Close V5 verifier capture and custody seams - #3606
Open
joshlf wants to merge 1 commit into
Open
Conversation
Adversarial review after the authenticated-review aggregation repair found two remaining path-reopen races. Snapshot validation compared a candidate word_count.py with trusted bytes and later executed the candidate pathname, so a coherent replacement could run after the equality check. Static verification likewise authenticated one lock but aggregation and gate derivation could reopen the lock pathname instead of consuming the verifier capture. The built-in production-shaped test also discarded the review-evidence result and therefore did not prove the exact three source plus eight snapshot receipt inventory. Capture regular files through one no-follow descriptor with stable before/after metadata. Compare the staged word counter with a descriptor capture, execute only the captured trusted implementation, and recheck the staged file without ever executing candidate bytes. Bind the canonical read-only STATIC-LOCK digest into the same-capture review-evidence envelope, require it to equal the separately custodied external commitment, and carry that captured digest through aggregate and gate derivation rather than reopening the path. Strengthen the mechanical production lifecycle assertions for the exact 3+8 receipt set, eleven reviewer identities, raw receipt hashes, lock commitment, and valid-A to valid-B substitution seams. Add negative coverage for candidate word-counter replacement and mismatched captured lock evidence. Document the remaining boundary precisely: the coordinator must maintain uninterrupted private OS-level custody of the bundle, runtime state, ancestors, and external commitment from final publication through bound-gate evaluation. Advisory modes and cooperative locks are defense in depth, not protection from a same-UID or privileged adversary; uncertain custody invalidates the run. gherrit-pr-id: Ghkhtqyl7uarxeejpm6eu2in5vz5l3asl Validation: prepare, integration, and protocol DRAFT checks; full integration and protocol self-tests including mechanical production and synthetic lifecycles; all four semantic validators; AST parsing; git diff cleanliness; and zero bytecode/cache artifacts.
This was referenced Aug 29, 2026
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This was referenced Aug 29, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## Ge64gipf6sorrrdfcfdn53nwmf5wjhtsu #3606 +/- ##
==================================================================
Coverage 91.85% 91.85%
==================================================================
Files 20 20
Lines 6093 6093
==================================================================
Hits 5597 5597
Misses 496 496 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adversarial review after the authenticated-review aggregation repair found two remaining path-reopen races. Snapshot validation compared a candidate word_count.py with trusted bytes and later executed the candidate pathname, so a coherent replacement could run after the equality check. Static verification likewise authenticated one lock but aggregation and gate derivation could reopen the lock pathname instead of consuming the verifier capture. The built-in production-shaped test also discarded the review-evidence result and therefore did not prove the exact three source plus eight snapshot receipt inventory.
Capture regular files through one no-follow descriptor with stable before/after metadata. Compare the staged word counter with a descriptor capture, execute only the captured trusted implementation, and recheck the staged file without ever executing candidate bytes. Bind the canonical read-only STATIC-LOCK digest into the same-capture review-evidence envelope, require it to equal the separately custodied external commitment, and carry that captured digest through aggregate and gate derivation rather than reopening the path.
Strengthen the mechanical production lifecycle assertions for the exact 3+8 receipt set, eleven reviewer identities, raw receipt hashes, lock commitment, and valid-A to valid-B substitution seams. Add negative coverage for candidate word-counter replacement and mismatched captured lock evidence.
Document the remaining boundary precisely: the coordinator must maintain uninterrupted private OS-level custody of the bundle, runtime state, ancestors, and external commitment from final publication through bound-gate evaluation. Advisory modes and cooperative locks are defense in depth, not protection from a same-UID or privileged adversary; uncertain custody invalidates the run.
Validation: prepare, integration, and protocol DRAFT checks; full integration and protocol self-tests including mechanical production and synthetic lifecycles; all four semantic validators; AST parsing; git diff cleanliness; and zero bytecode/cache artifacts.