Skip to content

fix(sota-convergence): tighten blind paths and measure env shell launchers - #680

Merged
seathatflowsinourveins merged 2 commits into
mainfrom
foundation/blind-audit-port-216-20261003
Oct 4, 2026
Merged

fix(sota-convergence): tighten blind paths and measure env shell launchers#680
seathatflowsinourveins merged 2 commits into
mainfrom
foundation/blind-audit-port-216-20261003

Conversation

@seathatflowsinourveins

@seathatflowsinourveins seathatflowsinourveins commented Oct 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Scope

Treat file/local/unix URL authorities as local paths in the blind audit, and measure env shell launchers under the blind child environment before refusing them. The original absolute-shell refusal remains, while the telemetry identity launcher can execute its absolute target.

SOTA sources

Evidence-class table

Claim Evidence class Command / receipt
Through full blind_audit, the prescribed local/unix reaches are flagged at both audit call sites (outside_paths and the runs-by-path comprehension). The five constructed reads and 3f456ec's six controls are flagged through the outside-path reason synthetic Focused command on the committed head: exit 0, 20 tests OK. The builder's mutant restoring both broad exemptions, run on the same code and test bytes: exit 1, five assertion failures, all at the outside-path assertion (tests/test_codex_lane.py:985). Residual: no test asserts a constructed read at the runs-by-path site, so an exemption restored at that site alone is untested
Rendered identity launcher executes an absolute /bin/sh fixture in the blind environment; env/asdf-style shims fail with 126/127 synthetic Focused launcher tests, exit 0 on the committed head. The test renders the launcher template at this base, which gained ECOSYSTEM_LANE handling in #671 without changing its shebang or exec line; the template is unchanged by this PR
Timeouts and other nonzero exits are diagnostics; only 126/127 refuse env shells. A launch error (OSError) is also reported as a diagnostic, backed by a passing test without a failing control synthetic Mock-boundary tests, exit 0 on the committed head. The builder's killed mutants (same code and test bytes) cover the timeout, other-nonzero-exit, 126 and 127 boundaries. Residual: no launch-error mutant was run, so the OSError assertion (tests/test_codex_lane.py:1084-1088) has no recorded failing control and is not counted as mutant-backed
Existing registry entries preserved and final codex/adjudication keys registered local_integration tests.test_verdict_lane_vendoring in the focused and eight-module commands, exit 0; append-only diff (16 added lines, 0 removed)
NativeStack resolves codex to an env-bash launcher; codex_launch_issue() is None; blind_child_argv(['codex','--version']) runs the caller-resolved bash on that launcher; probe exit 0, codex-cli 0.159.3 local_integration Host observation at publication, paths redacted; a --version probe only, no model run
NativeStack2604 resolves codex, under a login bash, to a symlink to Codex's standalone 0.160.0 ELF binary; the mise shims directory is on that PATH but has no codex shim; codex_launch_issue() is None; blind_child_argv runs the binary directly; probe exit 0, codex-cli 0.160.0 local_integration Host observation at publication through native WSL interop, the final codex_lane.py source loaded in memory, paths redacted; a --version probe only, no model run
macOS behavior, scoped to tests.test_codex_lane synthetic, macOS CI validate-macos on this head (run 37165890945) ran in changed-tests mode, tests.test_codex_lane only: 81 tests OK, including the six focused tests. This is a scoped result, not a full-suite macOS pass
AF_UNIX EPERM on 2026-09-24 under codex-cli 0.155.1 source_review of dated native evidence Pinned #216 README measurement retained; no current-pin remeasurement
Workflow lint and secret scan local_integration actionlint 1.17.0 exit 0; zizmor 1.30.1 exit 0 in offline mode; gitleaks 8.30.1 history and tree scans exit 0; allowlist tests 37 OK
Full unittest suite on this head Pending CI Not run locally; CI's validate job runs python3 -m unittest on this head

Local commands run

Every command below ran on the committed head 7797852, outside any sandbox, at nice -n 19, with TMPDIR set to a fresh scratch directory outside every git repository. Unit-test runs also set PYTHONDONTWRITEBYTECODE=1.

$ python3 -m unittest tests.test_codex_lane tests.test_adjudicate tests.test_token_e2e_grader tests.test_verdict_lane_vendoring tests.test_record_verdicts tests.test_landscape tests.test_verdict_review_gate tests.test_claude_lane
exit 0: Ran 1243 tests in 267.343s, OK

$ python3 -m unittest tests.test_codex_lane.BlindPathAndPrecisionTests.test_independent_review_of_206_reaches_still_flag tests.test_codex_lane.BlindPathAndPrecisionTests.test_separator_and_anchor_exemptions_do_not_hide_constructed_reads tests.test_codex_lane.BlindPathAndPrecisionTests.test_wave_20260924_separator_and_regex_residuals tests.test_codex_lane.BlindPathAndPrecisionTests.test_env_shell_shims_are_measured_under_the_blind_path tests.test_codex_lane.BlindPathAndPrecisionTests.test_identity_launcher_is_accepted_and_runs_in_the_blind_environment tests.test_codex_lane.BlindPathAndPrecisionTests.test_launcher_probe_uses_empty_scratch_homes_and_reports_other_failures tests.test_verdict_lane_vendoring
exit 0: Ran 20 tests, OK

$ python3 -m unittest tests.test_codex_lane.BlindPathAndPrecisionTests
exit 0: Ran 18 tests, OK

$ python3 scripts/component_matrix.py --write
exit 0: 32 rows, 0 flip-rule violations; report unchanged
$ python3 scripts/new_host_grand_list.py --write
exit 0: 32 layers, 66 winners; report unchanged
$ python3 scripts/component_matrix.py --check
exit 0
$ python3 scripts/new_host_grand_list.py --check
exit 0

$ python3 scripts/evidence_manifest.py --check
exit 0: 9570 files, passed
$ python3 scripts/validate.py
exit 0: status passed, 9570 hashed files, 193 receipts

$ python3 scripts/validate_convergence.py --all-recorded
exit 0: record[0] through record[28] valid
$ python3 scripts/validate_convergence.py --all-recorded --root . --json
exit 0: valid true, 29 records, 0 invalid

$ actionlint -color
exit 0: no output (kjanat/actionlint 1.17.0 release archive, sha256-checked as validate.yml does)

$ zizmor --no-config --no-ignores --persona regular --strict-collection .
exit 0: "No findings to report. Good job! (48 suppressed)". It ran in offline mode without a token, so the online audits remain CI's.

$ gitleaks git . --config .gitleaks.toml --max-target-megabytes 2 --log-opts=HEAD --redact --no-banner --report-format json --report-path "$TMPDIR/gitleaks.json"
exit 0: 880 commits, about 1.21 GB scanned, no leaks found (gitleaks 8.30.1 release archive, sha256-checked as validate.yml does)
$ gitleaks dir . --config .gitleaks.toml --max-target-megabytes 2 --redact --no-banner
exit 0: about 183.89 MB scanned, no leaks found; 4 files over the 2 MB limit skipped, including manifests/evidence.json, as in CI
$ GITLEAKS_TESTS_REQUIRED=1 python3 -m unittest tests.test_gitleaks_config -v
exit 0: Ran 37 tests, OK (the pinned binary first on PATH)

$ git diff --check origin/main...HEAD
exit 0

$ git merge-tree --write-tree 7d0174168d478d8e3a01602db2138905b6130f8a 779785284988990263f60df06c3afd80fbdca86c
exit 0: clean three-way merge; landing check conditions 1-5 ok, LANDABLE
$ git merge-tree --write-tree e0c329ae98efb6ac5e11a49220b69ec6eddbb658 779785284988990263f60df06c3afd80fbdca86c
exit 0: merged tree 7f93c955729f4c7700cf4d9d571a6cf45d75e732; landing check conditions 1-5 ok, LANDABLE; main drift 34 paths, none a PR content path

$ git push -u origin foundation/blind-audit-port-216-20261003
exit 0: the pre-push hook ran its 3 registry tests on 779785284, OK; no hook was bypassed. The pre-commit gitleaks hook found no leaks when each commit was created (the content commit before its rebase onto main, with the same changes).

The landing check is the coordinating session's script and is kept outside this repository. Its first condition is the git merge-tree --write-tree command above, which anyone can reproduce from a clone. Conditions 1-4 implement the disjoint-drift landing rule the Codex root lane acknowledged on #608 (issuecomment-5970679383); condition 5 was added later:

  1. git merge-tree --write-tree <main> <head> exits 0.
  2. The merged tree differs from main only in paths this PR changed against the merge base.
  3. Main's drift since the merge base touches none of those paths except manifests/evidence.json.
  4. Every manifests/evidence.json row this PR does not own equals main's, in main's order, and every top-level key the PR did not change equals main's.
  5. The merged files[] list stays sorted by path with no duplicates.

The review repair round re-ran the check against e0c329a on the same head: exit 0, LANDABLE.

The full python3 -m unittest suite (about 36 minutes) was not run locally for this head; CI's validate job runs it.

Failure classification (main baseline): no acceptance command above failed on the committed head, so no test needed a main baseline.

Test Class Main-baseline exit
None: every local acceptance command exited 0 n/a not run, no failure to classify

Earlier runs, retained as history rather than acceptance evidence: the sandboxed builder's runs on the pre-rebase tree returned the eight-module command exit 1 (282 failures, 2 errors), the full suite exit 1, and validate.py and validate_convergence.py exit 1. Its scratch root sat under another git directory, its paths were read-only, and its registry came from a newer main than its checkout. The committed-head results above replace them. Inside that sandbox, the PATH gitleaks wrapper could not create its lock; one same-second mutant reused stale Python bytecode and was re-run with a fresh cache prefix.

Mutation evidence comes from the builder's runs on the same codex_lane.py (5b089c48) and tests/test_codex_lane.py bytes, using native python3 -m unittest, and was not repeated at publication. Each of these mutants failed at least one focused test (exit 1): local recognition removed (2 failures), unix recognition removed (2), lowercase normalization removed (3), env shells refused statically (1), exit 126 omitted (1), exit 127 omitted (2, in the corrected run), every nonzero exit refused (1), timeout handling omitted (1 error), env -S stripping omitted (1), first stderr line used (1), and both broad audit exemptions restored (5).

Decision record

The build contract confines repository edits to the listed files, so no decision document is added, and the private custody handoff is not published. This section carries the decision.

  • Launcher (F1). The measured env-shell probe replaces Refuse env-style shell launchers; keep unix and local URL schemes checked (#206 review lows) [hold: after the wave] #216's static env-shell refusal, because the static rule refused the repository's own identity launcher (#!/usr/bin/env bash, exec of an absolute codex). The static absolute-shell refusal remains the fast path. The documented fallback was to leave codex_launch_issue unchanged and record asdf-style shims as a residual. It was not needed, because the probe is deterministic in the tests on Linux and, in validate-macos's changed-tests run on this head, on macOS. A reproducible Linux or macOS identity-wrapper or shim result inconsistent with the 126/127 policy would overturn this choice.
  • Audit exemptions (F2). Both broad exemptions are omitted. A narrowing would be adopted only if every must-flag case still flags and both historical wave shapes pass, at both audit call sites. A deterministic Linux/macOS narrowing that meets that test would overturn this choice. Until then, the two historical shapes stay flagged and are disclosed as a residual.

Host evidence

No files under evidence/hosts were changed. Both named-host observations above are local integration (a --version probe, no model run), and macOS remains a separate required observation through validate-macos.

Checklist

  • Existing GitHub Actions pins and permissions preserved; no workflow changes.
  • No credentials were printed or copied; no new required secret.
  • No paid hosting or billing surface.
  • Peer-owned files and worktrees preserved.
  • Rebased onto main 7d01741, with the hot-file registration, both generators and the validators repeated there.
  • Lane fixtures run outside every git ancestor; the eight-module command returned exit 0.
  • Named-host observations on NativeStack and NativeStack2604.
  • Independent read-only Opus review (headless, max effort) of 7797852: verdict repair, with 0 blocking, 1 should-fix and 3 minor findings. The contract's repair round changed this description only; the review-record comment gives each disposition.
  • Read-only cross-family review of the exact head by the Codex root lane.
  • The main ruleset's 8 required checks green on the head that merges: validate, validate-macos, verdict-review-gate, secret-scan, sota-sources, osv-scanner, token-report and dependency-review.

🤖 Generated with Claude Code

@seathatflowsinourveins seathatflowsinourveins added the lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers label Oct 4, 2026
This was referenced Oct 4, 2026
Open
Merged
@seathatflowsinourveins

seathatflowsinourveins commented Oct 4, 2026

Copy link
Copy Markdown
Collaborator Author

Claude session native-agent-stack-0c: review record and repair round for this PR.

Review. An independent, read-only Claude Opus 5.5 review at max effort, run as a separate headless session, read exact head 779785284988 (7797852). Verdict: repair, with 0 blocking, 1 should-fix and 3 minor findings.

What the review checked

  • Content: local_scheme and network_authority are AST-identical to 50ae3ac. The '://' and regex_anchored exemptions are absent at both call sites. One launcher_shebang helper serves both codex_launch_issue and blind_child_argv. The probe matches the contract, every F1 and F2 case is tested, and F2 took the drop branch with its README residual.
  • Carry: the contract designates no whole file to carry unchanged. The "port unchanged" functions match 50ae3ac, and both wave-20260924 strings equal 3f456ec's.
  • Paths: five files changed, all allowed. 4692a44 holds the four content files and 7797852 holds only manifests/evidence.json. The README hunks stay inside the blind-audit bullet.
  • Protected paths: no new-WSL owner path, blueprints/us-equities/ path, verdict row, wave or sealed artifact changed. The identity launcher, judge.py, adjudicate.py and verdict_review_gate.py are unchanged.
  • F3 registry: lane-provenance.json keeps main's entries and field order. It appends one codex entry and one adjudication entry, whose hashes equal the head's inputs. Refuse env-style shell launchers; keep unix and local URL schemes checked (#206 review lows) [hold: after the wave] #216's unlanded entries are absent.
  • Preserved facts: the hold-lapse facts are correct (one registered wave, one sealed directory, the Lane prompt Rule 2: status, license and popularity are not evidence of fit (D1 merit rule) #372 and Codex layer lane and adjudication judge default to effort max (standing GPT-6 rule); rules-only PR #505 pin moves), and the dated AF_UNIX sentence makes no claim about the current pin.
  • Evidence policy: sandbox runs are labelled as history and the mutants as the builder's runs. The builder's mutation record matches the description's exit codes and failure counts, and the head's test lines and bytes. AF_UNIX is labelled source_review.
  • Registry: manifests/evidence.json differs from main only in the README.md and lane-provenance.json rows. The review recomputed all 9570 rows from head blobs and found 0 mismatches; evidence_manifest.py --check exited 0.
  • Privacy: the added lines, both commit messages and the description carry no user name, home path, state or coordination file name, email or token pattern.
  • Reproduction: these all exit 0, with the worktree unchanged afterwards: the focused 20 tests, the 18 BlindPathAndPrecisionTests, the eight-module command (1243 tests), validate.py, validate_convergence.py --all-recorded, both report checks and git diff --check.
  • Template: ### SOTA sources is present and non-empty, the gitleaks commit count matches the history, and the unchecked items matched reality.
  • CI at review time: validate, verdict-review-gate, secret-scan, sota-sources and osv-scanner had succeeded; validate-macos was queued.
  • Other: the test diff is +128/-0, and the probe reaches only blind or pending callers. Merging onto e0c329a adds no evidence.json rows, and no [mac-coordinator] memory E2E: clean agentmemory 0.9.29 beside ai-memory, C4/D2h arms and token-efficiency measurement #384 notice is required.
  • Not verified by the review: the external SOTA pins were not re-fetched, and the named-host observations have no repository receipt.

Findings and dispositions

  1. Should-fix: the SOTA sources bullet pinned the in-repo references at the builder's pre-rebase commit cac8700 and called that the base, contrary to the contract's base-SHA rule. Fixed in the description: the three links are re-pinned to the base 7d01741. A note records that codex_lane.py and the decision are byte-identical at both commits, and that the launcher's shebang and exec line are unchanged between them.
  2. Minor: evidence row 1 said the constructed reads are flagged "at both audit call sites", but the tests assert them only through the outside-path reason. Fixed (wording): the row now says the local/unix reaches are flagged at both sites. The five constructed reads and the six controls are flagged through the outside-path reason, where all five failures of the restored-exemption mutant landed (tests/test_codex_lane.py:985). Residual, recorded in the row: no test asserts a constructed read at the runs-by-path site. Adding one would change assertions, which this round does not do.
  3. Minor: evidence row 3 counted launch errors as mutant-backed, but no OSError mutant was run. Fixed (disclosure): the row now credits the builder's mutants with only the timeout, other-nonzero-exit, 126 and 127 boundaries. Residual, recorded in the row: the OSError assertion (tests/test_codex_lane.py:1084-1088) has no recorded failing control.
  4. Minor: the Scope said macOS CI scope: validate-macos stays required, running the full suite for Mac-relevant changes, only changed test modules for test-only changes, and skipping otherwise (decision record, receipt, tests) #677 "touches no port path", and the landing commands named a script outside the repository. Fixed (wording): macOS CI scope: validate-macos stays required, running the full suite for Mac-relevant changes, only changed test modules for test-only changes, and skipping otherwise (decision record, receipt, tests) #677 changes only other manifests/evidence.json rows (33 rows, neither of this PR's two) and no content path. Reproducible git merge-tree --write-tree commands replace the script commands, and the description now lists the landing check's five conditions and cites the Client configuration for the new distribution: wire only what the definitive manifest installs (map, tool, F9) #608 disjoint-drift rule (issuecomment-5970679383).

Description updates beyond the findings

  • The macOS evidence row and the F1 decision record cite validate-macos run 37165890945 on this head. It ran in changed-tests mode on tests.test_codex_lane only: 81 tests OK, including the six focused tests. That is a scoped result, not a full-suite macOS pass.
  • The checklist marks this review and its repair round as done and keeps the cross-family review open. It also lists all 8 checks the main ruleset requires; token-report and dependency-review had been missing.

Head and exit codes. No file changed, so this round made no commit and no push. The head stays 779785284988990263f60df06c3afd80fbdca86c, and the remote branch equals it. origin/main is still e0c329a. Each command ran on that head at nice 19, with a scratch TMPDIR outside every repository:

  • python3 scripts/validate.py: exit 0 (9570 hashed files, 193 receipts)
  • python3 scripts/evidence_manifest.py --check: exit 0 (9570 files)
  • git diff --check origin/main...HEAD: exit 0
  • python3 scripts/component_matrix.py --check and python3 scripts/new_host_grand_list.py --check: exit 0 each
  • git merge-tree --write-tree e0c329ae98ef 779785284988: exit 0, merged tree 7f93c955729f
  • Landing check against e0c329a: exit 0, conditions 1-5 ok, LANDABLE.
  • The worktree status, including ignored files, was identical before and after. The contract's unit-test commands cover changed files; none changed, so they were not re-run.
  • Required checks at 2026-10-04T01:34:41Z: 7 of 8 succeeded. The description edit re-triggered validate, which is running again; its earlier run on this head succeeded. sota-sources passed on the edited description.

Remaining before merge:

  • Acks: the contract requires none for this lane:foundation PR (docs/lanes.md:24 and 145-149).
  • The Codex root lane's read-only review of exact head 7797852.
  • 8/8 required checks green on the head that merges.

@seathatflowsinourveins
seathatflowsinourveins marked this pull request as ready for review October 4, 2026 03:18
@seathatflowsinourveins

seathatflowsinourveins commented Oct 4, 2026

Copy link
Copy Markdown
Collaborator Author

Claude session native-agent-stack-5f: landing at head 779785284988990263f60df06c3afd80fbdca86c. The command center (wsl-architecture-design) gave its ACK at this exact head; under the user's 2026-10-04 decision it owns merges that touch the hot registry. A read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned ACCEPT at this head, with p1 empty.

Observed main 1a64e8f3ec104207f7659d03d07d112d12588278. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main 1a64e8f3ec104207f7659d03d07d112d12588278 head 779785284988990263f60df06c3afd80fbdca86c base 7d0174168d478d8e3a01602db2138905b6130f8a merged-tree c7767e1d63db3f90f517339de063587353ddac35 merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 5, outside PR-owned 0 []
ok   3: main drift 129 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 2, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (9688 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree c7767e1d63db3f90f517339de063587353ddac35)

Required checks at this head: 8 pass . Unresolved review threads: 0.

@seathatflowsinourveins
seathatflowsinourveins merged commit 096d295 into main Oct 4, 2026
30 of 35 checks passed
@seathatflowsinourveins
seathatflowsinourveins deleted the foundation/blind-audit-port-216-20261003 branch October 4, 2026 03:33
@seathatflowsinourveins

seathatflowsinourveins commented Oct 4, 2026

Copy link
Copy Markdown
Collaborator Author

Claude session native-agent-stack-0c: post-merge observation. Landed as 096d295bf57b3240596cf9620f670a5103c20c6a (parent 1a64e8f3ec104207f7659d03d07d112d12588278), tree c7767e1d63db3f90f517339de063587353ddac35. The landed tree equals the checked merged tree and the parent is the observed main.

@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Oct 4, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seathatflowsinourveins