Show current readiness before dated receipts in local pages by seathatflowsinourveins · Pull Request #891 · native-agent-stack/native-agent-stack

seathatflowsinourveins · 2026-10-08T21:45:50Z

Scope

The local source pages use independent exact path permissions before native or linked file access, preserve raw receipt custody and render portable text. FIX3 0b66de07b6e1437084ab39e1f0ac7dce802f8b93 adds four permissions from current main so the default refresh continues after merge, tests policy/index parity and fail-closed policy handling, and documents the four flags' actual permitted files.

Base commit: e48de2e6fa1dd3b740af4793ea5824ea35476dba (main merge base); FIX3 parent 7fac0184674168898e51787c85069fc35d2bb47f.
Lane: lane:foundation.
This corrective head changes tools/local-pages/source_policy.json, its test module and README. All earlier read-boundary, port21090, redirect, sanitizer, date/reset and view corrections remain in the PR.

SOTA sources

Current native source index, pin 958a6d1ab770c807c5ee59748475a5c14df7ba52, SHA-256 4cdfe0a722a8e2a620551f5b092e2db762555deb06eef085686623561996dcd2: independently approved exact root/path declarations for cc_g2_started, cc_g2_started_correction, cc_g5_closure and cc_g6_f9.
Maintained native readiness, same pin, reader SHA-256 59428d63e09bab10e216e86af377891f8546aca6b3f9cc08c59d0803573b57b0: original reader/portable export APIs under a module-local version-bound guard.
Maintained CI selector, same pin, discover()/module assignment and .github/workflows/validate.yml:265; installed CPython 3.13.16 unittest discovery is the native harness.
Existing CPython3.13 descriptor os.open/fstat/O_NOFOLLOW, urllib redirect-handler and zoneinfo interfaces remain the implementation sources for safe reads, loopback collection and New York timestamps.
Exact CC FIX2 micro SHA-256 e4a149c1fa20ab42647f71090aa6e1442369605a89cdb22121d242ebf95a8eba; prior policy/read-boundary evidence retained. No dependency, installation or upstream fork introduced.

Evidence-class table

Claim	Evidence class	Command / receipt
FIX3 policy approves every exact declaration in the current main28-key index	`local_integration`	Metadata-only old7facpolicy RED/currentpolicy GREEN; no state bodies followed
Every committed index key requires exact root/path approval	`local_integration`	New committed-index parity regression; in-memory omitted grant makes it fail
Ordinary unlisted names cannot bypass role permissions; invalid/missing policy fails before native opens	`local_integration` with synthetic inputs	Policy18tests with actual open watchers; existing protected cases retained
Local-page modules already run through maintained CI selection	`local_integration`	Native bounded discovery5modules/69cases,0loader errors,each assignedonce; selector13tests
Earlier view/collector/native behavior remains compatible	`local_integration` with synthetic inputs	Composer27/current10/sanitizer6/workstation8/native32
Repository integrity/scope	`source_review`	Validator0 and diff0

Local commands run

Each test command used nice -n 10 ionice -c2 -n7 timeout 600:

python3 -B -m unittest discover -s tests -p test_local_pages.py               # rc0,27
python3 -B -m unittest discover -s tests -p test_local_pages_current_view.py  # rc0,10
python3 -B -m unittest discover -s tests -p test_local_pages_sanitization.py  # rc0,6
python3 -B -m unittest discover -s tests -p test_local_pages_workstation.py   # rc0,8
python3 -B -m unittest discover -s tests -p test_local_pages_source_policy.py # rc0,18
python3 -B -m unittest discover -s tests -p test_north_star_readiness.py       # rc0,32
python3 -B -m unittest tests.test_validate_shards                            # rc0,13
python3 scripts/validate.py                                                # rc0
git diff --check                                                          # rc0
bash command-center/cc-tools/base_tests_at_head.sh <repo> e48de2e6fa1dd3b740af4793ea5824ea35476dba 0b66de07b6e1437084ab39e1f0ac7dce802f8b93 unittest
# rc0; modified_existing_test_files=0; every failing ID:none.

114 tests PASS:101page/native and13selector. The maintained pre-cue tool has no existing modified testfiles at the main merge base because these page modules are new in this PR; it does not replace executed tests. No expectation change in FIX3.

CI-selection investigation corrects the omission claim: the workflow runs eight native shards; discover() uses test*.py without an allowlist and already selects all five local-page modules. Workflow/selector bytes equal both7fac018 and fetched main958a6d1, so duplicate selection was unnecessary.

Decision record

research/fullspeed-20261008/g5-stars-gap/local-pages/architecture/stack-891-fix3-review.md under the local state root records the exact source grants, old-policy failure/new-policy parity, tests and CI-selection proof. Policy SHA-256 872bf19a9469e519cc1d4e08331689b5cdcf05db8c2bd7d9ccf85bcafb43886a:28direct roles, with the existing exact index/supporting/SDK/override sets preserved. Missing/malformed policy and all unlisted input refusals happen before native file access.

Host evidence

No registered host evidence changes or component/provider E2E inferred from fixtures. #899/#913 rebase onto FIX3; both reader micros, required CI/pre-cue and bottom-up CC landing cues through5f remain mandatory. F5 pruning remains separate.

Checklist

CI selection verified through its maintained harness; workflow pins/permissions preserved.
No secrets printed/logged/committed; no required secret added.
No paid hosting or billing surface introduced.
Peer files/supplied worktrees preserved; generated pages uncommitted.

chatgpt-codex-connector · 2026-10-09T10:38:24Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T10:45:08.660395Z	`0b66de0`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0b66de07b6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-09T10:45:05Z

+    if spec is None or spec.loader is None:
+        raise ValueError("native readiness module is unavailable")
+    native = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(native)


Verify the pinned reader before executing it

When --root points to a modified or untrusted checkout, exec_module() runs the selected build_readiness.py before guard_native() verifies its policy-pinned SHA-256 later in refresh(). A reader that should be rejected can therefore execute arbitrary top-level Python code before the hash mismatch is reported; verify the captured bytes against the policy before importing or execute only the already-verified bytes.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-10-09T10:45:05Z

+                relative = path.relative_to(base).as_posix()
+            except ValueError:
+                continue
+            self.validate("override:" + key, source_root, relative)


Check all matching roots before rejecting an override

When --state-root is located inside --root (or equals it), a valid state override is first found relative to the repository root, and this call immediately raises because the policy grants it under state; the loop never tries the matching state root. Consequently every default state-backed override fails despite having an exact policy grant. Continue to the next matching root after a role mismatch, or prefer the most specific root.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-10-09T10:45:05Z

+    with path.open("rb") as handle:
+        raw = handle.read(MAX_BYTES + 1)
+        stat = os.fstat(handle.fileno())


Reject nonregular snapshot inputs before blocking on them

When an approved input that does not pass through _check_target()—notably an allowlisted roadmap reference—is a FIFO or another nonregular file, this blocking open/read occurs before fstat() and can hang the refresh indefinitely. no_symlinks() does not reject such files, so a stale or hostile local-state entry defeats the documented finite refresh; open nonblocking and verify that the descriptor is a bounded regular file before reading, as the native-source guard already does.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-10-09T10:45:05Z

+        return local.strftime("%b %d, %H:%M:%S %Z") + "; " + utc.strftime("%b %d, %H:%M:%S UTC")
+    return (f'<time datetime="{esc(value)}">{local.strftime("%b %d, %H:%M:%S %Z")}</time>'
+            f'<small>{utc.strftime("%b %d, %H:%M:%S UTC")}</small>')


Include the year in visible current-view timestamps

When a retained observation, event, or owner deadline is from a different calendar year than the reader assumes, both visible formats omit the year even though the hidden datetime attribute retains it. This makes archived or cross-year snapshots appear current and can misstate scheduling context on the readiness and Sources pages; include the year in both the New York and UTC labels.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-10-09T10:45:05Z

+    if receipt.is_relative_to(output_dir):
+        raise ValueError("refresh receipt must be outside the served root")


Reject receipt paths that contain the output directory

When --output-dir is nested below the path supplied as --receipt, this one-way containment check passes. During publish(), creating the output parents turns the intended receipt path into a directory, the page replacements then succeed, and the final receipt replacement fails with IsADirectoryError, leaving newly served pages without their matching receipt even in the absence of an external I/O fault. Reject reverse containment before publication as well.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-10-09T10:45:05Z

+        host = unquote(parsed.hostname or "").lower()
+        path = unquote(parsed.path).lower()
+    except ValueError:
+        return False
+    return parsed.scheme.lower() in {"http", "https"} and (host in {"chatgpt.com", "chat.openai.com"} or host == "claude.ai" and path.startswith("/artifact"))


Normalize browser-equivalent backslashes before classifying URLs

When source text uses an account URL such as https://chatgpt.com\c/private, urlsplit() reports chatgpt.com\c as the hostname, so this classifier and the regex sanitizer both preserve it. Browsers normalize that backslash to /, and owner_link() consequently emits a clickable link to the private ChatGPT URL that the account-artifact policy intends to omit. Reject backslashes or classify after browser-equivalent URL normalization.

Useful? React with 👍 / 👎.

Add local source pages with native readiness composition

595295d

seathatflowsinourveins added the lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers label Oct 8, 2026

Show CC current readiness before dated repository receipts

164c071

seathatflowsinourveins changed the title ~~Add local readiness, gap and roadmap pages with native refresh composition~~ Show current readiness before dated receipts in local pages Oct 8, 2026

This was referenced Oct 8, 2026

Add fleet and Adoption views with native workstation reads #899

Merged

feat(local-pages): add architecture layers with receipt evidence and deferred detail #913

Merged

seathatflowsinourveins added 3 commits October 9, 2026 02:40

fix(local-pages): bind source paths and sanitize served output

0d86b53

fix(local-pages): bind native and override reads to independent policy

7fac018

fix(local-pages): keep source permissions aligned with committed inputs

0b66de0

seathatflowsinourveins marked this pull request as ready for review October 9, 2026 10:38

seathatflowsinourveins merged commit c945ea1 into main Oct 9, 2026
36 checks passed

seathatflowsinourveins deleted the codex/ns2604-local-pages-20261008 branch October 9, 2026 10:38

chatgpt-codex-connector Bot reviewed Oct 9, 2026

View reviewed changes

Navigation Menu

Repository navigation

Show current readiness before dated receipts in local pages - #891

Show current readiness before dated receipts in local pages#891
seathatflowsinourveins merged 5 commits into
mainfrom
codex/ns2604-local-pages-20261008

seathatflowsinourveins commented Oct 8, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		if receipt.is_relative_to(output_dir):
		raise ValueError("refresh receipt must be outside the served root")

Conversation

seathatflowsinourveins commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Scope

SOTA sources

Evidence-class table

Local commands run

Decision record

Host evidence

Checklist

Uh oh!

chatgpt-codex-connector Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seathatflowsinourveins commented Oct 8, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 9, 2026 •

edited

Loading