AdversaryGate patches six releases in four days after fixing fail-open merge-gate bugs
The author of AdversaryGate, a merge gate for coding-agent patches, shipped versions 3.0.0 through 3.0.6 after repeatedly finding ways the gate could wrongly approve changes. The bugs shared a pattern: an input the gate did not measure was silently skipped, letting the rest of the patch decide the verdict. Fixes included detecting tests that read code instead of running it, catching comment-only and no-op edits, refusing binary-marked diffs, and mutating every changed line and branch. Some changes, like handling the newline-at-EOF marker and raising timeouts and memory limits, addressed honest patches wrongly marked INCONCLUSIVE instead. Two releases, 3.0.2 and 3.0.3, were published with an API token, so versions before 3.0.4 were removed and releases now require signed tags and PyPI attestations.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in