Skip to content

Refuse env-style shell launchers; keep unix and local URL schemes checked (#206 review lows) [hold: after the wave] - #216

Closed
seathatflowsinourveins wants to merge 2 commits into
mainfrom
claude/blind-launch-shells-20260924
Closed

Refuse env-style shell launchers; keep unix and local URL schemes checked (#206 review lows) [hold: after the wave]#216
seathatflowsinourveins wants to merge 2 commits into
mainfrom
claude/blind-launch-shells-20260924

Conversation

@seathatflowsinourveins

@seathatflowsinourveins seathatflowsinourveins commented Sep 24, 2026

Copy link
Copy Markdown
Collaborator

Follow-up to #206 with two lows from its final targeted review:

  • Env-style shell launchers: codex_launch_issue also checks the interpreter an env-style launcher names. asdf's shims are #!/usr/bin/env bash, and such a launcher exits 127 in a blind child just as #!/bin/sh does.
  • unix and local URL schemes: the URL skip now treats file, fsspec's local and any unix scheme (http+unix://%2F…) as local paths.

Evidence: a real blind child created an AF_UNIX socket, but its connect() to a probe-owned socket failed with PermissionError: [Errno 1] Operation not permitted, while the caller's own connection was accepted. So the peer sessions' sockets are closed to it, as TCP already was.

Checks: the targeted tests pass (test_codex_lane, test_adjudicate, test_verdict_lane_vendoring, test_record_verdicts: 329 OK). All 4 mutants of the new checks are killed. validate.py and lint are clean, and gitleaks is clean.

Hold: do not merge until the 2026-09-24 wave, which runs with #206's code, is recorded. The record-time check requires the returns' codex_lane_py_sha256 to be the checkout's codex_lane.py. The registry is append-only, so both codes stay registered.

🤖 Generated with Claude Code

@seathatflowsinourveins @claude
Refuse env-style shell launchers; keep unix and local URL schemes che…
50ae3ac 
…cked (lows from the #206 review)

- codex_launch_issue also checks the interpreter an env-style launcher names
  (asdf's shims are #!/usr/bin/env bash), not only an absolute shell.
- local_scheme: file, fsspec's local and any unix scheme
  (http+unix://%2F...) keep their // checked as a path.
- README: a real blind child's AF_UNIX connect to a probe-owned socket the
  caller reached failed with EPERM (socket() itself succeeded), so the peer
  sessions' sockets are closed to it, as TCP is.
- lane-provenance.json: codex and adjudication entries appended.

Held until the 2026-09-24 wave (recorded with #206's code) lands.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 24, 2026

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Sep 24, 2026
Open
9 of 22 tasks
@seathatflowsinourveins @claude
Exempt a bare quoted '://' and a $-anchored regex fragment (wave 2026…
3f456ec 
…0924 Codex false positives)

The re-record's Codex lane (at b122312) flagged 2 of 32 layers with no read
outside the export: Python's `'://' in ref` URL test read as a // path, and an
rg fragment `(...|/runner.py$)` read as an absolute path. Narrow exemptions:
a bare quoted '://' (the same quote on both sides), and a path ending in the
regex anchor $ right before ) or |. `cat //`, an unquoted `://x`,
`/etc/passwd$''` (bash's $'' quoting) and a quoted '/runner.py$' stay flagged.
4/4 mutants killed. Both layers passed on rerun with the same code, so the
wave keeps a single codex_lane hash; this PR still waits for the wave.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@seathatflowsinourveins seathatflowsinourveins added the lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers label Sep 25, 2026
This was referenced Sep 26, 2026
Merged
Merged
seathatflowsinourveins pushed a commit that referenced this pull request Sep 29, 2026
Scout @claude
Drift closed entry: measured live-ruleset comparison, historical labe…
c7fb358 
…ls, executable rollback (B3, B4, B5)

B4: the before-GET, PUT, after-GET and PR-status claims are labelled historical, recorded by the PR author, output not retained. Measured today (2026-09-29T03:18:04Z, read-only): the recorded diff of the live ruleset 23739774 against origin/main (b0fb65b, GitHub's main tip then) exited 0 after stripping eight response-metadata keys and sorting rules by type; the rules order is the only other difference; the 57fb6d8 negative control exits 1 on the sota-sources context only; updated_at is still the recorded PUT second. packet.md L90-92 cited as historical corroboration.

B3: rollback is git show 57fb6d8:.github/main-ruleset.json | gh api --method PUT .../rulesets/23739774 --input - (not run); verified 57fb6d8's file equals 7bbb021's minus sota-sources (jq -S, cmp exit 0) and main still carries 7bbb021's file.

B5: a rebase is not the only way to get a sota-sources run (validate.yml L6-9 reopened/edited; docs/lanes.md merge path), GitHub starts no pull_request run while a PR conflicts, and reporting is not passing (the job reads only the description, L517-521); #205/#216 measured CONFLICTING with no sota-sources run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
seathatflowsinourveins added a commit that referenced this pull request Sep 29, 2026
@seathatflowsinourveins Scout @claude
GitHub practice: document the --match-head-commit merge guard; re-req…
5da38a4 
…uire sota-sources (#430)

* docs/lanes.md: merge with the reviewed head pinned (--match-head-commit)

Strict up-to-date checks stay off and this User-owned repository cannot use
a merge queue (docs/decisions/2026-09-22-github-automation-closure.md), so
`gh pr merge <N> --squash --match-head-commit <SHA>` is the guard against
merging a head nobody reviewed (https://cli.github.com/manual/gh_pr_merge).
It was practised but not written down: grep for match-head-commit across
docs, recipes, adoption, examples and AGENTS.md returned nothing.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Decision record: close the sota-sources ruleset drift with dated GETs

The live ruleset 23739774 now requires the committed eight checks. Before-GET
21:00:04Z (seven, no sota-sources); PUT of .github/main-ruleset.json at main
e82e6be at 21:00:13Z; after-GET matches the committed file. Records the open
PRs affected at PUT time and the rollback.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* docs/lanes.md merge guard: pin the checked and reviewed head read just before merge (B1, B2)

B1: <SHA> is the full 40-character headRefOid read with gh pr view <N> --json headRefOid,statusCheckRollup immediately before the merge, on which the review completed and every required check ran with none running or failed. The hot-file protocol's rebase or merge of main comes before that read; if main changed a shared hot file after <SHA>, merge main again, wait for the checks on the new head and pin it; the review carries over only if the reviewed files are byte-identical (GitHub's stale-approval rule, available-rules-for-rulesets). Sources: gh 2.101.0 'gh pr merge --help'; cli/cli v2.101.0 pkg/cmd/pr/merge/http.go L77-80 (expectedHeadOid); GraphQL MergePullRequestInput.expectedHeadOid read by schema introspection and in github/docs src/graphql/data/fpt/schema-pulls.json.

B2: the flag guards the head, not the base: with strict up-to-date checks off and no merge queue, two PRs green against an older main can still break it together (GitHub docs, loose required status checks).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Drift closed entry: measured live-ruleset comparison, historical labels, executable rollback (B3, B4, B5)

B4: the before-GET, PUT, after-GET and PR-status claims are labelled historical, recorded by the PR author, output not retained. Measured today (2026-09-29T03:18:04Z, read-only): the recorded diff of the live ruleset 23739774 against origin/main (b0fb65b, GitHub's main tip then) exited 0 after stripping eight response-metadata keys and sorting rules by type; the rules order is the only other difference; the 57fb6d8 negative control exits 1 on the sota-sources context only; updated_at is still the recorded PUT second. packet.md L90-92 cited as historical corroboration.

B3: rollback is git show 57fb6d8:.github/main-ruleset.json | gh api --method PUT .../rulesets/23739774 --input - (not run); verified 57fb6d8's file equals 7bbb021's minus sota-sources (jq -S, cmp exit 0) and main still carries 7bbb021's file.

B5: a rebase is not the only way to get a sota-sources run (validate.yml L6-9 reopened/edited; docs/lanes.md merge path), GitHub starts no pull_request run while a PR conflicts, and reporting is not passing (the job reads only the description, L517-521); #205/#216 measured CONFLICTING with no sota-sources run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Hot-file step: re-register docs/lanes.md and the automation-closure record in manifests/evidence.json

Registered with host_receipts.register_file; component_matrix.py --write and new_host_grand_list.py --write left the four generated reports unchanged; scripts/validate.py passed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs/lanes.md: read the pinned head's required checks with gh pr checks --required; move merge-guard mechanics to the decision record

The round-one verifier showed the documented statusCheckRollup filter prints superseded runs, so 'none failed' could not be judged with it (merged #389, #411 and #413 each show an earlier sota-sources failure and a later success on the final head). gh pr checks --required lists only the required checks with the latest run of each; measured exit 0 (all passed), 1 (one failed, none pending) and 8 (pending). The implementation-level citations move to the decision record, the stale-approval comparison is called an analogy, and 'today' leaves the dated record.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Sep 29, 2026
Merged
5 tasks done
seathatflowsinourveins added a commit that referenced this pull request Sep 29, 2026
@seathatflowsinourveins Scout @claude
Dispatch record: final status of the unresolved items; the max defaul…
3cc6bac 
…t carries its caveat in the portable CLAUDE.md (#504)

* Dispatch record: final status of the unresolved items

Refreshes the "Unresolved" section after the 2026-09-29 merges. Each open item now names who acts
and what starts it: the Harbor Terminal-Bench 4.0 run (the user's credential route, sandbox and
budget), the sealed run's --model (accepted by the Gate A owner for its Amendment 4), the trading
catalog's Claude row (the trading lane, after a native Opus 5.5 research run), the GPT-6 lane's
effort default (a standalone rules pull request by the owner of each wave's first Codex stage; it
fails 49 of 76 codex_lane tests when flipped and changes a verdict-gate trust path, and PR #216 does
not touch it, which corrects the earlier parenthetical), the OmniRoute Claude route, Codex 0.158.0,
the landscape sweep and the main-session model. Deferrals rest on the shared accounts' windows, read
live, not on a recorded reset. The record's hash is registered on main's manifest (last commit).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Dispatch record: correct the GPT-6 lane effort owner note

native-agent-stack-76 took the codex_lane.py default-effort flip as its own foundation rules pull
request, and its foundation sweep does not use codex_lane.py (it passes --effort max explicitly
through landscape-sweep/codex_job.py), so nothing there waits on the flip. The record said the
owner of each wave's first Codex stage flips it before that stage; it now says who took it and
what depends on it. The record's hash is re-registered in the same commit.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Portable CLAUDE.md: the max default carries its caveat

A read-only check by the session that built the launcher found that AGENTS.md, the workflows
README and the decision records say the max default rests on the user's requirement, not on a
measured gain, while the portable instruction file (which becomes the user-level CLAUDE.md) stated
the launcher, the opt-out and the fallback without it. It now carries the same clause (12 words;
the file is 1,420 words against the test's 1,440 ceiling). The file's hash is registered in the
same commit.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
@seathatflowsinourveins

seathatflowsinourveins commented Oct 3, 2026

Copy link
Copy Markdown
Collaborator Author

Custody plan for #216: Claude session native-agent-stack-0c

No live owner found: no coordination note claims this PR, and no #608 comment names it. The plan is port and close. A fresh PR from current main will carry the parts that still fit, with repairs, and this PR then closes with a link to it.

  • Ported: the file/local/unix scheme tightening and its tests, plus the dated AF_UNIX connect() EPERM measurement (2026-09-24, codex-cli 0.155.1).
  • Redesigned: the env-style launcher refusal. As written it refuses the repository's own codex identity launcher (observability/collector/codex-identity-launcher.sh.example), which main accepts. The port will either check the launcher by running it under the blind child's PATH or keep main's check.
  • Narrowed or dropped: the two audit exemptions from 3f456ec. In a function-level check they also stop flagging constructed reads that main flags, such as '://'[1:]+'etc/passwd'.
  • Not carried: this branch's lane-provenance entries, which register bytes that never reached main.
  • Hold: no longer applies. Only wave 20260922 is registered, and main's codex_lane.py and lane-prompt.md have changed since.

Objection window: 2 hours from this comment. Reply here to object or to claim the PR.

Claude session native-agent-stack-0c

This was referenced Oct 3, 2026
Merged
Merged
Open
seathatflowsinourveins added a commit that referenced this pull request Oct 4, 2026
@seathatflowsinourveins Scout @claude
fix(sota-convergence): tighten blind paths and measure env shell laun…
096d295 
…chers (#680)

* fix(sota-convergence): port blind audit tightening from PR #216

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore(evidence): register PR #216 port and regenerate foundation reports

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@seathatflowsinourveins

seathatflowsinourveins commented Oct 4, 2026

Copy link
Copy Markdown
Collaborator Author

Closed unmerged: superseded by its port #680, merged as 096d295bf57b3240596cf9620f670a5103c20c6a, which carries this PR's change rebuilt on current main. This PR's head and branch are preserved; recovery: git fetch origin pull/216/head.

@seathatflowsinourveins
seathatflowsinourveins deleted the claude/blind-launch-shells-20260924 branch October 8, 2026 07:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seathatflowsinourveins