Fix Codex post-merge findings: wider rtk blob exclusion, TOML-parsed bootstrap reminder, blind-packet leak, retained markitdown evidence by seathatflowsinourveins · Pull Request #314 · native-agent-stack/native-agent-stack

seathatflowsinourveins · 2026-09-26T02:38:21Z

Summary

Reconciled with #318, which another session merged first (5301c3c). #318's four-entry exclude_commands block, including a git branch exclusion, is the canonical rtk recipe and the one the workstation's live config runs. This PR keeps #318's text check and adds a behavioural rtk hook check probe to the bootstrap reminder, with five probes including git branch -a and git -C . branch. The reminder prints if EITHER check fails, which catches configs that rtk silently rejects, such as [tracking] without history_days. My earlier single-regex recipe is kept only as evidence of a tested alternative.

This PR fixes the defects that Codex cross-family post-merge reviews found in the merged #291 (rtk and markitdown pins) and #269 (catalog evidence basis). Both of those PRs had passed Claude evidence-reviewer rounds.

The rtk blob-read exclusion was too narrow (Pin rtk 0.50.0 and markitdown 0.1.8 on Linux with qualification receipts (workstation SOTA refresh) #291-1).
- ^git show [^ ]*: missed --no-color, -C ., two spaces, a tab, --no-pager and -c key=value.
- New pattern, a TOML literal string: '^git(\s+\S+)*\s+show(\s+\S+)*\s+(:\S|[^\s-]\S*:)' plus "diff". It excludes 14 of 14 blob-read and diff spellings; the old pattern excluded 8. The 8 other commands are still rewritten.
- It was re-tested on rtk 0.50.0 and 0.49.0 with a scratch config, and blob tails now equal native git in 4 of 4 cases.
- The coordinator applied it to the workstation's live ~/.config/rtk/config.toml on 2026-09-26, and read-back confirms it.
- Anchoring semantics follow upstream src/discover/registry.rs#L1540-L1569 at 1d87b8e7.
The bootstrap reminder could be fooled (Pin rtk 0.50.0 and markitdown 0.1.8 on Linux with qualification receipts (workstation SOTA refresh) #291-2). Final form, after the Codex repair round:
- The reminder decides from rtk hook check on the installed binary. It uses three probes, including git -C . show --no-color HEAD:x | tail -n 5, and stays silent only when rtk leaves every probe unrewritten.
- Why behaviour and not file contents: a TOML-valid config can still be rejected by rtk. For example, [tracking] without history_days makes rtk fall back to its defaults and ignore the exclusions.
- The reminder is still print-only.
- Stub tests cover every branch, and a real-binary test (skipped when rtk is absent) passed on the workstation.
  Earlier form, for history:
- rtk_config_reminder now parses the config with Python tomllib, and stays silent only when [hooks].exclude_commands holds both the exact regex and "diff".
- It remains print-only.
- Tests cover Codex's counterexample and the old pattern; they fail on the old implementation.
markitdown installed-byte evidence (Pin rtk 0.50.0 and markitdown 0.1.8 on Linux with qualification receipts (workstation SOTA refresh) #291-3). The verifier script, the run directories and the verifier's raw checker output are now retained. Outputs that were never written are declared as not_retained, with corrections.
P2 blind-packet leak (Grand catalogs carry each winner's evidence basis; ai-memory is the retained control, not a measured best #269-1).
- The durable-memory limitations sentences that carried the incumbent's build and releases now name "the incumbent", so the existing CHOICE_PHRASE filter withholds them. That includes two older Record the memory-stack cross-family convergence: retain ai-memory, trial three systems and eight models, adopt none #234 sentences that leaked the same way.
- In the withheld packet, 19b6429 / 2.3.2 / 2.4.0 / 2.4.1 / "production control" now occur 0 / 0 / 0 / 0 / 0 times, down from 3 / 5 / 4 / 1 / 2.
- The ledger keeps every fact, and no verdict field changed.
- A regression test in tests/test_lane_packets.py fails on the old ledger.
Legend (Grand catalogs carry each winner's evidence basis; ai-memory is the retained control, not a measured best #269-2). The legend now says the JSON carries each winner's why_selected and evidence_refs and only open-gap counts; limitations and gap text are in the ledgers.

Release markers "changed after v2026.09.26" are added.

SOTA sources

rtk-ai/rtk v0.50.0, tag commit 1d87b8e719ce0a50c223cd93ca64dd16921f9aec:
- src/discover/registry.rs#L1540-L1569 (compile_exclude_patterns)
- #L1599-L1604 (is_excluded)
- src/cmds/git/git_cmd.rs#L437 (run_show blob handler)
rtk 0.50.0 and 0.49.0 behaviour observed through rtk hook check and rtk hook claude (retained in evidence/artifacts/sota-refresh-20260925/rtk/out/mitigation-20260926.out)
Rust regex syntax: https://docs.rs/regex/latest/regex/#syntax
TOML v1.0.0 literal strings and tables: https://toml.io/en/v1.0.0#string
Python tomllib: https://docs.python.org/3/library/tomllib.html
rtk src/core/config.rs at 1d87b8e7:
- #L152-L158 (TrackingConfig; history_days has no default)
- #L261-L281 (cached_config falls back to the defaults)
- #L315-L338 (Config::load)
rtk hook --help at 0.50.0: check, the dry-run rewrite check
PyPA RECORD format: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
markitdown 0.1.8 on PyPI: https://pypi.org/pypi/markitdown/0.1.8/json
The repository's withholding filter: tools/sota-convergence/lane_packets.py (CHOICE_PHRASE, build_all_packets)
Codex cross-family post-merge reviews of Pin rtk 0.50.0 and markitdown 0.1.8 on Linux with qualification receipts (workstation SOTA refresh) #291 and Grand catalogs carry each winner's evidence basis; ai-memory is the retained control, not a measured best #269 (both needs_changes)

Verification (uv Python 3.13 with jsonschema/PyYAML/numpy; head `7871c70` on main `9c1669c`, which includes #318, #319 and #315)

Pass:
- validate.py, evidence_manifest --check, host_receipts validate;
- component_matrix --check, new_host_grand_list --check, build_ecosystem --check;
- catalog_decisions --check, landscape.py, validate_foundation.py;
- build_verdicts --check, verdict_review_gate --base origin/main (0 rows);
- shellcheck -S warning.
release_due: reports release_due, as expected.
Full suite: Ran 5805 tests / OK (skipped=614).
Codex cross-family review: at da338cd it returned needs_changes (P2: the reminder must check rtk's actual behaviour), and this head repairs it. A re-check of the repair is in progress.

Label: lane:foundation.

🤖 Generated with Claude Code

chatgpt-codex-connector · 2026-09-26T02:38:25Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

seathatflowsinourveins · 2026-09-26T02:44:16Z

Codex cross-family review of da338cd:

Verdict: VERDICT: needs_changes, with one P2. The bootstrap reminder validates TOML and list membership, but rtk 0.50.0 rejects a TOML-valid config that has [tracking] enabled = false without the required history_days, falls back to defaults, and ignores the exclusions.
Everything else was verified: adversarial rtk spellings, 0 incumbent identifiers in withheld packets, 116 provenance and 52 manifest hashes, 45/45 markitdown installed-file hashes, and checker re-runs.
Repair in progress: the reminder will decide from rtk hook check behaviour, not the file's contents.

…le text Codex cross-family review of #314 (P2). A TOML-valid config that lists both exclusions can still be ignored: rtk 0.50.0 deserializes the file into Config, TrackingConfig has no default for history_days (src/core/config.rs:152-158 at 1d87b8e7), and the hook's cached_config() falls back to Config::default() (config.rs:261-281). With `[tracking] enabled = false` alone, every probe was rewritten, exit 0, with no warning; adding history_days = 90 restores them. - rtk_config_reminder now runs "$bin_dir/rtk" hook check (timeout 30, stdin closed, the caller's environment and XDG_CONFIG_HOME) on `git show HEAD:x | tail -n 5`, `git -C . show --no-color HEAD:x | tail -n 5` (which also catches the 2026-09-25 narrow pattern) and `diff a missing`, and stays silent only when each answers exactly "No rewrite for: <probe>" with exit 1. A missing rtk, an unsupported subcommand, a rewrite or extra output keeps the reminder; tomllib only adds a hint that rtk may have ignored the file. Still print-only: `rtk hook check` writes no file. - RtkConfigReminderTests (LINUX_X86_64_ONLY) use a stub rtk whose `hook check` answer each test sets: effective exclusion, rewrite, unsupported subcommand, one probe rewritten, extra output, both Codex counterexamples, invalid TOML, a python3 without tomllib and XDG_CONFIG_HOME pass-through. RtkConfigReminderRealBinaryTests runs the function against an installed rtk 0.50.0 and skips without one. - The recipe, bootstrap.md step 4a and step 2 marker, the linux-wsl2 marker and the rtk receipt limitation say the reminder verifies through rtk hook check and that rtk can ignore a TOML-valid file. Retained: config-rejection-20260926.{sh,out} and a read-back of the reminder on this host (silent); results.json gains a correction, steps and files, and the receipt's provenance is regenerated. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

…checker output Codex post-merge review of #291, finding 3. - verify_installed.py is retained byte-identical. Its 2026-09-25 stdout was never written to a file, so results.json says so (not_retained) and adds a 2026-09-26 read-only re-run on the production prefix (45 of 45 identical) plus a per-file listing (installed_files.py) of the wheel RECORD, wheel member and installed digests in RECORD form. - run-candidate/, run-baseline/ and run-postswitch2/ (converted documents, PDF stderr with the home directory replaced by ~, package listings) are retained; their files hash to the recorded values. run_arm.py kept only checker counts, so check_outputs.py is re-run on them (out/checker-rerun-20260926.out), and the independent verifier's own checker.out, legs logs and integrity check are retained. - results.json gains corrections, not_retained, steps and files; the receipt gains a dated limitation and regenerated provenance. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> (cherry picked from commit 9ec4c33)

…ackets Codex post-merge review of #269, finding 1 (P2). The dated durable-memory limitations (the 19b6429/Mac/2.3.2/VelaNext entry, the open_gaps[0] entry and the 2.4.0/2.4.1 cutover entry), the older #234 "Production now runs ai-memory 19b6429" entry and the #234 "keeps ai-memory as the production control" sentence named the incumbent's build, releases and role without a selection word next to a candidate name, so build_all_packets(..., withhold=True) kept them. Each sentence carrying those identifiers now calls the component the incumbent, a choice phrase the prose filter (lane_packets.py CHOICE_PHRASE, reduce_prose) drops; the ledger keeps every fact. Verdict fields and checked_at are unchanged. A regression test builds the real withheld durable-memory packet (default and blind-export parameters) and asserts that 19b6429, 2.3.2, 2.4.0, 2.4.1 and "production control" are absent while the ledger still records them. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> (cherry picked from commit 418c0f0)

…counts Codex post-merge review of #269, finding 2 (P3). The "What a winner means" legend said the JSON carries the layer's limitations and open gaps; the generator emits each winner's why_selected and evidence_refs and only gap counts. The legend now says so and points to the layer ledgers for the limitations and the open-gap text (without paths: the page is a new-host document). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> (cherry picked from commit caeaa4d)

… check to its reminder Reconciles this branch's Codex post-merge fixes for #291 (findings 1-2) and the #314 P2 with #318, which merged first. - Recipe: #318's four-entry exclude_commands block stays the one set of guidance in recipes/README.md, bootstrap.md step 4a, token-practice.md, the rtk pin note and the SOTA refresh record. The single regex this branch had tested ('^git(\s+\S+)*\s+show(\s+\S+)*\s+(:\S|[^\s-]\S*:)' with "diff") is kept only as dated evidence, labelled as an alternative that was tested (mitigation-20260926, readback-20260926). The recipe also explains rtk's anchoring (registry.rs:1540-1569, 1599-1604) and that explicit `rtk` commands bypass the exclusions (registry.rs:1690). - Reminder: rtk_config_reminder keeps #318's text check (the exact four-entry key, exactly once) and, once it passes, runs the installed "$bin_dir/rtk" hook check (timeout 30, stdin closed, the caller's environment) on `git show HEAD:x | tail -n 5`, `git -C . show --no-color HEAD:x | tail -n 5`, `diff a missing`, `git branch -a` and `git -C . branch`. Either check failing prints the reminder; a text pass with an rtk failure adds a hint naming the probe, because rtk ignores a TOML-valid file that does not deserialize (TrackingConfig, src/core/config.rs:152-158 at 1d87b8e7). Print-only. - Tests: all of #318's reminder tests are kept (the silent ones now run against a stub rtk that honours the file); new stub tests cover an exact text that rtk rewrites, the [tracking] counterexample, an unsupported subcommand, a rewritten branch probe, extra output, the #291 comments counterexample, the five probes and XDG_CONFIG_HOME reaching rtk. An optional real-binary test (skipped without an installed rtk 0.50.0) covers the four-entry block, the [tracking] rejection with and without history_days, the old two-entry line, the single-regex alternative and a missing file. - Evidence: combined-reminder-20260926.{sh,out} (hook check and the combined reminder on scratch configs; silent on this host's #318 block). The rtk receipt keeps #318's addenda untouched; its added limitation now references #318's recipe and the combined reminder; results.json gains a step, files and relabelled corrections; the receipt's provenance is regenerated. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Hot-file commit (docs/lanes.md): manifests/evidence.json starts from main's copy (with #318's and #315's entries) and re-registers every changed or new file of this branch (indent 2, ensure_ascii); receipts[] mirrors the rtk and markitdown receipts' new limitations and keeps every other entry. component_matrix --write (no change) and new_host_grand_list --write regenerate the reports. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

seathatflowsinourveins · 2026-09-26T04:00:08Z

Codex cross-family re-check of the reconciliation, at 7871c70: VERDICT: agree, no defects.

rtk 0.50.0 hook recipe: exclude git show REV:path in every global-option form and git branch #318's recipe, text check and receipt addenda are byte-identical.
rtk 0.50.0 confirms the union behaviour: the exact recipe stays silent, and a missing history_days or a duplicate key both remind.
No conflicting rtk guidance remains.
Both withheld durable-memory builds contain none of the five identifiers.
58 bootstrap tests and 115 packet tests pass. CI is green.

…ence, blueprints and manifests (#1010) * Re-derive 10 published digests that hashed unmasked bytes, and guard evidence, blueprints and manifests Correction #161: the 2026-10-11 masked-digest audit of main at 7b76a88 found 8 sha256 values under evidence/artifacts that hash bytes from before sanitization. Its residual list found 2 more under blueprints. Each sits beside a copy in which the home directory is replaced by ~ or the user name by <user>. Anyone could put a guessed value back, hash the result and confirm the guess offline. Each value is now the sha256 of the published bytes. That is the basis scripts/host_receipts.py record has used for output_sha256 since #492 (scripts/host_receipts.py:1012-1029 at 7b76a88). - sota-refresh-20260925 markitdown (2), mcporter (3) and rtk (1) results.json: files[].run_copy_sha256 is now the sha256 of the committed file, the same value as the entry's sha256. byte_identical_to_run_copy stays false. Each record gets a corrections entry; mcporter had no list, so one is added. - The withdrawn nemotron vLLM use receipt -2: commands[1] and commands[4] output_sha256 are now the sha256 of output_excerpt (UTF-8), and its README records the change. This removes no oracle, because 4 registered evidence/hosts receipts keep the same digests (commands[1]'s in 4, commands[4]'s in 3). - blueprints/retrieval-quality-v2/review-293-repro-20260926.json: inputs.files[0].as_run_sha256 is now the committed driver's sha256. A corrections entry in the record's own shape records the change. - The withdrawn byterover-cli install receipt: commands[0].output_sha256 is now the excerpt digest. retained-outputs.json, the byterover-cli README and the trials README record the exception to "kept byte-for-byte". The sha256 of a file before this change would confirm a guess the same way: rebuild the old file from a guess, hash it and compare. Every digest of an old file is therefore re-pinned or dropped: - the three evidence/receipts qualification receipts re-pin results.json in provenance[], as #314 did; - retained-outputs.json gives the new receipt bytes for both private_original and published; - the review-293 correction records no as_recorded_sha256; - manifests/evidence.json re-registers the 13 files through host_receipts.register_file. tests/test_published_digest_privacy.py walks every JSON file under evidence/, blueprints/ and manifests/. It flags a 64-hex digest that hashes none of the published texts or files in its own or enclosing object, but does hash one of them once a home directory or name is put back. The masks are ~, <home>, <HOME>, <host-home>, $HOME, ${HOME}, <user>, <USER> and $USER, under /home/<name> and /Users/<name>. Names come from LANDING_PROHIBITED_NAMES. Without them, as in CI, that check skips. LEGACY_SITES freezes the 106 remaining sites by path, key and 8-hex prefix, with a count assertion: - 96 output_sha256 values in evidence/hosts receipts recorded before 2026-09-29, append-only since #492; - 10 that the audit's probe could not reach, because it put back only ~ and <user> and read only files named in the digest's own object. A new site fails. A listed site that is gone also fails until it is removed, so the list only shrinks. Two checks run in CI too: every listed site is still present, and the 10 fixed sites hash the published bytes. Fail-before: on the 7b76a88 tree, the guard reports exactly the 10 fixed sites and the fixed-site check fails 10 subtests, with or without names. After this change, all 11 tests pass, or 10 pass and 1 skips without names. Not changed: git history keeps the old digests. No rewrite is proposed, because the exposure is a home directory or account name, not a credential. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Re-pin readiness to the re-pinned receipts and enforce the digest guard in pre-push (#1010 round 1) B1 (CC adjudication of #1010 round 1): catalogs/north-star/readiness.json still pinned the pre-change sha256 of the three qualification receipts this PR re-pins, in 15 places. Each receipt had five: the repo:<receipt>@<digest> key, that entry's sha256 and expected_sha256, and two nested receipt objects. Rebuilt from the new bytes and a guessed name, each old receipt matched its pin, which is the second-order oracle of correction #161. Each pin now names the receipt's current sha256: - markitdown-018: d9a1a348 -> 74d066a1; - mcporter-0141: 5379b1e3 -> 9b69956e; - rtk-050: 9de293b6 -> b47326a1. Byte counts are unchanged. tools/north-star/build_readiness.py --write was not used, because it would also fold in readiness drift that predates this PR. tests/test_published_digest_privacy.py: - ReadinessPinTests needs no names. Every readiness binding of a receipt changed since the merge base with origin/main must hash that receipt's current bytes. It fails at 7a03593 (15 stale pins) and passes after. - The guard is now enforced. scripts/git-hooks/pre-push runs it on each pushed tip with PUBLISHED_DIGEST_GUARD_HOST_NAMES=1, so the names come from scripts/host_name_scan.py host_names(), the runtime source of #934's scan (docs/decisions/2026-10-09-host-name-scan.md); NATIVE_AGENT_HOST_NAMES_JSON replaces them in fixtures. The hook's runner refuses a skip, and an unavailable source errors. CI keeps the name-free tests. - The legacy check is one-directional, so it works in a clone whose names differ. An unlisted site fails. A listed site the names do not reproduce is reported only as a count. test_the_frozen_list_only_shrinks still fails, without names, once a listed digest is gone from its file. - The mask set adds the repository's existing markers <user-home>, <SCRATCH_HOME>, %USERPROFILE% (as C:\Users\<name>, C:/Users/<name> or /mnt/c/Users/<name>), <WSL_USER> and <hostname>. Every subset of up to four present masks is tried; beyond four, all of them or one at a time. - Measured with LANDING_PROHIBITED_NAMES (3 names) and with host_names() (5 names), the guard finds exactly the 106 listed sites both times. There is no new site, so the list and LEGACY_COUNT are unchanged. - Caching texts and resolved paths halves the whole-tree walk, from 24 s to 11 s with 3 names. tests/test_pre_push_gate.py overlays the guard module on the fixture tip, as it does the scanner sources. A clean push runs the guard once. A committed receipt whose output_sha256 hashes its excerpt with the fixture home put back is refused without echoing the name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

seathatflowsinourveins added the lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers label Sep 26, 2026

seathatflowsinourveins force-pushed the claude/codex-postmerge-fixes-20260926 branch 2 times, most recently from be2ed10 to 0d3125e Compare September 26, 2026 03:13

Scout and others added 5 commits September 25, 2026 23:37

seathatflowsinourveins force-pushed the claude/codex-postmerge-fixes-20260926 branch from 0d3125e to 7871c70 Compare September 26, 2026 03:46

seathatflowsinourveins merged commit 5c1961e into main Sep 26, 2026
26 of 28 checks passed

seathatflowsinourveins deleted the claude/codex-postmerge-fixes-20260926 branch September 26, 2026 04:00

seathatflowsinourveins mentioned this pull request Oct 11, 2026

Re-derive 10 published digests that hashed unmasked bytes; guard evidence, blueprints and manifests #1010

Merged

5 tasks done

Navigation Menu

Repository navigation

Fix Codex post-merge findings: wider rtk blob exclusion, TOML-parsed bootstrap reminder, blind-packet leak, retained markitdown evidence - #314

Fix Codex post-merge findings: wider rtk blob exclusion, TOML-parsed bootstrap reminder, blind-packet leak, retained markitdown evidence#314
seathatflowsinourveins merged 5 commits into
mainfrom
claude/codex-postmerge-fixes-20260926

seathatflowsinourveins commented Sep 26, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Sep 26, 2026

Uh oh!

seathatflowsinourveins commented Sep 26, 2026

Uh oh!

seathatflowsinourveins commented Sep 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

seathatflowsinourveins commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

SOTA sources

Verification (uv Python 3.13 with jsonschema/PyYAML/numpy; head 7871c70 on main 9c1669c, which includes #318, #319 and #315)

Uh oh!

chatgpt-codex-connector Bot commented Sep 26, 2026

Uh oh!

seathatflowsinourveins commented Sep 26, 2026

Uh oh!

seathatflowsinourveins commented Sep 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seathatflowsinourveins commented Sep 26, 2026 •

edited

Loading

Verification (uv Python 3.13 with jsonschema/PyYAML/numpy; head `7871c70` on main `9c1669c`, which includes #318, #319 and #315)