Skip to content

fix: post-1.2.1 hardening (OCR redaction, adaptive FPS, thread-safety, pip-audit in CI)#249

Merged
safal207 merged 9 commits into
mainfrom
fix/post-1.2.1-hardening-11226761085530156998
Mar 7, 2026
Merged

fix: post-1.2.1 hardening (OCR redaction, adaptive FPS, thread-safety, pip-audit in CI)#249
safal207 merged 9 commits into
mainfrom
fix/post-1.2.1-hardening-11226761085530156998

Conversation

@safal207
Copy link
Copy Markdown
Owner

@safal207 safal207 commented Mar 7, 2026

This PR implements several security and performance hardening measures following the 1.2.1 release.

Key changes:

  1. OCR Redaction: Updated the VisionSubsystem to ensure that OCR text extracted from frames is redacted before being processed by the vision pipeline or emitted to the event bus. This prevents sensitive information like emails and passwords from leaking into logs or downstream components.
  2. Adaptive FPS: Replaced the fixed 1-second sleep in the vision loop with a dynamic calculation based on a target_fps (defaulting to 2.0).
  3. Thread-Safety: Reinforced thread-safety across core perception components. SessionBlackboard.add_fact, AuditLog.log_event, and ConsentManager.is_capture_allowed now consistently use locks to protect shared state. Method parameters for add_fact were updated to (fact, score, source) as requested.
  4. CI Security Audit: Added a GitHub Actions workflow that performs a security audit of Python dependencies using pip-audit.
  5. Testing: Introduced tests/test_hardening_verification.py to specifically verify the new hardening measures, including PII redaction, FPS accuracy, and concurrent access safety.

PR created automatically by Jules for task 11226761085530156998 started by @safal207

@google-labs-jules @safal207
fix: post-1.2.1 hardening (OCR redaction, adaptive FPS, thread-safety…
92f4d0a 
…, pip-audit in CI)

- Implemented OCR redaction in VisionSubsystem, ensuring safe_ocr is used in pipeline and events.
- Added adaptive FPS throttling via _calculate_sleep.
- Reinforced thread-safety in SessionBlackboard, AuditLog, and ConsentManager.
- Renamed SessionBlackboard.add_fact parameters to (fact, score, source).
- Added pip-audit security step to CI workflow.
- Added comprehensive hardening verification tests.

Co-authored-by: safal207 <55020240+safal207@users.noreply.github.com>
@google-labs-jules
Copy link
Copy Markdown
Contributor

google-labs-jules Bot commented Mar 7, 2026

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

@google-labs-jules @safal207
feat: top-tier DevSecOps pipeline and vision subsystem hardening
f735d68 
- Implemented OCR redaction in VisionSubsystem with PII masking.
- Added adaptive FPS throttling (target_fps=2.0).
- Reinforced thread-safety in Blackboard, AuditLog, and ConsentManager.
- Renamed SessionBlackboard.add_fact parameters to (fact, score, source).
- Configured Dependabot and Dependency Review.
- Enabled CodeQL static analysis.
- Upgraded CI to a full Security Pipeline with SBOM (CycloneDX) and pip-audit.
- Implemented reproducible builds using pip-tools (requirements.in/txt).
- Added pre-commit hooks for security and code quality.
- Added comprehensive hardening verification tests.

Co-authored-by: safal207 <55020240+safal207@users.noreply.github.com>
@github-advanced-security
Copy link
Copy Markdown
Contributor

github-advanced-security AI commented Mar 7, 2026

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out
the documentation.

google-labs-jules Bot and others added 7 commits March 7, 2026 07:55
@google-labs-jules @safal207
feat: enterprise-grade DevSecOps pipeline and vision hardening
2f26902 
- Consolidated CI into a single Security & CI Pipeline with CodeQL, pip-audit, and SBOM.
- Implemented OCR redaction with PII masking in VisionSubsystem.
- Added adaptive FPS throttling (target_fps=2.0).
- Reinforced thread-safety in Blackboard, AuditLog, and ConsentManager.
- Updated SessionBlackboard.add_fact parameters to (fact, score, source).
- Configured Dependabot for automated dependency updates.
- Implemented reproducible builds using pip-tools.
- Added pre-commit hooks for local security and quality checks.
- Added comprehensive hardening verification tests.

Co-authored-by: safal207 <55020240+safal207@users.noreply.github.com>
@google-labs-jules @safal207
feat: top-tier DevSecOps pipeline and vision subsystem hardening
dc56b94 
- Consolidated CI into a single Security & CI Pipeline with CodeQL, pip-audit, and SBOM.
- Implemented OCR redaction with PII masking in VisionSubsystem.
- Added adaptive FPS throttling (target_fps=2.0).
- Reinforced thread-safety in Blackboard, AuditLog, and ConsentManager.
- Updated SessionBlackboard.add_fact parameters to (fact, score, source).
- Configured Dependabot for automated dependency updates.
- Implemented reproducible builds using pip-tools.
- Added pre-commit hooks for local security and quality checks.
- Added comprehensive hardening verification tests.

Co-authored-by: safal207 <55020240+safal207@users.noreply.github.com>
@google-labs-jules @safal207
feat: enterprise-grade DevSecOps pipeline and vision hardening
66d4c89 
- Consolidated CI into a single Security & CI Pipeline with CodeQL, pip-audit, and SBOM.
- Implemented OCR redaction with PII masking in VisionSubsystem.
- Added adaptive FPS throttling (target_fps=2.0).
- Reinforced thread-safety in Blackboard, AuditLog, and ConsentManager.
- Updated SessionBlackboard.add_fact parameters to (fact, score, source).
- Configured Dependabot for automated dependency updates.
- Implemented reproducible builds using pip-tools.
- Added pre-commit hooks for local security and quality checks.
- Added comprehensive hardening verification tests.

Co-authored-by: safal207 <55020240+safal207@users.noreply.github.com>
@google-labs-jules @safal207
feat: final post-1.2.1 security & performance hardening
d9a89c0 
- Consolidated Security & CI Pipeline in .github/workflows/ci.yml with CodeQL, pip-audit, and SBOM.
- Enhanced VisionSubsystem (python/modules/perception/coordinator.py) with adaptive FPS, OCR redaction, and crash-resilient loop.
- Reinforced thread-safety in Blackboard, AuditLog, and ConsentManager with documented Lock usage.
- Implemented reproducible builds with pip-tools (requirements.in/txt).
- Added .pre-commit-config.yaml and a dedicated .git/hooks/pre-commit script.
- Verified all hardening measures with comprehensive tests.

Co-authored-by: safal207 <55020240+safal207@users.noreply.github.com>
@google-labs-jules @safal207
feat: finalize enterprise-grade DevSecOps pipeline and vision hardening
db679c4 
- Consolidated CI into a single Security & CI Pipeline with CodeQL, pip-audit, and SBOM.
- Enhanced VisionSubsystem with adaptive FPS, robust OCR redaction, and crash protection.
- Reinforced thread-safety in Blackboard, AuditLog, and ConsentManager.
- Transitioned to pip-tools for reproducible builds (requirements.in/txt).
- Configured Dependabot and pre-commit hooks for security and quality.
- Added comprehensive hardening verification tests.

Co-authored-by: safal207 <55020240+safal207@users.noreply.github.com>
@google-labs-jules @safal207
feat: finalize post-1.2.1 hardening & enterprise CI/CD pipeline
930ba2d 
- Unified CI Pipeline with system dependencies (portaudio19-dev, build-essential) and Python 3.11.
- Integrated CodeQL, pip-audit (CVE auditing), and CycloneDX SBOM generation.
- Hardened VisionSubsystem with adaptive FPS throttling, robust OCR redaction, and crash-resilient capture loop.
- Reinforced thread-safety in Blackboard, AuditLog, and ConsentManager.
- Implemented reproducible builds with pip-tools and automated weekly maintenance via Dependabot.
- Configured pre-commit hooks for ruff, black, and pytest.
- Added comprehensive verification tests in tests/test_hardening_verification.py.

Co-authored-by: safal207 <55020240+safal207@users.noreply.github.com>
@google-labs-jules @safal207
feat: enterprise hardening & top-tier DevSecOps pipeline
ef3870d 
- VisionSubsystem: Added adaptive FPS (2.0), PII OCR redaction, and crash-resilient loop.
- Thread-Safety: Reinforced state protection in Blackboard, AuditLog, and ConsentManager.
- CI/CD: Consolidated tests, CodeQL, pip-audit, and SBOM into a single Python 3.12 pipeline.
- Supply Chain: Integrated pip-tools (requirements.in) and automated updates via Dependabot.
- Local QA: Added ruff-based pre-commit hooks and dedicated hardening tests.

Co-authored-by: safal207 <55020240+safal207@users.noreply.github.com>
@safal207 safal207 merged commit 1ba4d07 into main Mar 7, 2026
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@safal207 @github-advanced-security