Repository navigation
[G01] Harden seven evidence-packet review boundaries - #103
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 387a647355
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| isinstance(node.func, ast.Attribute) | ||
| and node.func.attr in python_path_filesystem_read_methods | ||
| and python_path_receiver_expression( | ||
| node.func.value, tree, parents | ||
| ) |
There was a problem hiding this comment.
The new receiver guard skips validation entirely when a Path constructor is aliased: factory = Path; print(factory("synthetic-private").read_text()) now returns no scanner violation, whereas the parent scanner rejected it. Any unrecognized factory or helper returning a Path similarly bypasses all filesystem-reader checks and can expose private files through packet output, so unresolved receivers using these reader names must remain fail-closed.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| elif isinstance(node, (ast.For, ast.AsyncFor, ast.comprehension)): | ||
| # Values yielded from an environment iterator remain sensitive in | ||
| # both loop bodies and comprehension elements. | ||
| assignments.append((node.target, node.iter)) |
There was a problem hiding this comment.
When an environment iterator is wrapped, recording only the outer iterable expression loses the taint: for _, value in enumerate(os.environ.values()): print(value) and the analogous zip(...) case both pass this scanner. Those snippets still print inherited values, including credentials, so iterable taint must recurse through ordinary iterator-wrapper calls rather than recognizing only a direct os.environ.values() call.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| if python_call_derived_command_alias(value, modules): | ||
| return True | ||
| if isinstance( |
There was a problem hiding this comment.
The new helper traverses literal containers but falls through on ordinary calls, so launchers = {"x": subprocess.run}; for launch in launchers.values(): launch(["gh", "workflow", "run", "ci.yml"]) is accepted. This leaves the iterable-alias finding open for dictionary views and container-conversion calls, allowing a hidden workflow replay or other process launch to pass packet certification; the iterable analysis needs to follow reviewed view/wrapper calls back to their source containers.
AGENTS.md reference: AGENTS.md:L8-L8
Useful? React with 👍 / 👎.
| for statement in module.body: | ||
| if isinstance(statement, (ast.Import, ast.ImportFrom)): | ||
| exec(compile(ast.Module(body=[statement], type_ignores=[]), "<packet-scanner-import>", "exec"), namespace) | ||
| elif isinstance(statement, (ast.FunctionDef, ast.AsyncFunctionDef)): | ||
| exec(compile(ast.Module(body=[statement], type_ignores=[]), "<packet-scanner-function>", "exec"), namespace) |
There was a problem hiding this comment.
When the Markdown scanner fence is modified, this setup executes every extracted import and function definition with full builtins before any specimen is inspected. An added import, decorator, or default-argument expression can therefore run arbitrary code merely by invoking the advertised offline regression harness, contradicting its non-executing contract; validate and whitelist these AST nodes without evaluating packet-controlled imports or definition-time expressions.
Useful? React with 👍 / 👎.
| def config_violation(assignment): | ||
| key = assignment.split("=", 1)[0].lower() | ||
| if git_config_include_key(key): | ||
| return "Git configuration includes are not allowed before read-only commands" |
There was a problem hiding this comment.
The new check covers include keys supplied as -c, --config-env, or git config operands but still accepts git config --includes --list and command-prefix injection such as GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=include.path GIT_CONFIG_VALUE_0=/tmp/inc git status. git config -h describes --[no-]includes as “respect include directives on lookup,” and a local probe confirmed the environment form loads values from the referenced file, so these forms can still read sensitive configuration or activate included Git behavior after passing certification; reject include-enabling flags and inspect Git configuration environment assignments before wrapper stripping.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| @@ -0,0 +1,582 @@ | |||
| """Offline, non-executing regression probes for the seven issue #79 findings. | |||
There was a problem hiding this comment.
This commit introduces a Python implementation without an ADR or evidence-backed exception, even though the repository requires Go unless an ADR changes that decision. Reimplement the harness using the repository's Go tooling or add the required accepted ADR before introducing this non-Go maintenance surface.
AGENTS.md reference: AGENTS.md:L14-L14
Useful? React with 👍 / 👎.
| executable = executable_basename(tokens[0]) | ||
| if executable == "set": |
There was a problem hiding this comment.
The environment-dump check handles set and export but still accepts bare env and forms such as env -0 or env -u NAME; the wrapper parser then strips env, finds no child executable, and certifies the command. env --help explicitly states, “If no COMMAND, print the resulting environment,” so an executable shell fence can still emit every inherited credential despite this hardening; reject env whenever wrapper parsing reaches the no-command case.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
|
Triage checkpoint: Codex completed review of 387a647 with seven P1 findings. All are being treated as unresolved premerge blockers; current quick-check success does not override them. Independent contract/security reviews also reproduced overlapping reader/iterator gaps. A single correction batch with focused red/green evidence is in progress; no merge until final-head independent delta review, a fresh @codex review completion and quick checks. No live operations or workflow replay are authorized by this fix batch. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 387a647355
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ) | ||
| ): | ||
| raise SystemExit("Git packet blob query was outside the reviewed revision/path") | ||
| command = git_query(["show", blob_spec]) |
There was a problem hiding this comment.
When the local repository contains refs/replace/<HEAD>, this git show resolves the replacement object, while rev-parse HEAD and the remote ls-remote comparison retain the original commit ID. I reproduced a clean worktree where the original HEAD contained one packet, a replacement commit contained different bytes, and both this blob query and the worktree returned the replacement bytes while HEAD still matched the original remote SHA. git --help lists the global [--no-replace-objects] option; use it for the exact-head queries or explicitly reject replacement refs, otherwise the template can certify content that is absent from the reviewed remote head.
AGENTS.md reference: AGENTS.md:L16-L16
Useful? React with 👍 / 👎.
| guarded = any( | ||
| isinstance(call, ast.Call) | ||
| and python_dotted_name(call.func) == "package_dir.relative_to" | ||
| and len(call.args) == 1 | ||
| and python_path_division_names(call.args[0]) == expected_root |
There was a problem hiding this comment.
When an executable fence defines source_fuzz_guard with these expected variable names but calls it with arbitrary roots, this check only proves that package_dir is below the caller-supplied go_repo_root / module_dir. I loaded the scanner and it accepted a helper invoked as source_fuzz_guard(Path("/"), Path("etc"), Path("")) that prints package_dir.glob("*"), allowing filesystem enumeration to enter packet output. Unlike the unresolved-receiver finding, this uses a directly recognized Path receiver and passes specifically through the new exemption; require provenance for the root or validate every call site rather than trusting the helper's name and parameter spelling.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dac58b4add
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if isinstance(node.func, ast.Name): | ||
| local_helpers = python_local_function_candidates( | ||
| node.func.id, node, tree, parents |
There was a problem hiding this comment.
Restricting helper resolution to calls whose target is an ast.Name lets other local callables launder inherited credentials. For example, a class method that returns dict(os.environ), followed by secret = Snapshot().read(); print(secret), receives no scanner violation and emits the environment; a lambda assigned to a name has the same result because it is absent from the function index. Resolve method/lambda bodies too, or fail closed when their return provenance is unknown.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| elif isinstance(node, (ast.For, ast.AsyncFor, ast.comprehension)): | ||
| # Values yielded from an environment iterator remain sensitive in | ||
| # both loop bodies and comprehension elements. | ||
| assignments.append((node.target, node.iter)) |
There was a problem hiding this comment.
When an outer loop consumes a comprehension, this new binding records the whole comprehension as the target's source, but that expression is not recognized as sensitive when its iterator is the call os.environ.values(). The fresh case for secret in [value for value in os.environ.values()]: print(secret) still passes after the enumerate/zip fix and prints inherited credentials; list, set, dict, and generator comprehensions need to propagate taint from their elements and generators.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| local_functions = {} | ||
| for node in ast.walk(tree): | ||
| if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)): | ||
| local_functions.setdefault(node.name, []).append(node) |
There was a problem hiding this comment.
Indexing only FunctionDef/AsyncFunctionDef nodes leaves other local factories outside launcher provenance. I checked factory = lambda: subprocess.run; launch = factory(); launch(["gh", "workflow", "run", "ci.yml"]) and the equivalent class-method factory, and both receive no scanner violation even though they execute a workflow dispatch. Include lambdas and callable methods in return analysis, or reject aliases produced by unresolved local calls.
AGENTS.md reference: AGENTS.md:L8-L8
Useful? React with 👍 / 👎.
| current = node | ||
| while current in parents: | ||
| parent = parents[current] | ||
| if isinstance(parent, ast.If): | ||
| condition = condition_value(parent.test) |
There was a problem hiding this comment.
The reachability evaluator treats unrecognized constant conditions as unknown, so wrapping the containment try in if 1 == 1: pass; else: ... is accepted even though the check can never run; I applied that mutation to the canonical source-fuzz body and inspect_python_heredoc returned no violation. With an escaping package argument, execution continues to package_dir.glob without proving containment, allowing files outside the reviewed module to be inspected. Require the containment try in the direct reachable function body instead of accepting it beneath partially evaluated branches.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| def _verification_function(module: ast.Module, name: str) -> ast.FunctionDef: | ||
| for statement in module.body: | ||
| if isinstance(statement, ast.FunctionDef) and statement.name == name: | ||
| return statement |
There was a problem hiding this comment.
Returning the first matching function lets the harness validate a safe definition while Python executes a later override. I inserted a second require_packet_head_parity that simply returns immediately before its call: the packet scanner reported no violation, _verification_function still selected the original verifier, but the live template would bind and invoke the no-op definition, allowing mismatched packet bytes or intent bits to pass. Require exactly one top-level helper with this name before compiling it.
AGENTS.md reference: AGENTS.md:L16-L16
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b79709bf4c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if ( | ||
| isinstance(value, ast.Attribute) | ||
| and value.attr in python_path_filesystem_read_methods | ||
| and not python_known_non_path_reader_call(value, tree) | ||
| ): | ||
| receiver = value.value | ||
| elif isinstance(value, ast.Name) and value.id in aliases: | ||
| receiver = aliases[value.id] |
There was a problem hiding this comment.
Fresh evidence after the direct-receiver fix is def factory(): return Path("synthetic-private/file").read_text; reader = factory(); print(reader()): the current scanner returns no violation and the snippet emits arbitrary file contents. This alias analysis follows only direct attributes and existing names, not call results, even though local return analysis already exists elsewhere; propagate returned Path reader callables or fail closed on the unresolved alias.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| if ( | ||
| isinstance(value.func, ast.Attribute) | ||
| and value.func.attr in {"items", "keys", "values"} | ||
| ): |
There was a problem hiding this comment.
Fresh evidence after the dictionary-view fix is launchers = {"x": subprocess.run}; launch = launchers.pop("x"); launch(["gh", "workflow", "run", "ci.yml"]), which the scanner accepts. I checked gh 2.96.0's workflow run --help, which states that this command creates a workflow_dispatch event and triggers the workflow, so limiting attribute-call propagation to items/keys/values still permits an automatic replay through pop; mapping element-producing methods must preserve launcher provenance.
AGENTS.md reference: AGENTS.md:L8-L8
Useful? React with 👍 / 👎.
| for node in ast.walk(tree): | ||
| if not isinstance(node, ast.Call) or not isinstance(node.func, ast.Name): | ||
| continue | ||
| function = local_functions.get(node.func.id) | ||
| if function is None: | ||
| continue | ||
| for parameter, argument in call_arguments(node, function): | ||
| if python_sensitive_value_expression( | ||
| argument, sensitive_names, tree, parents | ||
| ) and parameter not in sensitive_names: | ||
| sensitive_names.add(parameter) | ||
| changed = True | ||
| for function in python_local_function_candidates( | ||
| node.func.id, node, tree, parents | ||
| ): |
There was a problem hiding this comment.
Fresh evidence exercises argument flow rather than the previously fixed return flow: class C: def emit(self, payload): print(payload); C().emit(os.environ) receives no violation and prints the inherited environment; an assigned lambda with the same body also passes. The call-site taint pass considers only calls whose target is an ast.Name and resolves only function definitions, so method and lambda parameters never become sensitive; bind arguments for those local callable forms as well.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| packet_path = Path("docs/evidence/g01-recovery-packet.md") | ||
| intent_result = run_bounded_git_query( | ||
| git_query(["ls-files", "-v", "-z", "--", packet_path.as_posix()]), | ||
| cwd=Path.cwd(), | ||
| env=git_environment, |
There was a problem hiding this comment.
When scripts/evidence_packet/issue79_regression_test.py is marked assume-unchanged or skip-worktree and then edited to weaken or skip its tests, this packet-only intent/blob check still succeeds and the later git status remains empty, so test output from modified code can be paired with the reviewed remote HEAD. I checked the installed git update-index -h, which describes these flags as marking files “not changing” or “index-only”; reject such intent bits and compare HEAD bytes for every changed evidence source, not only the Markdown packet.
AGENTS.md reference: AGENTS.md:L16-L16
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9233241cbd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if isinstance(value, ast.Call) and isinstance(value.func, ast.Name): | ||
| class_names.add(value.func.id) | ||
| for returned in python_local_call_return_values(value, tree, parents): |
There was a problem hiding this comment.
Fresh evidence after the direct method-return correction is Alias = Snapshot; print(Alias().read()), where Snapshot.read returns dict(os.environ): the scanner reports no violation and prints the inherited environment. This resolver records the called name Alias as the class name without following its assignment to Snapshot, so both sensitive method returns and parameter flows can still be laundered through a class alias; resolve constructor aliases before looking up the method.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| isinstance(value.func, ast.Attribute) | ||
| and value.func.attr in {"items", "keys", "values", "pop"} | ||
| ): |
There was a problem hiding this comment.
Fresh evidence after the .pop correction is launchers = {"x": subprocess.run}; launch = launchers.get("x"); launch(["gh", "workflow", "run", "ci.yml"]), which the scanner accepts because this mapping-method list omits get. I checked gh 2.96.0's workflow run --help, which says it creates a workflow_dispatch event and triggers the workflow, so mapping lookup can still hide an automatic workflow replay; preserve launcher provenance through get as well.
AGENTS.md reference: AGENTS.md:L8-L8
Useful? React with 👍 / 👎.
| if dotted not in path_preserving_calls and not ( | ||
| isinstance(node.func, ast.Attribute) | ||
| and node.func.attr in {"as_posix", "as_uri"} | ||
| ): | ||
| return False |
There was a problem hiding this comment.
When a resolved path is converted with the built-in formatter, value = format(Path.cwd().resolve()); print(value) receives no scanner violation and emits the local worktree path. Because an unrecognized call returns False here instead of propagating path provenance from its arguments, the new output-sink protection can be bypassed by format (and similarly ascii or an explicit __str__ call); include these path-preserving conversions or conservatively trace their arguments.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| The harness must use only the standard library and explicitly selected local | ||
| Git fixture operations. Invoke it with `python3 -B` to avoid bytecode artifacts | ||
| and record the actual interpreter and test results. Adding dependencies, |
There was a problem hiding this comment.
When the maintainer environment has PYTHONPATH, a user-site sitecustomize, or another Python startup customization, the prescribed python3 -B command executes that code before the harness's import and definition-time validation. I reproduced this with a synthetic PYTHONPATH containing ast.py, which executed immediately on harness startup; Python's local --help confirms that -B only disables bytecode while -I isolates Python from the user environment. Invoke the harness with isolated mode so external startup/import code cannot access credentials or corrupt the recorded regression result.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a61c35fb8a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for statement in candidate.body | ||
| for call in ast.walk(statement) |
There was a problem hiding this comment.
When the Markdown link check nests path.relative_to(repository_root) under if False, this broad ast.walk predicate still marks the path as guarded; I applied that mutation to the canonical link-check heredoc and inspect_python_heredoc returned no violation. A repository Markdown target such as ../../private/file#x can then reach path.is_file() and anchors(path) without containment, causing certification to read outside the reviewed repository; require the containment call to be a direct reachable statement in the guarded try.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| candidates = tuple(assignments.get(value.id, ())) + tuple( | ||
| iterable_bindings.get(value.id, ()) | ||
| ) |
There was a problem hiding this comment.
When a function parameter shadows a module-level regex-match variable, this global name-based lookup still classifies the parameter as a regex result. I verified that match = re.match("x", "x"); def expose(match): print(match.group()); expose(Path("/etc/passwd")) receives no scanner violation, even though runtime dispatches Path.group() and performs an unreviewed filesystem metadata read. Scope assignment and parameter bindings before exempting .group() as a regex API.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2c755af9dc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if dotted == "dict" and any( | ||
| isinstance(argument, ast.Attribute) | ||
| and python_dotted_name(argument) == "os.environ" | ||
| for argument in node.args | ||
| python_sensitive_value_expression( | ||
| value, sensitive_names, tree, parents, seen.copy() | ||
| ) | ||
| for value in list(node.args) |
There was a problem hiding this comment.
In the packet's isolated Python heredocs, aliasing a preserving constructor bypasses this name-based check: maker = dict; value = maker(os.environ); print(value) receives no scanner violation and prints the inherited environment. Resolve aliases of the listed container/string constructors before testing the call target, otherwise packet certification can emit credentials despite the new taint propagation.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| python_imported_function_alias_is_stable( | ||
| node.func.id, "sys", "exit", tree | ||
| ) | ||
| or python_assigned_callable_alias(node.func.id, "sys.exit", tree) | ||
| ) |
There was a problem hiding this comment.
The name-based alias branch only resolves sys.exit, so a packet heredoc such as emit = print; emit(os.environ) receives no scanner violation and writes the entire inherited environment; emit = warnings.warn is affected similarly. Extend alias resolution to all sinks recognized by this function so known credential taint cannot be laundered merely by assigning the sink to another name.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| assignments_by_name, | ||
| seen.copy(), | ||
| ): | ||
| return True | ||
| return False |
There was a problem hiding this comment.
In the packet's isolated Python heredocs, print(Path.home()), print(Path("~").expanduser()), and print(os.path.expanduser("~")) all receive no scanner violation while emitting the maintainer's personal home path. This provenance check recognizes Path.cwd() but returns false for these other standard local-path constructors, so include home/expansion operations among resolved local path sources before output-sink certification.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| or value not in reviewed_shell_export_assignments | ||
| for value in assignments | ||
| ): | ||
| return "shell export requires explicit reviewed assignments" | ||
| return None |
There was a problem hiding this comment.
The new environment-output gate accepts every non-set/export command, but the shell allowlist includes processors with direct environment access: awk 'BEGIN { print ENVIRON["GH_TOKEN"] }' and jq -n env both receive no scanner violation, and local synthetic probes confirmed that each prints the supplied variable. Inspect or reject the environment primitives of these allowlisted processors so executable packet fences cannot emit inherited credentials.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| def _top_level_assignment(module: ast.Module, name: str) -> ast.Assign | ast.AnnAssign: | ||
| for statement in module.body: | ||
| if isinstance(statement, ast.Assign) and any( | ||
| isinstance(target, ast.Name) and target.id == name | ||
| for target in statement.targets | ||
| ): | ||
| return statement | ||
| if isinstance(statement, ast.AnnAssign) and isinstance(statement.target, ast.Name) and statement.target.id == name: |
There was a problem hiding this comment.
Fresh evidence beyond the duplicate-helper correction is a second top-level issue79_reviewed_evidence_paths assignment after the canonical one: this helper returns the first assignment and the regression assertion still sees both reviewed files, while Python executes the later value and the live parity loop can omit the harness entirely. Requiring each security-relevant template assignment to be unique prevents an assume-unchanged modified harness from being paired with the reviewed remote head after tests validated a shadowed value.
AGENTS.md reference: AGENTS.md:L16-L16
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
https://github.com/1XP-AI/gh-runnerd/blob/1f5f89bc80f09393dbc44f45d20f0141e747005a/docs/evidence/g01-recovery-packet.md#L11329-L11330
Fresh evidence after the launcher-alias corrections is import subprocess; (launch := subprocess.run)(["gh", "workflow", "run", "ci.yml"]), which the current scanner accepts. The installed gh 2.96.0 help states that workflow run creates a workflow_dispatch event and triggers the workflow, so limiting NamedExpr handling here to conditional values still permits an automatic replay when the assignment expression itself is the call target; resolve that target or fail closed on such callable expressions.
AGENTS.md reference: AGENTS.md:L8-L8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "traceback.print_exception", | ||
| }: | ||
| return True | ||
| if isinstance(node.func, ast.Name) and tree is not None: |
There was a problem hiding this comment.
Fresh evidence after the assigned/import-alias fix is import os; (emit := print)(os.environ): the current scanner returns no violation, while Python immediately invokes print and emits the entire inherited environment. This branch only resolves sink aliases when the callable is an ast.Name, so a NamedExpr used directly as the call target bypasses the new protection; resolve callable expressions here or fail closed on unresolved targets.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
| for value in assignments | ||
| ): | ||
| return "shell export requires explicit reviewed assignments" | ||
| return None |
There was a problem hiding this comment.
In an executable Bash fence, name=GH_TOKEN followed by printf '%s\n' "${!name}" receives no scanner violation and prints the inherited token; I confirmed this with a synthetic GH_TOKEN. The new environment-output gate accepts every command other than the special set/export cases, while the earlier parameter regex does not recognize Bash's ${!name} indirect expansion, so an allowlisted printf can still place credentials in packet output; reject indirect expansion or resolve its referenced variable before allowlisting the command.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
💡 Codex Reviewhttps://github.com/1XP-AI/gh-runnerd/blob/3023373c91251d51b07e86721b7291c766d6c3ad/docs/evidence/g01-recovery-packet.md#L27402-L27405 For a function defined in a class suite, this Name-only scan misses callers and escapes through AGENTS.md reference: AGENTS.md:L9-L9 https://github.com/1XP-AI/gh-runnerd/blob/3023373c91251d51b07e86721b7291c766d6c3ad/docs/evidence/g01-recovery-packet.md#L27369-L27372 When a default captures a helper under a parameter with the same name, this scope lookup mistakes the captured reference for the parameter and skips the escape check. An inert exact-head specimen defines AGENTS.md reference: AGENTS.md:L9-L9 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review exact correction head fa8aa39. Both P1 findings in 6378329549 are accepted/reproduced and fixed. Class-owned helpers/class-suite escape contexts cannot establish complete member/caller proofs; defaults/decorators/annotations use definition-time reference ownership, and missing outer header-walrus binders invalidate the proof. Adjacent same-spelling class export and reflected-accessor extraction bypasses are also reproduced/fixed. The batch includes a scanner self-audit compatibility correction: AST literal predicates no longer construct runtime types; integer-only bool exclusion and all declaration-owner consumers remain preserved. Runtime type/metatype policy is unchanged. Final-source PR103 prefix: 185 methods PASS (10.769s); complete getter fixture inventory: 49 PASS (12.451s); targeted native/owned-path/type/review controls: 10 PASS (1.721s); aggregate preflight PASS (206/328/7, 14.121s). Whole-packet qualification is running, not yet a pass. Source is frozen; the ledger records failed/superseded receipts honestly. Please check lexical ownership, escape completeness and the unchanged fail-closed policies. No live operations, internal approval or general sandbox guarantee is claimed. |
💡 Codex Reviewhttps://github.com/1XP-AI/gh-runnerd/blob/fa8aa396adbcdda479f888c65a2fe061ac3ec3fb/docs/evidence/g01-recovery-packet.md#L27343-L27346 Fresh exact-head inert evidence is AGENTS.md reference: AGENTS.md:L9-L9 https://github.com/1XP-AI/gh-runnerd/blob/fa8aa396adbcdda479f888c65a2fe061ac3ec3fb/docs/evidence/g01-recovery-packet.md#L27414-L27417 When a nested mutator declares AGENTS.md reference: AGENTS.md:L9-L9 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review exact correction head f53732c. Both P1 findings in 6378504497 are accepted/reproduced and fixed: outermost comprehension iterables use enclosing ownership, and global/nonlocal declarations resolve to their actual binding owners before escape checks. Adjacent list/dict/set/generator captures and nonlocal/default-mutation controls are included. A separate coordinator probe reproduced boxed globals/locals/vars, empty starred vars and builtin-module namespace calls; these namespace callables are now refused as data, while direct vars(obj) is preserved. The actual AST-parameter conditional assignment that tripped the unchanged launcher gate is rewritten equivalently as an explicit if; no command policy exception was added. Current-source 189 PR103 methods PASS (10.789s), all 52 getter-fixture methods PASS (12.324s), expanded preflight PASS (206/328/7, 13.832s). The fast launcher test extracts the changed actual helper; it does not replace the whole scanner check. Fresh full-packet qualification is running, not a pass. Source is frozen, failed/incomplete historical receipts remain recorded, and no live operation, internal approval or general sandbox guarantee is claimed. |
💡 Codex Reviewhttps://github.com/1XP-AI/gh-runnerd/blob/f53732cd8a5d5170f4e5eb358a146872c28784fe/docs/evidence/g01-recovery-packet.md#L27385 When a method definition is inside class-suite control flow, the inherited scope chain still includes the class namespace, so this resolver can incorrectly attribute a method's global reference to a class member. Fresh exact-head inert evidence defines a module helper AGENTS.md reference: AGENTS.md:L9-L9 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review exact correction head b8990ff. P1 6378874822 is accepted/reproduced and fixed: class scopes are never lexical parents for member-proof method references, regardless of intervening if/try/loop nodes. Unsupported class-suite contexts remain refused. Missing header binders invalidate every possible enclosing owner rather than guessing across class global redirection; an adjacent nested-class/header-walrus bypass is reproduced/fixed. The unchanged read-only method positive remains accepted. Final-source PR103 regression: 191 methods PASS (10.865s); getter fixture inventory: 54 PASS (12.581s); targeted ownership/native-path/prior-review controls: 12 PASS (0.816s); aggregate preflight PASS (206/328/7, 13.960s). All prior P1 triage is retained in the ledger. Source is frozen. To avoid qualifying superseded inputs, mandatory fresh whole-packet qualification will run after the final-head review settles the source; it is not skipped or claimed passed. No live operations, internal approval or general sandbox guarantee is claimed. |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Final-head GitHub review receipt for
The source/worktree remains unchanged. Separate required internal security/design approval is not claimed or silently waived; account/provider setup remains outside the maintainer-selected scope. No merge, live/canary execution, runner modification or general Python sandbox guarantee is claimed. |
|
Maintainer authorization update (2026-10-24): the maintainer explicitly approved replacing the separate internal independent-review requirement with completed GitHub Codex review for PR #103 only. This is a narrowly scoped review-route exception, not a claim that an unavailable internal review occurred, not a repository-wide policy change, and not a waiver of exact-head GitHub review, finding triage, hosted quick checks, or the fresh full-packet qualification. The current candidate remains b8990ff. Full-packet qualification is still running; merge remains conditional on its successful result and a final same-head audit. Actual live/canary execution remains separately approval-gated. |
|
@codex review Please review exact head cc6a499. Delta from b8990ff: replace the equivalent conditional AST-reference initializer in v22_closed_call with an explicit if, preserving the conservative conditional-launcher rule; add a fast actual-source projection covering ALL conditional assignments, rather than just the preceding primitive helper. No security rule/proof or shared interface is relaxed. Whole-packet qualification on b8990ff failed after 1570.462s at this sole remaining initializer, despite its clean GitHub review; it is explicitly not a pass. Reproduction RED 0.525s, focused GREEN 0.844s; final 192 PR103 methods PASS 21.615s, 54 getter methods PASS 16.509s, aggregate preflight PASS 17.593s (206/328/7). Counts overlap. Packet blob adf98700018c5ea04fb5ec060cf9a868ad5a6a07; harness cbcf97c4d3f633db9a4c2697cd61c635388db42a. Ledger carries the failed qualification and narrow maintainer-approved internal-review replacement for this PR. Fresh same-head review, quick CI, all-finding triage and successful whole-packet qualification remain required before merge. No live/canary execution or general Python sandbox guarantee is claimed. |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Stable correction checkpoint: exact head cc6a499 received completed GitHub Codex review with no major issues at #103 (comment) and matching hosted quick success at https://github.com/1XP-AI/gh-runnerd/actions/runs/40058295714. Current inline and formal review pages add no findings; prior finding dispositions remain in the ledger. A fresh complete packet qualification started on the clean frozen inputs at 2026-10-24T03:29Z: packet adf98700018c5ea04fb5ec060cf9a868ad5a6a07 and harness cbcf97c4d3f633db9a4c2697cd61c635388db42a, isolated CPython 3.14.3 with PATH/locale-only environment. It is RUNNING, not yet a pass. The failed b8990ff qualification remains historical FAIL. Merge stays gated by this current result and the final same-head audit. Maintainer-approved separate-internal-review replacement applies only to this PR; no unavailable internal approval, G01/G02 completion, live/canary operation or general Python sandbox claim. |
|
@codex review Please review exact head 5536e60. Delta from cc6a499 is alpha-renaming only: 44 local AST Name references in seven private helper scopes from call to syntax_call, plus one private scalar-index predicate and its four references from index to v22_sequence_index_is_scalar. A read-only immutable-source AST comparison confirms no other scanner operation, literal, expression or public signature changed. The conservative launcher rules/alias inventory are NOT weakened and no whitelist is expanded. A fast actual-source test covers the real callback guard and unresolved direct-call inventory, including new private helpers; it retains only the inspector existing value exception in python_literal_bindings. RED reproduced the whole-scan callback finding (3.230s), then four latent index collisions before another slow scan (3.438s). Final GREEN 3.633s; 193 PR103 methods PASS 16.893s, 54 getter methods PASS 15.242s, expanded aggregate preflight PASS 16.306s (206/328/7). Counts overlap. Packet 3ee10900f24c7a467acbd762096679681e72e435; harness 46620589f228f11ba556373dc1cd237ec2bead39. The cc6a499 full qualification FAILED one callback finding after 1938.693s despite its clean review/quick; failure and prior controls remain in the ledger. Fresh full qualification follows this stable review; it is not waived. Maintainer-approved replacement of separate internal review with GitHub Codex applies only to this PR. All exact-head review/finding/quick/full-packet gates remain; no live/canary operation or general Python sandbox guarantee. |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Attribution-only repeat on the SAME unchanged head 5536e60. Please include the reviewed commit SHA in the completed result. The prior cycle was recorded as running on this SHA and returned no major issues at #103 (comment), but its completed metadata has commit_sha=null and its receipt omits Reviewed commit. Do not infer exact-head approval from null. Repeating once because that attribution is inconclusive, not because source changed or to request intermediate reviews. The delta remains private identifier renaming only, with 193 focused methods and 54 getter methods passing; no rule/allowlist changes or live actions. |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Stable V32 checkpoint: exact head 5536e60 has completed same-head Codex review with explicit Reviewed commit at #103 (comment) and matching quick success at https://github.com/1XP-AI/gh-runnerd/actions/runs/40061238858. One attribution-only review repeat was needed: the earlier no-findings receipt omitted its SHA and completed metadata was null; that inconclusive receipt was not used for exact-head approval. No source changed between requests. New inline/formal pages add no findings. Current full-packet qualification started 2026-10-24T04:15Z on clean frozen packet 3ee10900f24c7a467acbd762096679681e72e435 and harness 46620589f228f11ba556373dc1cd237ec2bead39, isolated CPython 3.14.3 with PATH/locale-only environment. It is RUNNING, not a pass. Prior FAIL receipts remain in the ledger. Same-head final audit, successful qualification and the other non-waived gates remain required before merge. The PR-specific separate-internal-review replacement is maintainer-approved; live/canary and G01/G02 completion are not authorized or claimed. |
|
@codex review Review exact head 9d9b864 and include Reviewed commit SHA in the completed receipt. The minimal scanner delta replaces private v22_position nested getattr returns with explicit fixed AST location attributes guarded by hasattr, preserving start-field fallback -1 and existing end-field precedence (including None) for parser-created AST metadata. Arbitrary objects with side-effecting attribute overrides are outside this helper contract. No reflection/helper-return rule or allowlist is relaxed. The preceding 5536e60 full packet scan FAILED 2286.539s at the conservative reflective-helper-result gate despite its clean review/quick; recorded as FAIL. Actual helper+caller projection reproduced the exact definitions alias/body line15653 RED 0.455s, GREEN 0.469s. Final 194 PR103 methods PASS14.558s, 54 getter methods PASS18.546s, aggregate206/328/7 PASS19.965s. Crucially, the COMPLETE actual scanner definition source now passes the filesystem-alias guard (446.103s), not just the tiny projection. Later signal and indirect-execution gates also PASS1.266s. These are targeted preflights, not whole-packet approval. Packet125ea92e4566304a23488948d559ec2e684ba595; harness69b1f698609071823bb7dea4a0d92a48560ca7d6. Prior controls/failure/source identities remain in the ledger. Fresh same-head review/quick, all-finding triage and whole-packet qualification remain premerge gates. PR-specific maintainer internal-review replacement applies; no live/canary or general Python sandbox claim. |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Stable V33 checkpoint: exact head 9d9b864 has completed explicitly attributed Codex review with no major issues (#103 (comment)) and same-SHA hosted quick success (https://github.com/1XP-AI/gh-runnerd/actions/runs/40064876584). New inline/formal pages add no findings. Frozen whole-packet qualification started at 2026-10-24T05:08Z on clean packet125ea92e4566304a23488948d559ec2e684ba595 and harness69b1f698609071823bb7dea4a0d92a48560ca7d6 using isolated CPython3.14.3 and a PATH/locale-only environment. It is RUNNING, not a pass. The preceding 5536e60 full FAIL2286.539s is retained. The exact changed helper+caller projection and complete actual-scanner filesystem-alias preflight PASS446.103s do not replace whole-packet qualification. Final same-head audit and successful qualification remain required before merge; the maintainer-approved internal-review replacement is PR-specific, with no unavailable internal approval, live operation or G01/G02 completion claimed. |
|
FINAL FROZEN QUALIFICATION — PASS Exact candidate: 9d9b864. Packet blob125ea92e4566304a23488948d559ec2e684ba595; harness blob69b1f698609071823bb7dea4a0d92a48560ca7d6. Input hashes and clean worktree verified again after completion; no source changed after final review. Actual command: env -i PATH=/opt/homebrew/bin:/usr/bin:/bin LC_ALL=C /opt/homebrew/bin/python3.14 -I -B scripts/evidence_packet/issue79_regression_test.py -k test_current_packet_has_no_static_scanner_violations Actual isolated CPython3.14.3 result: one test PASS in2409.790s, exit0; 261 shell commands and86 Python heredoc bodies statically inspected, ZERO violations. Specimens remained inert AST data, not executed. Earlier1570.462s/1938.693s/2286.539s FAIL receipts remain historical FAIL in the ledger, not overwritten. Other final-source receipts: 194 focused methods PASS14.558s; 54 getter methods PASS18.546s; aggregate206/328/7 PASS19.965s; complete actual-scanner filesystem-alias preflight PASS446.103s. Selectors overlap. Completed exact-head Codex review: #103 (comment) . Matching PR quick success: https://github.com/1XP-AI/gh-runnerd/actions/runs/40064876584 . Final updated issue-comment, inline and formal-review audit adds no findings; historical immutable-source finding triage and reproductions remain in the packet/ledger. No unresolved blocker or pending review was found. PR head is unchanged and mergeable/clean against main3255cf3a990312a65e9ffa4971a468dd12310e3b. Maintainer-approved replacement of separate internal independent review applies ONLY to this PR (#103 (comment)); no unavailable internal approval is claimed. Proceeding with an exact-head constrained merge under the resumed merge authorization. Main Public CI will be recorded separately as integration evidence. No local Go/race/full-matrix PASS, G01/G02 completion, live/canary operation or general Python sandbox guarantee is claimed. |
|
POSTMERGE INTEGRATION — PASS Merged at 2026-10-24T05:50:45Z as main1eb30fcfe010f25c16bfe1a87c69c0189a7bfc62. The merge tree matches reviewed/qualified head9d9b86460402fb200deb9e7a0846e665d9f22e9f (no source-tree diff). Local clean main was fast-forwarded to the same merge SHA. Automatic push-triggered Public CI completed SUCCESS on that exact main SHA: https://github.com/1XP-AI/gh-runnerd/actions/runs/40067852573 . All seven checks passed: root/tooling, root race, G01 offline, G02 offline, R1 credentials offline, vulnerability check and aggregate Go checks. No manual dispatch/replay was used. This is separate postmerge integration evidence, not retroactive merge authority. Premerge frozen packet PASS261 shell/86 Python bodies/zero violations in2409.790s and same-head review/quick/finding audit are recorded at #103 (comment) . A postmerge audit found no late inline, formal or issue-comment findings. #79 acceptance is satisfied; closing that issue and marking its Project item Done. G01#1/G02#2 remain open/incomplete and the parent goal remains paused. No live/canary/runner/credential operation or general Python sandbox guarantee is claimed. |
Delivered — merged and validated
Merged as
1eb30fcfe010f25c16bfe1a87c69c0189a7bfc62, with a source tree identical to reviewed head9d9b86460402fb200deb9e7a0846e665d9f22e9f.125ea92e4566304a23488948d559ec2e684ba595, harness69b1f698609071823bb7dea4a0d92a48560ca7d6.The separate-internal-review replacement was approved for this PR only, not as a global policy change. G01 #1 / G02 #2 remain OPEN/incomplete and the parent goal remains paused. No live canary or runner/credential operation was performed or authorized. No general Python sandbox guarantee. Historical failed scans and candidate summaries below retain their original identities/results; they are not relabeled as passes.
Current correction candidate — 9d9b864
Head
9d9b86460402fb200deb9e7a0846e665d9f22e9freplaces private AST-coordinategetattrreturns with direct fixed attributes guarded byhasattr. For parser-created AST metadata it retains fallback-1, end-field precedence and existingNone; it makes no promise about arbitrary side-effecting attribute overrides. No reflection policy, result authority or allowlist changes.The preceding
5536e60whole qualification FAILED, one reflective-helper-result finding / 2286.539s, despite clean review/quick CI. A focused extraction of the actual position helper and caller reproduced the same finding RED0.455s/GREEN0.469s. Final 194 PR103 methods PASS14.558s, 54 getter methods PASS18.546s, aggregate 206/328/7 PASS19.965s; selectors overlap. The complete actual scanner definition source passes the filesystem-alias guard 446.103s; later signal/indirect-execution gates pass too. These targeted preflights do not replace whole-packet qualification. Packet125ea92e4566304a23488948d559ec2e684ba595; harness69b1f698609071823bb7dea4a0d92a48560ca7d6.Fresh exact-head review requested; matching quick, finding triage and successful fresh stable-head whole-packet qualification remain mandatory. The maintainer-approved separate-internal-review replacement is PR-specific. No unavailable internal approval, live/canary operation, completed-goal or general Python sandbox claim. #79 remains In review; older receipts below are historical.
Current correction candidate — 5536e60
Head
5536e6006b465e52af2a4dacca6ae1d36a99c078only renames colliding private scanner identifiers: 44 localcallName references in seven helper scopes, plus one scalar-index predicate and four references. Immutable-source AST comparison confirms an alpha-renaming-only scanner delta: no expressions, literals, public signatures, alias rules or allowlists changed. The added fast actual-source regression covers callback and direct-call targets across new helpers too.The preceding
cc6a499full-packet qualification FAILED, one callback-target finding / 1938.693s, despite clean GitHub review and quick CI. That failure and a latent index-collision RED discovered before the next slow scan are preserved in the ledger. Final 193 PR103 methods PASS 16.893s, 54 getter methods PASS 15.242s, aggregate 206/328/7 PASS 16.306s; counts overlap. Packet3ee10900f24c7a467acbd762096679681e72e435; harness46620589f228f11ba556373dc1cd237ec2bead39.Fresh exact-head review requested. Matching quick CI, all-finding triage and successful fresh whole-packet qualification remain mandatory before merge; the slow qualification follows stable review. The maintainer-approved replacement of separate internal review with GitHub Codex is PR-specific, not a claim of unavailable internal approval. No live/canary/runner operation, completed-goal claim or general Python sandbox guarantee. #79 remains In review; older receipts below are historical only.
Current correction candidate — cc6a499
Head
cc6a49928b002fc1a264eb0ff848129410158aa2replaces the remaining conditional reference-point initializer inv22_closed_callwith an equivalent explicitif. The conservative launcher rule is unchanged. A new fast actual-source test checks all conditional assignments, avoiding first-helper-only coverage; it does not replace whole-compiler or whole-packet qualification.The preceding
b8990fffull-packet qualification FAILED, one finding / 1570.462s, at scanner body line 17619 despite its clean GitHub review. The failure is preserved in the ledger, not counted as approval. New RED 0.525s; focused GREEN 0.844s; final 192 PR103 methods PASS 21.615s, 54 getter methods PASS 16.509s, aggregate 206/328/7 PASS 17.593s. Selectors overlap. Packet blobadf98700018c5ea04fb5ec060cf9a868ad5a6a07; harnesscbcf97c4d3f633db9a4c2697cd61c635388db42a.The maintainer approved replacing the separate internal independent review with GitHub Codex review for this PR only (authorization). No unavailable internal approval is claimed. Fresh exact-head GitHub review, matching quick CI, all-finding triage and successful frozen whole-packet qualification remain merge gates. Review requested; full-packet qualification will run after this correction settles. No live/canary/runner operation, completed-goal claim or general Python sandbox guarantee. Project #79 remains In review. Older candidate receipts below are historical only.
Current correction candidate — b8990ff
Head
b8990ffa3d6aecabf1ccbe53ab175c0a5376eae4addresses P1 method/class lexical ownership: class namespaces are excluded regardless of if/try/loop wrappers around method definitions. Class suites remain unsupported proof contexts, and unindexed header bindings invalidate all possible enclosing owners rather than guessing. An adjacent class/global/header rebinding bypass is covered; a read-only nested method remains accepted.Final packet blob
fb07ea1786ae9e61d2f74cc7782b52f29b78a248; harness blob0556313926baf95a23a6ba1ec31f26c6c2071929. GREEN: 191 PR103 methods (10.865s); 54 getter-fixture methods (12.581s); focused review/prior-helper/owned-path controls 12 (0.816s); expanded preflight 206/328/7 (13.960s). Counts overlap. New RED: four assertions / two methods (0.324s). All prior findings and failed/interrupted qualification receipts remain in the ledger.Fresh exact-head GitHub review requested. The mandatory fresh full-packet qualification will run after review settles this frozen source, to avoid repeatedly scanning superseded candidates; it is not waived or passed yet. Current review/finding triage, matching quick CI, mandatory review requirements and complete packet qualification remain merge gates. Older candidate results below are historical only. No live/canary/runner operation, unavailable independent approval, completed-goal/merge-ready claim or general Python sandbox guarantee is made. Project #79 remains In review.
Current correction candidate — f53732c
Head
f53732cd8a5d5170f4e5eb358a146872c28784feaddresses both P1 findings from fa8aa39: outermost comprehension input references resolve outside the comprehension, and global/nonlocal declarations resolve to actual binding owners. Additional first-class namespace getter probes are corrected: globals/locals cannot be data, vars requires one explicit object without callable escape, and namespace getters cannot be obtained through attributes/reflection. Direct vars(obj) remains accepted. An equivalent explicit if replaces the scanner's conditional AST-parameter assignment without weakening the launcher rule.Final packet blob
94ab93cc66705f386c23d65c19ff69cb1d97808c; harness blob3096b1a116180d048903cc9cc714759e3fbbf9cc. GREEN: 189 PR103 regression methods (10.789s); 52 getter-fixture methods (12.324s); expanded preflight 206/328/7 (13.832s). Selectors overlap. Red cases, actual-helper extraction, failed historical full packet scans and interrupted/superseded runs are recorded in the candidate ledger; no incomplete scan is called a pass.Fresh exact-head GitHub review requested. Current full-packet qualification is running, not yet a pass. Older receipts below remain historical. Final review/finding triage, matching quick CI, mandatory review requirements and complete packet qualification remain merge gates. No live/canary/runner operation, unavailable internal approval, completed-goal/merge-ready claim or general Python sandbox guarantee is made. Project #79 remains In review.
Current correction candidate — fa8aa39
Head
fa8aa396adbcdda479f888c65a2fe061ac3ec3fbaddresses both P1 ownership findings from completed review of3023373: class-qualified callers and same-name default captures. Class-owned/class-suite contexts do not establish caller/nonescape completeness; definition headers resolve outside the new function, and unindexed header-walrus bindings invalidate the proof. Adjacent same-spelling class exports and reflected-accessor extraction are refused. The unchanged runtime-type gate also admits the scanner again after literal predicates were rewritten without runtime type construction, preserving integer bool exclusions and declaration-owner semantics.Final inputs: packet blob
8aca669e430aedd3e1573ee6682ca16dd9d5d556; harness blob93641a03d9942d77e741c4c119b2fff7798b4951. GREEN: 185 PR103 regression methods (10.769s); 49 getter-related methods (12.451s); targeted review/native protocol/type/owned-path controls 10 (1.721s); aggregate preflight 206/328/7 (14.121s). Counts overlap. The ledger preserves RED evidence for both GitHub findings and adjacent namespace probes, plus the failed historical full packet scan and its correction.Fresh exact-head GitHub review requested; current full-packet static qualification is running, not a pass. Older review/CI/test receipts below are historical only. Current review/finding triage, matching quick CI, mandatory review requirements and final packet qualification remain merge gates. No specimen execution, live/canary/runner operation, unavailable internal approval, merge-ready claim or general Python sandbox guarantee is made. Project #79 remains In review.
Current correction candidate — 3023373
Head
3023373c91251d51b07e86721b7291c766d6c3adpreserves two existing safe getter fixtures after the preceding security fix: zero-argument single-return literal member helpers and explicit/default member parameters from completely known named callers. Metadata/alias/callback/default escape, rebinding, unknown returned values and unknown argument expansions refuse the proof. Receiver-independent complete member domains and all prior P1 corrections remain in place.TDD: existing local-return positive RED (9 methods, 1 failure, 0.352s); broader getter audit RED (45 methods, 1 failure, 12.346s). Final source: 46 getter-related methods PASS (13.345s), 181 PR103 regression methods PASS (10.227s), aggregate preflight PASS (206/328/7, 14.834s). Counts overlap. Packet blob
6dbd21ff2509ea94748ad8bef7a5a8d8e06100ee; harness blob56173ad9a0a387cef73076288218bb23a74fe535.Fresh exact-head GitHub review requested; whole-packet qualification is running. The preceding
46e15a3no-major-issues review, CI, 200-method regression and 86-body namespace delta are historical only, not approval of this new head. All final-head review/finding triage, quick CI and packet qualification gates remain required. No live/canary/runner operation, unavailable internal approval, merge-ready claim or general Python sandbox guarantee is made. Project #79 remains In review.Current correction candidate — 46e15a3
Head
46e15a3b6da05be57e219699f4cde56562082664addresses P1 wrapped callable reflection from the completed review ofd278433. Member-name domains must be complete and bounded regardless of receiver identity; unknown alternatives are never dropped. Reflective accessor escapes are refused. Closed literal key-iteration preserves the unchanged stream-capture body, with mutation/escape/closure controls.TDD: new wrapped/opaque cases RED (3 assertions, 0.368s); wrapped protocol-getter RED (1 assertion, 0.321s); intermediate strict-domain compatibility failure recorded (200 methods, one failure, 14.374s), not hidden. Final focused boundary/native protocol/path/default controls: 11 methods PASS (0.595s). Aggregate preflight PASS (206/328/7, 15.086s). Packet blob
a439036c4099032175eeb326ffe6a8076b789bb9; harness blob831136307994ae7b1072bfe0682c1ab4d42c672a.Current combined regression and whole-packet static qualification are running; no pass is claimed yet. The old
d278433combined regression completed 199 methods PASS (646.963s), but it and its hosted quick success are historical evidence only. Fresh exact-head GitHub review requested. All final-head finding triage, matching quick CI and packet qualification remain required before merge. No specimen execution, live/canary operation, unavailable independent approval or general Python sandbox guarantee is claimed. Project #79 remains In review.Current correction candidate — d278433
Current head:
d2784333608433ae5c1c33d4ffe2fc7eefa3dd4f. The completed review of preceding head5024b6freported one P1, reproduced and corrected in this batch. A coordinator-reproduced function-global namespace alias bypass is corrected as well. Only singleton matching key domains can strongly replace selected-value facts; possible writes preserve UNKNOWN. Execution-namespace handles are refused at the existing admission gate, with alias/default/computed-member controls.3c4241aaea257f20c2392ce8d7f414cdeb2cbcce, harness blobe4ba5c4055e273fddaaa70ac1d891b247ebf2d13.The candidate ledger carries immutable finding links and historical evidence. Project #79 is In review. Earlier candidate receipts below remain historical, not current-head approval.
Current candidate:
5024b6f7f6add0cf5b5f7b7452cfe6a5ae02e217This checkpoint supersedes historical candidate summaries below.
98a1913dc6d920d4f02ea54a8c165cfd71bcb61cand harnessf2f73605c8824ed60151d8f87af9806401bb5176. Final harnessfb6ee136383edb684702cb60e71bd7d0d5eebc9dadds only four negative constructor variants; that expanded method separately PASS / 0.304s on the identical packet.Issue #79 — keyword, member, hook and callback proof closure
Head:
66c33aa19ab72603e48a8deb67fbe7d11064da6f. Refs #79; G01/G02 remain open.The immutable ledger retains historical source-scoped findings and addresses the four-P1 exact-3b44ecc report.
Actual evidence
Initial RED4methods15failed assertions/zero errors0.287s (9sensitive6policy); additional computed-hook closure RED1method4failures0.249s (2sensitive2policy). Final GREEN22methods0.632s; 145 focused methods PASS22.030s; identical expanded preflight PASS12.456s206/328helpers7regexzero collisions/lostproofs. Earlier144-method receipts retain their own hashes.
Packet
9d9a0dfba93d08f04c62f5cb9f527e48cad5375a; harness76a232bff88a0da828c6f52f60c329b0a91c1462; ledger3b7806ef34b59b26fcb1609de2571b514e43736f. Exact three-file hygiene and clean candidate verified. Two independent Codexgpt-6.1-sol / mediumexact-SHA source approvals under maintainer override: contract5methods0.289s+8contrasts, security22methods0.639s+12contrasts; keyword-only callback contrasts explicitly policy-only.Fresh V20 whole-packet qualification: NOT RUN / pending. One scan remains mandatory on the stable GitHub-approved immutable candidate BEFORE MERGE, recorded in a PR comment without amending source. Historical V14 full PASS958.273s is not current evidence; V15–V19 full scans were not run.
Remaining gates / safety
Completed same-head GitHub Codex review, all-finding triage, hosted quick and stable-head packet qualification remain mandatory. Public CI remains postmerge integration evidence.
All specimens/recipes/descriptors/callbacks stayed inert AST data. No live canary, runner/JIT/credential/token/container operation, manual workflow dispatch or specimen execution occurred. Rollback is a reviewed bounded revert preserving historical evidence and reopening removed coverage.