hibou04-ops/antemortem-cli

Review signals: 90 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. 11 distinct locations. 90 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• lint exits 0 when every citation checks out on disk: Real input produced the expected result: PASS -- demo_antemortem.md validates clean

  Source: `lint` exits `0` if every citation checks out on disk, `1` if any is fabricated or stale.

  Input: examples/demo_antemortem.md

  Expected: PASS report for the demo artifact

  Command: <guest-path> lint examples/demo_antemortem.md --repo .

  Observed: PASS -- demo_antemortem.md validates clean (schema + classifications)

• strict-evidence lint reports missing evidence hashes through the MCP lint tool: Real input produced the expected result: classification t1: missing evidence_hash

  Source: `--strict-evidence` on `lint` requires the cited *text*, not just the line range, to be unchanged.

  Input: {"tool": "lint", "arguments": {"document": "examples/demo_antemortem.md", "repo": ".", "strict_evidence": true}}

  Expected: violation naming missing evidence_hash

  Command: <guest-path> tools/call {"tool": "lint", "arguments": {"document": "examples/demo_antemortem.md", "repo": ".", "strict_evidence": true}}

  Observed: …classification t1: missing evidence_hash\",\n \"classification t1: cited range too large (44 lines; max 40)\",\n \"classification t2: missing evidence_hash\",\n \"classification t3: missing evidence_hash\",\n \"new_trap t_new_1: missing evidence_hash\",\n \"new_trap t_new_1: cited range too large (46 lines; max 40)\"\n ],\n \"checked\": 4\n}"}], "isError": false}

• metrics reports the fabrication rate for the demo artifact: Real input produced the expected result: Fabrication rate: 0.0% of cited

  Source: antemortem metrics examples/demo_antemortem.json --repo .

  Input: examples/demo_antemortem.json

  Expected: Fabrication rate of 0.0 percent of cited

  Command: <guest-path> metrics examples/demo_antemortem.json --repo .

  Observed: Fabrication rate: 0.0% of cited - classification t1 (GHOST): VERIFIED [src/antemortem/cli.py:1-44] - classification t2 (REAL): VERIFIED [src/antemortem/citations.py:15-25] - classification t3 (GHOST): VERIFIED [src/antemortem/decision.py:30-35] - classification t4 (UNRESOLVED): UNRESOLVED (no citation) - new_trap t_new_1 (NEW): VERIFIED [src/antemortem/schema.py:177-222] Status: PASS

Examples

• documented offline demo replays a recon and prints the decision: command completed successfully

  Source: README.md Try it in 30 seconds

  Input: examples/demo_replay.py

  Expected: PROCEED_WITH_GUARDS decision

  Command: <guest-path> examples/demo_replay.py

  Observed: l line ranges in bounds - UNRESOLVED: citation correctly null (t4) ---- Decision gate (four-level enum) ---- SAFE_TO_PROCEED no REAL findings; lint and gate checks passed PROCEED_WITH_GUARDS REAL findings exist, every one has remediation <- THIS RUN NEEDS_MORE_EVIDENCE too many UNRESOLVED relative to total findings DO_NOT_PROCEED high-severity REAL without remediation, OR critic CONTRADICTED ---- Install ---- pip install antemortem Apache 2.0 - test count reproducible with pytest collection - Anthropic / OpenAI / Gemini / OpenAI-compatible [demo_replay] elapsed: 55.3s

• documented offline test suite passes: command completed successfully

  Source: README.md offline test suite (python -m pytest -q)

  Input: tests directory

  Expected: tests pass

  Command: <guest-path> -m pytest -q

  Observed: ................................. [ 13%] ........................................................................ [ 26%] ........................................................................ [ 39%] ........................................................................ [ 52%] ........................................................................ [ 66%] ........................................................................ [ 79%] ........................................................................ [ 92%] ........................................ [100%]

Local or hosted: local

Install antemortem 0.12.0 from the README and run its offline demo, lint, metrics, and MCP lint tool on the bundled demo recon artifact

cd <guest-path> && ls -la && git status 2>&1 | head -3; python3 --version; cat README.md | head -c 6000
cd <guest-path> && grep -n -i "try it in 30\|offline demo\|demo\|antemortem doctor\|lint\|--out\|mcp" README.md | head -80; ls .coldpass; cat pyproject.toml | head -40
cd <guest-path> && sed -n 231,250p README.md; python3 -m venv <guest-path> && <guest-path> install -q --upgrade pip 2>&1 | tail -3; echo rc=$?
cd <guest-path> && <guest-path> install -e ".[mcp]" 2>&1 | tail -5; echo rc=$?; ls <guest-path> | grep antemortem
cd <guest-path> && ls examples; PYTHONIOENCODING=utf-8 <guest-path> examples/demo_replay.py; echo rc=$?
cd <guest-path> && <guest-path> lint examples/demo_antemortem.md --repo .; echo rc=$?; <guest-path> metrics examples/demo_antemortem.json --repo .; echo rc=$?
cd <guest-path> && grep -n "def \|@mcp\|WORKSPACE" src/antemortem/mcp.py | head -60; sed -n 1,60p docs/MCP.md | cut -c1-300
cd <guest-path> && F=$(<guest-path> -c "import antemortem,os;print(os.path.dirname(antemortem.__file__))" 2>/dev/null); echo $F; ls $F; grep -rn "def lint\|def scaffold\|def run" $F/*.py $F/mcp/*.py 2>/dev/null | head
cd <guest-path> && sed -n 443,470p src/antemortem/mcp/server.py; grep -n "ANTEMORTEM_WORKSPACE_ROOT" src/antemortem/mcp/server.py | head -3
cd <guest-path> && grep -rn -i "cron\|schedul\|--once\|--now\|webhook\|while True" src/antemortem --include=*.py | head; ls /inputs 2>&1; ls <guest-path>; <guest-path> install -q pytest 2>&1 | tail -2; cd <guest-path> && timeout 900 <guest-path> -m pytest -q 2>&1 | tail -5; echo rc=$?
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>"],"cwd":"<guest-path>","tool":"lint","arguments":{"document":"examples/demo_antemortem.md","repo":"."},"expected_text":"\"ok\": true"}
EOF
cat probe.json; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40
grep -n "expected_text\|tool_result\|json.dumps" <guest-path> | head -40
cd <guest-path> && sed -n 143,200p src/antemortem/mcp/server.py | cut -c1-200
mkdir -p <guest-path> && cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>"],"cwd":"<guest-path>","tool":"scaffold","arguments":{"name":"probe-check","output_dir":"<guest-path>"},"output_directory":"<guest-path>","expected_text":"Fill in spec, traps, and files_to_read"}
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -c 1500
rm -rf <guest-path> && cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>"],"cwd":"<guest-path>","tool":"lint","arguments":{"document":"examples/demo_antemortem.md","repo":".","strict_evidence":true},"expected_text":"Status"}
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | grep -o 'tool_result.\{0,400\}' | head -2
cd <guest-path> && grep -n -F -e '`lint` exits `0` if every citation checks out on disk, `1` if any is fabricated or stale.' -e 'requires the cited *text*, not just the line range, to be unchanged.' -e 'antemortem metrics examples/demo_antemortem.json --repo .' -e 'Zero LLM calls. Catches the model hallucinating its own evidence.' -e 'The MCP server exposes exactly these three tools' README.md | cut -c1-200
cd <guest-path> && cat > claims.json <<'EOF'
[
{"kind":"claim","claim":"lint exits 0 when every citation checks out on disk","source":"`lint` exits `0` if every citation checks out on disk, `1` if any is fabricated or stale.","input":"examples/demo_antemortem.md","expected":"PASS report for the demo artifact","probe_kind":"cli","argv":["<guest-path>","lint","examples/demo_antemortem.md","--repo","."],"expected_text":"PASS -- demo_antemortem.md validates clean","cwd":"<guest-path>"},
{"kind":"claim","claim":"strict-evidence lint reports missing evidence hashes through the MCP lint tool","source":"`--strict-evidence` on `lint` requires the cited *text*, not just the line range, to be unchanged.","input":"examples/demo_antemortem.md with strict_evidence true","expected":"violation naming missing evidence_hash","probe_kind":"mcp","argv":["<guest-path>"],"tool":"lint","arguments":{"document":"examples/demo_antemortem.md","repo":".","strict_evidence":true},"expected_text":"classification t1: missing evidence_hash","cwd":"<guest-path>"},
{"kind":"claim","claim":"metrics reports the fabrication rate for the demo artifact","source":"antemortem metrics examples/demo_antemortem.json --repo .","input":"examples/demo_antemortem.json","expected":"Fabrication rate of 0.0 percent of cited","probe_kind":"cli","argv":["<guest-path>","metrics","examples/demo_antemortem.json","--repo","."],"expected_text":"Fabrication rate: 0.0% of cited","cwd":"<guest-path>"}
]
EOF
cat > examples.json <<'EOF'
[
{"kind":"example","claim":"documented offline demo replays a recon and prints the decision","source":"README.md Try it in 30 seconds","input":"examples/demo_replay.py","expected":"PROCEED_WITH_GUARDS decision","argv":["<guest-path>","examples/demo_replay.py"],"cwd":"<guest-path>","env":{"PYTHONIOENCODING":"utf-8"},"expected_text":"PROCEED_WITH_GUARDS"},
{"kind":"example","claim":"documented offline test suite passes","source":"README.md offline test suite (python -m pytest -q)","input":"tests directory","expected":"tests pass","argv":["<guest-path>","-m","pytest","-q"],"cwd":"<guest-path>","env":{},"expected_text":"passed"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md and src/antemortem entrypoints (cli.py, mcp/server.py, commands/). No cron, loop, webhook, watch, --once or --now scheduler was found; antemortem is a one-shot CLI and MCP tool server."}
EOF
for f in claims examples cycles probe; do <guest-path> -m json.tool $f.json >/dev/null && echo "$f ok"; done
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; wc -c <guest-path>; head -c 3000 <guest-path>
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>"],"cwd":"<guest-path>","tool":"lint","arguments":{"document":"examples/demo_antemortem.md","repo":".","strict_evidence":true},"expected_text":"classification t1: missing evidence_hash"}
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; python3 -c "
import json;d=json.load(open('<guest-path>'))
print('valid',d.get('valid')); print('problems',d.get('problems'))
r=d.get('replay',{}); print('replay',r.get('status'), r.get('evidence_strength'))
for c in d.get('claims',[]): print('CLAIM',c.get('claim'),'|',c.get('verdict'),'|',c.get('outcome'))
" 2>&1 | cut -c1-600; 
cd <guest-path> && python3 -c "
import json;d=json.load(open('<guest-path>'))
print(list(d.keys()))
for k in ('claims','examples','cycles'):
  v=d.get(k)
  print(k, json.dumps(v)[:700] if v is not None else None)
" ; ls .coldpass
cd <guest-path> && python3 -c "
import json;d=json.load(open('.coldpass/observed.json'))
print(json.dumps(d)[:2500])
"
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install antemortem 0.12.0 from the README and run its offline demo, lint, metrics, and MCP lint tool on the bundled demo recon artifact","operation_scope":"Offline only: no provider API key or network calls. Python 3.12.3 in a venv at <guest-path> (README requires 3.11+). Source is the workspace copy; the pinned commit was not fetched because the workspace was already present and is not a git repo.","steps":["python3 -m venv <guest-path>","<guest-path> install -e \".[mcp]\"  (installed antemortem-0.12.0 and antemortem-mcp)","PYTHONIOENCODING=utf-8 python examples/demo_replay.py  (run with venv python)","antemortem lint examples/demo_antemortem.md --repo .  -> PASS","antemortem metrics examples/demo_antemortem.json --repo .  -> Fabrication rate 0.0%","antemortem-mcp stdio server, tools/call lint with strict_evidence=true -> ok:false with violations, returned as product output","python -m pytest -q  (offline test suite, all passed)"],"deviations":["MCP probe: the default lint call returns only ok/violations/checked with no quoted text, and the checker matches expected_text against escaped JSON, so I used strict_evidence=true, which returns specific violation strings. ok:false is the product's real result on this demo artifact (no evidence_hash), not a failure of the run.","MCP scaffold was tried as a probe but rejected by the checker because output_directory must match an argv destination; MCP tool arguments cannot be marked, so I dropped it and removed the empty <guest-path> parent I had created.","Checker path: /inputs/coldpass-preflight.py does not exist in the VM, so I used <guest-path> as the task's checker instruction allowed.","Pin not applied: the workspace is not a git repository and was already populated, so I did not run the git fetch/reset steps."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the tested operations. Note that run and scaffold were not exercised: run needs a provider API key and scaffold needs an output directory the checker cannot mark."}
EOF
<guest-path> -m json.tool report.json >/dev/null && echo report ok; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | head -c 300; echo; ls <guest-path> 2>&1 | head -1