Repository navigation
Key management record: OmniRoute management API decision, Codex snapshot cleanup, status 2026-09-30 - #544
Merged
Conversation
seathatflowsinourveins
added
the
lane:foundation
seathatflowsinourveins
force-pushed
the
claude/key-lane-status-20260930
branch
3 times, most recently
from
October 1, 2026 03:06
5eb49e9 to
6f851bf
Compare
4 tasks done
seathatflowsinourveins
force-pushed
the
claude/key-lane-status-20260930
branch
from
October 1, 2026 03:31
6f851bf to
c9a11b9
Compare
…anup record (2026-09-30) The decision record gains two dated sections. "OmniRoute management API (decision, 2026-09-30)": the anonymous management surface at upstream 2f42a9ac1 (reads and writes), who reaches it on this host (same-uid processes, containers through 10.0.2.2, browsers behind Local Network Access), the options compared and the choice: a documented posture plus a K4 guard rule, with a load-bearing container rule and no gateway change. "Codex shell snapshots that recorded the messaging token (done, 2026-09-30)": 2 files left of 19, deleted by literal paths, rescan 0. Item 6 of the 2026-09-29 status is marked superseded. The receipt codex-shell-snapshot-cleanup-20260930 records the names-only counts; its two scripts are published as artifacts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…4 contract v2, canary draft 3, Claude OAuth token) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… planned guard rule, scan scope, peer reports) One repair round on the independent review of this branch (4 blocking, 2 high, 5 medium, 4 low): - the trust boundary holds only while every untrusted workload is stopped or verifiably isolated, and an exposed one is stopped at once; - the K4 guard rule and data-directory protection are labelled planned, not effective; - the snapshot scan's roots, exclusions and unreadable-entry skips are stated, and its zero is qualified; - the Harbor isolation and canary reports are attributed as peer reports without a retained receipt; - container verification uses listener-side observation, because a transparent proxy can accept TCP; - the Firefox 154 private-network-to-localhost exemption is added to the residuals and the overturn; - smaller wording fixes: no open descriptor observed, the byte-for-byte comparison, the dates recorded by the first scan, the removed 290 count, the settings route's internal keys, and the cli-tools readers named individually. The receipt and its first scan script are updated to match. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…wsers, not a desktop browser At the user's direction, the OmniRoute section names the browsers this ecosystem runs (agent-browser 0.38.1, playwright-cli 0.1.21 on Playwright 1.64.0-alpha, playwright-test 1.63.0, driving Chrome for Testing) instead of Chrome, Edge and Firefox desktop defaults. Whether Chromium's Local Network Access is in effect under automation is not measured, so an agent browser that loads untrusted third-party pages is treated like any workload that runs third-party code until a canary-listener measurement decides it; the overturn names that measurement and the origin-validator carry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…eceipt agent-browser-lna-20260930) A GPT-6 worker measured Chrome for Testing 153.0.8010.12 launched by agent-browser 0.38.1, Playwright 1.63.0 and directly: a public-address-space page could not deliver fetch, image or iframe requests to a loopback listener without a permission grant in any of six launch configurations; with the override off, or with Local Network Access disabled, the requests arrived. Agent browsing of public pages therefore stays within the same-uid boundary; navigations, private-address-space pages, permission grants and the playwright-cli 0.1.21 pin are recorded as not covered, with a re-measure overturn. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…in manifests/evidence.json (hot-file commit, last) Main's manifest at 11227bf plus the receipts codex-shell-snapshot-cleanup-20260930 and agent-browser-lna-20260930 and their published scripts (docs/lanes.md protocol; validate.py passes). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
3 of 5 tasks
seathatflowsinourveins
force-pushed
the
claude/key-lane-status-20260930
branch
from
October 1, 2026 04:32
c9a11b9 to
e5f83c0
Compare
seathatflowsinourveins
pushed a commit
that referenced
this pull request
Oct 1, 2026
…habet (flaky echo check) assert_never_echoed refuses any six-character piece of a test value in the output, and the reports print hex SHA-256 digests; with hex values a piece matched a digest by chance in about 0.07% of runs (a simulation of test_parser_never_expands' own value shapes: 138 of 200,000), which failed PR #544's validate job on "['abe471']". Values now map each hex digit to one of the letters g-v, which no digest contains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
seathatflowsinourveins
pushed a commit
that referenced
this pull request
Oct 1, 2026
…habet (flaky echo check) assert_never_echoed refuses any six-character piece of a test value in the output, and the reports print hex SHA-256 digests; with hex values a piece matched a digest by chance in about 0.07% of runs (a simulation of test_parser_never_expands' own value shapes: 138 of 200,000), which failed PR #544's validate job on "['abe471']". Values now map each hex digit to one of the letters g-v, which no digest contains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
seathatflowsinourveins
added a commit
that referenced
this pull request
Oct 1, 2026
…agement routes (#567) * Inventory: injectable claude-oauth-token entry, CLAUDE_CODE_OAUTH_TOKEN in must_not_be_set Adds the optional private_env_file entry `claude-oauth-token` (${XDG_CONFIG_HOME:-$HOME/.config}/native-agent-stack/claude-oauth-token.env, sole variable CLAUDE_CODE_OAUTH_TOKEN, no public or pointer variables) per K4 contract-v2 section 6.5 and amendments A3/A13, and lists CLAUDE_CODE_OAUTH_TOKEN in must_not_be_set: exported in a shell it would override every Claude Code session's native sign-in, so it is injected per command only through tools/credentials/credential_run.py. The entry is injectable, so tests/test_credential_run.py's INJECTABLE_IDS gains it (A3 authorizes that line only). Peer input (A13): the class provider_api_key, the credential_run.py loader line, the Harbor 0.23.0 claude-code consumer (src/harbor/agents/installed/claude_code.py:1709-1736) and the rotation wording that revokes the old token come from the sota-memory-foundation session's unlanded patch (from-34-claude-oauth.patch); the id and file name stay claude-oauth-token to match the kernel keyring id already in use. Edits made by the GPT-6 runtime worker in the k4-build clone before its deadline; committed unchanged by the continuing Claude session. Co-Authored-By: GPT-6 Codex runtime worker (gpt-6-astra-max via OmniRoute, effort max) <noreply@openai.com> * Settings template: Read denies for both OmniRoute data trees Adds the four Read denies of K4 contract-v2 section 6.5 in the template's existing convention: Read(~/.local/share/omniroute/**), Read(**/.local/share/omniroute/**), Read(~/.local/share/omniroute-fw/**) and Read(**/.local/share/omniroute-fw/**). Metadata only; no host setting changes. (As left by the worker, the new lines and the preceding .config/omniroute twin are indented with four spaces instead of six; the next commit restores the template's indentation.) Edits made by the GPT-6 runtime worker in the k4-build clone before its deadline; committed unchanged by the continuing Claude session. Co-Authored-By: GPT-6 Codex runtime worker (gpt-6-astra-max via OmniRoute, effort max) <noreply@openai.com> * Guard K4 draft: runner, gateway, manager, store, ps, canary, F and CODE rules with their tests The GPT-6 runtime worker's uncommitted K4 implementation as it stood at its deadline (contract-v2 plus amendments A1-A13), committed unchanged so that its authorship stays separate from the repairs that follow: - a second, K4 reading (module flag _baseline) beside the dc33b48 reading B(T), which keeps B's string-tuple segment identity, its names and its stores; the K4 reading adds descriptor metadata to segment identity (D-ID), CLAUDE_CODE_OAUTH_TOKEN and CLAUDE_CODE_MESSAGING_TOKEN, both OmniRoute data trees, runner starts and the shell -c/eval reading before a keyring or runner unwrap; - RUN (start, environment, usage, mentions), GW (the frozen matrix, curl, wget, httpie/xh, requests/httpx, urllib, fetch, the omniroute CLI), MANAGER, STORE-LITERAL, PS-SELECTOR and CANARY rules and their hints; - form F recognition, interpreter here-document regions with a Python/JS lexer, SHELL-LITERAL, SHELL-OUT, WHOLE-ENV, INLINE-ENV and TAIL-READ; - K4GuardTests (22 of the contract's 28 named tests) and an independent reference_form_f. State at this commit (python3 -B -m unittest tests.test_secret_path_guard: 68 tests, 12 failures, 1 error): the K4 reading re-reads every command and charges many whole-text passes, so seven existing budget and timing rows fail (command_too_complex or over the 0.5 s CPU gate); the two authorized verdict changes (a safe form F body, the inline whole-environment print) are not yet reflected in the existing tests; adoption/hooks/claude/SHA256SUMS is not recomputed; and test_host_profile_copy_is_verbatim fails as tolerated. The following commits repair these and complete the contract. Co-Authored-By: GPT-6 Codex runtime worker (gpt-6-astra-max via OmniRoute, effort max) <noreply@openai.com> * Settings template: restore the deny list indentation The previous commit indented the four new OmniRoute data-tree Read denies and the existing Read(**/.config/omniroute/**) line with four spaces; the template uses six. Whitespace only: against dc33b48 the template now differs by exactly the four added deny lines (contract-v2 section 2). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Guard K4: B(T) first, then anchored tightenings in the contract's tier order Repairs the draft's reading structure (contract-v2 sections 1 and 3, amendments A4 and A5). read_command() now computes B(T) exactly as dc33b48 does (whole-text rules with its names, then this version's and the prior word readings, string-tuple identity) and returns B's reason for every command B refuses. Only for a command B allows does k4_tightenings() run, in the order (a) added names and stores, (b) runner keyring-equivalent rules and existing rules on what only the K4 walk reads, (c) runner usage and mentions, (d) gateway, (e) manager, (f) literal stores, (g) ps selectors, (h) canary, (i) SHELL-LITERAL, SHELL-OUT, WHOLE-ENV, (j) tails. Why: the draft read every command twice (a second full base reading with _baseline False) and charged many whole-text passes, so a command near the budget that B allows became command_too_complex and the 0.5 s CPU gate failed (seven existing rows). Now: - one charged scan of the unquoted text finds the K4 anchors (a runner, keyring or canary basename, a gateway port, a selector or new secret name, a data-tree name, a manager verb, `<<`, an environment source); a rule whose literal is absent does no work, so an ordinary command pays one pass; - a K4 walk (metadata identity, runner starts, shell strings read before a keyring or runner unwrap) runs only when a runner or keyring start exists or when B's own deduplication dropped a string duplicate with other descriptors (note_identity_collision, D-ID); - the added names and trees are checked as deltas over both readings' segments; B's functions keep BASE_* names and stores; - form F is recognized on its own (k4_form_f); regions follow logical lines and the bash delimiter word; TAIL-READ reads the text after each exact quoted terminator in the context bash resumes in (k4_resume_contexts), piece by piece with equal pieces read once, so 4,000 commit-message here-documents cost two reads instead of 4,000 suffixes; - SHELL-LITERAL reads a double-quoted literal's substitution bodies (as the base does), not the whole literal as a command; SHELL-OUT also reads exec/spawn argv without the program path; WHOLE-ENV fails closed on reflective or aliased sources (getattr(x, 'environ'), o.environ, a bare process, require('process')), NFKC-normalizes Python code and treats a JS method call on process.env as no single key; the JS lexer knows regular-expression literals and flags identifier escapes; - inline code: the installed Python 3.13.15 and Node 24.21.0 option tables (value options, -p/--print, here-strings to an interpreter), with an uncertain command line failing closed on a visible source; - curl: more ordinary options, --globoff, URL glob expansion (bounded); percent escapes cannot hide an /api path; - the two authorized verdict changes are recorded in the existing tables (the harmless F body moved out of BLOCKED; the inline whole-environment print moved from EXPECTED_PASS_THROUGH to BLOCKED). python3 -B -m unittest tests.test_secret_path_guard: 68 tests, 1 failure (test_host_profile_copy_is_verbatim, tolerated until the coordinator installs after window W). The checksum line is recomputed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Guard K4: complete the contract's fixtures and named tests; repairs they found Tests (tests/test_secret_path_guard.py), all inert strings for check(): - every example of contract-v2 sections 3 to 7 not already listed, expanded without ellipses (1,514 K4_CASES fixtures across the 20 case groups), plus the review witnesses of this repair round; - K4_F_LABELED: 111 manually labelled form F boundaries (every grammar token and option, both quotes, the PY'2/JS'1 suffix blockers, CR/tab/ trailing-space terminators, ANSI-C and backslash delimiters, leading lines, several operators, launchers, options and tails), checked against the independent reference_form_f and the guard's k4_form_f with their body spans; - K4_BASE_REFUSED: the measured base outcome of every fixture the pinned base refuses (88; amendment A10, a recorded local measurement against dc33b48, sha256 a70a056f...), and test_k4_base_reason_precedence holds the guard to those reasons outside form F; - the five named tests the draft lacked: test_k4_prior_only_heredoc_controls (current reading None, prior reading dotenv_read, as measured at the base), test_k4_original_review_controls (the eighteen historical fixtures; B5 command_too_large in the real hook), test_k4_helper_failures_and_budget_charges (every new helper reached, then raising inside main() and in a child process; own charge per scanning helper; one shared budget), test_k4_timing (48 section 9.6 rows in fresh children, median CPU under 0.5 s, per-helper 25k/50k/100k generators) and test_k4_hook_process_and_hints (the real hook, every new reason, allowed controls, the size cap, hint concepts, no command text or sentinel in the output). Guard repairs found by these tests: - the gateway rules also run when curl runs (its URL globbing can spell a port: 2012[8-9]); a covered URL inside an interpreter command line whose options could not all be read is found by K4_GW_FIND; - a keyring exec's started command is reread through k4_join in the K4 walk (a touching descriptor stays touching: D-ID); - the K4 walk reruns only where it can differ (k4_needs_walk: a runner start, a descriptor collision, or a keyring start with descriptors or inside a shell or eval segment); - STORE-LITERAL walks only stages and texts that name the keyring script; - the runner and interpreter-operand questions are memoized per word list (k4_memo), so the tiers do not charge the same scan repeatedly. python3 -B -m unittest tests.test_secret_path_guard: 73 tests, 1 failure (test_host_profile_copy_is_verbatim, tolerated). The credential_status, credential_boot_receipt, install_claude_profile, credential_run and credential_tools suites pass. Checksum line recomputed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Guard K4: finish the contract's gates: OmniRoute option repair, checksum, documentation, sanitized fixtures The continuation a GPT-6 runtime worker completed after the Opus builder stopped at a usage limit: the preserved OmniRoute option repair and its SHA256SUMS line, the guard documentation within the contract's allowed regions, the credential runner's docstring lines, and three inert fixture home paths sanitized. The worker's sandbox mounts .git read-only, so the coordinator commits its working tree unchanged. Its handoff records the gates: guard suite 73 tests (only the host-copy test fails, by design), oracle, probes, replay and differential families exit 0, timing and real hook processes pass; still open: five mutation survivors, 163 tightenings without an attribution label, and the whole repository suite, which the sandbox could not finish. Co-Authored-By: GPT-6 Codex runtime worker (gpt-6-astra-max via OmniRoute, effort max) <noreply@openai.com> * Guard K4: the one repair round against the GPT-6 verification and the Opus review A GPT-6 runtime worker (gpt-6-astra, effort max, native login) repaired every finding of both reviews; the coordinator commits its working tree unchanged (the worker's sandbox mounts .git read-only): - the two hook-timeout inputs: charged indexes replace repeated assignment-suffix scans and failed regex lookahead, and the real hook answers the review's generators within one second; - the runner path no longer expands a command twice; K4's named timing rows keep the contract's 0.5 s CPU bound; - the eleven missed tightenings (empty URL userinfo, HTTPie/xh operands, urllib's positional method, attribute reassignment, commands started through credential_run, CR/CRLF/U+2028/U+2029 comment endings, environment-copy aliases with secret keys, the SHELL-OUT argv prefix, os.spawn* modes, STORE-LITERAL through builtin/command and ANSI-C feeds, the canary triggers through executing python -m modules), each with BLOCKED and control rows; - the urlopen(timeout=) false refusal and the low findings; - the mutation gate counts only failures of the named permanent tests: every decisive witness now lives in tests/test_secret_path_guard.py, and the budget mutants use limits derived from single-stage measurements; 461 of 461 mutants killed; - the runner parser-vocabulary test against credential_run.parse_args; - the guard documentation states which reasons change for form F. Co-Authored-By: GPT-6 Codex runtime worker (gpt-6-astra, native, effort max) <noreply@openai.com> * Guard K4 docs: the five residuals the read-only re-check of the repair round found The re-check (GPT-6, read-only) confirmed every finding of both reviews fixed and found no command K3 refuses that K4 allows outside form F. It found two gateway forms both guards allow (keyword-ordered urlopen of a Request, augmented full_url assignment), two false refusals K4 introduced (an incomplete computed argv item, command -v lookup read as an assignment) and one generated 193,560-character urllib command that takes about 1.9 s in the real hook. The documented-command replay stays at 0 newly blocked, 0 loosened, 0 reason changed against both K3 and the installed guard, so they are recorded as residuals for the next guard change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Register the K4 guard changes and its verification receipt (hot-file commit, last) evidence/receipts/guard-k4-verification-20261001.json records the coordinator's gates on the final K4 head (documented-command replay against K3 and against the installed guard, the acceptance oracle, the tracked-file scan, the gitleaks ancestry scan and the targeted suites), the repair worker's mutation gate, the reviews and the five residuals. manifests/evidence.json re-registers the eight changed files and adds the receipt; scripts/validate.py passes with 179 receipts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Runner tests: synthetic values drawn from letters outside the hex alphabet (flaky echo check) assert_never_echoed refuses any six-character piece of a test value in the output, and the reports print hex SHA-256 digests; with hex values a piece matched a digest by chance in about 0.07% of runs (a simulation of test_parser_never_expands' own value shapes: 138 of 200,000), which failed PR #544's validate job on "['abe471']". Values now map each hex digit to one of the letters g-v, which no digest contains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Guard K4 timing: growth exponent over the minimum of up to three rounds (the #556 criterion) test_k4_timing judged each helper by one CPU-time sample per size with "100k under 8 times 25k"; PR #567's hosted validate failed it on two linear helpers at margins of 1 to 6 % (k4_shell_literals 0.1058 against 0.0998, k4_store_text 0.1408 against 0.1397). It now uses the criterion of examples/claude-native/workflows/ test-child-usage.mjs (#556): the growth exponent ln((t100k + 5 ms) / (t25k + 5 ms)) / ln 4 under 1.5, over the elementwise minimum of up to three rounds, with K4_LINEAR_SECONDS kept as the absolute bound. Measured with the minimum of three rounds on the workstation, all 67 helpers fit exponents of 0.975 or less. A new test pins the criterion: the two failing CI samples pass and a helper quadratic by construction fails from 4.5 ms at 25k up. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Guard K4 timing: processor-time bounds scaled by host speed (the hosted macOS runner is about 2.8 times slower) PR #567's validate-macos failed K4's fixed 0.5 s processor-time bound on linear work: row T-STORE-PRINTF took 0.550 s and k4_runner_commands' whole check 0.562 s on the hosted macOS runner, where this workstation measures the row at 0.197 s. The bound now scales by k4_host_factor(): this host's time for a guard-independent reference (the standard library's pure-Python shlex lexer over a fixed text, minimum of five runs) relative to the workstation's 0.0355 s, never below 1, a reference-machine ratio as SPEC CPU reports speed. On the workstation the bound stays the contract's 0.5 s; a quadratic regression still grows 16 times per 4 times input and fails on any host. The controls test pins the scale (1 on a faster host, proportional on a slower one). docs/secret-storage.md states both criteria. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Guard K4 timing: the host-speed reference also lexes one long quoted word The second hosted macOS run of PR #567 measured row T-STORE-PRINTF at 0.522 s against a scaled bound of 0.515 s: the short-word shlex reference ran at 1.03 times the workstation there, while the row, whose time is mostly the standard library's shlex building one 120,000-character quoted token by repeated string concatenation (a cost that follows the platform's allocator), ran at 2.6 times. The reference text now holds short words and that long quoted word (0.188 s here, minimum of five runs), so the factor follows both costs; the docs say so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Guard K4: curl -0 and pypy3 here-documents (the two review threads on PR #567) Two false refusals the Codex review bot reported on #567 (P2): - `curl -0` selects HTTP/1.0 like `--http1.0` (curl(1): "-0, --http1.0 Use HTTP 1.0"), but the short-flag table lacked it, so `curl -0 http://127.0.0.1:20128/api/health` was refused as gateway_credential_route; `0` is now a recognized short flag, and routes and bodies are judged as before (`-0` with /api/settings or with -d still refused). - form F's interpreter expression accepted `pypy` but not `pypy3`, while K4_PYTHON and the contract's form-F grammar (PY := ... "pypy" [ "3" ]) accept both; `pypy3 - <<'PY'` now qualifies, and its bodies are read as Python (`set()` allowed, `print(os.environ)` refused as environment_dump). The test file's independent form-F reference and the docs' PYNAME rule follow. Guard sha256 33a11fc01ee35dc4b157b04eee4a8524460bb3fe74375ee32485bc3b2530782f (275,624 bytes); SHA256SUMS updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Register the K4 guard changes and its verification receipt on main (hot-file commit, last) manifests/evidence.json from main b72c588 with the changed files re-registered and the receipt entry added. The receipt now names guard sha256 33a11fc0... (the two review-thread fixes) and the coordinator's gates on it: replay against K3 and the installed guard, oracle, tracked-file scan, growth exponents and targeted suites (409 tests, the host copy failing by design). scripts/validate.py passes with 181 receipts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Scout <scout@local> Co-authored-by: GPT-6 Codex runtime worker (gpt-6-astra-max via OmniRoute, effort max) <noreply@openai.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
codex-shell-snapshot-cleanup-20260930and its three published scripts record the one host cleanup of this lane.11227bfdlane:foundationdocs/decisions/2026-09-29-key-management.md,evidence/receipts/codex-shell-snapshot-cleanup-20260930.json,evidence/artifacts/codex-shell-snapshot-cleanup-20260930/and the last commit'smanifests/evidence.json. No code, hook, setting, gateway or template changes.SOTA sources
diegosouzapw/OmniRoute@2f42a9ac1(release/v3.8.51; both live gateways are built from it with carries that do not touch these files):src/server/authz/policies/management.ts:261-266,src/shared/utils/apiAuth.ts:472,474-478,511-515,src/lib/api/requireManagementAuth.ts:59-61;providers/client,settings,settings/cache-config,sync/tokenswithlib/sync/bundle.ts,cli-tools/*-settings,oauth/cursor/auto-import,keys,cli/tokens,relay/tokens,settings/require-login);open-sse/executors/base.ts:417-430,src/server/authz/pipeline.ts:418-421,src/server/origin/publicOrigin.ts:177-179,243-245.moby/moby@a46e6fa7contrib/dockerd-rootless.sh:23-24,170-173(RootlessKit host loopback).manifests/stack.jsonrows); Chromium Local Network Access: Chrome Platform Status 5152728072060928, https://developer.chrome.com/blog/local-network-access, WICG Local Network Access draft of 2026-08-07, sections 2.2 and 5.2.openai/codexatrust-v0.157.1:codex-rs/shell-command/src/shell_snapshot_exports.rs,codex-rs/core/src/shell_snapshot.rs:105andcodex-rs/features/src/lib.rs:1008-1011.harbor-framework/harbor@v0.23.0:src/harbor/environments/docker/docker.py(the egress allowlist network mode).docs/decisions/2026-09-27-omniroute-account-pool.mddecision 5 (the keyless posture and its overturn),docs/decisions/2026-09-28-openhands-resolver-isolation.md(O1 and the container finding) anddocs/acceptance-evidence-policy.md.Evidence-class table
source_reviewsource_reviewof the daemon unit, plus a peer reportdocker.service:33; the Harbor lane's canary-listener report is attributed as a peer reportcodex-shell-snapshot-cleanup-20260930Local commands run
Review and repair record
gpt-6-astra, effort max, OmniRoute gateway lane) of the branch: 4 blocking, 2 high, 5 medium, 4 low.7cb99351):19d5be93; whether Local Network Access is in effect under automation is not measured, so untrusted third-party browsing is treated like other third-party workloads until a canary-listener measurement decides it);Decision record
docs/decisions/2026-09-29-key-management.md, the three new sections. The OmniRoute section lists the options compared (upstreamrequireLogin, a redaction carry, an origin-validator carry, a guard rule, a documented posture), the choice and its overturn conditions.Host evidence
Not applicable: no file under
evidence/hosts/changes.Checklist
permissions: contents: read: no workflow changes.🤖 Generated with Claude Code