OpenHands resolver: owned-path gate on the exact pushed commit, instruction files and aliases refused, driver behind a start-up self-test

[seathatflowsinourveins]

Scope

• What this PR changes: it adds an owned-path allowlist gate on the exact commit the OpenHands resolver pushes, and enables the public resolver driver only behind a start-up self-test of that gate. The gate refuses:
  • any path outside the brief's owned paths;
  • Git-semantic dot files;
  • instruction-bearing files: instruction basenames, the Codex AGENTS template, the token-lanes carrier blocks, and the adoption/agents/ prefix;
  • symlinks, gitlinks, mode and type changes;
  • case, Unicode (NFC/NFKC), HFS and NTFS aliases of all of the above.
• Base commit: 3b8f9c8a1b938358d65bf422f61592dc3b89407d
• Lane: lane:foundation
• Owned paths touched: blueprints/runtime-workers/openhands/{resolver.py, resolver/push_gate.py, RESOLVER.md, skills/resolver/SKILL.md, evidence/owned-path-gate-fail-first.txt}, docs/decisions/2026-09-28-openhands-resolver-isolation.md, tests/test_runtime_worker_openhands_{push_gate,resolver}.py, manifests/evidence.json (last commit, per the hot-file protocol).

SOTA sources

• OpenHands/OpenHands at 7bc33009: openhands/resolver/resolve_issue.py and issue_resolver.py#L376, the upstream resolver whose push this gate constrains.

• OpenHands/software-agent-sdk at fcc102a697874d54a357e36004e02c95040dbdc0: examples/03_github_workflows/01_basic_action/agent_script.py.

• OpenHands/extensions at bea7a20c59c44ec4dacddac3fc0efe58b9c73880: skills/github-issue-to-pr/scripts/main.py#L595.

• git/git v2.43.0 documentation, for the Git-semantic files and plumbing the gate reads:

  • Documentation/gitattributes.txt, gitignore.txt and gitmailmap.txt;
  • config.txt, diff-format.txt, git-commit-tree.txt and git-hash-object.txt.

  The gate uses native git diff-tree --no-renames on the exact pushed commit.

• github/docs at 82fb420ff85c1b3e66035c4f902bac339de3dd2d, for repository instruction-file locations.

• The repository's own adoption installers at 0e2610d66, for the instruction carriers they install: tools/adoption/install_claude_profile.py, tools/adoption/apply_codex_lane.py and adoption/hooks/claude/token-lanes-subagent-start.py.

Evidence-class table

Claim	Evidence class	Command / receipt
Gate refusals: owned-path, dot files, instruction files and prefix, aliases, mode, type and symlink	local_integration (synthetic Git repositories, native git, unittest)	blueprints/runtime-workers/openhands/evidence/owned-path-gate-fail-first.txt (each control red against the prior round, green after)
Driver enabled only behind the start-up self-test	local_integration	the same receipt; tests/test_runtime_worker_openhands_resolver.py
Three resolver suites pass	local_integration	coordinator rerun with a writable gitleaks lock: 381 tests, OK (1 skip: PyYAML parity), exit 0

No live resolver, GitHub, model or provider call is part of this evidence.

Local commands run

$ python3 -m unittest tests.test_runtime_worker_openhands_push_gate tests.test_runtime_worker_openhands_resolver tests.test_runtime_worker_openhands -v   Ran 381, OK (skipped=1)   exit 0   [coordinator]
$ python3 scripts/validate.py                    exit 0   [coordinator]
$ python3 scripts/evidence_manifest.py --check   exit 0   [coordinator]
$ git diff --check                               exit 0   [coordinator]

Review

Built by GPT-6.1 Sol through the packaged SDK worker (rounds r1-r5); committed by the coordinator.

• Claude Opus cross-family reads, all ACCEPT:

  • r1: two reads, with 5 and 4 P2;
  • r2: 3 P2;
  • r3: 2 P2;
  • r4: 2 P2;
  • r5: 0 P2.

  Each round fixed the previous round's P2s, as each later read confirmed.

• The coordinator's receipt append, its writable-lock rerun requested by the r5 read: a GPT read returned ACCEPT, 0/0.

Recorded residuals (bounded review, 2026-10-05)

• Transitive standard-library shadowing beside a CI script run by path: carried from r2 as partial. It is a documented residual with a coordinator precondition at RESOLVER.md:91-99.
• Under adoption/agents/, rename-in, rename-out, mode, symlink, type and gitlink changes are refused by mechanism only: --no-renames turns a rename into delete plus add, and path_refusals runs on every changed path. No native control exercises these cases; the r5 read gives the scratch fixture to add one.

Decision record

docs/decisions/2026-09-28-openhands-resolver-isolation.md

Checklist

• No GitHub Actions or workflow changes.
• No secrets printed, logged or committed.
• No new paid hosting, subscription or billing surface.
• Peer-owned untracked files and worktrees were preserved.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T09:33:21.699102Z	87f27ea	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: landing at head 87f27ea18f4bc2b62e6bd46680b80ddaf4dc1eee. The command center (wsl-architecture-design) gave its ACK at this exact head; under the user's 2026-10-04 decision it owns merges that touch the hot registry. The read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned ACCEPT at ee78a711a4c2; this head is reached from it through recorded carry edges (equal owned patch-ids, or a cross-family delta read returning ACCEPT at the edge's target), with no P1 item.

Observed main a11dc5ff33e6fe41cc3684eb8571b408c232c164. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main a11dc5ff33e6fe41cc3684eb8571b408c232c164 head 87f27ea18f4bc2b62e6bd46680b80ddaf4dc1eee base 3b8f9c8a1b938358d65bf422f61592dc3b89407d merged-tree 37444bef8e83af341ac3b941b3b79dd8db238613 merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 12, outside PR-owned 0 []
ok   3: main drift 310 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 11, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (10139 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree 37444bef8e83af341ac3b941b3b79dd8db238613)

Required checks at this head: 7 pass . Unresolved review threads: 0.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: post-merge observation. Landed as 4fd710698f53c3581cb1cfe9258ef7b1854ac080 (parent a11dc5ff33e6fe41cc3684eb8571b408c232c164), tree 37444bef8e83af341ac3b941b3b79dd8db238613. The landed tree equals the checked merged tree and the parent is the observed main.