Pular para conteúdo

AUR-449 — aurumcode review --seguranca: the deterministic pass runs without a provider

Documento histórico do board. Pode descrever componentes removidos; para uso atual, consulte o guia do produto.

Command

aurumcode review --base <ref> [--fail-on <level>] [--modelo <nome>] [--seguranca]

Same command AUR-435/AUR-442 published. This card does not add a flag or change the output shape of any path that already had a provider; it removes an artificial requirement from exactly one path: --seguranca alone, with no provider configured at all.

The measured defect (2026-08-14 re-test)

aurumcode review --base HEAD~1 --seguranca with no AURUMCODE_LLM_FIXTURE and no LLM_API_KEY/LLM_BASE_URL exits 1 with no LLM provider configured — before the security pass ever runs. But that pass (internal/review.SecurityScan, restored by AUR-442) is a deterministic regex matcher over the diff's ADDED lines: it never calls a model. Requiring a provider for it was a barrier the pass's own implementation does not need — the product's only free, offline, deterministic path was locked behind the one thing that needs a credential.

The decision

When all three of the following hold, aurumcode review --base <ref> --seguranca now runs the security pass alone and reports its findings, instead of refusing outright:

  1. --seguranca was given.
  2. --modelo was not given. An explicit model choice is a specific request; the caller who makes it must still be told loudly when it cannot be served (reportModelUnavailable, unchanged — see docs/specs/AUR-436.md). Composing --modelo with --seguranca and no provider that serves the model is untouched: exit 1, the AUR-436 error.
  3. Provider selection failed with exactly "nothing is configured at all" — selectProvider's errNoProviderConfigured sentinel, not any other provider failure. A caller who attempted configuration and got it wrong (an AURUMCODE_LLM_FIXTURE path that does not exist, for example) is still told the review failed; that is a different, more specific defect than "nothing was configured," and silently downgrading it into "just run the security pass" would hide a real misconfiguration from the caller.

Combined with the quality review (no --seguranca, or a provider that IS configured), the provider requirement is completely untouched: this card changes nothing about the path that talks to a model.

When the skip engages, runReview (cmd/aurumcode/main.go) never constructs the orchestrator, the cost tracker, or the review cache — none of that machinery has anything to do when no call is ever made. The result carries no quality issues, and the quality section is not printed at all (see "Output shape" below): printing "No issues found." would assert something the tool never checked.

Output shape

Without a provider, --seguranca given:

Security findings (standards/security-review):
config/demo-tokens.txt:4: [error] Hardcoded credentials or API keys detected [standards/security-review SCR-003] (rule security/hardcoded-secret: Hardcoded Secrets)
config/demo-tokens.txt:5: [error] Hardcoded credentials or API keys detected [standards/security-review SCR-003] (rule security/hardcoded-secret: Hardcoded Secrets)
config/demo-tokens.txt:6: [error] Hardcoded credentials or API keys detected [standards/security-review SCR-003] (rule security/hardcoded-secret: Hardcoded Secrets)

No quality block precedes it — not even "No issues found." — because no quality review ran. stderr carries the actionable explanation, printed before stdout, never silence:

aurumcode review: no LLM provider configured: quality review skipped, running --seguranca only (no LLM provider configured: set AURUMCODE_LLM_FIXTURE=<path> to a JSON file shaped like {"issues":[{"file":"<path>","line":<n>,"severity":"error|warning|info","message":"<text>"}]} for offline use (see tests/fixtures/review/known-problem-response.json for a worked example), or set LLM_API_KEY and LLM_BASE_URL for a live provider)

Without a provider, --seguranca given, but nothing in the diff matches (e.g. --base HEAD against itself, an empty diff): the pass still ran and found nothing, so it prints the honest absence, not silence and not a claim it never ran:

Security findings (standards/security-review):
No security findings.

With a provider configured, --seguranca given: byte-identical to the AUR-442 contract — the quality block, then the security section, exactly as already published. Manually verified during this card's development: a binary built from the parent commit (before this card's change) and the candidate binary built from this card's tree both produce the exact same git-demo --seguranca stdout under AURUMCODE_LLM_FIXTURE, sha256 63c649af1c90e38b473e1bd45b4152b1f96ecad17d5d9c05c17bb94df7b8240f (stderr empty on both sides). tests/acceptance/AUR-449.sh pins this exact hash as a regression guard.

Without --seguranca: byte-identical to the AUR-430 contract — this card touches nothing on that path; no LLM provider configured still refuses with exit 1 when no provider is set, exactly as before.

Exit codes

Unchanged from AUR-435/AUR-442 (docs/specs/AUR-435.md), with one addition:

Code Meaning
0 Review ran; gate (if any) open. New under this card: includes --seguranca alone with no provider configured — the security pass ran and its findings printed.
1 The review itself failed: no provider (when the quality review is actually needed — no --seguranca, or --seguranca with --modelo, or --seguranca with an attempted-but-broken provider configuration), unreadable repo, broken rules catalog, or an explicit --modelo that cannot be served.
2 Usage error (missing --base, unknown flag or level).
3 --fail-on gate closed. A matched security finding closes the gate even when no quality review ran at all — the gate composes with the skip exactly as it already composed with --seguranca (docs/specs/AUR-442.md).

Offline, secret-free example

cd tests/fixtures/repos/git-demo/repo.git
unset AURUMCODE_LLM_FIXTURE LLM_API_KEY LLM_BASE_URL
aurumcode review --base HEAD~1 --seguranca

prints, with exit 0:

Security findings (standards/security-review):
config/demo-tokens.txt:4: [error] Hardcoded credentials or API keys detected [standards/security-review SCR-003] (rule security/hardcoded-secret: Hardcoded Secrets)
config/demo-tokens.txt:5: [error] Hardcoded credentials or API keys detected [standards/security-review SCR-003] (rule security/hardcoded-secret: Hardcoded Secrets)
config/demo-tokens.txt:6: [error] Hardcoded credentials or API keys detected [standards/security-review SCR-003] (rule security/hardcoded-secret: Hardcoded Secrets)

and stderr says plainly why the quality block is absent — never silence:

aurumcode review: no LLM provider configured: quality review skipped, running --seguranca only (...)

Failure diagnosis

  • flag provided but not defined: -seguranca — the binary predates AUR-435; rebuild from source.
  • aurumcode review: no LLM provider configured: ... with exit 1 and no "quality review skipped" note — either --seguranca was not given, --modelo was given (an explicit model choice always fails loudly instead of falling back), or a provider WAS attempted and is broken (check the AURUMCODE_LLM_FIXTURE path, or LLM_API_KEY / LLM_BASE_URL).
  • The security section says No security findings. but you expected a match — unrelated to this card: the pass's coverage is exactly what AUR-442 documents (docs/specs/AUR-442.md's "Failure diagnosis").
  • aurumcode review: review rules unavailable: ... — the embedded rules catalog is broken; fix internal/review/rules/ and rebuild.

Security

  • No new sink: the security pass's own output guarantees (trusted catalog text, never the matched diff body) are exactly AUR-442's; this card only changes when the pass is reached, not what it prints.
  • The AURUM_SECRET_CANARY value never reaches stdout, stderr, prompt, cache, or evidence on the skip path; tests/acceptance/AUR-449.sh asserts this.

Compatibility

  • review --base with a configured provider, with --modelo, or without --seguranca, is byte-identical to the already-published contract (tests/acceptance/AUR-442.sh, tests/acceptance/AUR-443.sh, tests/acceptance/AUR-433.sh, tests/acceptance/AUR-441.sh, tests/acceptance/AUR-436.sh all pass unchanged against this card's tree).
  • --fail-on's composition with security findings (docs/specs/AUR-442.md) is unaffected: it still gates on result.Issues plus securityFindings, and the latter is exactly what the skip path alone produces.
  • The review cache (AUR-441) is never consulted on the skip path — there is no model call for it to deduplicate.

Validation

tests/acceptance/AUR-449.sh AC-001 (sealed: ./.board/bin/oci-run --profile bootstrap-readonly-v1 --card AUR-449), with selectors TestAUR449 (tests/unit/AUR-449.go), IntegrationAUR449 (tests/integration/AUR-449.go), E2EAUR449 (tests/e2e/AUR-449.sh) and AC-001-MUT-001 (reverting runReview's skip condition to always require a provider, which must make --seguranca alone fail again — the exact pre-AUR-449 defect).

Selector naming note (same technique tests/unit/AUR-442.go and tests/unit/AUR-445.go document): the card text's TDD proof section names TestAUR435 / IntegrationAUR435 / E2EAUR435, copy-paste artifacts from the AUR-435 card this one was drafted against. Those symbols already exist in their packages (tests/unit/AUR-435.go, tests/integration/AUR-435.go, and TestAUR442/IntegrationAUR442 already occupy the next-available names too) and would collide, so this card's proofs are TestAUR449 / IntegrationAUR449 / E2EAUR449 instead.