fix(a2a): restore OFFSEC-003 trust-boundary wrap on tool_delegate_task return (closes #491) #492

2026-05-11T15:00:20Z

release-manager commented

2026-05-11 15:00:20 +00:00

Summary

Restores sanitize_a2a_result(result) wrap on the non-error return path of tool_delegate_task (line ~325)
Aligns staging (8ca75765) with the correct main branch pattern (f99b0fdf)
Fixes CWE-117 / OFFSEC-003 trust-boundary regression — peer boundary markers could escape into agent context

Technical Detail

Staging at PR #393 diverged before OFFSEC-003 commits landed on main. The _sanitize_a2a_result import was present (line 50) but the return at line 325 was raw. Main has the correct return sanitize_a2a_result(result) wrap. This hotfix brings staging back in sync with a single-line functional change + OFFSEC-003 comment.

Gitea Issues Fixed

Closes [security] OFFSEC-003 boundary wrapping regressed on staging (#491)

Test Plan

staging CI green on this PR
delegation smoke: verify raw boundary markers are stripped from delegation results

🤖 Generated by Release Manager Agent

## Summary - Restores `sanitize_a2a_result(result)` wrap on the non-error return path of `tool_delegate_task` (line ~325) - Aligns staging (`8ca75765`) with the correct main branch pattern (`f99b0fdf`) - Fixes CWE-117 / OFFSEC-003 trust-boundary regression — peer boundary markers could escape into agent context ## Technical Detail Staging at PR #393 diverged before OFFSEC-003 commits landed on main. The `_sanitize_a2a_result` import was present (line 50) but the return at line 325 was raw. Main has the correct `return sanitize_a2a_result(result)` wrap. This hotfix brings staging back in sync with a single-line functional change + OFFSEC-003 comment. ## Gitea Issues Fixed - Closes #491 ## Test Plan - [ ] staging CI green on this PR - [ ] delegation smoke: verify raw boundary markers are stripped from delegation results 🤖 Generated by Release Manager Agent

release-manager added 1 commit 2026-05-11 15:00:21 +00:00

fix(a2a): restore OFFSEC-003 trust-boundary wrap on tool_delegate_task return

sop-tier-check / tier-check (pull_request) Failing after 2s

Details

Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 2s

Details

audit-force-merge / audit (pull_request) Successful in 2s

Details

c49523bb54

Fixes Gitea #491 — CWE-117 / OFFSEC-003 regression on staging.

Staging at 8ca75765 (PR #393) diverged before the OFFSEC-003
sanitize_a2a_result wrapping landed on main. The import was present
(line 50) but the non-error return path at line 325 was raw.

Main at f99b0fdf correctly wraps:
  return sanitize_a2a_result(result)

This hotfix restores the same pattern on staging. One-line fix
plus OFFSEC-003 comment matching the main branch.

Co-Authored-By: Release Manager Agent <release-manager@agents.moleculesai.app>