rollout, and operational risks.>
78
78
-<<<<<<< Updated upstream
79
-=======
79
Sensitive data handling plan:
80
81
- <Whether the work may expose secrets, credentials, bearer tokens, SNMP communities, community/customer data, personal data, non-private customer-identifying IPs, private endpoints, or proprietary incident details; how evidence will be redacted in SOWs, specs, docs, skills, instructions, and code comments.>
82
84
->>>>>>> Stashed changes
83
Implementation plan:
84
85
1. <Ordered chunk with scope, dependencies, and likely files/modules.>
@@ -100,6 +98,10 @@ Artifact impact plan:
98
- End-user/operator skills: <expected update or reason likely unaffected>
99
- SOW lifecycle: <split/merge/status/follow-up/regression handling>
100
101
+Open-source reference evidence:
102
+
103
+- <If local mirrored repositories under `/opt/baddisk/monitoring/repos/` were checked, list each as `owner/repo @ commit` plus repository-relative paths. If none were checked, record why external OSS references were not relevant.>
104
+
105
Open decisions:
106
107
- <Resolved decision, or numbered options that block implementation until the user decides.>
@@ -141,6 +143,10 @@ Same-failure scan:
143
144
- <search and result>
145
146
+Sensitive data gate:
147
+
148
+- <Confirm durable artifacts contain no raw secrets, credentials, bearer tokens, SNMP communities, community member names, customer names, personal data, non-private customer-identifying IPs, private endpoints, or proprietary incident details; note redactions used.>
149
+
150
Artifact maintenance gate:
151
152
- AGENTS.md: <updated path or evidence-backed reason no update was needed>
@@ -185,3 +191,9 @@ Pending.
191
## Followup
192
193
None yet.
194
+
195
+## Regression Log
196
+
197
+None yet.
198
+
199
+Append regression entries here only after this SOW was completed or closed and later testing or use found broken behavior. Use a dated `## Regression - YYYY-MM-DD` heading at the end of the file. Never prepend regression content above the original SOW narrative.
.agents/sow/audit.sh
+45
-23
@@ -66,8 +66,6 @@ read_sow_status() {
66
' "$1" 2>/dev/null
67
}
68
69
-<<<<<<< Updated upstream
70
-=======
69
sensitive_scan_files() {
70
[ -f ./AGENTS.md ] && printf '%s\n' ./AGENTS.md
71
[ -f ./AGENTS.md.pre-sow.bak ] && printf '%s\n' ./AGENTS.md.pre-sow.bak
@@ -160,7 +158,6 @@ scan_sensitive_file() {
158
' "$file" 2>/dev/null
159
}
160
163
->>>>>>> Stashed changes
161
# --- Marker check ---
162
echo "${BLUE}-- initialization marker --${NC}"
163
if [ -f ./AGENTS.md ]; then
@@ -184,18 +181,18 @@ required_sections=(
181
"## SOW System"
182
"### Roles"
183
"### Git Worktrees"
184
+ "### Sensitive Data In Durable Artifacts"
185
+ "### Open-Source Reference Evidence"
186
"### Pre-Implementation Gate"
188
-<<<<<<< Updated upstream
189
-=======
187
"### SOW Completion And Commit"
188
"### Regressions"
192
->>>>>>> Stashed changes
189
"### Project Skills"
190
"### Specs"
191
"### Project-specific overrides"
192
)
193
sections_ok=0
194
sections_missing=0
195
+sensitive_warning_missing=0
196
if [ -f ./AGENTS.md ]; then
197
for s in "${required_sections[@]}"; do
198
if grep -qF "$s" ./AGENTS.md 2>/dev/null; then
@@ -206,11 +203,39 @@ if [ -f ./AGENTS.md ]; then
203
sections_missing=$((sections_missing + 1))
204
fi
205
done
206
+ if grep -qF "CRITICAL: Never write raw sensitive data to durable artifacts." ./AGENTS.md 2>/dev/null; then
207
+ echo " ${GREEN}OK${NC} CRITICAL sensitive-data warning"
208
+ else
209
+ echo " ${RED}--${NC} CRITICAL sensitive-data warning (missing)"
210
+ sensitive_warning_missing=1
211
+ fi
212
else
213
echo " ${GRAY}(AGENTS.md not present; skipping section check)${NC}"
214
fi
215
echo
216
217
+# --- All AGENTS.md sensitive-data warnings ---
218
+echo "${BLUE}-- all AGENTS.md sensitive-data warnings --${NC}"
219
+agents_warning_missing=0
220
+agents_warning_checked=0
221
+while IFS= read -r f; do
222
+ [ -z "$f" ] && continue
223
+ if git rev-parse --is-inside-work-tree >/dev/null 2>&1 && git check-ignore -q "$f" 2>/dev/null; then
224
+ continue
225
+ fi
226
+ agents_warning_checked=$((agents_warning_checked + 1))
227
+ if grep -qF "CRITICAL: Never write raw sensitive data to durable artifacts." "$f" 2>/dev/null; then
228
+ echo " ${GREEN}OK${NC} $f"
229
+ else
230
+ echo " ${RED}--${NC} $f (missing CRITICAL sensitive-data warning)"
231
+ agents_warning_missing=$((agents_warning_missing + 1))
232
+ fi
233
+done < <(find . -path ./.git -prune -o -name AGENTS.md -type f -print 2>/dev/null | sort)
234
+if [ "$agents_warning_checked" -eq 0 ]; then
235
+ echo " ${GRAY}(no AGENTS.md files found)${NC}"
236
+fi
237
+echo
238
+
239
# --- Cross-tool instruction bridges ---
240
echo "${BLUE}-- cross-tool instruction bridges --${NC}"
241
bridge_missing=0
@@ -278,8 +303,6 @@ if [ -f ".agents/sow/SOW.template.md" ]; then
303
echo " ${RED}--${NC} template missing ## Pre-Implementation Gate"
304
sow_template_pre_impl_missing=1
305
fi
281
-<<<<<<< Updated upstream
282
-=======
306
if grep -q "^Sensitive data handling plan:$" ".agents/sow/SOW.template.md" 2>/dev/null && grep -q "^Sensitive data gate:$" ".agents/sow/SOW.template.md" 2>/dev/null; then
307
echo " ${GREEN}OK${NC} template includes sensitive data gates"
308
sow_template_sensitive_gate_missing=0
@@ -301,17 +324,13 @@ if [ -f ".agents/sow/SOW.template.md" ]; then
324
echo " ${RED}--${NC} template missing completed-status or one-commit close rule"
325
sow_template_completion_rule_missing=1
326
fi
304
->>>>>>> Stashed changes
327
else
328
echo " ${RED}--${NC} .agents/sow/SOW.template.md (missing)"
329
framework_missing=$((framework_missing + 1))
330
sow_template_pre_impl_missing=1
309
-<<<<<<< Updated upstream
310
-=======
331
sow_template_sensitive_gate_missing=1
332
sow_template_open_source_reference_missing=1
333
sow_template_completion_rule_missing=1
314
->>>>>>> Stashed changes
334
fi
335
if [ -f ".agents/sow/audit.sh" ]; then
336
echo " ${GREEN}OK${NC} .agents/sow/audit.sh"
@@ -381,6 +400,7 @@ echo
400
echo "${BLUE}-- current SOW pre-implementation gates --${NC}"
401
current_sow_pre_impl_missing=0
402
current_sow_pre_impl_checked=0
403
+current_sow_sensitive_gate_missing=0
404
if [ -d ".agents/sow/current" ]; then
405
while IFS= read -r f; do
406
[ -z "$f" ] && continue
@@ -391,6 +411,10 @@ if [ -d ".agents/sow/current" ]; then
411
echo " ${RED}--${NC} $f (missing ## Pre-Implementation Gate before implementation continues)"
412
current_sow_pre_impl_missing=$((current_sow_pre_impl_missing + 1))
413
fi
414
+ if ! grep -q "^Sensitive data handling plan:$" "$f" 2>/dev/null || ! grep -q "^Sensitive data gate:$" "$f" 2>/dev/null; then
415
+ echo " ${RED}--${NC} missing sensitive data handling plan or validation gate"
416
+ current_sow_sensitive_gate_missing=$((current_sow_sensitive_gate_missing + 1))
417
+ fi
418
done < <(find ".agents/sow/current" -mindepth 1 -maxdepth 1 -name 'SOW-*.md' -type f 2>/dev/null | sort)
419
fi
420
if [ "$current_sow_pre_impl_checked" -eq 0 ]; then
@@ -398,8 +422,6 @@ if [ "$current_sow_pre_impl_checked" -eq 0 ]; then
422
fi
423
echo
424
401
-<<<<<<< Updated upstream
402
-=======
425
# --- Regression section placement ---
426
echo "${BLUE}-- regression section placement --${NC}"
427
regression_order_violations=0
@@ -488,7 +510,6 @@ else
510
fi
511
echo
512
491
->>>>>>> Stashed changes
513
# --- Project skills ---
514
echo "${BLUE}-- runtime project skills --${NC}"
515
project_skills_ok=0
@@ -604,18 +625,20 @@ skill_classification_warnings=${non_project_skills_unclassified:-0}
625
626
sow_status_errors=$((sow_status_mismatch + sow_status_missing))
627
pre_impl_errors=$((sow_template_pre_impl_missing + current_sow_pre_impl_missing))
607
-<<<<<<< Updated upstream
608
-=======
628
sensitive_gate_errors=$((sow_template_sensitive_gate_missing + current_sow_sensitive_gate_missing + sensitive_findings))
629
open_source_reference_errors=${sow_template_open_source_reference_missing:-0}
630
completion_rule_errors=${sow_template_completion_rule_missing:-0}
631
sow_evidence_errors=$((regression_order_violations + mirror_path_violations + open_source_reference_errors + completion_rule_errors))
613
->>>>>>> Stashed changes
632
615
-if $initialized && [ "$sections_missing" -eq 0 ] && [ "$bridge_missing" -eq 0 ] && [ "$sow_dir_missing" -eq 0 ] && [ "$empty_sow_dir_missing_keep" -eq 0 ] && [ "$framework_missing" -eq 0 ] && [ "$sow_status_errors" -eq 0 ] && [ "$pre_impl_errors" -eq 0 ] && [ "$todo_untracked_count" -eq 0 ] && [ "$skill_classification_warnings" -eq 0 ]; then
633
+if [ "$sensitive_findings" -gt 0 ]; then
634
+ echo " ${RED}=== CRITICAL: sensitive data patterns found in durable artifacts. Redact before commit. ===${NC}"
635
+ exit 2
636
+fi
637
+
638
+if $initialized && [ "$sections_missing" -eq 0 ] && [ "$sensitive_warning_missing" -eq 0 ] && [ "$agents_warning_missing" -eq 0 ] && [ "$bridge_missing" -eq 0 ] && [ "$sow_dir_missing" -eq 0 ] && [ "$empty_sow_dir_missing_keep" -eq 0 ] && [ "$framework_missing" -eq 0 ] && [ "$sow_status_errors" -eq 0 ] && [ "$pre_impl_errors" -eq 0 ] && [ "$sensitive_gate_errors" -eq 0 ] && [ "$sow_evidence_errors" -eq 0 ] && [ "$todo_untracked_count" -eq 0 ] && [ "$skill_classification_warnings" -eq 0 ]; then
639
echo " ${GREEN}=== SOW initialization complete and clean. ===${NC}"
640
exit 0
618
-elif $initialized && [ "$sections_missing" -eq 0 ] && [ "$bridge_missing" -eq 0 ] && [ "$sow_dir_missing" -eq 0 ] && [ "$empty_sow_dir_missing_keep" -eq 0 ] && [ "$framework_missing" -eq 0 ] && [ "$sow_status_errors" -eq 0 ] && [ "$pre_impl_errors" -eq 0 ] && [ "$todo_untracked_count" -eq 0 ]; then
641
+elif $initialized && [ "$sections_missing" -eq 0 ] && [ "$sensitive_warning_missing" -eq 0 ] && [ "$agents_warning_missing" -eq 0 ] && [ "$bridge_missing" -eq 0 ] && [ "$sow_dir_missing" -eq 0 ] && [ "$empty_sow_dir_missing_keep" -eq 0 ] && [ "$framework_missing" -eq 0 ] && [ "$sow_status_errors" -eq 0 ] && [ "$pre_impl_errors" -eq 0 ] && [ "$sensitive_gate_errors" -eq 0 ] && [ "$sow_evidence_errors" -eq 0 ] && [ "$todo_untracked_count" -eq 0 ]; then
642
echo " ${YELLOW}=== SOW initialization structurally complete with skill classification warning(s):${NC}"
643
echo " ${YELLOW}- ${skill_classification_warnings} non-project skill director(y/ies) need classification in AGENTS.md${NC}"
644
echo " ${YELLOW}- Runtime input skills should be renamed/wrapped as .agents/skills/project-*/${NC}"
@@ -624,6 +647,8 @@ elif $initialized && [ "$sections_missing" -eq 0 ] && [ "$bridge_missing" -eq 0
647
elif $initialized; then
648
echo " ${YELLOW}=== SOW marker present but partial state detected:${NC}"
649
[ "$sections_missing" -gt 0 ] && echo " ${YELLOW}- ${sections_missing} canonical AGENTS.md section(s) missing${NC}"
650
+ [ "$sensitive_warning_missing" -gt 0 ] && echo " ${YELLOW}- CRITICAL sensitive-data warning missing from AGENTS.md${NC}"
651
+ [ "$agents_warning_missing" -gt 0 ] && echo " ${YELLOW}- ${agents_warning_missing} AGENTS.md file(s) missing CRITICAL sensitive-data warning${NC}"
652
[ "$bridge_missing" -gt 0 ] && echo " ${YELLOW}- ${bridge_missing} cross-tool instruction bridge(s) missing${NC}"
653
[ "$sow_dir_missing" -gt 0 ] && echo " ${YELLOW}- ${sow_dir_missing} SOW directory(ies) missing${NC}"
654
[ "$empty_sow_dir_missing_keep" -gt 0 ] && echo " ${YELLOW}- ${empty_sow_dir_missing_keep} empty SOW directory(ies) missing .gitkeep/.keep${NC}"
@@ -632,8 +657,6 @@ elif $initialized; then
657
[ "$sow_status_missing" -gt 0 ] && echo " ${YELLOW}- ${sow_status_missing} SOW file(s) missing Status line${NC}"
658
[ "$sow_template_pre_impl_missing" -gt 0 ] && echo " ${YELLOW}- project-local SOW template missing Pre-Implementation Gate${NC}"
659
[ "$current_sow_pre_impl_missing" -gt 0 ] && echo " ${YELLOW}- ${current_sow_pre_impl_missing} current SOW(s) missing Pre-Implementation Gate${NC}"
635
-<<<<<<< Updated upstream
636
-=======
660
[ "$sow_template_sensitive_gate_missing" -gt 0 ] && echo " ${YELLOW}- project-local SOW template missing sensitive data gates${NC}"
661
[ "$current_sow_sensitive_gate_missing" -gt 0 ] && echo " ${YELLOW}- ${current_sow_sensitive_gate_missing} current SOW(s) missing sensitive data handling/gate${NC}"
662
[ "$sensitive_findings" -gt 0 ] && echo " ${YELLOW}- ${sensitive_findings} sensitive-data finding(s) in durable artifacts${NC}"
@@ -641,7 +664,6 @@ elif $initialized; then
664
[ "${sow_template_completion_rule_missing:-0}" -gt 0 ] && echo " ${YELLOW}- project-local SOW template missing completed-status or one-commit close rule${NC}"
665
[ "$regression_order_violations" -gt 0 ] && echo " ${YELLOW}- ${regression_order_violations} SOW file(s) have regression sections before original outcome/lessons/follow-up${NC}"
666
[ "$mirror_path_violations" -gt 0 ] && echo " ${YELLOW}- ${mirror_path_violations} SOW file(s) use /opt/baddisk/monitoring/repos absolute paths instead of owner/repo @ commit citations${NC}"
644
->>>>>>> Stashed changes
667
[ "$todo_untracked_count" -gt 0 ] && echo " ${YELLOW}- ${todo_untracked_count} untracked orphan TODO file(s) at project root${NC}"
668
[ "$skill_classification_warnings" -gt 0 ] && echo " ${YELLOW}- ${skill_classification_warnings} non-project skill director(y/ies) need classification${NC}"
669
echo " ${YELLOW} Repair non-destructively using the project-local AGENTS.md and .agents/sow/SOW.template.md.${NC}"