Repository navigation
feat(receipt): add explicit local authenticated receipt bootstrap - #176
Conversation
Add a manually operated private collector and receipt-only handler. Preserve original budgets through private IPC v2, generation-bound Codex v1, and a separate Claude delegated context without native identity or consumption claims. Fence one native submission, preserve known facts on unknown receipt outcomes, and keep authority out of argv, environment, public output and sender/collector persistence. Refs #132
abruption
added this to the
0.6.0 — Claude discovery, authenticated receipts and research milestone
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 749199fb13
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review final security follow-up adbd95a. Independent noninteractive Claude Opus 5.5 and Gemini 4 Argon both found that adapter wrapping erased pre-effect stop/deadline Refusal; this commit preserves only unattempted local guard reasons and terminal timeout facts. Attempted native outcomes remain unknown; no retry/fallback is added. Six deterministic scenarios were added; receipt-send35/35pass. Full review scope/model/input hashes and limits are retained with the release evidence. |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Problem and resulting behavior
The runtime retains correlated handoff facts but has no installed receipt producer/collector bootstrap. This adds an explicitly selected, local owner-private route: a manually started foreground collector, a private-stdin receipt-only handler, and opt-in send integration. It never prompts an agent from a receipt or treats ordinary replies/turn completion as ACK.
--messageargument or a legacy fallback. Unsupported best-effort fallback is unwrapped, before preparation, context-pinned and charged to the original budget.token_possessiondoes not prove model identity, native injection, consumption or completion. Public CLI envelope schema remains 1.Independent development and review
Antigravity CLI 1.4.12 / actual
gemini-4-argon-mediumindependently drafted a stdout-only prototype. Codex validated the proposal and performed all persistent edits. Fresh Gemini core/integration reviews and separate Claude Code 2.1.314 / canonicalclaude-opus-5-5reviews checked frozen inputs. The final focused pair received identical SHA-256cb1b3cac18c6cf0188b963b7adad533b11d63d8082524114552c197e9686f70din parallel fresh contexts, with tools disabled or plan+sandbox. No model fallback or reviewer repo writes occurred.Verified findings fixed: response scope/generation matching, original deadline renewal across IPC, terminal-stop result races, unknown-stop exit semantics, pre-effect stop cleanup order and expired-wait quota classification. Native
queued/postedfacts were deliberately retained; the contrary status-overwrite suggestion violated the existing contract. A larger Gemini request self-reported unviewed context; actual transport truncation could not be proven, so it is not claimed as complete coverage. Later bounded scope review and full Claude review are recorded separately. Private raw inputs, outputs, hashes, failures and Codex dispositions are retained in the task review record.Final security correction and validation
The final static security delta (77,801bytes; SHA-256
32861d788754449199140aeded5c6efafb4a722599ff2bca4a1322b65ec3a0e8) was reviewed independently by Claude Code 2.1.314/canonical first-partyclaude-opus-5-5(95.214s) and Antigravity 1.4.12/initgemini-4-argon-medium(146.036s), both successful with fixed inputs and no reviewer tools or edits. Both found adapter wrapping could erase pre-effect stop/deadline reasons. Final commitadbd95ad2bf00cc11072d6b005a84a4e311d173fpreserves local unattempted guard reasons and immutable terminal timeout facts; attempted native outcomes stay unknown. Six new deterministic scenarios and receipt-send 35/35 pass validate this. Root audited the correction. Exit 130 follows a proven original stopped wait, while unknown submission facts remain intact; it does not claim zero native effect or consumption.Final feature head passes 12/12 CI checks and current-head code review completes with no findings. GitHub Security Review metadata still names an older head; it is not presented as a current-head result. The independent security delta and root correction are recorded separately, without a claim of new live native/model/SSH qualification.
The integrated 0.6.0 tree
39eede022558106efaae5fd8cd391ce7393a1ef8passes 666 local tests:654pass, 0fail, 11skip, 1existing TODO with pinned Python reference8ca77cf31254c8287a2593fe484bb30a7dba2727. CI fixture paths/installations are private and canonical; production trust guards are unchanged. Test-file concurrency is bounded at two without weakening 800-ms owner bounds/assertions. An earlier macOS pre-effect owner refusal remains of unconfirmed cause; final-head CI passes. An earlier wrong Python-reference environment name caused an excluded ENOENT run.Limits and release separation
The 32-MiB quota and conservative 64-KiB reservation can fill near 511 small intents before the 10,000-record cap. No automatic history reset/recovery is added. Explicit revoke blocks duplicate presentations; owner status preserves committed ACK. TTL-only identical authenticated retrieval stays read-only.
Windows managed storage, reverse-SSH receipts, new native profiles and general model/tool permission grants remain unsupported. No live user profile/transcript/auth access or real native/model/SSH receipt qualification was performed. Existing immutable skill 0.2.1 pin stays unchanged; metadata compatibility does not imply receipt feature coverage. Feature VERSION stays 0.5.2 until release PR #177. #132 remains open for implementation/qualification follow-up.
Refs #132