Enforce a retrieval-CLI-free PATH for blind Codex children; stop voiding lanes on search terms

[seathatflowsinourveins]

Why

The first 2026-09-24 two-family re-record (wave 20260924, catalog 149940af) could not be recorded.

• The Codex lane's blind audit voided 15 of 32 layers, and every flag was a false positive; no command read outside the export:

  Reason	Flags	Example
  Retrieval-CLI name used as a search term or Python list item	15	rg -i 'qmd|…', for t in ['serena', …]
  Quoted '/' joining path parts	8	p+'/'+k
  Python path join or URL read as an absolute path	2	Path.cwd()/ref, 'https://'
  Backtick inside a quoted heredoc	1	kept as a known low (REG7-3)

  A rerun would repeat these, because the lanes must search for candidates such as qmd, serena and socraticode by name.

• The headless Claude lane was killed 20 minutes in. claude -p ends background tasks 600 s after its turn ends: "Background tasks still running after 600s; terminating. Set CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0 to wait indefinitely."

What changes

• Enforcement instead of a name heuristic.
  • A blind child's PATH is /usr/bin:/bin:/usr/sbin:/sbin.
  • codex is launched by the absolute path the caller's PATH resolves (run_attempt passes executable=; argv[0] stays codex).
  • blind_path_issue refuses a blind run (codex_lane and adjudicate codex, exit 2) when ai-memory, agentsview, mcporter, qmd, socraticode, jcodemunch, serena, codex or claude resolves on that PATH, or on what the login shell adds. The latter is measured each run: Codex runs commands with bash -lc, and /etc/profile.d adds /snap/bin on this host.
  • Real probe (a blind child using the same home, environment and launch path): every one of those CLIs, plus node, npx and uvx, was MISSING. python3, git and Codex's bundled rg resolved.
• Audit rules.
  • In blind runs the audit no longer flags retrieval-CLI names; a non-blind run still flags them.
  • git, sqlite3, curl and wget keep the raw word rule.
  • The root rule skips a quoted '/' joined with +.
  • The path rule skips a / after ) or ], and a URL's // after :.
• Recipe: CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0 for the headless lane and adjudication runs.
• lane-provenance.json: new codex and adjudication entries appended (append-only against main).

Evidence

• Replayed over the real run's 420 commands, 1 of 32 layers is flagged (the kept backtick case), down from 15.
• New BlindPathAndPrecisionTests:
  • every voided form from the re-record is now clean;
  • real reaches still flag: ls /, os.listdir('/'), git log, curl, out-of-export paths inside Python, x:/etc/passwd, and a retrieval CLI run by its absolute path;
  • the PATH refusal, including a login shell that cannot be measured;
  • non-blind reporting.
• 11 of 11 mutants killed. They cover: no child PATH, no absolute executable, the names put back, no root exemption, no lookbehind, no or overly broad URL skip, no login-shell measurement, an unmeasured shell accepted, no non-blind extension, and no refusal.
• Checks: full suite 4343 OK on 3.12 and on 3.13 (run sequentially); envelope 214/214; validate.py passed; ruff clean on the changed files; gitleaks: no leaks.

Remaining limits

The audit is still a heuristic lower bound for paths a program computes, as the README states. A retrieval CLI that a host installs in a system directory makes the lane refuse to run, rather than run unaudited.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.