D13 audit: requires none / opaque on extdeps ops (134 none, 120 opaque; 267 Network)

[gunbai-bot]

D13 Network audit, second half: every dag/extdeps operation now carries exactly one requires clause (521 of 521; shell.Exec.RunArgvStdin arrived from #12973 and is opaque like its siblings). This PR adds the requires none and requires opaque rows; #12965 already landed requires Network. The selection rule and per-class citations are in docs/plans/d13-network-audit.md; each verdict lives only on its operation's clause.

Partition

clause	count
requires Network	267
requires opaque	120
requires none	134

Rule additions (rulings 2026-10-02, after the HOLD review)

• Runtime program in an argument → opaque. This covers scripts, expressions, inner argv and executing templates, and also program-executing options reachable from an unrefined string (git grep -O).
• Remote-selecting option in an unrefined string → Network. An example is systemctl -H. The exception is when the argv structurally prevents it (--, or the string is an option's value).

Reclassified (66 from the first two rounds, then 62 for repository-selected executables)

• Manager rulings (7): tmux.Session.New → opaque; hostnamectl.Process.Run → Network; systemd.Systemctl.ListUnits, ListUnitsAllLoaded → Network; sed.Sed.InPlaceSubstitute, ScriptsSuppressAutoPrint → opaque; browser.Page.Evaluate, browser.Element.EvaluateOn → opaque.

• Re-audit, remote option (16): systemd.Systemctl Enable, Restart, DisableNow, Start, Stop, ResetFailedUnit, KillUnitTerm, MaskNow, SetProperty, RevertMemoryCaps, IsActive, ShowProperty, ShowUserProperty, ShowLoadState, Status → Network ({unit} is an unrefined positional before which no -- appears). http.Client.PostStdinWithinUnixSocket → Network ({url} can carry -K/-x).

• Re-audit, runtime program (2): git.Inspect.GrepMatchesAtRevision, GrepFixedAtRevision → opaque (-O<pager> through {pattern}/{ref}).

• Second rulings (40): live browser page → Network (Context.Launch, Page.CurrentUrl, Page.Title); runtime positionals to the unverifiable playwright-runner → opaque (Context.Close, Page.WaitForSelector, QueryAll, Click, Fill, UploadFile, Screenshot, Wait, Element.IsVisible, InnerText). Git reads that may lazily fetch in a partial clone → Network: git.Core TrackedWorktreeDiffFromInRepo, Diff, DiffNameOnly, DiffNameOnlyNoRenames, DiffNameOnlyMerge, DiffUnified0, DiffNameStatus, LogPathCommits, Show, RestoreBlobTo, CheckoutNewBranchAtInRepo, CheckoutBranchInRepo, MergeNoEditInRepo, CatFileBlobInRepo, ResetHardInRepo; git.Worktree.Add; git.Inspect ReadTreeIntoIndex, ListTreePathsAtRevision, ListTreeEntriesAtRevision, MergeTreeWriteTree; git.Plumbing CatFileBlob, CatFileExists, CatFileSize, UnpackObject, ReadTreeIntoIndex, ReadTreeIntoIndexPrefixed, CheckoutIndexToPrefix.

• Kept none by ruling: jq Process.Run*; rustc.Check.CheckSourceText (fixed argv admits no --extern/-L/-Z); cron.Tab.Replace and git.Core.ConfigLocalSet (they store a program but execute nothing). Host resolver configuration (NSS, DNS) is the sandbox's environment, not demand.

• Third ruling, repository-selected executables → opaque (62; 21 were none, 41 were Network):

  • git hooks/filters/drivers/fsmonitor/post-index-change/reference-transaction:
    • git.Core: WriteTreeInRepo, TrackedWorktreeDiffFromInRepo, Diff, DiffUnified0, RestoreBlobTo, AddAllInRepo, CommitInRepo, CheckoutNewBranchInRepo, CheckoutNewBranchAtInRepo, CheckoutBranchInRepo, MergeNoEditInRepo, UpdateRefCompareAndSwapInRepo, ListUntrackedInRepo, ResetHardInRepo
    • git.Worktree.Add
    • git.Inspect: WorkingTreeStatus, ReadTreeIntoIndex, StatusAgainstIndex, IgnoredAgainstIndex, IgnoredFiles, MergeTreeWriteTree
    • git.Plumbing: HashObjectWrite, ReadTreeIntoIndex, ReadTreeIntoIndexPrefixed, AddAllIntoIndex, UpdateIndexCacheInfo, WriteTreeFromIndex, CheckoutIndexToPrefix, CreateRefIfAbsent, AdvanceRefIfExpected, DeleteRefIfExpected
    • git.PublicationTransport: RecordCommit, RecordEmptyCommit
  • git transports (credential helper, core.sshCommand, uploadpack, pre-push):
    • git.Core: LsRemoteHeads, FetchNoTags, FetchPrune, LsRemoteRefInRepo, FetchForcedRefInRepo, FetchForcedRefInRepoTrustingSource, PushForcedRefInRepo, PushRefInRepo, PushRefWithLeaseInRepo
    • git.PublicationTransport: PushRefUpdate, PushRefUpdateWithLease
  • Cargo build scripts / proc macros / aliases: all 13 cargo.Build operations, including Fmt.
  • npm.Ci IgnoreScripts and IgnoreScriptsOffline (.npmrc git).
  • Agent CLIs: claude.Invoke.Run, llm.Anthropic.CliPrompt, llm.Codex.Review.

• Fourth ruling (27; 14 were none, 13 Network). Index reads → opaque, because fsmonitor can run on the first index load and :path revisions read the index:

  • git.Core: LsFiles, LsFilesUnmergedInRepo, LsFilesStageZPathspecInRepo, LsFilesStageZInRepo, CommitTreeInRepo, RevList, RevParseInRepo, ReflogInRepo, DiffNameOnly, DiffNameOnlyNoRenames, DiffNameOnlyMerge, DiffNameStatus, Show, CatFileBlobInRepo
  • git.Inspect: MergeBase, ResolveRefCommit, ShowTree, ListTreePathsAtRevision, ListTreeEntriesAtRevision
  • git.Plumbing: CommitTree, ObserveRef, CatFileBlob, CatFileExists, CatFileSize, UnpackObject

  Toolchain proxy in an input cwd → opaque: rustfmt.Parse.Files (rustup rust-toolchain.toml) and typescript.Compiler.Compile (project .npmrc). cargo --version and rustc --version take no cwd input, so they stay none.

• Fifth ruling: codex_app_server.Cli.GenerateJsonSchema → opaque, because argv[0] is the caller-supplied CodexAppServerExecutable.path, a runtime-selected program.

Narrowing the inputs instead (argv termination, typed sed subset, sandbox) is listed as follow-ups in the doc.

Incidental repairs

• I imported GET in the docker inspect/stats modules, and retired the coreutils_stat.dag#get and sha256sum.dag#get roster rows as NotAReference.
  • An earlier head retired them as ImportsFixed, which was false: neither file imports anything for get. get is a std.algebra profile method with no importable declaration.
  • The pair stopped being derived because the parsed reader does not read get(...) as a bare reference. That is the same cause as grub.dag and 35 other get rows.

Gate gap (follow-up)

The floor's unimported-bare-provider gate (v2.workflow.floor_unimported_bare_provider_debt unimported_bare_provider_row_standing) does not catch a false ImportsFixed. A retired row is checked only for not-carried-and-file-present; that check is identical for ImportsFixed and NotAReference. So the cause is unverified: no check asks whether the file's imports actually changed to name the provider. The RosterStale message also recommends ImportsFixed unconditionally, which is how the wrong cause was written here. Holding ImportsFixed true would need the host to supply, per row, whether the file now imports the pair's provider. Otherwise the gate should name both causes and let the author choose.

• I imported Filesystem in gunbc.runner_microvm_boot_probe. requires none / requires opaque in both seeds; an absent requirements edge is undeclared, not none (D13 ruling B) #12960's std.resources made the bare read ambiguous.

D13 step (b) stays ordered after this population lands.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-02T03:35:34.134932Z	07b6e25	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 07b6e25a56

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Mark runtime tmux commands as opaque

inner_argv is appended as tmux's trailing new-session [shell-command], so a caller can supply a program such as curl that opens a non-local connection. Classifying this operation as requires none consequently derives an empty demand for an arbitrary runtime program, unlike the equivalent systemd-run command_argv operations; use requires opaque so callers receive DemandUndecided rather than silently appearing network-free.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Require network for remote-capable hostnamectl arguments

This handler accepts a generic ProcessArgvExpansion, and hostnamectl --help documents -H --host=[USER@]HOST Operate on remote host; supplying that option makes the process open an SSH connection (confirmed locally by its attempted connection to port 22). The service boundary itself does not restrict the expansion to the sealed hostname-setting plan, so requires none under-declares valid inputs and should be replaced with a network requirement or a network-incapable argument type.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Do not classify remote-capable systemctl patterns as local

When pattern is --host=<host>, this exact systemctl list-units ... {pattern} argv treats it as the documented global option -H --host=[USER@]HOST Operate on remote host and attempts an SSH connection, because option parsing continues after the verb. Thus this operation may contact a non-local endpoint despite requires none; either prevent option-shaped patterns with an option terminator/refined type or declare the Network requirement.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Treat executable sed expressions as opaque

GNU sed expressions can contain the e command, which executes a shell command; the installed help explicitly notes that --sandbox disables e/r/w, but this argv does not enable that mode. For example, an expression such as 1e curl … can open a network connection while this operation contributes no demand, so the unrestricted runtime expression must be classified as opaque or constrained to a non-executable substitution representation.

Useful? React with 👍 / 👎.

[briansrls]

HOLD at exact head 402ceb4e022f13d6ad86ca38f9bf8dfd6e78f691.

The three-form substrate from #12960, one-clause population, single-authority placement of each verdict on its operation, class-level audit citations, and the incidental provider-import repairs are coherent. Exact-head CI is green. But the population is only mechanically complete: several requires none rows contradict the audit's own fail-closed rule and would let D13 step (b) derive empty demand for an operation that may open a non-local connection or execute runtime-supplied behavior.

P1 — runtime behavior and remote-capable arguments are classified none

1. tmux.Session.New takes inner_argv: List<String> and appends it as the command run by tmux new-session. That is a runtime program, the same semantic class this PR correctly marks opaque for systemd-run command_argv and shell.Exec. It must be requires opaque unless the input is replaced by a carrier whose admitted program demand is known.

2. hostnamectl.Process.Run takes an unrestricted ProcessArgvExpansion and forwards it after hostnamectl. hostnamectl -H/--host= operates on a remote host over SSH. The service boundary does not restrict its input to the sealed local set-hostname plan, so requires none is false for admitted inputs. Declare Network or narrow the operation input so remote options are structurally impossible.

3. systemd.Systemctl.ListUnits and ListUnitsAllLoaded append an unrefined pattern after the verb and options. A value such as --host=<host> is accepted by systemctl as its remote-host option and uses SSH. Either prevent option-shaped patterns by construction/argv termination or declare Network.

4. sed.Sed.InPlaceSubstitute and ScriptsSuppressAutoPrint accept runtime sed programs. GNU sed's e command and s///e execute shell commands; these operations do not use --sandbox. Their demand is opaque unless the input becomes a non-executable typed sed subset or sandbox mode is enforced.

5. browser.Page.Evaluate and browser.Element.EvaluateOn accept runtime JavaScript. Playwright evaluates it in the page context, where it can call fetch. These are runtime-program inputs and cannot truthfully declare no Network demand; mark them opaque or restrict them to a structurally non-network expression vocabulary.

The first four classes were already reported on the initial 07b6e25 head. The commits after it merge main and repair imports; the exact head still carries the same none rows. The Playwright runtime-expression rows are the same underlying class found by this re-review.

Please correct these rows and re-derive the 520-way partition rather than preserving 236 / 12 / 272 mechanically. The required invariant is one correct declaration per operation, not merely one syntactic clause. D13 step (b) must remain ordered after the corrected population lands.

Non-blocking but worth fixing on the refreshed head: the PR title still says requires Network, and the body is the untouched session-dashboard TODO rather than this PR's none/opaque population and test evidence.

Exact-head floor, generated, emit-build, and witnesses pass. This hold is semantic, not CI-related. No direct merge or check bypass.

[briansrls]

HOLD at exact head 400fc3eee647e259dcdaffa6f6064666b13a516c.

The five rows from review 5388658399 are corrected, and the wider re-audit of runtime positionals, remote-selecting options, live browser operations, partial-clone reads, title/body, and the 321 Network / 29 opaque / 170 none partition is coherent as far as those classes go. Exact-head CI is green.

P1 — Git commands still marked none execute repository-selected programs

The revised rule now catches a runtime program supplied in an argv argument, but not a runtime program selected from the repository/configuration that is itself the operation's input.

Concrete rows on this exact head:

• git.Core.CommitInRepo is requires none and executes git -C {repo} commit -q -m {message}.
• git.PublicationTransport.RecordCommit and RecordEmptyCommit are requires none and execute git commit.

Git's own git-commit documentation says the command can run pre-commit, prepare-commit-msg, commit-msg, post-commit, and post-rewrite hooks. Those are repository/config-selected executables, and can open a non-local connection. The argv here does not disable them; moreover prepare-commit-msg is not suppressed by --no-verify, so merely adding that flag would not close the class.

There is a second direct specimen:

• git.Core.AddAllInRepo is requires none and executes git -C {repo} add -A.

Git's gitattributes contract permits repository/config-selected clean and long-running process filter commands, and explicitly notes that git add --all can invoke the process filter. This operation can therefore execute an arbitrary runtime program too.

CheckoutNewBranchInRepo is another likely member: git checkout invokes post-checkout. More generally, this needs a bounded Git re-audit over commands that invoke hooks or external filter drivers, not three isolated clause edits. The repository is not host-wide ambient NSS/DNS: it is the command's selected input, exactly as the partial-clone ruling treats repository state.

Required correction

Add the missing rule: a program selected from an input repository or its Git configuration and executed by the invoked command is OpaqueDemand unless the operation structurally disables that execution surface. Then re-audit the Git rows against upstream hook/filter behavior and re-derive the 520-way partition.

At minimum, the commit and add rows above cannot remain requires none. Either make them requires opaque, or change their realization so hooks/filters are structurally impossible and cite that boundary. Keep D13 step (b) ordered after the corrected population.

This is semantic, not a CI failure. No direct merge or check bypass.

[briansrls]

HOLD at exact head 60e301ddba42e864e20035487d40bee760f32949.

The repository/config-selected execution rule is now stated at the right authority and the Git, Cargo, npm, agent, fsmonitor/index, toolchain-proxy, live-browser, runtime-program, and remote-option populations are coherently re-derived. The prior Git hook/filter hold is resolved. Exact-head CI is green. One P1 remains.

P1 — codex_app_server.Cli.GenerateJsonSchema executes a runtime-selected program but declares requires none

The audit's governing rule says a runtime program supplied in an argument is OpaqueDemand. This operation accepts:

CodexAppServerExecutable { path: FilePath }

and places executable.path directly in argv[0]:

["{executable.path}", "app-server", "generate-json-schema", ...]

Nothing in the type or operation constrains that FilePath to the cited/pinned Codex executable. The adjacent prose says it is the same executable, but the representation admits any program path. A caller can therefore supply an arbitrary executable whose demand is unknown, exactly the class already marked opaque for gunbc.WitnessBin.Run, runtime interpreters, shell.Exec, and the agent operations.

This is also the only dynamic executable-position spelling found under dag/extdeps (argv: ["{...), so it is a bounded correction rather than another open-ended audit class.

Required correction: either:

1. change codex_app_server.Cli.GenerateJsonSchema to requires opaque, update its audit citation, and re-derive the partition (absent another change: 267 Network / 120 opaque / 134 none); or
2. replace the open FilePath carrier with a structurally closed identity that can only denote the pinned Codex executable, and provide the corresponding discriminator.

The operation cannot remain requires none solely because the intended Codex subcommand writes local schema files; the program that is actually executed is still caller-selected.

No direct merge or check bypass.

[briansrls]

APPROVE-MERGE at exact head 0f6bd55b0e1cec9c5bec60f8138fa08dcc43a56f.

The remaining P1 from review 5389618425 is resolved. codex_app_server.Cli.GenerateJsonSchema now declares requires opaque, matching the actual representation: a caller supplies CodexAppServerExecutable.path, and that open FilePath occupies argv[0]. The audit rule and class citation now name this runtime-selected executable explicitly, and the partition is consistently re-derived as 267 Network / 120 opaque / 134 none = 521.

The dashboard correction to the two get roster rows is also right. Neither coreutils_stat.dag nor sha256sum.dag gained an import that could justify ImportsFixed; each still uses get(...), while the roster's own authority defines NotAReference for names the old textual reader mistook for a bare reference and the parsed reader no longer derives. The new dispositions agree with the existing grub.dag#get and other profile-method precedents.

The disclosed gate gap is real: unimported_bare_provider_row_standing checks carriage and file presence but does not prove that an ImportsFixed retirement actually added a provider import. That is a pre-existing follow-up, not a remaining false assertion on this head; the two affected rows now carry the verified cause.

Exact-head floor, generated, emit-build, and witnesses are green. No findings. Merge-queue landing only; the composed merge_group candidate must pass against then-current main. No direct merge or check bypass.