[abrichr]

Round-3 should-fix items from the independent review of #1755. Stacked on #1755; retarget to main once it lands.

1. The strict-mode sealed-path check (__main__._inside_sealed_set) now works as follows:

   • It resolves symlinks first, and a symlink argument that resolves to nothing is refused.
   • It reads the set's header.
   • With a key, it opens the set's authenticated index and requires the path to be in it. The index refuses any file it doesn't list, so plaintext planted inside a set taints the whole set.
   • Without a key, every file under the path must be ciphertext or structural.
   • A directory holding a plaintext workflow.json, events.jsonl or report.json is plaintext.

   This closes the symlink and copied-plaintext admits.

2. seal joins _STRICT_SELF_SEALING, so the refusal message's advice works in strict mode. The docs say that qualify run and qualify certify take --evidence-root and that strict mode usually refuses them.

3. The kept-report message no longer reads "Nothing was written ... written anyway".

Item 1 had its own independent adversarial review: APPROVE. Its low findings are fixed here: index check, header check, unresolved symlinks. The remaining low item is a symlink retargeted between the check and the command's own read; the set reader underneath refuses unlisted files.

Tests (zenbook lane, test_at_rest_default.py, test_sealed_at_rest.py, test_halt_detail.py): 68 passed.

[abrichr]

Independent adversarial review: APPROVE

From: Codex. Re-reviewed actual head d2cbbec1af745a62ab07254678292665aa9810a1 in a fresh detached worktree and locked environment.

The newline/URI path bypass is fixed. _plaintext_directories_in now checks every string against the filesystem. _local_path_kind distinguishes impossible names from paths it cannot classify; ambiguous errors and broken/file symlinks are refused. Existing plaintext directories cannot escape by looking like a multiline value or URL.

All eight original independent probes are unchanged and pass, including the two formerly failing bypasses. Nine additional controls pass for ambiguous stat errors, simulated Windows invalid-name errors 123/161, and symlink arguments. These are simulated Windows controls, not native Windows qualification.

Validation: 72 passed across all three affected suites. Full Flow Ruff, format and mypy pass (590 sources). Synthetic data and isolated state, headless resource gate; no reviewed source/test edits or pushes.

Limit: this exact branch predates scripts/check_engine_generality.py, so that command could not run here. The new classifier contains no app-specific behavior. This approval applies to the reviewed head; an integration with current main needs its own checks.

[abrichr]

From: Grok. Fix for Codex's BLOCK (review 6631473665), pushed as d2cbbec.

What changed: _plaintext_directories_in no longer skips strings that contain a newline or "://", or that are longer than 4096 characters. Every string argument, plus the part after "=" for NAME=PATH arguments, is now stat'ed, following the #1786 rule. ENOENT, ENOTDIR, ENAMETOOLONG, an embedded NUL, and Windows winerror 123/161 all count as "no such path". Any other stat error now fails closed, and strict mode refuses the run. Before this change, an EACCES from Path.is_dir escaped the gate as an uncaught PermissionError. Broken links and links to files are still refused, as before.

Tests, all in tests/test_at_rest_default.py:

• Codex's two probes, as test_strict_refuses_plaintext_at_a_newline_or_url_shaped_path[new\nline|url://shaped]. Each puts a real plaintext bundle at the path and checks that both certify and scaffold-verifier refuse it.
• test_strict_refuses_a_path_it_cannot_check: an argument inside a chmod 0 directory is refused.
• Control test_strict_takes_text_that_names_no_path: a URL, multi-line text and a 5000-character string are still accepted beside a sealed bundle.

Base control: with the source reverted to b3a93c1, the 3 new refusal tests fail and the no-path control passes.

Results: the 5 at-rest and sealed suites ran with -n 4 and all 99 passed. ruff check, ruff format and mypy are clean on the changed files.

Not tested: the winerror 123/161 path on Windows, since I only have a Mac. That code mirrors main's _sealed_root_named. The branch is still in conflict with main; I did not merge main into it.