Repository navigation
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 387a647355
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| isinstance(node.func, ast.Attribute) | ||
| and node.func.attr in python_path_filesystem_read_methods | ||
| and python_path_receiver_expression( | ||
| node.func.value, tree, parents | ||
| ) |
There was a problem hiding this comment.
The new receiver guard skips validation entirely when a Path constructor is aliased: factory = Path; print(factory("synthetic-private").read_text()) now returns no scanner violation, whereas the parent scanner rejected it. Any unrecognized factory or helper returning a Path similarly bypasses all filesystem-reader checks and can expose private files through packet output, so unresolved receivers using these reader names must remain fail-closed.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| elif isinstance(node, (ast.For, ast.AsyncFor, ast.comprehension)): | ||
| # Values yielded from an environment iterator remain sensitive in | ||
| # both loop bodies and comprehension elements. | ||
| assignments.append((node.target, node.iter)) |
There was a problem hiding this comment.
When an environment iterator is wrapped, recording only the outer iterable expression loses the taint: for _, value in enumerate(os.environ.values()): print(value) and the analogous zip(...) case both pass this scanner. Those snippets still print inherited values, including credentials, so iterable taint must recurse through ordinary iterator-wrapper calls rather than recognizing only a direct os.environ.values() call.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| if python_call_derived_command_alias(value, modules): | ||
| return True | ||
| if isinstance( |
There was a problem hiding this comment.
The new helper traverses literal containers but falls through on ordinary calls, so launchers = {"x": subprocess.run}; for launch in launchers.values(): launch(["gh", "workflow", "run", "ci.yml"]) is accepted. This leaves the iterable-alias finding open for dictionary views and container-conversion calls, allowing a hidden workflow replay or other process launch to pass packet certification; the iterable analysis needs to follow reviewed view/wrapper calls back to their source containers.
AGENTS.md reference: AGENTS.md:L8-L8
Useful? React with 👍 / 👎.
| for statement in module.body: | ||
| if isinstance(statement, (ast.Import, ast.ImportFrom)): | ||
| exec(compile(ast.Module(body=[statement], type_ignores=[]), "<packet-scanner-import>", "exec"), namespace) | ||
| elif isinstance(statement, (ast.FunctionDef, ast.AsyncFunctionDef)): | ||
| exec(compile(ast.Module(body=[statement], type_ignores=[]), "<packet-scanner-function>", "exec"), namespace) |
There was a problem hiding this comment.
When the Markdown scanner fence is modified, this setup executes every extracted import and function definition with full builtins before any specimen is inspected. An added import, decorator, or default-argument expression can therefore run arbitrary code merely by invoking the advertised offline regression harness, contradicting its non-executing contract; validate and whitelist these AST nodes without evaluating packet-controlled imports or definition-time expressions.
Useful? React with 👍 / 👎.
| def config_violation(assignment): | ||
| key = assignment.split("=", 1)[0].lower() | ||
| if git_config_include_key(key): | ||
| return "Git configuration includes are not allowed before read-only commands" |
There was a problem hiding this comment.
The new check covers include keys supplied as -c, --config-env, or git config operands but still accepts git config --includes --list and command-prefix injection such as GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=include.path GIT_CONFIG_VALUE_0=/tmp/inc git status. git config -h describes --[no-]includes as “respect include directives on lookup,” and a local probe confirmed the environment form loads values from the referenced file, so these forms can still read sensitive configuration or activate included Git behavior after passing certification; reject include-enabling flags and inspect Git configuration environment assignments before wrapper stripping.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| @@ -0,0 +1,582 @@ | |||
| """Offline, non-executing regression probes for the seven issue #79 findings. | |||
There was a problem hiding this comment.
This commit introduces a Python implementation without an ADR or evidence-backed exception, even though the repository requires Go unless an ADR changes that decision. Reimplement the harness using the repository's Go tooling or add the required accepted ADR before introducing this non-Go maintenance surface.
AGENTS.md reference: AGENTS.md:L14-L14
Useful? React with 👍 / 👎.
| executable = executable_basename(tokens[0]) | ||
| if executable == "set": |
There was a problem hiding this comment.
The environment-dump check handles set and export but still accepts bare env and forms such as env -0 or env -u NAME; the wrapper parser then strips env, finds no child executable, and certifies the command. env --help explicitly states, “If no COMMAND, print the resulting environment,” so an executable shell fence can still emit every inherited credential despite this hardening; reject env whenever wrapper parsing reaches the no-command case.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
|
Triage checkpoint: Codex completed review of 387a647 with seven P1 findings. All are being treated as unresolved premerge blockers; current quick-check success does not override them. Independent contract/security reviews also reproduced overlapping reader/iterator gaps. A single correction batch with focused red/green evidence is in progress; no merge until final-head independent delta review, a fresh @codex review completion and quick checks. No live operations or workflow replay are authorized by this fix batch. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 387a647355
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ) | ||
| ): | ||
| raise SystemExit("Git packet blob query was outside the reviewed revision/path") | ||
| command = git_query(["show", blob_spec]) |
There was a problem hiding this comment.
When the local repository contains refs/replace/<HEAD>, this git show resolves the replacement object, while rev-parse HEAD and the remote ls-remote comparison retain the original commit ID. I reproduced a clean worktree where the original HEAD contained one packet, a replacement commit contained different bytes, and both this blob query and the worktree returned the replacement bytes while HEAD still matched the original remote SHA. git --help lists the global [--no-replace-objects] option; use it for the exact-head queries or explicitly reject replacement refs, otherwise the template can certify content that is absent from the reviewed remote head.
AGENTS.md reference: AGENTS.md:L16-L16
Useful? React with 👍 / 👎.
| guarded = any( | ||
| isinstance(call, ast.Call) | ||
| and python_dotted_name(call.func) == "package_dir.relative_to" | ||
| and len(call.args) == 1 | ||
| and python_path_division_names(call.args[0]) == expected_root |
There was a problem hiding this comment.
When an executable fence defines source_fuzz_guard with these expected variable names but calls it with arbitrary roots, this check only proves that package_dir is below the caller-supplied go_repo_root / module_dir. I loaded the scanner and it accepted a helper invoked as source_fuzz_guard(Path("/"), Path("etc"), Path("")) that prints package_dir.glob("*"), allowing filesystem enumeration to enter packet output. Unlike the unresolved-receiver finding, this uses a directly recognized Path receiver and passes specifically through the new exemption; require provenance for the root or validate every call site rather than trusting the helper's name and parameter spelling.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dac58b4add
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if isinstance(node.func, ast.Name): | ||
| local_helpers = python_local_function_candidates( | ||
| node.func.id, node, tree, parents |
There was a problem hiding this comment.
Restricting helper resolution to calls whose target is an ast.Name lets other local callables launder inherited credentials. For example, a class method that returns dict(os.environ), followed by secret = Snapshot().read(); print(secret), receives no scanner violation and emits the environment; a lambda assigned to a name has the same result because it is absent from the function index. Resolve method/lambda bodies too, or fail closed when their return provenance is unknown.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| elif isinstance(node, (ast.For, ast.AsyncFor, ast.comprehension)): | ||
| # Values yielded from an environment iterator remain sensitive in | ||
| # both loop bodies and comprehension elements. | ||
| assignments.append((node.target, node.iter)) |
There was a problem hiding this comment.
When an outer loop consumes a comprehension, this new binding records the whole comprehension as the target's source, but that expression is not recognized as sensitive when its iterator is the call os.environ.values(). The fresh case for secret in [value for value in os.environ.values()]: print(secret) still passes after the enumerate/zip fix and prints inherited credentials; list, set, dict, and generator comprehensions need to propagate taint from their elements and generators.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| local_functions = {} | ||
| for node in ast.walk(tree): | ||
| if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)): | ||
| local_functions.setdefault(node.name, []).append(node) |
There was a problem hiding this comment.
Indexing only FunctionDef/AsyncFunctionDef nodes leaves other local factories outside launcher provenance. I checked factory = lambda: subprocess.run; launch = factory(); launch(["gh", "workflow", "run", "ci.yml"]) and the equivalent class-method factory, and both receive no scanner violation even though they execute a workflow dispatch. Include lambdas and callable methods in return analysis, or reject aliases produced by unresolved local calls.
AGENTS.md reference: AGENTS.md:L8-L8
Useful? React with 👍 / 👎.
| current = node | ||
| while current in parents: | ||
| parent = parents[current] | ||
| if isinstance(parent, ast.If): | ||
| condition = condition_value(parent.test) |
There was a problem hiding this comment.
The reachability evaluator treats unrecognized constant conditions as unknown, so wrapping the containment try in if 1 == 1: pass; else: ... is accepted even though the check can never run; I applied that mutation to the canonical source-fuzz body and inspect_python_heredoc returned no violation. With an escaping package argument, execution continues to package_dir.glob without proving containment, allowing files outside the reviewed module to be inspected. Require the containment try in the direct reachable function body instead of accepting it beneath partially evaluated branches.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| def _verification_function(module: ast.Module, name: str) -> ast.FunctionDef: | ||
| for statement in module.body: | ||
| if isinstance(statement, ast.FunctionDef) and statement.name == name: | ||
| return statement |
There was a problem hiding this comment.
Returning the first matching function lets the harness validate a safe definition while Python executes a later override. I inserted a second require_packet_head_parity that simply returns immediately before its call: the packet scanner reported no violation, _verification_function still selected the original verifier, but the live template would bind and invoke the no-op definition, allowing mismatched packet bytes or intent bits to pass. Require exactly one top-level helper with this name before compiling it.
AGENTS.md reference: AGENTS.md:L16-L16
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b79709bf4c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if ( | ||
| isinstance(value, ast.Attribute) | ||
| and value.attr in python_path_filesystem_read_methods | ||
| and not python_known_non_path_reader_call(value, tree) | ||
| ): | ||
| receiver = value.value | ||
| elif isinstance(value, ast.Name) and value.id in aliases: | ||
| receiver = aliases[value.id] |
There was a problem hiding this comment.
Fresh evidence after the direct-receiver fix is def factory(): return Path("synthetic-private/file").read_text; reader = factory(); print(reader()): the current scanner returns no violation and the snippet emits arbitrary file contents. This alias analysis follows only direct attributes and existing names, not call results, even though local return analysis already exists elsewhere; propagate returned Path reader callables or fail closed on the unresolved alias.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| if ( | ||
| isinstance(value.func, ast.Attribute) | ||
| and value.func.attr in {"items", "keys", "values"} | ||
| ): |
There was a problem hiding this comment.
Fresh evidence after the dictionary-view fix is launchers = {"x": subprocess.run}; launch = launchers.pop("x"); launch(["gh", "workflow", "run", "ci.yml"]), which the scanner accepts. I checked gh 2.96.0's workflow run --help, which states that this command creates a workflow_dispatch event and triggers the workflow, so limiting attribute-call propagation to items/keys/values still permits an automatic replay through pop; mapping element-producing methods must preserve launcher provenance.
AGENTS.md reference: AGENTS.md:L8-L8
Useful? React with 👍 / 👎.
| for node in ast.walk(tree): | ||
| if not isinstance(node, ast.Call) or not isinstance(node.func, ast.Name): | ||
| continue | ||
| function = local_functions.get(node.func.id) | ||
| if function is None: | ||
| continue | ||
| for parameter, argument in call_arguments(node, function): | ||
| if python_sensitive_value_expression( | ||
| argument, sensitive_names, tree, parents | ||
| ) and parameter not in sensitive_names: | ||
| sensitive_names.add(parameter) | ||
| changed = True | ||
| for function in python_local_function_candidates( | ||
| node.func.id, node, tree, parents | ||
| ): |
There was a problem hiding this comment.
Fresh evidence exercises argument flow rather than the previously fixed return flow: class C: def emit(self, payload): print(payload); C().emit(os.environ) receives no violation and prints the inherited environment; an assigned lambda with the same body also passes. The call-site taint pass considers only calls whose target is an ast.Name and resolves only function definitions, so method and lambda parameters never become sensitive; bind arguments for those local callable forms as well.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| packet_path = Path("docs/evidence/g01-recovery-packet.md") | ||
| intent_result = run_bounded_git_query( | ||
| git_query(["ls-files", "-v", "-z", "--", packet_path.as_posix()]), | ||
| cwd=Path.cwd(), | ||
| env=git_environment, |
There was a problem hiding this comment.
When scripts/evidence_packet/issue79_regression_test.py is marked assume-unchanged or skip-worktree and then edited to weaken or skip its tests, this packet-only intent/blob check still succeeds and the later git status remains empty, so test output from modified code can be paired with the reviewed remote HEAD. I checked the installed git update-index -h, which describes these flags as marking files “not changing” or “index-only”; reject such intent bits and compare HEAD bytes for every changed evidence source, not only the Markdown packet.
AGENTS.md reference: AGENTS.md:L16-L16
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9233241cbd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if isinstance(value, ast.Call) and isinstance(value.func, ast.Name): | ||
| class_names.add(value.func.id) | ||
| for returned in python_local_call_return_values(value, tree, parents): |
There was a problem hiding this comment.
Fresh evidence after the direct method-return correction is Alias = Snapshot; print(Alias().read()), where Snapshot.read returns dict(os.environ): the scanner reports no violation and prints the inherited environment. This resolver records the called name Alias as the class name without following its assignment to Snapshot, so both sensitive method returns and parameter flows can still be laundered through a class alias; resolve constructor aliases before looking up the method.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| isinstance(value.func, ast.Attribute) | ||
| and value.func.attr in {"items", "keys", "values", "pop"} | ||
| ): |
There was a problem hiding this comment.
Fresh evidence after the .pop correction is launchers = {"x": subprocess.run}; launch = launchers.get("x"); launch(["gh", "workflow", "run", "ci.yml"]), which the scanner accepts because this mapping-method list omits get. I checked gh 2.96.0's workflow run --help, which says it creates a workflow_dispatch event and triggers the workflow, so mapping lookup can still hide an automatic workflow replay; preserve launcher provenance through get as well.
AGENTS.md reference: AGENTS.md:L8-L8
Useful? React with 👍 / 👎.
| if dotted not in path_preserving_calls and not ( | ||
| isinstance(node.func, ast.Attribute) | ||
| and node.func.attr in {"as_posix", "as_uri"} | ||
| ): | ||
| return False |
There was a problem hiding this comment.
When a resolved path is converted with the built-in formatter, value = format(Path.cwd().resolve()); print(value) receives no scanner violation and emits the local worktree path. Because an unrecognized call returns False here instead of propagating path provenance from its arguments, the new output-sink protection can be bypassed by format (and similarly ascii or an explicit __str__ call); include these path-preserving conversions or conservatively trace their arguments.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| The harness must use only the standard library and explicitly selected local | ||
| Git fixture operations. Invoke it with `python3 -B` to avoid bytecode artifacts | ||
| and record the actual interpreter and test results. Adding dependencies, |
There was a problem hiding this comment.
When the maintainer environment has PYTHONPATH, a user-site sitecustomize, or another Python startup customization, the prescribed python3 -B command executes that code before the harness's import and definition-time validation. I reproduced this with a synthetic PYTHONPATH containing ast.py, which executed immediately on harness startup; Python's local --help confirms that -B only disables bytecode while -I isolates Python from the user environment. Invoke the harness with isolated mode so external startup/import code cannot access credentials or corrupt the recorded regression result.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a61c35fb8a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for statement in candidate.body | ||
| for call in ast.walk(statement) |
There was a problem hiding this comment.
When the Markdown link check nests path.relative_to(repository_root) under if False, this broad ast.walk predicate still marks the path as guarded; I applied that mutation to the canonical link-check heredoc and inspect_python_heredoc returned no violation. A repository Markdown target such as ../../private/file#x can then reach path.is_file() and anchors(path) without containment, causing certification to read outside the reviewed repository; require the containment call to be a direct reachable statement in the guarded try.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| candidates = tuple(assignments.get(value.id, ())) + tuple( | ||
| iterable_bindings.get(value.id, ()) | ||
| ) |
There was a problem hiding this comment.
When a function parameter shadows a module-level regex-match variable, this global name-based lookup still classifies the parameter as a regex result. I verified that match = re.match("x", "x"); def expose(match): print(match.group()); expose(Path("/etc/passwd")) receives no scanner violation, even though runtime dispatches Path.group() and performs an unreviewed filesystem metadata read. Scope assignment and parameter bindings before exempting .group() as a regex API.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2c755af9dc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if dotted == "dict" and any( | ||
| isinstance(argument, ast.Attribute) | ||
| and python_dotted_name(argument) == "os.environ" | ||
| for argument in node.args | ||
| python_sensitive_value_expression( | ||
| value, sensitive_names, tree, parents, seen.copy() | ||
| ) | ||
| for value in list(node.args) |
There was a problem hiding this comment.
In the packet's isolated Python heredocs, aliasing a preserving constructor bypasses this name-based check: maker = dict; value = maker(os.environ); print(value) receives no scanner violation and prints the inherited environment. Resolve aliases of the listed container/string constructors before testing the call target, otherwise packet certification can emit credentials despite the new taint propagation.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| python_imported_function_alias_is_stable( | ||
| node.func.id, "sys", "exit", tree | ||
| ) | ||
| or python_assigned_callable_alias(node.func.id, "sys.exit", tree) | ||
| ) |
There was a problem hiding this comment.
The name-based alias branch only resolves sys.exit, so a packet heredoc such as emit = print; emit(os.environ) receives no scanner violation and writes the entire inherited environment; emit = warnings.warn is affected similarly. Extend alias resolution to all sinks recognized by this function so known credential taint cannot be laundered merely by assigning the sink to another name.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| assignments_by_name, | ||
| seen.copy(), | ||
| ): | ||
| return True | ||
| return False |
There was a problem hiding this comment.
In the packet's isolated Python heredocs, print(Path.home()), print(Path("~").expanduser()), and print(os.path.expanduser("~")) all receive no scanner violation while emitting the maintainer's personal home path. This provenance check recognizes Path.cwd() but returns false for these other standard local-path constructors, so include home/expansion operations among resolved local path sources before output-sink certification.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| or value not in reviewed_shell_export_assignments | ||
| for value in assignments | ||
| ): | ||
| return "shell export requires explicit reviewed assignments" | ||
| return None |
There was a problem hiding this comment.
The new environment-output gate accepts every non-set/export command, but the shell allowlist includes processors with direct environment access: awk 'BEGIN { print ENVIRON["GH_TOKEN"] }' and jq -n env both receive no scanner violation, and local synthetic probes confirmed that each prints the supplied variable. Inspect or reject the environment primitives of these allowlisted processors so executable packet fences cannot emit inherited credentials.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| def _top_level_assignment(module: ast.Module, name: str) -> ast.Assign | ast.AnnAssign: | ||
| for statement in module.body: | ||
| if isinstance(statement, ast.Assign) and any( | ||
| isinstance(target, ast.Name) and target.id == name | ||
| for target in statement.targets | ||
| ): | ||
| return statement | ||
| if isinstance(statement, ast.AnnAssign) and isinstance(statement.target, ast.Name) and statement.target.id == name: |
There was a problem hiding this comment.
Fresh evidence beyond the duplicate-helper correction is a second top-level issue79_reviewed_evidence_paths assignment after the canonical one: this helper returns the first assignment and the regression assertion still sees both reviewed files, while Python executes the later value and the live parity loop can omit the harness entirely. Requiring each security-relevant template assignment to be unique prevents an assume-unchanged modified harness from being paired with the reviewed remote head after tests validated a shadowed value.
AGENTS.md reference: AGENTS.md:L16-L16
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
https://github.com/1XP-AI/gh-runnerd/blob/1f5f89bc80f09393dbc44f45d20f0141e747005a/docs/evidence/g01-recovery-packet.md#L11329-L11330
Fresh evidence after the launcher-alias corrections is import subprocess; (launch := subprocess.run)(["gh", "workflow", "run", "ci.yml"]), which the current scanner accepts. The installed gh 2.96.0 help states that workflow run creates a workflow_dispatch event and triggers the workflow, so limiting NamedExpr handling here to conditional values still permits an automatic replay when the assignment expression itself is the call target; resolve that target or fail closed on such callable expressions.
AGENTS.md reference: AGENTS.md:L8-L8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "traceback.print_exception", | ||
| }: | ||
| return True | ||
| if isinstance(node.func, ast.Name) and tree is not None: |
There was a problem hiding this comment.
Fresh evidence after the assigned/import-alias fix is import os; (emit := print)(os.environ): the current scanner returns no violation, while Python immediately invokes print and emits the entire inherited environment. This branch only resolves sink aliases when the callable is an ast.Name, so a NamedExpr used directly as the call target bypasses the new protection; resolve callable expressions here or fail closed on unresolved targets.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| for value in assignments | ||
| ): | ||
| return "shell export requires explicit reviewed assignments" | ||
| return None |
There was a problem hiding this comment.
In an executable Bash fence, name=GH_TOKEN followed by printf '%s\n' "${!name}" receives no scanner violation and prints the inherited token; I confirmed this with a synthetic GH_TOKEN. The new environment-output gate accepts every command other than the special set/export cases, while the earlier parameter regex does not recognize Bash's ${!name} indirect expansion, so an allowlisted printf can still place credentials in packet output; reject indirect expansion or resolve its referenced variable before allowlisting the command.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
Apply the already-authorized Go 1.26.9 shared pins, offline-harness BuildInfo admission gates, and current-contract updates needed for packet 1.26.9 compatibility (source: immutable G01 pin commit c81a17b654686600277474ae63376fdcb1210193, corrected record 9776562). Existing 12 issue-79 commits preserved; no rebase/reset/wholesale copy. Scope: active pins (4 go.mod, Makefile, 3 scripts, compare-sdk.sh, 2 workflows), runtime gates (live/worker buildRevisionFromInfo, validBrokerBuild) plus their admission tests, tooling harness expectations, and current contracts (CI.md, DEPENDENCIES toolchain line, matcher provenance note, 3 experiment READMEs). Excluded: G01 evidence docs (checkpoint addendum, live-canary checklist) and unrelated G01 action-SHA prose; this branch keeps its v4.2.2/v5.5.0 workflow pins. Historical 1.26.8 records unaltered (CI.md warmed baseline, R1 evidence section, matcher 1.26.8 adaptation source). RED (reused known tests, before pins): TestToolingCheckToolchain- RequiresGo1269 FAIL (3 subtests, go-directive mismatch), TestBrokerBuildMustMatchReviewedController FAIL (reviewed metadata rejected), live/worker TestBuildRevisionAdmissionRequiresGo1269 FAIL (1.26.9 build rejected). GREEN (focused, GOTOOLCHAIN=go1.26.9): make toolchain exit 0; tooling pin tests ok 1.575s; G02 4-test admission set ok 0.314s; live/worker admission ok 0.289s/0.279s; go vet clean on scripts, live, worker, g02; go mod tidy -diff clean on all 4 modules; gofmt/git diff --check clean. Full suites and live profiles not run. Co-authored-by: Cursor <cursoragent@cursor.com>
Update only the packet current profile to the branch-active Go 1.26.9 (local dependency 36e39fb; authorized G01 pin c81a17b, record 9776562): pins-table toolchain row (1.26.8 pair recorded historical), 2 ledger toolchain references, wrapper build-identity comment, reviewed_toolchain, and 28 go_test_checked + 2 go_vet_checked prescription identities/commands including drain-pr72. 65 current-profile lines carry go1.26.9; 106 pre-existing go1.26.8 lines (dated RED/GREEN, finding ledgers, audit probes, specimens, snapshots) preserved byte-identical. No blanket replacement. G01 canary/checkpoint docs deliberately not copied (G01-owned). RED (static, no packet execution): new packet_toolchain_profile_test.py (pins row, AST-inspected reviewed_toolchain, all wrapper-fence versions vs branch pins) failed 4/4 on the stale packet. GREEN: 4/4 pass in 0.005s; git diff --check clean; added-line credential/path scan clean (only pre-existing test-name/label tokens); no new Markdown links. Scanner suite not rerun for this unit: it holds no toolchain assertions; one smoke probe fails identically before/after this change (pre-existing #79 reflective-hardening state, out of scope). No packet execution, Go suite, CI, review, or live op claimed. Co-authored-by: Cursor <cursoragent@cursor.com>
Fix test_current_packet_has_no_static_scanner_violations hang (>600s, no result) caused by superlinear reflective analysis when the packet scanner audits itself (BODY 19, 620KB, 309 top-level stmts, byte-identical since 8de8e07; pre-existing #79 reflective-hardening state, not the f362d54 toolchain change). Minimal semantics-preserving memoization in python_filesystem_mutator_alias_violation only: per-invocation caches for enclosing-scope resolution (32 explicit call sites), known_collection_constructor (pure, keyed by node+seen), and reflective_value_flows True outcomes (sound by fixpoint monotonicity; False recomputed as bindings grow). No policy/logic change; no globals() (self-audit rejects mutable-global access); loader validation unchanged (nested defs only, clean defaults, no new imports). RED (pre-fix, f362d54): BODY 19 >300s timeout; prefix 140 = 50.7s; profile prefix 100 = 11.2s / 85M calls via reflective_value_flows + known_collection_constructor + ast.walk; full suite blocked. GREEN (post-fix): smoke ok, zero violations (261 shell + 86 bodies) in 230s; compiler self-audit 654s -> 216s; toolchain profile 4/4 still pass (0.006s); full suite 174/176 with the 2 remaining path-reader FAILs byte-identical pre/post (pre-existing, out of scope for this unit). Writer: Cursor Agent, Muse Spark 1.3 Max, selected by current user override. Independent and GitHub review not requested for this local work. No push/PR/merge/live op. Co-authored-by: Cursor <cursoragent@cursor.com>
Fix test_nested_function_name_collision_does_not_hide_launcher_alias FAIL (category: test's wrong expectation, not scanner defect). The safe specimen returned print (a recognized output sink since 6574b87, after the test's 184701d introduction); sink-returns fail closed per policy, so the scanner correctly flagged line 2 and the test failed identically pre/post the memoization fix. The unsafe body also passed vacuously via its incidental print return instead of the intended launcher alias. Minimal 2-line specimen fix: return print -> return len in both factories (len is not a sink/launcher/mutator; str.upper already accepted). No policy change. RED: FAIL 'stores an imported output sink in an unreviewed holder on line 2 is not None', body flagged only for sink (line 6). GREEN: ok in 0.2s; body flagged for launcher (unresolved command-capable call launch, line 8), safe None. Full suite: this test now in the 174 passes. Writer: Cursor Agent, Muse Spark 1.3 Max, selected by current user override. Independent and GitHub review not requested for this local work. No push/PR/merge/live op. Co-authored-by: Cursor <cursoragent@cursor.com>
The getattr-reader regression test failed after 0cbe820 over-tightened member-name resolution: a safe specimen reads a benign member name via a local helper return (return reader_name()), which the fixpoint treated as an unresolved dynamic name and flagged as a mutator alias, while the unsafe specimen was already caught by the path-reader check. Resolve helper-returned member names (cycle-guarded) at the three member-resolution call sites so benign readers returned by local helpers resolve to closed strings; keep fail-closed behavior for unresolvable or mutator members. RED: test_path_getattr_readers_follow_local_path_and_member_returns FAIL (pre-fix; broken since 0cbe820, safe specimen flagged as mutator alias). GREEN: same test ok in 0.19s post-fix; unsafe specimen still flagged via the path-reader check; related 89 tests pass (40s); packet smoke test OK (231s, 261 shell commands + 86 bodies, zero violations). Co-authored-by: Cursor <cursoragent@cursor.com>
The filesystem-reader regression test failed after 2a2ee6c blanket-rejected any local-helper result whose return expression contains a reflective getattr call: a safe factory returning getattr(reviewed_packet_path, "read_text") was flagged identically to the unsafe factory returning a reader over synthetic-private paths. Resolve each helper-returned getattr call before rejecting: skip only calls with a single closed non-mutating member on a reviewed reader path (same python_reviewed_path_reader predicate the reader-alias check uses); keep fail-closed rejection for missing args, unresolved or mutating members, and unreviewed receivers. RED: test_path_filesystem_readers_require_reviewed_paths FAIL (pre-fix; broken since 2a2ee6c, safe reviewed factory flagged as unreviewed helper result). GREEN: same test ok in 0.22s post-fix; all 17 unsafe specimens still flagged; related 90 tests pass (38s); packet smoke test OK (222s, 261 shell commands + 86 bodies, zero violations). Co-authored-by: Cursor <cursoragent@cursor.com>
|
@codex review |
💡 Codex Reviewhttps://github.com/1XP-AI/gh-runnerd/blob/db79bde7b40a17740e27f4671e0838bcaaeaa310/docs/evidence/g01-recovery-packet.md#L16932-L16934 At this exact head, AGENTS.md reference: AGENTS.md:L8-L8 https://github.com/1XP-AI/gh-runnerd/blob/db79bde7b40a17740e27f4671e0838bcaaeaa310/docs/evidence/g01-recovery-packet.md#L21449-L21452 When the inherited environment contains credentials, AGENTS.md reference: AGENTS.md:L9-L9 https://github.com/1XP-AI/gh-runnerd/blob/db79bde7b40a17740e27f4671e0838bcaaeaa310/docs/evidence/g01-recovery-packet.md#L21772-L21775 At this exact head, AGENTS.md reference: AGENTS.md:L8-L8 https://github.com/1XP-AI/gh-runnerd/blob/db79bde7b40a17740e27f4671e0838bcaaeaa310/docs/evidence/g01-recovery-packet.md#L7688-L7691 In an executable shell fence, AGENTS.md reference: AGENTS.md:L9-L9 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Codex exact-head review of db79bde (comment 6167225325) showed from-imported but unlisted OS mutators lose module identity: 'from os import removedirs' plus a direct call was accepted while 'os.removedirs(...)' was rejected, and 'from shutil import disk_usage' bypassed the unreviewed-entry-point guard that rejects the direct attribute spelling. Resolve bare-Name call targets through from-import aliases before the unknown-OS classification, so imported names receive exactly the direct spelling verdict: unlisted os calls fail closed, reviewed os calls and 'shutil.which' stay accepted, and already-import-rejected mutators keep single attribution. RED: new test_from_imported_os_and_shutil_calls_use_fail_closed_... fails 4 unsafe assertions pre-fix (removedirs/renames/alias/disk_usage accepted). GREEN: test ok in 0.19s post-fix; related 105 tests pass (31s); packet smoke test OK (240s, 261 shell commands + 86 bodies, zero violations). Co-authored-by: Cursor <cursoragent@cursor.com>
Codex exact-head review of db79bde (comment 6167225325) showed launcher provenance is erased by parameter defaults: '(lambda launch=os.system: launch("rm ..."))()' and the def/kwonly equivalents were accepted because the launcher index only binds assignment targets, never defaults. Bind def/lambda positional and keyword-only defaults in the launcher index fixpoint: a default resolving to a command function marks the parameter, so inner calls receive the same command-argument verdict as direct assignments. Capture without a call stays accepted. RED: new test_launchers_bound_through_callable_defaults_stay_classified fails 3 unsafe assertions pre-fix (lambda/def/kwonly accepted). GREEN: test ok in 0.19s post-fix; related 66 tests pass (23s); packet smoke test OK (224s, 261 shell commands + 86 bodies, zero violations). Co-authored-by: Cursor <cursoragent@cursor.com>
Codex exact-head review of db79bde (comment 6167225325) showed an unquoted opener ('/opt/homebrew/bin/python3 -I - <<PY') lets the shell expand the body before Python starts, so 'print("$GH_TOKEN")' in the body emits the inherited token after certification. The descriptor kept only delimiter text, interpreter and isolation state. Retain the regex-captured quote state on each heredoc invocation and require quoted delimiters in both enforcement paths (stdin-segment gate and body-inspection loop); mirror the gate in the regression smoke test. Backslash-escaped openers remain rejected as unrecognized invocations. RED: new test_python_heredoc_requires_quoted_delimiter fails 3 assertions pre-fix (unquoted openers gated True, quoted flag absent). GREEN: test ok in 0.19s post-fix; related 51 tests pass (11s); packet smoke test OK (223s, 261 shell commands + 86 bodies, zero violations). Co-authored-by: Cursor <cursoragent@cursor.com>
Codex exact-head review of db79bde (comment 6167225325) showed '{}[str(os.environ)]' passes the sensitive-read guard, so the KeyError message carries the environment value out of the reviewed body; int()/float() conversions over secret aliases leak the same way through ValueError. The guard only inspected explicit raise/assert messages and os.environ receivers. Collect lexical bindings (assignments, loop targets, parameter defaults) with keys-only iteration flags, resolve operand sensitivity structurally through propagators, iterators, helper returns and aliases, and reject sensitive subscript slices (except Store context and os.environ receivers, which keep their dedicated verdict) plus int/float conversions including assigned aliases. Keys-only iteration over environment mappings (.keys(), dict(), tuple-unpack position 0 of .items()) stays accepted, matching bare 'for key in os.environ'. RED: new test fails all 14 unsafe assertions on the HEAD packet (accepted pre-fix; measured 14 failures); 10 safe assertions pass. GREEN: test ok in 0.23s post-fix; related 68 tests pass (13s); self-host scan of 85 small bodies reports 0 flags (19s); full suite 180 pass, 0 fail (829s); packet smoke reports 261 shell commands + 86 bodies, zero violations. Co-authored-by: Cursor <cursoragent@cursor.com>
|
@codex review Fresh-P1 fix batch pushed (db79bde..7638c51, 4 commits) for the 4 new P1s from exact-head review comment 6167225325 (vs db79bde):
Verification (measured): full suite 180 pass, 0 fail (829s); packet smoke 261 shell commands + 86 bodies, zero violations; each fix has RED (fails pre-fix) + GREEN evidence in its commit message. Please review the exact current head 7638c51. |
💡 Codex Reviewhttps://github.com/1XP-AI/gh-runnerd/blob/7638c514ff941fc8d9ec0040670ea651c5b9d350/docs/evidence/g01-recovery-packet.md#L21639-L21640 When a sensitive key is passed through a helper parameter, such as AGENTS.md reference: AGENTS.md:L9-L9 https://github.com/1XP-AI/gh-runnerd/blob/7638c514ff941fc8d9ec0040670ea651c5b9d350/docs/evidence/g01-recovery-packet.md#L21473-L21479 For AGENTS.md reference: AGENTS.md:L9-L9 https://github.com/1XP-AI/gh-runnerd/blob/7638c514ff941fc8d9ec0040670ea651c5b9d350/docs/evidence/g01-recovery-packet.md#L21828 The conversion guard covers AGENTS.md reference: AGENTS.md:L9-L9 https://github.com/1XP-AI/gh-runnerd/blob/7638c514ff941fc8d9ec0040670ea651c5b9d350/docs/evidence/g01-recovery-packet.md#L12843-L12846 Callable defaults are classified only when AGENTS.md reference: AGENTS.md:L8-L8 https://github.com/1XP-AI/gh-runnerd/blob/7638c514ff941fc8d9ec0040670ea651c5b9d350/docs/evidence/g01-recovery-packet.md#L16165-L16169 The global alias dictionary lets a later or nested import overwrite the identity of an earlier call: AGENTS.md reference: AGENTS.md:L8-L8 https://github.com/1XP-AI/gh-runnerd/blob/7638c514ff941fc8d9ec0040670ea651c5b9d350/docs/evidence/g01-recovery-packet.md#L21830-L21834 The alias branch recognizes only ordinary assigned names, so AGENTS.md reference: AGENTS.md:L9-L9 https://github.com/1XP-AI/gh-runnerd/blob/7638c514ff941fc8d9ec0040670ea651c5b9d350/docs/evidence/g01-recovery-packet.md#L21783-L21787 A computed key can disclose credentials through its representation without being directly tainted: AGENTS.md reference: AGENTS.md:L9-L9 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Codex exact-head review of 7638c51 (comment 6169988457, G3) showed 'complex(str(os.environ))' is certified while CPython raises a ValueError whose message includes the full supplied string. The conversion guard covered int/float builtins and their assigned aliases but omitted the adjacent complex builtin. Include complex, builtins.complex and assigned complex aliases in the implicit-exception conversion check. RED: new test fails 2 unsafe assertions pre-fix (accepted). GREEN: test ok in 0.19s (2 unsafe + 2 safe); related 69 pass (14s); self-host scan of 85 small bodies reports 0 flags (20s). Full-suite batch verification runs in the background before push. Co-authored-by: Cursor <cursoragent@cursor.com>
Codex exact-head review of 7638c51 (comment 6169988457, G6) showed 'def f(convert=int): convert(str(os.environ))' and 'converters = [float]; converters[0](str(os.environ))' are certified while each raises a conversion error exposing the inherited environment. The alias branch recognized only ordinary assigned names. Resolve conversion targets structurally: direct int/float/complex names, assigned aliases, parameter defaults (recursive), call-site arguments, and list/tuple containers with constant-index selection (any-element fallback for computed indices). Non-conversion callables (len) in the same positions stay accepted with sensitive arguments. RED: new test fails 4 unsafe assertions pre-fix (accepted). GREEN: test ok in 0.20s (4 unsafe + 2 safe); related 69 pass (14s); self-host scan of 85 small bodies reports 0 flags (19s). Full-suite batch verification runs in the background before push. Co-authored-by: Cursor <cursoragent@cursor.com>
Codex exact-head review of 7638c51 (comment 6169988457, G1) showed 'def lookup(key): return {}[key]; lookup(str(os.environ))' is certified while the KeyError renders the inherited environment. Parameter names returned False without consulting the collected call-site bindings. Resolve parameter operands through the union of lexical bindings (defaults, reassignments) and call-site argument mappings (positional, keyword, variadic, star-expansion) in the matching scope; uncalled parameters stay opaque. Closure-captured names keep resolving through the lexical scope chain. RED: new test fails 3 unsafe assertions pre-fix (accepted); closure pin passes pre/post via the scope chain. GREEN: test ok in 0.21s (4 unsafe + 2 safe); related 70 pass (17s); self-host scan of 85 small bodies reports 0 flags (23s). Full-suite batch verification runs in the background before push. Co-authored-by: Cursor <cursoragent@cursor.com>
Codex exact-head review of 7638c51 (comment 6169988457, G2) showed 'd = {}; d[str(os.environ)] = 1; for key in d: {}[key]' is certified while the KeyError carries the inherited environment. Key sensitivity derived only from the mapping's original assignment and ignored later subscript writes, update, or setdefault. Collect mutated-in key expressions per mapping (subscript stores, |= sources, update/setdefault/__setitem__ arguments, tagged as key or mapping sources) and resolve them in the matching domain when a keys-only loop variable is queried, filtered by visible scopes. Element-preserving iterators (sorted/list/tuple/...) stay in keys-domain; repr-producing calls analyzed sensitively after fixing a same-node seen-set block that swallowed keys-to-sensitive delegation. RED: new test fails 4 unsafe assertions pre-fix (|= pins a case the old binding walk already rejected). GREEN: test ok in 0.21s (7 unsafe + 6 safe); related 71 pass (15s); self-host scan of 85 small bodies reports 0 flags (22s). Full-suite batch verification runs in the background before push. Co-authored-by: Cursor <cursoragent@cursor.com>
Codex exact-head review of 7638c51 (comment 6169988457, G7) showed '{}[K()]' is certified when K.__repr__ returns str(os.environ), while the KeyError invokes the representation and prints the inherited environment. Index local class definitions once per body and resolve subscript slices through constructions, alias bindings and call-site arguments; when the key is an instance of a local class whose __repr__ (including inherited bases) returns a sensitive value, reject with a dedicated verdict. Classes without custom representations, safe representations, local factory/method calls and non-local constructions stay accepted, matching the packet's established local-analysis boundary. RED: new test fails 4 unsafe assertions pre-fix (accepted). GREEN: test ok in 0.20s (4 unsafe + 4 safe); related 72 pass (16s); self-host scan of 85 small bodies reports 0 flags (22s). Full-suite batch verification runs in the background before push. Co-authored-by: Cursor <cursoragent@cursor.com>
Codex exact-head review of 7638c51 (comment 6169988457, G5) showed 'from os import removedirs as action; action(...); from shutil import which as action' is certified because a global alias map lets the later import rewrite the earlier call to shutil.which, although the first call executes the destructive OS function. Record from-import bindings with scope and source position and resolve each bare-name call against visible imports: same-scope bindings preceding the call (unioned fail-closed so conditional imports cannot smuggle), else innermost enclosing scope wins for shadowing. Single-import behavior is unchanged. RED: new test fails 3 assertions pre-fix (both unsafe accepted; call-before-import over-rejected by the global map). GREEN: test ok in 0.19s (2 unsafe + 2 safe); related 108 pass (37s); self-host scan of 85 small bodies reports 0 flags (20s). Full-suite batch verification runs in the background before push. Co-authored-by: Cursor <cursoragent@cursor.com>
Codex exact-head review of 7638c51 (comment 6169988457, G4) showed 'def f(launch=os.system if flag else len)' is certified because defaults reduce only through whole-expression dotted names, while the call executes os.system. Walk default expressions for launcher provenance through conditionals, boolean/selection/container forms, named expressions and immediately invoked lambdas (resolving through the import maps), plus from-imported command leaves bound in the tree; defaults that contain a launcher but do not reduce to one name map the parameter to unresolved so calls fail closed. Clean defaults (len/str branches, local helpers, uncalled tainted defaults) stay accepted, and bare leaf names without a matching from-import are not guessed. RED: new test fails 7 unsafe assertions pre-fix (accepted). GREEN: test ok in 0.22s (7 unsafe + 3 safe); F3 regression test ok. Related/self-host/full-suite batch verification follows with the traversal fix (G1-era predicate shape hangs import bindings on large bodies; fixed next). Co-authored-by: Cursor <cursoragent@cursor.com>
The mutually recursive error_operand_sensitive / error_operand_keys_sensitive pair made launcher-index traversal blow up combinatorially once G1 added call-argument edges: every BODY 19 import-bindings pass (smoke, compiler and origin self audits, callback self audit) hung instead of completing. Bisected clean at d9b6a2d (3.3s) to hanging at a0849e3; faulthandler showed iterable_may_contain_launcher cycling through return_values with tens of thousands of redundant resolutions. Replace both predicates with one worklist over (node, domain) pairs that expands each pair once, preserving verdicts: same True sources, same first-match scope shadowing, same per-entry domains, same return/argument expansion rules. No behavior change is intended; the traversal can no longer cycle through operand analysis because no local recursive edges remain. RED: test_current_scanner_self_audit_ast_parameters_are_not_callbacks exceeds 120s pre-fix (G1..G7 states). GREEN: same test ok in 3.8s post-fix; all 10 finding tests ok; related 72 pass (14s); self-host scan of 85 small bodies reports 0 flags (19s). Full suite gates the push. Co-authored-by: Cursor <cursoragent@cursor.com>
…oofs
Self-audit RED: test_current_packet_has_no_static_scanner_violations failed
twice after the G-batch. Both failures share one root cause: locals inside
new scanner code reuse names that the scanner's scope-less body-global maps
key on, flipping verdicts for pre-existing body19 code.
1. G6 conversion-callable Subscript walker bound 'container'/'containers'
(for-target + list). python_regex_match_receiver all-quantifies over
assignments+iterable_bindings, so the extra 'containers' binding broke the
re.match proof for 'container.group(1)' in fence_details, yielding
'unresolved Path receiver for .group'. Renamed to
option_container/option_containers (verified absent from body19).
2. G5 from_import_candidates bound 'matches = sorted(...)'. The
candidate_aliases fixpoint absorbed the name, writing
functions['matches']=None, which turned the pre-existing recursive
'matches(value, {name})' call into an 'unresolved command-capable call'.
Renamed to ordered_matches.
Evidence: pre/post None-valued functions-key diff isolates the pollution;
after the renames only unlooked-up names (never called, never attribute
receivers) remain newly-None, confirmed by a current-body lookup scan.
GREEN: smoke test passes in 245.7s with 261 shell commands + 86 Python
bodies and zero violations. No new unit test: the self-audit tests are the
regression pins for this self-hosting invariant.
Co-authored-by: Cursor <cursoragent@cursor.com>
|
G-batch fixes for the second exact-head review (G1-G7) plus H1 self-hosting fix, now pushed as 7638c51..1407f88 (9 commits). Second-review findings (comment 6169988457) addressed:
Follow-ups found during validation:
Evidence: full suite 187 pass / 0 fail in 900s (smoke 262s, 261 shells + 86 bodies, zero violations). Each fix has RED (fresh witness fails) and GREEN (witness + safe pins pass) runs recorded in its commit message. @codex review |
💡 Codex Reviewhttps://github.com/1XP-AI/gh-runnerd/blob/1407f88a58a796a7bec8b1736ca1e179dc8678d3/docs/evidence/g01-recovery-packet.md#L21477-L21479 When the sensitive operand is passed through an inline lambda or method call, such as AGENTS.md reference: AGENTS.md:L9-L9 https://github.com/1XP-AI/gh-runnerd/blob/1407f88a58a796a7bec8b1736ca1e179dc8678d3/docs/evidence/g01-recovery-packet.md#L21903-L21907 For AGENTS.md reference: AGENTS.md:L9-L9 https://github.com/1XP-AI/gh-runnerd/blob/1407f88a58a796a7bec8b1736ca1e179dc8678d3/docs/evidence/g01-recovery-packet.md#L21807-L21809 A callable container such as AGENTS.md reference: AGENTS.md:L9-L9 https://github.com/1XP-AI/gh-runnerd/blob/1407f88a58a796a7bec8b1736ca1e179dc8678d3/docs/evidence/g01-recovery-packet.md#L22074-L22077 For a local class whose AGENTS.md reference: AGENTS.md:L9-L9 https://github.com/1XP-AI/gh-runnerd/blob/1407f88a58a796a7bec8b1736ca1e179dc8678d3/docs/evidence/g01-recovery-packet.md#L12825-L12829 An exact-head heredoc such as AGENTS.md reference: AGENTS.md:L8-L8 https://github.com/1XP-AI/gh-runnerd/blob/1407f88a58a796a7bec8b1736ca1e179dc8678d3/docs/evidence/g01-recovery-packet.md#L22176-L22180 Both AGENTS.md reference: AGENTS.md:L9-L9 https://github.com/1XP-AI/gh-runnerd/blob/1407f88a58a796a7bec8b1736ca1e179dc8678d3/docs/evidence/g01-recovery-packet.md#L12972-L12975 An exact-head body containing AGENTS.md reference: AGENTS.md:L8-L8 https://github.com/1XP-AI/gh-runnerd/blob/1407f88a58a796a7bec8b1736ca1e179dc8678d3/docs/evidence/g01-recovery-packet.md#L22294-L22298 For AGENTS.md reference: AGENTS.md:L9-L9 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Issue #79 offline evidence hardening
Parent G01 #1 remains In progress. This PR changes only the evidence packet,
its isolated stdlib Python regression harness and scoped ADR 0004; it does
not complete G01/G02 or implement production Go/runner behavior.
Pushed review head:
db79bde7b40a17740e27f4671e0838bcaaeaa310(2026-10-14).Candidate batch: 18 commits over
74e865e(12 reflective-hardening closures + Go 1.26.9 toolchain requalification + 4 verification/fix units). Full isolated regression suite 176/176 PASS in 866s on the pushed head (smoke: 261 shell + 86 bodies, zero violations); static toolchain profile 4/4 OK;git diff --checkclean; no secret/private-path/token matches in the pushed range. Fresh@codex reviewrequested post-push; exact-head review and PR quick check pending before any merge decision. No merge claimed.Previous pushed review head:
74e865e5ed4c8096b4e0a83cb5897df11cb04310.Latest frozen local checkpoint:
2a2ee6c8ae397e2ce5a4703bca6f96d98ec8ca67,clean/unpushed, overall HOLD. Getter capability flow is limited to direct calls and simple
name aliases; unreviewed holder/conditional/walrus/callback escapes and
reflective helper results are refused before granting Path mutator authority.
Writer RED: eight assertions in 0.272s; final four changed-boundary methods
PASS in 5.531s, retaining owned direct reflected methods, string transform,
local set-copy, namespace and bounded Git verifier controls. Coordinator
read all 153 additions/12 deletions, verified clean hygiene and no added-line
sensitive-pattern matches. All earlier external/local P1 witnesses,
including the distinct untyped receiver/helper case, now REFUSE as inert
AST data; canonical verifier and string positive ACCEPT. No specimen was
executed or compiled. Writer settled/released. Exact-head contract delta
review completed scoped APPROVE: two pinned string/namespace methods PASS
in 0.299s on Python 3.14.3 with isolation flags; getter assignment chains,
unsupported escapes and helper result refusal add no method/source/compiler
allowlist. That reviewer settled/released. The security agent's final
transcript reports HOLD: its pinned Path selector PASS in 0.271s, but a
local function extracting
getattr(receiver, attribute)into a wrapped aliasand calling it with an unowned destination remains ACCEPTED when visible
arguments provide a temporary Path and
move_into. Coordinator independentlyreproduced the exact inert AST witness; no specimen was executed or compiled.
The agent stopped without worker_done after an inbox
consumer_fencederror.Following positive final-turn evidence and the recovery contract, the old
attempt was explicitly abandoned: no process/filesystem action, resources
retained. The same-task retry completed with an accepted HOLD report: one
pinned Path selector PASS in 0.267s, the function-internal unowned-destination
witness still ACCEPTS; an owned destination control also ACCEPTS. The retry
settled/released. No security approval or accepted completion is claimed for
the original failed attempt. One exclusive writer is correcting the confirmed
function-parameter reflection boundary with focused TDD.
One coordinator final packet selector PASSED
in 58.750s: 261 shell commands, 86 Python bodies, zero violations. No
latest-head full/119/compiler-self-audit/Go/CI/live pass, push or merge
is claimed. Final same-head approvals, stable push, hosted quick success and
fresh completed GitHub Codex review remain required.
Earlier frozen local checkpoint:
0cbe8207bd9333b181230ab6edc9da76fb4c61d0,clean/unpushed, overall HOLD. Reflective getter aliases, computed/variable method names,
unresolved Path method names and direct saved getter aliases now retain the
mutator provenance/ownership gate. Writer RED: three refusal assertions in
0.230s, then one direct-alias assertion in a two-test 0.241s run; final two
focused methods PASS in 0.239s. A malformed-fixture intermediate result is
explicitly excluded from GREEN evidence. Coordinator read the whole
134-addition/41-deletion delta, checked clean hygiene and no added-line
sensitive-pattern matches. All prior GitHub and local P1 witnesses REFUSE
in inert AST probes; canonical verifier and ordinary string transformation
ACCEPT. Qualified/imported builtins getters are refused by the existing
import allowlist. No specimen was compiled or executed. Writer settled and
released. One final packet selector PASSED in 59.274s: 261 shell commands,
86 Python bodies, zero violations. Exact-head contract delta review completed
scoped APPROVE: one pinned string selector PASS in 0.159s; static-name and
getter aliases preserve receiver/destination gates, ambiguous/unresolved
Path names fail closed, and direct-mutation checks remain unchanged. That
reviewer settled/released. Independent security review completed HOLD: one
pinned Path method PASS in 0.235s, but dictionary-held and conditional getter
aliases still ACCEPT an unowned Path-mutator destination. Coordinator
independently reproduced both variants and the reviewer's exact holder
witness as inert AST data. One same-name local-parameter hypothesis REFUSES
and is not classified as a confirmed additional issue. A distinct local
function with untyped
receiver/attributeparameters returninggetattr(receiver, attribute)does ACCEPT the unowned Path destination;coordinator confirmed that separate binding shape as inert AST data.
Security reviewer settled/released; one exclusive writer corrected
getter capability escape and unknown-receiver provenance in 2a2ee6c with focused TDD,
not merely adding another literal method spelling.
No current full/119/compiler-self-audit/Go/CI/live pass,
push or merge is claimed. Final same-head independent approvals,
packet integration, stable push, hosted quick success and fresh completed
GitHub Codex review remain required.
Earlier frozen local checkpoint:
513844225017403261b0aa2524837c079f7e8e81,clean/unpushed, overall HOLD. The immediate-call false positive and reflective wrapped
Path-mutator P1 below were corrected with focused TDD: string positive RED
in 0.166s; reflective Path negative RED in 0.215s; final two methods PASS
in 0.219s. Coordinator read the whole 66-addition/five-deletion delta,
verified clean diff hygiene and no added-line sensitive-pattern matches.
Inert AST probes now REFUSE the reflective tuple-wrapped Path case, all
four unique GitHub P1 cases, the earlier five and pattern capture; canonical
verifier and ordinary string replacement ACCEPT. No specimen was compiled
or executed. One final packet selector PASSED in 57.384s: 261 shell commands,
86 Python bodies, zero violations. Its immutable security review completed
HOLD: two tiny selectors PASS in 0.217s, but method-variable, concatenated-name
and aliased-getter forms of the reflective wrapped Path mutator still ACCEPT
an unowned destination. Coordinator reproduced all three as inert AST data;
literal-name wrapper remains refused. A sole writer corrected the
reflective provenance family with focused TDD in 0cbe820 above; packet success does not clear
this P1. Both reviewers settled/released. Contract scoped APPROVE: one
pinned string-compatibility selector PASS in 0.159s; direct-call ownership
checks are unchanged and inspected. This does not clear the security HOLD.
No latest-head full suite, 119-boundary
sweep, compiler-self-audit, Go, hosted or live pass is claimed. No push or
merge yet; same-head final approvals and stable push, hosted quick success
plus a fresh completed GitHub Codex review are required.
Earlier frozen local checkpoint:
1fde7b9ef333504885e31e173e6a4175c1c153db,clean/unpushed, integration HOLD. The final packet selector FAILED: one
test in 54.076s, 24 diagnostics. The new wrapped-method fallback mistakenly
classifies safe string
.replace(...)call results as borrowed filesystemmethods, including the canonical path-normalization helper. The exclusive
writer corrected this with focused TDD in 5138442 above; merge remains HOLD.
The four unique GitHub P1 cases below now REFUSE in coordinator
AST probes; the previous five cases and pattern capture also refuse, with
the canonical verifier accepted. Writer RED: five assertions failed across
four methods in 5.265s at 74e865e; GREEN: four methods PASS in 5.180s.
Coordinator read all 119 additions, verified clean diff hygiene and no
added-line private-path/credential-pattern matches.
The changed boundary conservatively rejects dynamic cwd-module imports,
unsupported sensitive-callable/mutator wrappers and function-global namespace
escape before granting Git-helper stability. No general wrapper interpreter
was added. The immutable namespace/helper-stability review completed scoped
APPROVE: one pinned selector PASS in 5.080s, canonical verifier accepted and
an additional aliased/computed function-globals escape refused as inert AST.
The immutable security review completed HOLD: two pinned cwd/runtime methods
PASS in 5.071s, but wrapped
getattr(source, "move_into")method extractionACCEPTS an unowned destination, unlike the equivalent direct method alias.
The coordinator reproduced this using inert AST; no specimen was executed
or compiled. The same exclusive writer corrected this P1 alongside the
call-result false positive in 5138442. Both readonly reviewers settled/released;
the namespace scoped approval does not clear either integration blocker.
No new packet/full/119/compiler-self-audit/Go/hosted/live pass,
push or merge is claimed. Same-head independent approval, stable push,
hosted quick success and fresh completed GitHub Codex review remain required.
Pushed
74e865ereview disposition: HOLD. Its exact-head GitHub Codex reviewcompleted at 2026-10-04T06:15:44Z with five entries in
comment 5977232555:
four unique blocking P1s, with the identical tuple-extracted hook finding
repeated twice and triaged once. No new inline or review-object findings.
Coordinator independently reproduced all four ACCEPT results as inert AST
data: a stored literal dynamic cwd-module import, tuple/subscript extraction
of a named-expression hook or owned-Path-mutator alias, and a fabricated
Git runner installed through a function's
__globals__dictionary. Priorfive findings and the pattern binder remain refused; canonical verifier
still accepts. No specimen, directory change, path move, hook, namespace
write or Git verifier program was executed or compiled.
The four unique escape/provenance cases were corrected by one exclusive
Codex GPT-6-Luna max writer in local 1fde7b9 above; final candidate approvals
remain pending. Project #79 returned to In progress. Earlier independent,
packet and quick success do not clear these new blockers; merge remains
HOLD and the next stable push requires a fresh exact-head Codex review.
Earlier frozen checkpoint:
74e865e5ed4c8096b4e0a83cb5897df11cb04310,clean, pushed as one two-commit correction batch after both immutable delta
approvals and final packet integration. Exact remote head was confirmed.
The five GitHub P1 cases and actual callable pattern-capture
replacement now REFUSE in coordinator immutable AST probes; the canonical
verifier remains accepted. The pattern test was RED with two assertions in
4.462s at e9ab4dc, then GREEN in 4.453s; namespace positive PASS in 0.292s.
Coordinator read the whole 64-addition delta and the preceding 214-addition/
six-deletion correction, checked cumulative diff hygiene, and found no
added-line private-path/credential-pattern matches. No writer remains active.
One exact-head packet selector PASSED in 57.863s: 261 shell commands,
86 Python bodies, zero violations. The immutable contract delta review
completed scoped APPROVE: one pinned runtime-dependency method PASS in
4.490s; an inert aliased static tempfile private-provider import also
REFUSES. Canonical-verifier positive and helper/pattern negatives remain
intact. Popen/collector implementation is unchanged but its stability proof
changed. The immutable security delta review completed scoped APPROVE:
two pinned hook/cwd methods PASS in 0.213s; aliased dynamic cwd imports,
wrapped Path mutators, computed private-provider reflection, direct and
pattern runner rebinding all REFUSE in inert AST controls, with canonical
verifier positive retained. Both reviewers used Codex GPT-6-Luna max.
At candidate push no writer or review worker remained active. Same-head hosted PR quick
37181826255
completed SUCCESS. Fresh Codex request
was posted at 2026-10-04T06:07:15Z; the summary reports Completed on
74e865eat 06:15:44Z with the four unique blockers triaged above. No full/119/Go
unit/race/full-matrix/live pass or merge is claimed. A completed exact-head
GitHub Codex review of the eventual correction head remains required.
G01 #1 remains In progress.
Earlier frozen local checkpoint:
e9ab4dc6b7ab6ef14f8dde5bc86d60d081cd04fa,clean/unpushed at entry, overall HOLD. The five GitHub P1 cases below now
REFUSE in coordinator immutable AST probes and the canonical verifier remains
accepted. Writer RED: four methods, 11 assertions failed in 3.949s; GREEN:
four methods PASS in 3.904s. The changed compiler-body self-audit passed in
43.062s and the cwd namespace positive in 0.292s. Each selector was invoked
twice because the initial combined invocation yielded before its completion
output was retained; the ledger records the captured individual results.
Coordinator read the entire 214-addition/six-deletion delta.
One adjacent actual helper-binding P1 remains ACCEPTED: a module-level
matchcaptures a fabricated callable intorun_bounded_git_querybeforethe origin query.
MatchAs.nameis a string binding field, not aName.Store,and the new stability guard misses it, so the fake origin can retain the
reviewed helper proof. This is an extension of the fifth finding below, not
a new external review URL. One exclusive writer corrected raw named
bindings with focused TDD in 74e865e above. No packet selector, independent
review or push was repeated on this known-unsafe intermediate head. Earlier hosted quick
success and packet results do not clear this new source boundary.
Previous
1fbd7a1review disposition: HOLD. That exact-head GitHub Codex reviewcompleted at 2026-10-04T05:30:35Z with five new P1 findings in
issue comment 5976946399.
There were no new inline or review-object findings. Coordinator independently
reproduced all five ACCEPT results from immutable source as inert AST data:
literal dynamic
contextlib.chdir, named-expression-wrapped output-hookand owned-Path-mutator aliases, dynamic
tempfile._os.readprovider patching,and rebinding the reviewed Git-query helper before the origin comparison.
The unchanged canonical verifier remains accepted; no specimen or recipe
was compiled or executed. All five are blocking security/provenance cases,
not routine P2/P3 items. Their local e9ab4dc/74e865e corrections and pending
final-head approvals are described above. Earlier packet/independent/quick
success never cleared the five blockers at the old head; #79 returned to
In progress during correction. The new pushed correction head now requires
same-head hosted quick success and a fresh completed GitHub Codex review.
Earlier frozen checkpoint:
1fbd7a1fd4c186036f6d367f385cf0f2165c6e30,clean, pushed as one correction batch after both independent delta approvals.
Four local/global/nonlocal/nested-comprehension hook-store assertions were
RED in 0.206s at 734ef68; five focused methods PASSED in 0.223s (the ledger
also records an actual 0.231s run). Coordinator read the full 75-addition,
two-deletion delta and independently corroborated all four witnesses
ACCEPT at 734ef68 and REFUSE at this head; known older cases still refuse
and the literal local callback remains accepted. Cumulative diff hygiene
is clean and added-line credential/private-path patterns reported no matches.
Named-expression stores now skip all enclosing comprehension scopes before
the existing containing-scope declaration and actual-cell ownership logic.
One exact-head packet selector PASSED in 55.996s: 261 shell commands,
86 Python bodies, zero violations. The readonly exact-head security delta
review completed scoped APPROVE: one pinned hook method PASS in 0.201s;
inert list/set/dict/generator walrus controls all refuse and the literal
callback remains accepted. The contract delta review completed scoped
APPROVE: one pinned sink method PASS in 0.211s, ordinary comprehension
targets retain their prior scope and the earlier cleanup/collector/origin/
provider/path/CWD/compiler proofs are unchanged. Both reviewers used
Codex GPT-6-Luna max with immutable Git blobs. No writer or review worker
remains active. Exact remote head was confirmed after an ordinary non-force
push. Same-head hosted PR quick check 37179670317
completed SUCCESS. Fresh GitHub Codex request
was posted at 2026-10-04T05:22:24Z; the summary reports Completed on
1fbd7a1at 05:30:35Z with the five blocking findings triaged above. No full suite,
new 119-helper execution, Go unit/race/full
matrix, live result or merge is claimed. A completed exact-head GitHub
Codex review of the eventual correction head remains required. Parent G01
#1 remains In progress.
Earlier frozen local checkpoint:
734ef68b6036f86f5a6ecc68014e9888e07de80f,clean/unpushed at review entry, overall HOLD. Two transparent
intermediate-function regressions were RED in 0.195s at 8f24ad6; five focused
methods PASSED in 0.220s (the ledger also records an actual 0.219s run).
Coordinator read all 108 additions and four deletions, confirmed all known
hook-flow/owner cases refuse and the literal local callback remains accepted,
and checked cumulative diff hygiene and added-line credential/private-path
patterns with no reported matches. Actual nonlocal ownership now uses raw
local-name bindings, skips unbound intermediate functions and treats
unresolved ownership as refusing rather than safe callback provenance.
One exact-head final packet selector PASSED in 56.417s: 261 shell commands,
86 Python bodies, zero violations. The independent security delta review
completed HOLD: two pinned hook/output methods PASS in 0.206s, but a
comprehension walrus store under
nonlocalhides the imported output hook.The coordinator independently confirmed both nonlocal and global versions
are ACCEPTED as inert AST data; no specimen was compiled or executed.
The assignment expression binds in the containing scope, not the
comprehension scope indexed by the scanner. One exclusive writer is fixing
this narrow ownership boundary with focused TDD. The immutable 734ef68
contract delta review completed scoped APPROVE with bounded AST-only
direct/nonlocal/global/transparent-middle/destructuring controls and the
benign local callback. Cleanup, collector, origin and provider proof source
is unchanged from 1377bad; this is continuity, not new test execution.
Security HOLD governs the whole candidate. No full suite, new 119-helper execution,
Go/hosted/live result, new push, GitHub review, merge or completion is claimed.
The 8d9bd7f 119-helper result remains historical. A stable push still requires
both independent reviews, followed by same-head hosted quick success and a
fresh completed GitHub Codex review with all findings triaged.
Earlier frozen local checkpoint:
8f24ad697700fe3b31d7240f472d2ba044bbe7cb,clean/unpushed at entry, overall HOLD. Six declaration-owned hook store
regressions were RED in 0.195s; five focused methods PASSED in 0.210s
(the ledger also records an earlier actual 0.211s run). Coordinator read
the entire two-file delta and confirmed the immediate global/nonlocal
import and alias-assignment store controls refuse, while the literal local
callback still passes.
Two additional inert AST cases nevertheless remain ACCEPTED: an import or
alias assignment through
nonlocalcrosses an intermediate function thatdoes not bind the name, then the outer function calls the stored hook. The
new owner calculation selects the first enclosing function instead of the
nearest enclosing function with the actual name binding. Runtime writes go
to the outer cell; the scanner indexes the intermediate scope and loses the
source. One exclusive writer is correcting this actual-cell-owner case with
focused TDD. No packet/119-helper/full sweep or independent review is repeated
on this known-unsafe intermediate head. Final new-head review and integration
gates remain required; no new push, merge or live operation is claimed.
Earlier frozen local checkpoint:
1377bad93401b8b437d6b5b1b009db55e65d417b,clean/unpushed at entry, overall HOLD after completed independent review. The two
module-global regression assertions were RED at 8d9bd7f in 0.182s; the final
four focused methods PASSED in 0.201s (the prose also records an earlier
actual 0.203s run). Coordinator read the full 26-addition/2-deletion delta,
confirmed every known hook-flow witness now REFUSES and a genuine local
parameter callback remains accepted. Cumulative diff hygiene is clean and
the added-line private-path/credential-pattern scan reported no matches.
The exact-final-head contract delta review completed APPROVE on immutable
1377bad: one pinned hook method PASS in 0.180s; the earlier approved cleanup
proof is unchanged and was not rerun. The security review completed HOLD:
two pinned hook/output methods PASS in 0.185s, but imports under function
globalornonlocaldeclarations are indexed in the lexical functionrather than the runtime module/enclosing-cell store owner. Both direct and
container-held sensitive hook calls can therefore pass. The coordinator
independently reproduced these cases and an adjacent global alias assignment
store: the copied hook is likewise lost when indexed at the wrong destination.
One exclusive writer is correcting declaration-owned imports and assignment
stores with focused TDD; previous read-routing fixes remain required.
One final packet selector PASSED at this
head in 54.918s: 261 shell commands, 86 Python bodies, zero violations.
The 119-helper result below remains pinned to earlier 8d9bd7f, not a
new 1377bad execution claim. Packet success does not clear the new P1 store
ownership finding. No final approval, new push, GitHub review,
hosted/Go/full-suite/live success, merge or issue completion is claimed.
Earlier frozen local checkpoint:
8d9bd7f0b28ba6423dc8fe1237b0c244a2ed5ca8,clean/unpushed at entry, overall HOLD. The writer's four new hook-flow RED
assertions failed in 0.184s, then four focused methods PASSED in 0.200s.
Coordinator read the complete 93-addition/27-deletion two-file delta and
independently confirmed nonlocal direct/container, saved-hook and global
lookup over an enclosing shadow now REFUSE; a genuine local callback remains
accepted. Unrelated class/default hypotheses refuse through existing unknown
caller guards and are not additional findings.
One coordinator integration command actually PASSED two methods in 59.373s:
119 actual compiler-helper boundaries, and the final packet selector with
261 shell commands, 86 Python bodies, zero violations. This is not a full
Python suite or Go/hosted/live result. It does not approve the candidate:
a subsequent inert AST control with a legal module-level
global emitdeclaration before the imported exception hook is ACCEPTED. The resolver
treats this module no-op as a failed recursive global redirect and erases the
hook's sink identity. One exclusive writer is correcting this narrow case
with focused TDD. No intermediate 8d9bd7f independent review is claimed or
requested on the already-known-unsafe source. Final-head independent delta
reviews, final packet verification, same-head quick success and completed
GitHub Codex review remain required. No new push, merge, issue completion or
live operation is claimed.
Earlier frozen local checkpoint:
746c1c148c882dede9ea9e12fc47bbec69855097,clean/unpushed at entry, overall HOLD. The writer reproduced six RED assertions across
three methods in 38.495s, then passed seven focused methods in 49.059s.
Coordinator read the complete two-file delta: 534 additions and 70 deletions.
Direct reachable timeout/error/normal/finally cleanup checks replace the
four-reference-only proof; the existing bare BaseException re-raise is
preserved, and all four false-condition cleanup variants refuse. Imported
hook references are scoped, and AST-node variables were renamed without a
callback/source-hash/marker exemption. Both new exact-head independent delta
reviews completed. Contract scope APPROVE: two pinned methods PASS in 3.713s,
but overall HOLD for the hook regression. Security overall HOLD: hook-shadow
and launcher-alias methods PASS in 0.174s, with two concrete remaining P1s.
Coordinator independently reproduced a new P1 regression: a nested function
declares
nonlocal emitfor an outer function's importedsys.excepthook.Both direct calls and container-held hook calls with an environment-bearing
exception are ACCEPTED at 746c1c1, but REFUSED at immutable 86f4f8f. Global-only
and unrelated-shadow negative controls refuse; a genuine local callback
remains accepted. The new alias resolver records nonlocal bindings but fails
to resolve the nearest enclosing nonmodule binding. All specimens remained
inert AST data; no hook/environment access or modified recipe was executed.
Both independent reviewers reproduced the nonlocal regression. Security and
coordinator additionally accept a saved hook after its source name is rebound:
saved = emit; emit = None; handlers = [saved]. That saved-binding bypass alsoexists at 86f4f8f and is not misattributed as a new regression. A coordinator
AST control also accepts a real module hook reached via
global emitwhenan enclosing function defines a same-name local callback: global must route
to the module rather than that intervening function. All three provenance
cases are assigned to one exclusive-writer follow-up; immutable 746c1c1 is
not approved. No packet/119-helper/full
suite is repeated on this known-unsafe head; no push, fresh GitHub review,
hosted/Go/live success, merge or issue completion is claimed.
Earlier local checkpoint:
86f4f8fcc4c54782079b8502b6f2359414a82203,clean/unpushed, overall HOLD. The nested-process RED failed two subcases in
1.951s at unchanged 6574b87; after the two-line subtree-reference correction,
eight focused methods passed in 7.855s. Coordinator read all 137 additions
and two deletions. Compiler-source provenance was unchanged and the earlier
119-helper result was not rerun or attributed to this head. Two independent
exact-head delta reviews were started; the security review is now completed
with HOLD. An unrelated nested parameter, function or class named like the
global imported
sys.excepthookalias erases the scanner's sink identity,letting a container call with an environment-bearing exception pass. Both
the independent reviewer and coordinator reproduced all three inert variants
against immutable 86f4f8f; the no-shadow form refuses. A scope-aware correction
is required. The contract/pipe review also completed with HOLD: moving the
timeout termination call into an uncalled nested function still satisfies
the scanner's four-reference count. The following
process = Noneandraise then skip the final cleanup, leaving the owned timed-out process
group without a reachable termination path. This is an inert AST/source
reproduction, not an executed process leak or kill test. The sole writer
is correcting scope-sensitive hook provenance, reachable per-path cleanup,
and the compiler self-audit regression below; no final approval is claimed.
One final packet selector actually FAILED at 86f4f8f in 50.995s, with one
canonical compiler self-audit violation: packet line 7412, unresolved
command-capable callback/target
callon body line 2263. This is a normalAST-helper path regression and must be corrected before a stable push.
The completed contract review traced it to unrelated pure AST-analysis
loop/comprehension bindings named
call; a data-only rename control clearsthe finding. Replacing the synthetic
ast.Callprobe did not clear it,so that earlier hypothesis is explicitly negative, not a fix result.
No packet pass, full Python suite, hosted/Go/live result, new push or fresh
GitHub review is claimed. Remote remains 034c131.
Earlier local checkpoint:
6574b875297a70aa1a644415433c7d797e726c97,clean/unpushed, still HOLD. The writer's 12 focused methods passed in 7.354s,
with a separate 119-helper method PASS in 4.097s. Coordinator read the entire
274-addition/3-deletion delta. Exact-source AST probes confirm direct stdout
mutation and imported-hook container escapes refuse, and the canonical
compiler namespace is accepted again. The same false-clean P1 nevertheless
survives through nested function and lambda captures of the authoritative
Popen object; both were independently accepted by the coordinator's pinned
6574b87 scanner. No hostile code was executed. A compact closure correction
is active. No packet/full suite, new push or fresh GitHub review is claimed.
Earlier local checkpoint:
82fe7ba3619595f7cd92a337bacf12c8f81877b6,clean and unpushed, overall HOLD. Its final focused selection passed eight
tests in 9.892s, including 119 actual compiler-helper calls. The coordinator
read all 555 additions (packet 294, harness 261; no deletions). The four
reported GitHub P1 corrections received completed independent delta reviews,
both overall HOLD. The contract reviewer passed the pinned provider selector
but confirmed two status-stdout suppression variants. The security reviewer
also confirmed imported
sys.excepthookname aliases in list/tuple/dictionaryholders bypass the storage guard (direct calls refuse), and that the unchanged
canonical scanner-namespace recipe is wrongly rejected by the new cwd guard.
The coordinator corroborated the hook and canonical-positive results using
immutable Git objects and inert AST only. No security full/unit sweep is claimed.
A sole-writer follow-up batch covers all three remaining defects; the
coordinator's status-stdout suppression witness is still accepted at exact
82fe7ba and is not fixed by module-provider stability alone. No packet-wide
or full suite was repeated on this known-unsafe candidate; no new push or
GitHub review request is claimed. Remote head remains 034c131.
Earlier pushed checkpoint:
034c131329a00f315b81bd11956e1fd0744037ee,clean and pushed, with both independent exact-head delta reviews APPROVED.
The coordinator read all 212 additions (two files, no deletions); the writer's
four focused methods PASSED in 8.301s with 119 actual helper controls. One
coordinator final packet-wide selector PASSED in 51.945s: 261 shell commands,
86 Python bodies, zero violations. The collector now rejects break/yield,
additional loops/comprehensions and continues outside the four canonical sites.
The new status-break, early-continue, extra-loop and corrected two-yield AST
controls refuse while the real collector remains accepted. The full 169-test
result below is pinned to earlier 062fade, not automatically certified for
034c131. Contract delta review's collector method passed in 3.085s; security
delta review ran no additional tests and reused unchanged earlier boundaries.
No specimen, verifier recipe or live operation was executed.
The same-head hosted PR quick check
SUCCEEDED: build, formatting, vet, root/changed-offline-module test compilation,
dependency/license checks and vulnerability check. Offline tooling regression
and workflow-contract execution were skipped by scope. This is not a Go
unit/race or Python full-suite execution result. A fresh exact-head Codex
review request
completed for 034c131 in review 5401702605.
Merge is HOLD: four new P1 findings were independently reproduced as accepted
inert AST against both immutable packet and harness scanners: container-stored
exception hooks (finding),
container-stored new Path mutators (finding),
rebound collector dependencies (finding),
and contextlib cwd changes before relative reads (finding).
No hook, mutation, synthetic collector recipe or cwd change was executed.
These blocking findings are being batched into one local correction; a new
pushed head requires new independent delta sign-off and exact-head Codex review.
Earlier internal approvals and hosted quick success do not clear the findings.
The coordinator also reproduced an adjacent pipe-provenance P1 on immutable
034c131 (no external finding URL): inserting
if "status" in command: process.stdout = Noneimmediately after the canonical Popen assignment isaccepted as inert AST. Suppressed status stdout can incorrectly certify a
clean worktree. This is included in the same local correction family; no
process, modified verifier or specimen was executed, and no fixed result is
claimed yet.
Earlier frozen local checkpoint:
062fade5d0b3f5067a9620b9cd91c6ff9de4abb0,clean and unpushed; both independent reviews are complete with overall HOLD.
The coordinator read the complete 980-insertion/131-deletion delta and ran
one complete offline suite: all 169 tests PASSED in 166.716s, including 119
actual compiler-helper checks and the current packet scan (261 shell commands,
86 Python bodies, zero violations). The writer's five focused methods passed
in 7.367s. This does not certify Go/hosted CI or any live operation. Parameter
set-copy inference was removed, and actual pipe/chunk/budget/returned-buffer
provenance checks were added. The contract review's two focused methods passed
in 2.596s, but it independently confirmed the coordinator's accepted conditional
early-break AST witness for a
statusquery and classified it P1: the subsequentclean-worktree consumer trusts empty captured output. The security review's two
assigned methods passed in 0.886s and confirmed kwargs/seeded Path controls;
overall approval is likewise withheld for the collector finding. A related
coordinator pinned AST probe accepts fabricated two-yield output, without any
claim that a specimen or full verifier executed. The sole writer subsequently
implemented a compact closed-control-flow correction and new data-only controls.
Review is not approved on test success alone. No new-head push, GitHub review or merge is
claimed; the remote head remains 6a069ab.
Earlier local checkpoint:
628c3b4d1171fc63c2120e5bf78c9c4f0c891e90,unpushed and HOLD. Complete tiny delta audit confirmed only the corrected
seeded destructuring test and evidence attribution/ledger changes; scanner
and executable fences are identical to dba804f. The corrected Path selector
passed one test in 0.176s. Both independent dba reviews nevertheless retain
HOLD on new actual P1s: changing the inner collector to unbounded communicate
or fabricated expected-origin bytes is accepted (contract selector PASS
0.721s; coordinator corroborated both mutants with immutable Git inputs),
and an expanded
**kwargsargument can supply an unowned Path to thedefault-set helper copy exception (security selector PASS 0.311s, actual
pinned unsafe witness ACCEPTED). The three seeded binding regressions were
refused; the latter is a different caller-binding gap. The sole writer then
implemented a batched collector-byte-provenance correction and removal of the
unnecessary inter-helper parameter-copy exemption. The historical full-suite
success below remains true, but does not clear these newly reproduced
blocking findings. Remote head remains 6a069ab; no push or merge is claimed.
Frozen tested core checkpoint:
dba804f69cafcf2a1f171ad72a3db98288b70ed8,unpushed. The coordinator read the complete 499-insertion/92-deletion delta;
one complete offline run PASSED all 168 tests in 160.796s. It included 119
actual helper checks, ten historical loader controls and the current packet
scan: 261 shell commands, 86 Python bodies, zero violations. This is actual
offline evidence at dba804f, not a Go/hosted/live result. It follows the writer's
five-method PASS in 45.850s and expanded active-result selector PASS in 0.741s.
The correction requires a reachable bounded capture whose returned streams
are uniquely bound, restores the original verifier assertions, rejects the
confirmed set-to-Path binding variants, and refactors internal visited-set
clones to explicit set construction without new source/helper allowlists.
Independent pinned-core contract/security reviews subsequently reported HOLD.
A tiny test/prose-only correction followed: restore the missing set seed in the
destructuring regression and correct a ledger SHA/count attribution. Scanner
and executable fences are frozen; no new-head GitHub review, push, merge or
automatic whole-suite certification of that later correction is claimed.
Earlier local checkpoint:
a9d602e5bce88545a8652e9d4286b35cea985fd4,unpushed and HOLD. Its 15 focused methods passed in 10.789s with 119 actual
helper checks and ten loader controls. Coordinator inspected the entire
597-insertion/4-deletion correction delta. The exact packet selector FAILED
in 23.713s on one compiler self-audit violation: the new comparison proof's
runtime
type(...)call. Complete source audit also found older verifierassertions displaced into unreachable code after a new staticmethod return;
they must be restored, not deleted. A bounded immutable-a9 AST-only probe
additionally reproduced a P1: after a set seed, loop-target or destructuring
rebinding of
seento an unowned Path still permits its copy to an unowneddestination; a nested-global retarget was likewise accepted. Literal-set copy
remained accepted; conservative dictionary-copy refusal is unsupported behavior,
not an unsafe-acceptance blocker. Independent security review passed its capture
selector in 0.806s and confirmed raw/alias/decoded output, removed/dead comparison
and expected-URL-rebinding controls, but held the Path-copy and integration gaps.
Independent contract review passed two scoped selectors in 5.285s and held a
further actual unbounded-capture bypass: the bounded collector can remain under
if Falsewhile the live collection assignment usesprocess.communicate().Coordinator corroborated this acceptance using both harness and packet loaded
from immutable a9 Git objects, with no recipe/process execution. The sole writer
owns these scoped corrections. No new push, hosted run, whole-suite pass, or
merge is claimed.
Earlier local checkpoint:
3e597eb276fd473f788d86e7136f6903700f53f0,unpushed and HOLD. The three new GitHub P1s were reproduced RED (three methods,
15 unsafe assertions, 0.168s); the correction passed 13 focused methods in
5.567s with 119 helper checks and ten historical loaders. The coordinator's
exact packet selector FAILED in 44.815s on two compatibility regressions:
five bounded Git helper call sites and benign non-Path
seen.copy().Independent contract review passed three scoped AST methods in 0.178s and
refused forwarded-sensitive-query/aliased-builder probes, but held the same
integration regressions. Independent security review additionally reproduced
a P1 on immutable 3e597eb: the actual packet verifier remains accepted as
inert AST data after printing captured origin stdout/decoded results or
removing its expected-origin comparison. Capturing output alone is not the
required captured-and-compared proof. The sole writer now owns this correction
and the two compatibility regressions. Neither old approvals nor the earlier
same-head hosted success clears these current blockers; no new push or current
whole-suite/packet success is claimed.
Earlier 6a069ab checkpoint:
The stable correction batch was pushed once after both GPT-6-Luna/max independent
delta sign-offs. Contract APPROVED with two pinned methods passing in 0.168s;
security APPROVED with two methods passing in 0.163s, eight OS re-export probes
refused and two benign controls accepted. Their unchanged earlier root/guard,
loader and isolated-Git assessments were reused rather than repeated.
Project #79 is back In progress. Same-head hosted PR quick run 37123674015
SUCCEEDED: root build/vet/format/test compilation/dependency/license/vulnerability
checks. Changed-tooling and workflow regression steps were skipped by scope;
no Python/full-unit/race execution is implied. Fresh GitHub Codex request
completed at 6a069ab with review 5400894000
and three new P1 findings, all triaged blocking: sys.excepthook output,
Python 3.14 Path mutators,
and Git builder sensitive output.
One exclusive writer owns focused AST-only reproductions and a batched minimal
correction; prior independent approvals and hosted success do not clear these
new findings. No merge is authorized until fixes and a fresh exact-head review.
Earlier GitHub Codex review
5399684772at fe38cc1 had three P1 findings;their local fixes and subsequent reproduced regressions are recorded below.
The coordinator read the final correction's complete
82-insertion/20-deletion delta, confirmed a clean tree, and found no added-line
private-path/credential-pattern matches or diff whitespace errors. Five focused
methods passed in 5.292s with 119 actual helper checks and ten historical loaders.
The exact frozen 6a069ab packet selector PASSED in 45.732s: 261 shell commands,
86 Python bodies, zero reported violations. No current whole-suite pass is
claimed. No compiler-input/source revision/helper allowlist or dependency was added.
Earlier
e7206034600adcae9afae2738dd7be690209ea48was held. Its fifteen focusedmethods passed in 13.564s with 119 actual helper checks and ten historical-loader
controls; the coordinator read its complete 258-added-line delta. It fixes the
prior historical Git positive fixtures, current-loader mutation target,
repository-root binders and reads inside refusal guards. The subsequent full
offline run executed 163 tests in 96.557s and FAILED one assertion: an inert
pathlib.os.removespecimen was unexpectedly certified after the OS receiverguard was narrowed to subprocess. The packet selector within that run PASSED:
261 shell commands, 86 Python bodies, zero reported violations. This is not a
whole-suite pass. Both independent exact-e720 reviews completed HOLD on that
same reproduced re-export regression; unchanged root/guard and loader/Git
closures were verified. The sole writer subsequently committed the minimal
6a069ab correction and was processed/released/acknowledged. No adversarial body
was executed. The later stable batch push is recorded above; no merge, new
GitHub Codex completion for that earlier checkpoint was claimed then; the later
6a069ab hosted success and completed blocking review are recorded above.
Earlier
e0c8156ca81d680448918c4ff1ca9c4e353d575apassed twelve focused methodsin 13.200s but its full 163-test run FAILED four assertions in 96.757s. Both
independent reviews held annotated/augmented repository-root retargets and a
read inside a symlink refusal branch before continue. A NamedExpr probe raised
AttributeError, recorded as fail-closed robustness rather than unsafe acceptance.
Earlier local checkpoint
05044cfc34a76528d1c8d4baa6a8a195ee59c323was held:ten focused methods
passed in 10.087s with 119 actual compiler-helper checks and historical-loader
controls, but the exact frozen packet selector FAILED in 42.123s with two
violations (new helper's unresolved
calltarget and remaining unisolated Git).The coordinator read its entire 799-insertion/102-deletion two-file delta.
A sole writer then owned those two compatibility fixes and two independently
reproduced tracked-path blockers. Both pinned 05044cf assessments completed
HOLD: contract reproduced accepted nested-global repository_root retargeting;
security reproduced accepted dead lexical/symlink guards wrapped in if False.
The dead symlink check could certify reads of an untracked private file inside
the repository, while changed-root proof could permit reads outside the
original repository. Specimens were AST data only; no symlink/body was executed.
The environment-forwarding mutator hypothesis was rejected by existing guards,
with direct/read-only-forwarded positives accepted; it is not a new defect.
Contract confirmed all seven historical fences and no widened SHA/compiler/
helper allowlist or dependency. Prior 128-helper evidence is historical, not a
claim about this 119-helper candidate. Both read-only reviewers were processed,
released and acknowledged; the exclusive writer subsequently completed. No further
push, hosted check or merge is claimed.
Earlier local checkpoint
3b7202bca95d647e495363703b0a805d58c52d2eincluded thePython, Git-isolation, private-module and callable/argv corrections but was held.
Coordinator full delta audit found builder rebinding and direct/aliased
argv-list mutation at the earlier
7abfdf25bc3af4cd4eca964ace1410df6c7dddcb:two new methods were RED with four genuine unsafe expected-refusal failures
in 0.157s; three safe controls remained accepted. The correction's six focused
methods passed in 5.615s with 128 helper checks and ten historical loaders.
The exact frozen 3b7202b packet selector FAILED in 43.662s with ten reported
violations: root/helper dynamic argv, tracked Markdown path-read provenance,
and remaining literal Git calls without the new isolation prefix. A separate
writer then owned executable-prescription compatibility. Both pinned 3b7202b
contract/security reviews completed with integration HOLD, not final approval.
Contract: the two binding/argv methods passed in 0.189s, reflective globals
rebinding was refused and an unrelated same-name local parameter remained
accepted. A sibling-target chained argv assignment was identified in source
but not probed by that reviewer. The later writer reproduced one unexpected
acceptance in 0.163s and changed canonical argv certification to sole-target
assignments; it is included in the 05044cf focused results, not merge approval.
Security: bare Git, saved builder aliases, saved-argv mutation and private
tempfile reflection were refused, while canonical isolated Git and public
tempfile/pathlib controls remained accepted. No additional reproduced blocker
was reported. Both read-only reviewers were processed, released without
closing their external terminals and acknowledged. These 3b7202b assessments
do not approve the later 05044cf source or its subsequent mutable correction.
Independent Codex GPT-6-Luna/max APPROVED only the earlier two Python
corrections at immutable
35c18f3d6f564273287acbff2c103599e05505d4:two focused methods passed in 0.006s, with two additional reflective sink
probes refused. This is not integrated-candidate or merge approval.
An adjacent private stdlib module escape was independently confirmed P1/HOLD
at that immutable SHA: inert AST-only direct and imported-alias/reflection
probes accepted
tempfile._shutil.rmtreeagainst a synthetic path, while abenign public tempfile/pathlib control remained accepted. No specimen was
executed. The later local Git/private-module corrections are recorded below;
the eventual stable 6a069ab push is recorded above.
The writer's earlier mutable-tree checkpoint records Git RED 12 assertions in
0.131s across two methods and private tempfile RED four assertions in 0.128s,
followed by targeted GREEN. The final writer selection passed 20 methods in
5.533s with 128 compiler-helper checks and ten historical loaders. Those results
did not certify the builder/argv-mutation gaps at the 7abfdf2 local checkpoint.
The later 05044cf correction includes bounded current-recipe compatibility,
removal of the generic anchors(path) read exception, and direct/aliased/nested
Git-derived Markdown-list mutation and loop-target rebinding negatives. Actual
source-list RED was three unexpected acceptances in 0.399s, plus one nested
mutation in 0.387s. Seven old source transcripts were visibly made inert text
with their code/results retained; the active wrapper, Markdown audit and
synthetic Git status control remain executable. Their historical classification
and the final corrected source still require independent approval.
The finding ledger in the packet retains immutable review URLs, actual
RED/GREEN results, historical failures and bounded limitations.
GitHub Codex review of
d618c229197797f7896d6e72c2e5630b0fd30d62reported three P1s. All have inert regression reproductions and local fixes:
--no-replace-objects; current executable reader prescriptions use it.Both independent reviews then retained HOLD on immutable
29ca0d57forparameter-shadowed extraction bounds and same-line reassignment. The final
delta fixes lexical fallback, requires immutable deferred module bounds,
uses statement-end/read-start line-and-column ordering, and preserves the
legacy direct compiler-slice base-name allowlist. No new historical source
revision or compiler-input name was added. Shifted-marker probes established
no additional confirmed P1 and received a scoped nonblocking disposition,
not a universal safety claim.
Actual verification
fe38cc195617ee1d71e3704e7ff6b3e7e2880ed7packet selector passed in 40.704s: 331 shell commands, 95 Python bodies, zero reported violations.git diff --checkpassed and the added-line private-path/credential-pattern scan found no matches. The 6a069ab hygiene and independent approvals are separately reported above; its same-head hosted quick passed, but completed GitHub review reported three blocking P1s. Current local HOLD is recorded at the top.All adversarial programs remain AST/token data. The full current Python suite
ran and failed as recorded above; no whole-suite success,
product-live result, credential access, Scale Set operation, runner/host-service
mutation or workflow dispatch/replay is claimed. Rollback remains a reviewed
revert of this issue's tooling delta, retaining unrelated evidence/product code
and explicitly reopening any removed safety coverage. Merge requires exact
final-head Codex completion, triage of all findings (including stale ones),
independent delta approval and same-head hosted PR quick success.