fix(bin): harden PR check artifacts

[kunchenguid]

Intent

Complete the PR-check security remediation on existing PR 556 without merging or runtime activation. Validate task identifiers and canonical GitHub PR URLs before side effects; keep watcher polls byte-static with data-only private state, canonical provenance, exact metadata binding, transactional publication, and fail-closed non-executing migration; preserve merge, custom-check, X-mode, and unrelated lifecycle behavior. Require private single-link artifacts and safe cleanup, authenticate all checks at execution, migrate only the exact legitimate historical X polling identity under watcher exclusion to the strict current identity without execution, reject linked, symlinked, byte-mismatched, wrong-device, wrong-mode, and nonordinary lookalikes, and publish X artifacts through same-directory private temporaries plus guarded atomic rename without following destination symlinks. Preserve all prior pipeline fixes, keep the complete rendered public PR diff disclosure-safe, run focused and full validation without warning suppression, push only the existing branch to existing PR 556, and finish at one exact checks-green head.

What Changed

• Hardened PR-check watcher setup around validated task IDs and canonical GitHub PR URLs, static poll shims, canonical provenance, private atomic artifact publication, and authenticated execution snapshots.
• Added fail-closed PR-check migration and teardown handling that quarantines unsafe legacy polls without executing them, preserves legitimate historical X poll identity migration, and rejects linked, symlinked, byte-mismatched, wrong-device, wrong-mode, or nonordinary artifacts.
• Extended X-mode and custom-check artifact handling to require private single-link reads/writes, guarded same-directory publication, and expanded security coverage across PR-check, watcher, merge, X-mode, backend, and lifecycle tests.

Risk Assessment

✅ Low: The latest changes are narrowly scoped to hardening X artifact reads/writes through the shared private single-link publication and validation path, and I did not find remaining material contradictions to the stated intent.

Testing

The preexisting baseline full-suite result was already successful; I reran focused PR-check, X-mode, and PR-merge suites, captured an end-to-end CLI transcript proving invalid-input refusal, private static poll publication, metadata binding rejection, non-executing migration, and guarded X outbox publication, then reran the complete configured tests/*.test.sh suite with tmux 3.6a; all passed and the worktree remained clean.

Evidence: PR-check security E2E transcript

## invalid requests refuse before side effects
bad_id_rc=2 stderr=error: invalid PR check request
bad_url_rc=2 stderr=error: invalid PR check request
state_unchanged=yes
state_entries=task-a.meta 
gh_calls_after_rejections=0

## valid PR check arms canonical private static poll
stdout=armed: state/task-a.check.sh
stderr=●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
●  WATCHER DOWN - SUPERVISION IS OFF
●  1 task(s) in flight, but no watcher has a fresh beacon (last beat: never, grace 300s).
●  Trust the emitted supervision protocol for this harness; do not use shell & for watcher repair.
●  This is a supervision warning only; the guarded operation WILL still run.
●  resume supervision according to the session-start block for this harness; do not use shell &.
●━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
meta_contents:
window=fm-task-a
worktree=/var/folders/5x/4nqprlbx0518k3ybcb1sz6gr0000gn/T/no-mistakes-evidence/01KXMSQ4Z7DX1WE3CKRY1X98J7/pr-check-security-e2e/wt
project=demo
kind=ship
mode=no-mistakes
pr=https://github.com/octo-org/demo_repo/pull/42
pr_head=0123456789abcdef0123456789abcdef01234567
private_modes meta=600 check=600 data=600 registration=600
check_template_match=yes
poll_artifacts_valid=yes

## watcher-visible poll output
open_poll_stdout=<empty>
merged_poll_stdout=merged
gh_calls:
pr view https://github.com/octo-org/demo_repo/pull/42 --json state -q .state
pr view https://github.com/octo-org/demo_repo/pull/42 --json state -q .state

## exact metadata binding rejects byte tampering
tampered_validation=rejected

## migration rebuilds canonical legacy poll without execution
stdout=PR_CHECK_MIGRATION: canonical polls rebuilt and armed; resume supervision for this home
legacy_executed=no
rebuilt_static_poll=yes
migrated_modes check=600 data=600 log=600
migrated_poll_artifacts_valid=yes
migration_log:
task task-legacy: migration outcome tracking started before legacy poll handling
task task-legacy: canonical legacy poll rebuilt and armed

## X dry-run artifacts are private and symlink guarded
dry_run_stdout=req-x
dry_run_stderr=fm-x-reply: DRY RUN - would POST to https://myfirstmate.io/connector/answer (recorded: state/x-outbox/req-x.json): preview text
outbox_modes dir=700 file=600
outbox_record={"request_id":"req-x","text":"preview text"}
symlink_retry_rc=1
symlink_retry_stdout=
symlink_retry_stderr=fm-x-reply: cannot write dry-run outbox: /var/folders/5x/4nqprlbx0518k3ybcb1sz6gr0000gn/T/no-mistakes-evidence/01KXMSQ4Z7DX1WE3CKRY1X98J7/x-outbox-e2e/home/state/x-outbox/req-x.json
destination_still_symlink=yes
external_target_contents=external sentinel
leftover_temp_count=0

- Outcome: 🔧 1 issue found → auto-fixed ✅ across 2 runs (1h36m50s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

🔧 **Rebase** - 1 issue found → auto-fixed ✅

• ⚠️ AGENTS.md - merge conflict rebasing onto origin/main

🔧 Fix applied.
✅ Re-checked - no issues remain.

🔧 **Review** - 3 issues found → auto-fixed (2) ✅

• 🚨 bin/fm-x-poll.sh:105 - Intent requires "publish X artifacts through same-directory private temporaries plus guarded atomic rename without following destination symlinks", but X inbox publication still writes through $INBOX/$REQ.json.tmp and then mv -f to $INBOX/$REQ.json without validating x-inbox, the temp file, or the destination as private single-link ordinary files. A symlinked state/x-inbox or temp path can redirect the write outside private state.
• 🚨 bin/fm-x-lib.sh:384 - Intent requires "Require private single-link artifacts" and guarded X artifact publication, but fmx_context_registry_set creates state/x-context with plain mkdir -p and publishes with mv -f "$tmp" "$file" without rejecting a symlinked context directory or validating the final registry file. This leaves the durable X context artifact outside the new private/single-link guarantees.
• 🚨 bin/fm-x-reply.sh:301 - Intent requires X artifacts be published through private same-directory temporaries and guarded atomic rename, but dry-run outbox still writes directly with printf ... > "$outbox_file" after plain mkdir -p. A symlinked state/x-outbox or destination can receive the would-be reply payload, and readers can observe a partial write.

🔧 Fix: Guard X artifact publication
3 errors still open:

• 🚨 bin/fm-x-poll.sh:49 - Intent requires "Require private single-link artifacts" and "publish X artifacts through same-directory private temporaries plus guarded atomic rename without following destination symlinks", but the X poll diagnostic still uses printf ... > "$ERROR_FILE" after plain mkdir -p "$STATE". A preexisting state/x-poll.error symlink or hardlink is still followed/written instead of rejected through the private artifact boundary.
• 🚨 bin/fm-x-lib.sh:292 - Intent requires private single-link X artifacts, but the reply-context reader still trusts state/x-inbox/<request_id>.json directly. A symlinked or hardlinked inbox record can be read by fm-x-reply/follow-up context resolution even though the new publisher would reject writing that artifact.
• 🚨 bin/fm-x-lib.sh:481 - Intent requires private single-link X artifacts, but fmx_context_registry_get reads state/x-context/<request_id>.json after only -f; symlinked directories, symlinked files, and hardlinked records can still supply platform/budget data to reply/follow-up resolution. The write path was hardened, but existing unsafe registry artifacts remain trusted.

🔧 Fix: Enforce private X artifact reads
✅ Re-checked - no issues remain.

🔧 **Test** - 1 issue found → auto-fixed ✅

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"

🔧 Fix: Fix backend compatibility fixture dependencies
✅ Re-checked - no issues remain.

• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"
• Baseline already reported successful before this round: command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"
• bash tests/fm-pr-check-security.test.sh
• bash tests/fm-x-mode.test.sh
• bash tests/fm-pr-merge.test.sh
• Manual evidence transcript exercising fm-pr-check.sh, generated PR poll execution for OPEN and MERGED states, fm-pr-check-migrate.sh, and fm-x-reply.sh dry-run symlink guarding, written to /var/folders/5x/4nqprlbx0518k3ybcb1sz6gr0000gn/T/no-mistakes-evidence/01KXMSQ4Z7DX1WE3CKRY1X98J7/pr-check-security-e2e-transcript.txt
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"
• git status --short

✅ **Document** - passed

✅ No issues found.

🔧 **Lint** - 1 issue found → auto-fixed ✅

• ⚠️ linter found issues (exit code 1)

🔧 Fix: Remove unused x-mode test locals
✅ Re-checked - no issues remain.

✅ **Push** - passed

✅ No issues found.

[lquach99]

Landed in https://github.com/lquach99/scenely/pull/564, merged to main. The PR body carried no closing keyword, so this stayed open after the merge — closing by hand. NOT YET VERIFIED AGAINST STRIPE: the two Stripe-side checks (e2e Round 5 asserting no live subscription remains after a cancellation, and the repair script's dry run against a real account) could not run in the validation environment and remain outstanding.