feat(autonomy): guardrail matrix, security binding, setup slice (WP5)

[kyle-sexton]

WP5 guardrail-enforcement package (T2 + T3 + the security-review policy resolution), per the merged PLAN. Phases 1–3 complete; Phase 4's positive probe runs in this PR's CI (transcript below after the run).

No linked issue

Related

• docs(topics): WP4-WP7 implementation plans (trigger dispatch, guardrails, routines, runner design pack) #359 (WP4–WP7 plans, incl. this package's PLAN as merged)
• feat(autonomy): trigger-dispatch package - contract, setup slice, envelope check (WP4) #372 (WP4 trigger-dispatch — the admission seam this package's policy content binds; envelope/classification cross-links land here)
• feat(autonomy): telemetry contract + setup slice, conformance check, live-proven demo (WP2) #343 (WP2 telemetry — the promotion-evidence base and trace-tree payloads)

What ships

• Guardrail hub (reference/guardrails.md): five-class × five-column matrix (T3 verbatim), glance-layer routing to four leaves, D8 permission-posture note, escalation event classes + org-bound routing + work-item/trace payload over the governed queue (no second channel).
• Leaves (reference/guardrails/): isolation-ladder.md (L0–L3, attendance × input-provenance axes, rejected trigger-source axis with falsification reason, L2 unattended floor, fail-closed no-silent-degrade), work-classes.md (risk bundles; C1 repo-read-only with queue writes permitted; C5→L3 floor; promotion/demotion discipline with shipped default predicates — C2 auto-merge ≥20 completions/≥14 days/100% gates/0 reverts, C3 ai-review ≥30 advisory/0 missed-blocking; demotion one-event-suffices), security-review.md (two layers, per-class blocking knobs as floors — no override escape on verification), admission-policy.md (3-axis decision table with "*" wildcard + most-specific-wins, equal-specificity tie = invalid binding, shipped defaults C1/C2 autonomous within caps regardless of provenance, C3 per-item human, C4/C5 human-gated; caps autonomous_concurrency: 1, items_per_run: 3).
• Security-binding schema (skills/setup/schemas/guardrails-security-binding.schema.json): draft 2020-12, additionalProperties: false, fail-closed semantics in-schema; executor_class, dispatch_posture, per-surface isolation_bindings (level → substrate + probe_evidence + runtime_markers), merge/verification knobs, promotion_state, escalation_routes, admission (classification + rules + caps).
• Semantic validator (skills/setup/scripts/check-security-binding.mjs, exit 0/1/2): matrix merge caps, vendor-hosted human-gate cap, marker non-emptiness + pairwise joint-satisfiability ambiguity rejection, class-aware per-surface isolation verdicts (C5 requires L3), missing-L2 error under autonomous-enabled vs declared verdict under human-gated-only, non-promotable promotion entries rejected, admission weakening requires override_justification (admission-only escape), promotion-gated knobs require their ratified promotion_state entry, equal-specificity ties invalid, evaluation mode resolving EFFECTIVE promotion state against contrary evidence without writing the binding. 91 binding fixtures plus 67 transcript and 2 evidence files, each negative producing exactly one finding. Note: egress-probe targets must be multi-label DNS names or public literal IPs — encoded loopback/private forms are normalized and rejected.
• Setup guardrail slice (SKILL.md): two-surface resolution (security binding in settings-as-code home behind an agent-unwritable org-policy-home bootstrap; repo-local non-security remaps), substrate detection per surface, probe-before-bind live validation, detect-diff-reconcile against existing org guardrail surfaces, security review folded in (one slice, no near-duplicate capability), paid SKUs advisory + cost surfaced, fail-closed no-L2. Plus templates/isolation-probe.md and five new evals; plugin 0.5.0.

Live-validation demonstration (Phase 4)

Positive probe — this PR carried a one-off workflow (wp5-isolation-probe-demo.yml, since removed per the PLAN; evidence persists in the run log below) that PROVISIONED a genuine egress-denied boundary on the hosted runner (nested docker run --network none container) and executed the probe recipe INSIDE it, with a networked-outer-job control step. Transcript from the PR run:

From run 29675620833:

outer-egress: HTTP 200 (networked, as expected)
egress-denial: PASS - external fetch failed inside the boundary (exit 4)
credential-absence: PASS - every tested credential path absent inside the boundary (exit 3)
captured live transcript:
  "schema_version": "1",
  "probed_at": "2026-07-19T05:56:39Z",
  "assertions": {
    "egress_denied": { "host": "example.com", "exit_code": "4", "outcome": "denied" },
    "credentials_absent": { "path": "$HOME/.ssh,$HOME/.netrc,$HOME/.docker/config.json", "exit_code": "3", "outcome": "absent-or-denied" }
  },
  "outer_context_networked": true
Security binding OK: live-evidence/demo-binding.json
- surface "ci-pool-a": C1 eligible, C2 eligible, C3 eligible, C4 eligible, C5 blocked (requires L3, proven L2)

The final line is check-security-binding.mjs exit 0 against a binding whose probe_evidence is the transcript captured seconds earlier in the same job — the checker passes only against live-captured, identity-matched evidence. (The recorded transcript predates the capture-contract fields that later review hardening added to the checker — per-target credential exit codes, host-side expansions, transport outcomes, and the outer-context reachability/existence codes on both assertions; it is preserved verbatim as the run's historical record.)

Negative path — check-security-binding.mjs on the missing-L2 autonomous-enabled fixture (exit 1):

- isolation_bindings: no bound surface reaches L2 under dispatch_posture autonomous-enabled — autonomous dispatch is blocked fail-closed; compliant paths: bind an L2-capable substrate (whole-process OS-sandbox wrap, default-deny-egress container) on an execution surface, or declare dispatch_posture human-gated-only

Declared posture — the same missing-L2 shape under human-gated-only validates (exit 0) with the blocked-dispatch verdict reported as the DECLARED posture, not a defect.

Demotion evaluation — promoted-C2 binding + contrary evidence (exit 0, binding file unchanged):

- C2-auto-merge: bound promoted -> effective unpromoted — ceiling lowered by contrary evidence (reverted-merge at 2026-07-10T12:00:00Z) WITHOUT modifying the binding; demotion files an escalation item on route "queue:escalations/demotion" requesting the human-ratified binding update

Near-duplicate audit

Security review is folded into the ONE guardrail slice of guided-setup (no separate security-review capability); escalation composes the governed queue itself via the trigger contract's acknowledgment symmetry — no second claim, dispatch, or escalation channel was created anywhere in this package.

Gates

validate-plugins.sh, validate-plugin-contracts.mjs (vendor deny-list clean over reference/), catalog --check in sync, markdownlint 0 errors, typos clean, lychee offline 0 errors, claude plugin validate --strict pass, skill-quality check-skill.sh setup PASS (2 pre-existing WARNs), evals.json schema-valid (ajv draft2020), actionlint clean on the demo workflow. Full plugin test suite rides CI. Validator exercised over the full fixture set with expected exit codes and single-finding assertions.

Boris check

Step-3 guardrails cell covered (agent sandboxing = isolation ladder; automatic code + security review = verification layers; token/model management = cost tiers); the step-4 sentence ("enforcing the right guardrails for each type of work") is instantiated as the matrix; the step-3 trap honored (human-ratified promotion, automatic evaluation-time demotion); step-1 guardrail untouched. Auto-mode classifier tuning + allowlist distribution explicitly deferred with named triggers.

PLAN.md (as merged, tags advanced)

ai-ladder-wp5-guardrails

Brief

TLDR

Guardrail-enforcement package (T2 + T3 + #241 instance): one guardrail contract shaped as a
progressive-disclosure hub (matrix doc as index/spine) with on-demand leaf docs, an org-binding
seam split by governance sensitivity, evidence-gated promotion with automatic demotion, and the
guardrail slice of guided-setup (detect → bind → live-validate → fail-closed).

Goal

Any adopting org can bind the five-class guardrail matrix to its own instances and get
per-work-class enforcement — isolation floor, verification layers, merge policy, cost tier,
escalation — with the security-sensitive bindings outside agent blast radius, promotion earned
on queryable evidence, and no silent degrade anywhere.

Locked decisions

#	Decision
D1	ONE guardrail contract, hub-and-leaves progressive disclosure: matrix doc = index/spine (table + one-line class/column definitions, glance layer resolves the common question); leaf docs load on demand — e.g. isolation-ladder levels, per-class detail + promotion triggers, security-review policy, admission policy (examples, not a fixed list; split at architect). Plus the guardrail slice of guided-setup. Both in the capability-distribution home. Fleet materializations = /work-items backlog.
D2	Org-binding seam: contract-owned schema, one logical binding, two governance surfaces split by sensitivity. Security-sensitive axes (isolation substrates per level, merge policy, per-layer blocking knobs, promotion-trigger state, escalation routes, admission policy) bind in the settings-as-code home — outside the blast radius of agents working in the consuming repo (agent-writable guardrail binding = bypass channel). Non-security mappings (class→label strings, cost-tier→model names) may bind repo-locally per the work-item-tracker binding pattern. Layered resolution: org-policy-home defaults → settings-as-code per-repo binding → repo-local non-security remaps; contract defines resolution order, materialization at architect. Fail-closed on absent/invalid security-sensitive binding; documented defaults only for non-security axes.
D3	Promotion/demotion discipline: contract defines the trigger SHAPE — an evidence predicate over queryable telemetry (verification outcomes per the telemetry contract are the evidence base). Promotion = human-ratified knob flip, recorded as a reviewable change on the governance surface — never automatic. Demotion = automatic fail-closed on contrary evidence (gate failure, human-reverted merge), re-earn from there. Org binds threshold values; suggested defaults at architect. Near-term promotable cells: C2 auto-merge, C3 AI-review advisory→blocking (#241); C4/C5 merge never promotes.
D4	Sandbox-ladder setup slice: detect available substrates per level per machine surface → bind level→substrate in the security binding → live-validate BEFORE recording (empirical probe, e.g. denied-egress smoke test inside the boundary; a binding lands only after the sandbox provably blocks) → fail-closed verify (no L2 substrate → autonomous dispatch blocked for that surface, compliant paths named — no silent degrade).
D5	#241 three-part resolution folds into the matrix structure, nothing ships separate: security-review policy contract (two layers, per-layer blocking knob) = verification-column leaf; security-review setup = part of the one guardrail slice of guided-setup (near-duplicate capability ban); the adjustment/audit layer generalizes matrix-wide — guided-setup always detect-diff-reconcile against existing org guardrail surfaces (sandbox configs, branch protections, review workflows), never greenfield-assume, never silently overwrite.
D6	Escalation column sharpened from DIRECTIONAL: contract defines escalation event classes (gate failure, verification divergence, admission rejection, demotion event, structural-class plan approval, untrusted-provenance always), routing obligation (org-bound routes in the security binding), and payload (work-item ref + trace link, one causal tree). Mechanism reuses the governed queue: escalation lands as a human-gated work item + optional channel notification via the trigger-contract acknowledgment symmetry — no second channel. Only interactive escalation UX stays deferred; trigger: WP7 runner design pack.
D7	Admission-policy content (the trigger contract's admission seam enforces it; this package owns it): decision-table shape — signal-surface class × initiator provenance × work class → disposition (autonomous-eligible / human-gated / audited rejection) — plus caps (autonomous concurrency, per-run items). Shipped defaults: C1/C2 autonomous-eligible within caps regardless of provenance (blocking agent provenance would sever the agent-kicks-off-agent loop), C3 per-item human admission, C4/C5 human-gated. Provenance is recorded input to gating, never trusted as isolation; caps bound total autonomous fan-out.
D8	Permission posture: attended ergonomics (auto-mode classifier tuning, safe-command allowlist distribution) is NOT a matrix column — unattended runs replace per-action prompts with the whole-process boundary; the ladder leaf carries a one-line permission-posture note (L1 = attended ergonomics tier, L2+ = the boundary is the control). Classifier tuning + allowlist distribution = backlog seeds with trigger, not silent drops.

Constraints

• Any fleet repo or vendor name in normative contract text is a defect; vendor names appear only
  as marked examples and in binding docs.
• Security-sensitive bindings never live where the agents they govern can edit them.
• Fail-closed everywhere: unavailable substrate, absent/invalid security binding, contrary
  promotion evidence — block and name the compliant path, never degrade silently.
• No new cost by default: free-path scanners and substrates default; entitlement-gated tools
  (e.g. paid code-scanning SKUs) are advisory + explicit opt-in with cost surfaced.
• One queue, one escalation channel (the queue itself); no second claim, dispatch, or
  escalation mechanism.
• Boris-alignment is the standing acceptance criterion (no step-skipping, trust before scale).

Acceptance criteria

• Matrix doc's glance layer alone answers "what governs class X" — leaf docs only for depth
  (progressive-disclosure convention conformance).
• Binding schema names the two governance surfaces + layered resolution order; security axes
  fail closed when unbound.
• Promotion is human-ratified + evidence-gated; demotion is automatic; both leave a reviewable
  audit trail on the governance surface.
• Guided-setup slice detect-diff-reconciles existing guardrail surfaces, live-validates
  isolation before binding, and has zero paid dependencies on its default path.
• Admission decision-table defaults match the matrix class defaults verbatim; agent provenance
  is not blocked by default; caps are org-bindable.
• Boris check: step-3 guardrails cell covered (agent sandboxing = ladder; automatic code +
  security review = verification layers; token/model management = cost tiers); step-4 sentence
  ("enforcing the right guardrails for each type of work") instantiated as the matrix; step-3
  trap honored (human-ratified promotion, automatic demotion); step-1 guardrail untouched.
• Auto-mode classifier tuning + allowlist distribution explicitly out-of-scope with named
  triggers, not dropped.

Captured assumptions

• Verification-outcome telemetry (WP2 contract) is queryable at promotion-evaluation time; until
  wired, promotion evaluation is manual over the same evidence definition.
• Free-path deterministic scanners remain available on the default path; paid code-scanning
  SKUs stay entitlement-gated (re-verified: private-repo CodeQL requires a paid license).
• The work-item-tracker binding precedent (contract-owned schema, org-supplied values,
  stop-and-report on invalid binding) remains the fleet's binding idiom.

Out-of-scope (deferred with triggers)

• Interactive escalation UX — trigger: WP7 runner design pack.
• Auto-mode classifier tuning + safe-command allowlist distribution — trigger: 1→2 residue
  sweep / standards allowlist-distribution work (backlog seeds).
• Cost ENFORCEMENT (hard spend caps) — trigger: 3→4 transition work; cost tiers here are
  policy vocabulary only.
• Fleet materializations (binding instances, workflow gates, scanner wiring) — /work-items
  backlog post-graduation.

Deferred questions

• Exact class/level/column/attribute tokens + binding schema fields — /architect (with the
  plugin naming pass).
• Leaf-doc file split + glance-layer wording — /architect.
• Promotion-trigger default values (run counts, windows) + demotion evidence set — /architect.
• Setup-slice probe mechanics per substrate class — /architect.
• Admission decision-table serialization format — /architect.

Plan

Recommendation-locked this round under the user's standing pre-authorization (same basis as
the WP2/WP3 round): hub doc reference/guardrails.md with leaf docs under
reference/guardrails/ (isolation-ladder.md, work-classes.md, security-review.md,
admission-policy.md — the D1 example split, adopted); class tokens C1–C5 and level
tokens L0–L3 carried verbatim from T3/T2; security binding = a contract-owned JSON
document in the settings-as-code home (schema_version from "1.0"); non-security remaps =
an ADDITIVE guardrails section of the WP1 repo-local binding; admission decision table
serialized as JSON inside the security binding.

Prerequisite: the WP4 implementation PR merged (reference/trigger-dispatch.md exists — the
admission leaf cites its seam; the interim is safe via WP4's fail-closed absent-binding
clause).

Phase 1: Guardrail hub + leaf docs [DONE]

File	Action	What changes
plugins/autonomy/reference/guardrails.md	Create	The hub/spine (D1): the five-class × five-column matrix table imported from T3 unchanged (C1 read-only / C2 mechanical / C3 scoped / C4 structural / C5 untrusted-provenance × min-isolation / verification / merge policy / cost tier / escalation), one-line class and column definitions, and the glance-layer rule — this table alone answers "what governs class X"; every deeper question routes to a named leaf. Permission-posture note per D8 (one line: L1 = attended ergonomics tier; L2+ = the boundary is the control). Escalation event classes per D6 (gate failure, verification divergence, admission rejection, demotion, structural-class plan approval, untrusted-provenance always) with the routing obligation (org-bound routes in the security binding) and payload (work-item ref + trace link); mechanism = the governed queue itself (human-gated item + optional channel notification via the trigger contract's acknowledgment symmetry — no second channel). Boris step-4 sentence cited as the matrix's source framing. Zero vendor/fleet names.
plugins/autonomy/reference/guardrails/isolation-ladder.md	Create	T2 ladder normative text: L0–L3 level definitions, attendance × input-provenance axes, the falsified trigger-source axis recorded as rejected (with reason), L2 unattended floor, fail-closed rule where L2 unavailable (block + name compliant paths, no silent degrade), permission-posture line per D8. Instances org-supplied; free-path substrate CLASSES named as marked examples only.
plugins/autonomy/reference/guardrails/work-classes.md	Create	Per-class detail: risk-property bundle per class (blast radius, reversibility, provenance, verifiability) — stating explicitly that C1 "read-only" scopes REPO surfaces and permits governed-queue/tracker writes (work-item filing, no repo mutation; the WP6 stress-test's F8 disambiguation) and that C5's min-isolation cell is the L3 floor WP7's C5-dispatch gate cites, per-cell promotion triggers (D3 shape: evidence predicate over queryable telemetry per the telemetry contract; promotion = human-ratified knob flip recorded as a reviewable change on the governance surface; demotion = automatic fail-closed on contrary evidence, re-earn from there). Suggested default predicates (org-bindable values): C2 auto-merge — ≥ 20 autonomous C2 completions over ≥ 14 days with 100% deterministic-gate pass and 0 human-reverted merges; C3 AI-review advisory→blocking — ≥ 30 advisory reviews with 0 human-confirmed missed-blocking findings. C4/C5 merge never promotes. Demotion evidence set: any post-merge gate failure, any human-reverted merge, any verification divergence — one event suffices.
plugins/autonomy/reference/guardrails/security-review.md	Create	The #241 security-review policy contract as the verification-column leaf: two layers (deterministic scanners + AI security review), per-layer blocking knob (advisory/blocking per class, bound on the governance surface), free-path scanners default, paid SKUs advisory + explicit opt-in with cost surfaced.
plugins/autonomy/reference/guardrails/admission-policy.md	Create	The D7 admission-policy content the WP4 seam enforces: decision-table shape (signal-surface class × initiator provenance × work class → disposition autonomous-eligible / human-gated / audited-rejection) + caps (autonomous_concurrency, items_per_run). Shipped defaults verbatim from D7: C1/C2 autonomous-eligible within caps regardless of provenance; C3 per-item human admission; C4/C5 human-gated; provenance recorded, never trusted as isolation. Default cap values (org-bindable): autonomous_concurrency: 1, items_per_run: 3 — conservative Boris trust-before-scale floor. Serialization: the admission object of the security binding (Phase 2 schema).

Sanity Check:

• Hub glance test: grep -c '| C[1-5] |' plugins/autonomy/reference/guardrails.md = 5 (matrix rows present) and hub contains zero level-definition prose (grep -c 'microVM' plugins/autonomy/reference/guardrails.md = 0 — depth lives in leaves)
• grep -c 'audited-rejection' plugins/autonomy/reference/guardrails/admission-policy.md ≥ 1
• grep -ci 'fail-closed' plugins/autonomy/reference/guardrails/isolation-ladder.md ≥ 1
• Promotion defaults present: grep -c '20 autonomous C2 completions' plugins/autonomy/reference/guardrails/work-classes.md ≥ 1 and grep -c '14 days' plugins/autonomy/reference/guardrails/work-classes.md ≥ 1
• Vendor+fleet deny-list sweep exit 0; lychee lane passes

Phase 2: Binding schema (two governance surfaces) [DONE]

File	Action	What changes
plugins/autonomy/skills/setup/schemas/guardrails-security-binding.schema.json	Create	Contract-owned JSON Schema for the security binding document that lives in the settings-as-code home (outside agent blast radius per D2): schema_version (const "1.0"), executor_class (self-operated | vendor-hosted — the merge-policy gating input, security-surface data per the trigger contract), dispatch_posture (autonomous-enabled | human-gated-only, default autonomous-enabled — an org may intentionally record its security settings while keeping every dispatch human-gated; the PR-review finding that a missing L2 entry must not conflate that deliberate posture with an invalid binding), isolation_bindings keyed by EXECUTION SURFACE (org-named surface id — e.g. the CI pool, a self-run host class; the PR-review finding that a flat level→substrate map lets one surface's L2 binding satisfy the check while a different dispatch surface has no boundary at all) → level token → substrate instance id + probe evidence ref + runtime_markers (the per-surface TRUSTED identifying markers the trigger contract's dispatch seam matches platform-attested runner context against — a key/value set drawn from metadata the executing workload cannot forge, e.g. attested runner-pool/label identity; serialized HERE, on the agent-unwritable security surface, so surface attestation never falls back to the repo-local recorded id), merge_policy (per class, capped per matrix), verification_blocking (per layer per class), promotion_state (per PROMOTABLE cell only: state + ratifying change ref + evidence window), escalation_routes (event class → org route), admission (classification rules — the signal→work-class mappings the trigger contract's adapters stamp from, e.g. label→class for tracker-vcs-event — plus decision-table rules with a "*" wildcard per axis and most-specific-wins precedence (full triple > two axes > one axis > default), optional per-rule override_justification, and caps autonomous_concurrency / items_per_run). additionalProperties: false; fail-closed semantics documented in-schema (absent/invalid security binding blocks autonomous dispatch).
plugins/autonomy/skills/setup/scripts/check-security-binding.mjs	Create	Validates a security-binding document against the schema + semantic rules the schema cannot express: merge-policy caps never exceed the matrix (C4/C5 human always; executor_class: vendor-hosted caps every class at human-gated); every surface bound under dispatch_posture: autonomous-enabled must declare non-empty runtime_markers (else the dispatch seam could never attest the actual surface and every dispatch would fail closed as unattestable), and marker sets must be PAIRWISE UNAMBIGUOUS under joint satisfiability — two conjunctive predicates are compatible (and the binding REJECTED) unless they require CONFLICTING values for at least one shared key, since a runtime context carrying the union of two non-conflicting predicates matches both (subset/identity checks alone miss e.g. {pool: blue, region: us} vs {pool: blue, os: linux}); the dispatch seam still requires EXACTLY ONE matching surface at runtime, failing closed on zero or multiple matches — the validator-level joint-satisfiability rejection is what keeps that runtime rule from turning validly bound fleets into ambiguity outages; isolation verdicts are PER SURFACE and CLASS-AWARE: each bound surface resolves, per work class, eligible (its bound level meets that class's min-isolation matrix cell — L2 is the floor for any autonomous dispatch, C5 requires L3) or blocked — admission/executor resolution must name the surface a dispatch would run on AND the item's work class, and verifies the surface meets the class's minimum at dispatch time, so an L2-only surface is never selected for a C5 item (even after human admission or a later policy change) and an unbound surface is blocked even when a sibling surface is bound; under dispatch_posture: autonomous-enabled it is an ERROR when NO bound surface reaches L2 (fail-closed, compliant paths named) — under human-gated-only the binding validates and the verdict reports blocked autonomous dispatch as the declared posture, not a defect; a promotion_state entry for a non-promotable cell (C4/C5 merge) is rejected; admission defaults not weaker than shipped defaults without the rule's override_justification (declared in the schema, so a justified override validates); every bound isolation level carries probe evidence. Plus an EVALUATION mode: given a binding + an evidence source, resolves the EFFECTIVE promotion state — the bound knob is a ceiling; live contrary evidence (gate failure, reverted merge, verification divergence) lowers it at evaluation time without writing the binding (automatic demotion has no write-back actor by design: the binding is agent-unwritable; the demotion event additionally files an escalation item requesting the human-ratified binding update). This evaluation is a LIVE-PATH OBLIGATION, not a demo artifact: the admission seam and the merge disposition MUST resolve the effective state (querying the promotion-evidence telemetry) before every autonomous dispatch/merge decision — reading the raw promotion_state alone is non-conforming, and unavailable evidence telemetry fail-closes to the unpromoted default — the checker's evaluation mode exists to exercise the same resolution mechanically. Exit contract 0/1/2.
plugins/autonomy/skills/setup/SKILL.md	Modify	Document the two-surface split + layered resolution order (org-policy-home defaults → settings-as-code per-repo security binding → repo-local non-security remaps in the WP1 binding's additive guardrails section: class→label strings, cost-tier→model names) — INCLUDING the security binding's resolvable locator: the org-policy home carries the repo→security-binding-document registry the dispatch seam resolves the binding through when settings-as-code is a separate repository — and for SECURITY resolution the org-policy-home identity itself must come from an agent-unwritable bootstrap, never the repo-local binding (the binding seam's known limitation that org_policy_home may persist repo-locally is tolerable for non-security defaults only; a repo-writable pointer would let an agent redirect the whole chain to a forged policy repository with a forged registry, binding, and matching runtime markers): the seam pins the org-policy-home identity from org-level platform configuration outside repo blast radius (an org-level setting/variable repo agents cannot write) or the executor's trusted deployment config, and any security resolution that would depend on a repo-writable pointer — or an unresolvable locator — fail-closes autonomous dispatch with the compliant path named. Fail-closed on absent/invalid security binding; documented defaults only for non-security axes.

Sanity Check:

• check-security-binding.mjs exit 0 on a fixture-valid document, exit 1 on each negative fixture: C4 merge_policy auto, executor_class: vendor-hosted with any non-human-gated merge row, promotion_state entry for a C4 cell, missing probe evidence, missing L2 under dispatch_posture: autonomous-enabled, admission weakened without override_justification; exit 0 with a blocked-dispatch verdict on the missing-L2 + human-gated-only fixture (deliberate posture, not a defect) (fixtures under evals/fixtures/)
• Evaluation mode: a promoted-C2 binding + contrary-evidence fixture resolves the EFFECTIVE state demoted (exit output asserts the ceiling was lowered without modifying the binding file)
• Schema declares executor_class and override_justification (grep -c 'executor_class' …schema.json ≥ 1; grep -c 'override_justification' …schema.json ≥ 1)
• Schema additionalProperties: false present (grep -c '"additionalProperties": false' …schema.json ≥ 1)
• claude plugin validate --strict exit 0

Phase 3: Guided-setup guardrail slice [DONE]

Extends the setup skill: detect → bind → live-validate → fail-closed (D4), always
detect-diff-reconcile against existing org guardrail surfaces (D5 — sandbox configs, branch
protections, review workflows), never greenfield-assume, never silently overwrite.

File	Action	What changes
plugins/autonomy/skills/setup/SKILL.md	Modify	Guardrail slice: detect available substrates per level per machine surface; bind level→substrate into the security binding; LIVE-VALIDATE before recording — the empirical probe per substrate class: denied-egress smoke test inside the boundary (a network fetch to a well-known external host MUST fail) + host-credential-path read attempt (MUST be absent/denied); a binding lands only after the probe transcript proves the boundary; probe evidence ref recorded in the binding. Fail-closed verify: no L2 substrate on a surface → autonomous dispatch blocked for that surface, compliant paths named. Security-review slice folded here per D5 (one guardrail slice, no separate near-duplicate capability). Paid scanner SKUs advisory + opt-in with cost surfaced.
plugins/autonomy/skills/setup/templates/isolation-probe.md	Create	Probe recipe per substrate class (container / OS-sandbox wrap / VM-microVM), parameterized, vendor names as marked examples only: egress-denial probe command shape, credential-absence probe shape, expected-failure assertions, transcript capture shape.
plugins/autonomy/skills/setup/evals/evals.json	Modify	Add guardrail-slice cases: substrate detection interview, probe-before-bind ordering, fail-closed no-L2 path, detect-diff-reconcile against a pre-existing branch-protection surface, paid-SKU advisory refusal-to-default.
plugins/autonomy/README.md + plugins/autonomy/.claude-plugin/plugin.json	Modify	Capability list + description + minor version bump.

Sanity Check:

• /skill-quality:check + validate-evals pass
• grep -c 'probe' plugins/autonomy/skills/setup/templates/isolation-probe.md ≥ 3
• grep -ci 'detect-diff-reconcile' plugins/autonomy/skills/setup/SKILL.md ≥ 1
• Fleet-name sweep exit 0

Phase 4: Live-validation demonstration + gates [DONE]

Acceptance probe, BOTH paths mandatory: (positive) run the Phase 3 probe recipe against a
REAL, PROVISIONED egress-denied boundary — the CI job on this public repo (free minutes)
launches a nested no-network container via the container runtime present on the hosted
Linux runner image (network mode none / internal-only, no host env or secrets passed in)
and executes the probe INSIDE it; the outer job keeps normal networking, so the probe's
egress-denial assertion is satisfied by a genuine boundary the job itself created — never
by the bare runner (which has outbound access and would fail the assertion) and never by a
hardcoded "denied" — transcript shows denied egress + absent credentials inside the
boundary, proving the probe DETECTS a genuine boundary; (negative) the fail-closed path is demonstrated by
validating an autonomous-enabled binding with a MISSING L2 entry and observing the
blocked-dispatch error; the deliberate human-gated-only posture validates separately with
its blocked-dispatch verdict reported as declared, not as a defect. A
fixture security binding referencing the positive probe's evidence passes
check-security-binding.mjs; the demotion evaluation fixture (Phase 2) runs here as part of
the demo record. Then the full gate roster (WP2 Phase 4): validate-plugins.sh,
run-plugin-tests.sh, validate-plugin-contracts.mjs, markdown/typos/lychee,
claude plugin validate --strict, catalog regen. Near-duplicate audit statement: security
review folded into the one guardrail slice (D5); escalation composes the governed queue — no
second channel created.

Sanity Check:

• Positive probe transcript (provisioned no-network container on the CI runner: egress denied + credentials absent inside; outer job networked) attached to the PR body
• Negative path: check-security-binding.mjs exit 0 on the demo binding, exit 1 on the missing-L2 autonomous-enabled fixture, exit 0 + declared blocked-dispatch verdict on the human-gated-only fixture
• Demotion evaluation output (effective state lowered, binding file unchanged) in the demo record
• All gate scripts exit 0; catalog in-sync
• Near-duplicate audit statement present in the PR body

Blast radius

MEDIUM-HIGH — one plugin's files, but this contract governs every autonomous dispatch
decision (admission), every isolation binding, and the promotion path to the closed loop;
security-posture content raises the review bar. Fully git-revertible; the security binding
itself ships as schema + fixtures only (no live org binding lands in this package).

Stress-test summary

Fresh-context plan review (WP4+WP5 batch): 14 findings, verdict FIX-THEN-SHIP, all folded.
WP5's share — F1b (HIGH, cross-package): the hosted human-merge-gate cap keyed on an
executor class the schema never carried → executor_class added to the security schema and
enforced by the check; F9 (MED): override_justification was required by the check but
undeclared under additionalProperties: false → declared in the admission-rule sub-schema;
F10 (MED): automatic demotion had no write-back actor against an agent-unwritable binding →
eval-time evidence-gating (bound state is a ceiling; live contrary evidence lowers the
effective state; the demotion event files an escalation item requesting the human-ratified
update), with an evaluation-mode fixture in the check and the demo; F11 (MED): the
fail-closed pivot alone never proved the probe detects a real boundary → positive probe
mandatory against a free-tier CI container, negative path demonstrated separately; F12
(LOW): fragile grep -c '20' → full-phrase grep; F13 (LOW): 3-D admission table gains a
"*" wildcard + most-specific-wins precedence, and promotion entries for non-promotable
cells are rejected; F14 (LOW, symmetry): the D8 backlog seeds are echoed in Open questions.
The classification-rules half of F1a lands here as the admission.classification schema
content (the WP4 contract's adapters stamp from it).

Execution shape

Fully sequential 1 → 2 → 3 → 4 — Phase 2's schema serializes Phase 1's admission leaf;
Phase 3 wires Phase 2's binding; Phase 4 probes Phase 3's recipe. Cross-package: after the
WP4 implementation PR (admission seam exists to cite).

Phase	Surface	Basis
1	main-session	normative security-policy authoring, tightly coupled T2/T3 imports
2	main-session	schema + semantic-validator judgment
3	main-session	setup-skill judgment, probe design
4	main-session	live probe + gate runs

Open questions

• Fleet materializations (live org security binding, workflow gates, scanner wiring) —
  /work-items backlog post-merge (Brief out-of-scope, triggers recorded).
• Interactive escalation UX — WP7 runner design pack (Brief trigger).
• D8 backlog seeds (auto-mode classifier tuning + safe-command allowlist distribution) —
  carried in the Brief with named triggers; filed via the work-items flow.

Decisions made (gate-passed)

Decision	What it changes in the plan	Basis (evidence)
Leaf split: 4 leaves under reference/guardrails/	Phase 1 file set	Brief D1 names exactly these four as the example split; each maps to one matrix column/axis
Hub-subdirectory layout (first reference/ subdir)	Phase 1 paths	Progressive-disclosure hub needs its leaves grouped; flat names would couple hub prose to 4 sibling filenames
Promotion defaults: C2 ≥20 runs/≥14 days/100% gates/0 reverts; C3 ≥30 advisory/0 missed-blocking	work-classes leaf	D3 requires suggested defaults at architect; values conservative per Boris trust-before-scale (org-bindable)
Cap defaults autonomous_concurrency: 1, items_per_run: 3	admission leaf + schema	D7 requires caps; floor values bound total fan-out at the trust-earning stage
Security binding as JSON + JSON Schema + semantic validator	Phase 2 deliverables	WP1 binding precedent (schema-versioned JSON, stop-and-report on invalid); schema alone cannot express matrix caps
executor_class + classification rules live on the security surface; promotion is eval-time evidence-gated (ceiling semantics)	Phase 2 schema + check	Stress-test F1b/F10: gating inputs must sit outside agent blast radius; an agent-unwritable binding cannot receive an automated demotion write
Demo pivots to fail-closed path when no container substrate exists	Phase 4	D4 makes fail-closed the required behavior — the pivot demonstrates the contract, not a skipped demo

[FALLBACK — confirm or override] check-security-binding.mjs as a NEW deliverable (Phase 2)
— invented beyond the Brief on the WP2/WP4 enforcement-surface precedent. Flag if unwanted.

Handoff to implementation

User-approval gates

• The binding-check script above is [FALLBACK] — surface before authoring if contested.
• Any change to the shipped admission defaults or matrix cells during implementation → STOP
  (these are T3/D7 user-locked content, not implementation discretion).
• Any scope expansion beyond the four phases re-enters /architect review.

Execution shape ([EXEC-SHAPE] tagged)

Sequential 1→4, all main-session (table above). PLAN.md phase tags advance in the same commit
as each phase; live probe per Phase 4 with the documented fail-closed pivot.

Mechanical work

Commit per phase on the implementation branch (suggest feat/autonomy-guardrails); gates
re-run in full at Phase 4; PR body carries the probe transcript + near-duplicate audit
statement + this PLAN in a <details> block at close-out.

🤖 Generated with Claude Code

[claude]

Claude finished @kyle-sexton's task in 5m 30s —— View job

---

PR Review: feat(autonomy): guardrail matrix, security binding, setup slice (WP5)

• Gather context and understand the request
• Review guardrail reference documents (hub + 4 leaves)
• Review security-binding JSON schema
• Review semantic validator script (check-security-binding.mjs)
• Review SKILL.md setup slice changes
• Review evals and fixtures
• Review plugin.json version bump and templates
• Review demo workflow handling
• Compile findings and post review

---

Summary

Architecturally this is a well-designed package. The two-surface split (agent-unwritable settings-as-code home for security axes, repo-local for non-security remaps), the fail-closed semantics at every decision point, and the probe-before-bind discipline are the right model. The validator script is thorough and the contracts are internally consistent. One blocker, two correctness notes, and a few minor items below.

---

Blocker

Demo workflow must be removed before squash-merge

wp5-isolation-probe-demo.yml is still in the branch. The PR body says "removed before merge" and the commit message echoes it, but the file is present and would land in the squash commit as written. Per the PR flow: run CI to collect the transcript, then delete the file in a follow-up commit before merging.

The workflow itself is sound — permissions: {}, triggers only on edits to its own path, outer job stays networked while the inner boundary is sealed. No security concern with the file existing; the concern is the stale artifact landing in main.

Fix this →

---

Correctness

dispatch_posture schema default is annotation-only and won't be applied by validators

guardrails-security-binding.schema.json L26:

"dispatch_posture": {
  "enum": ["autonomous-enabled", "human-gated-only"],
  "default": "autonomous-enabled"
}

In JSON Schema 2020-12, default is a purely documentary annotation — no conformant validator (AJV, ajv-formats, etc.) materializes it. A consumer that validates an absent-dispatch_posture binding with the schema will see it as valid, but if they then also run check-security-binding.mjs, the validator correctly defaults to "autonomous-enabled" on line 348:

const posture = binding.dispatch_posture ?? "autonomous-enabled";

The script is the enforcement path and it handles this correctly. The risk is a consumer who validates with the schema alone, doesn't run the script, and assumes an absent field resolves to "autonomous-enabled" — when their runtime behavior (whatever enforces admission) may not apply any default. The schema description already says the field governs the posture; adding a note that the default is semantic (enforced by the validator script) and not schema-materialized would close the gap. Alternatively, make the field required.

Probe workflow uses a mutable image tag

.github/workflows/wp5-isolation-probe-demo.yml L28:

docker run --rm --network none ubuntu:24.04 bash -c '...'

ubuntu:24.04 is a mutable tag. A digest-pinned reference (ubuntu@sha256:...) would guarantee the same image across runs and remove the supply-chain dependency on Docker Hub tag immutability. Low severity given the workflow is temporary, has permissions: {}, and runs no checkout — but the probe transcript is meant to serve as evidence in the binding's probe_evidence field, and evidence produced by an unspecified image is slightly weaker. If the probe is already run and the transcript is captured, this is moot; flagging in case the run hasn't completed yet.

---

Validator notes (non-blocking)

bindingPath = undefined error message could be more specific (check-security-binding.mjs L620)

When extra positional arguments are supplied (e.g. binding.json unexpectedarg), the parser sets bindingPath = undefined and falls through to the usage error, which prints the generic usage string. The user sees "usage: ..." with no indication which argument triggered it. Adding a diagnostic line (unexpected positional argument: "${args[i]}") before the break would make CLI debugging faster. Very minor.

promotion_state schema allows any key; semantic restriction is validator-only

guardrails-security-binding.schema.json L58 uses additionalProperties: { "$ref": "#/$defs/PromotionEntry" }, which allows any key (including non-promotable cells like C4-merge). The schema description documents the restriction correctly, and the validator enforces it at lines 443–449. This is a reasonable design choice (JSON Schema cannot express the closed enum of promotable cell ids without a propertyNames constraint), but worth a comment in the schema description noting that key validation is semantic-only, so a schema-only check won't catch C4-merge. Already implicit in the validator's architecture; just noting for completeness.

---

CLAUDE.md compliance

Rule	Status
Repo-agnostic (no hardcoded paths/repos)	✓ All paths use ${CLAUDE_PLUGIN_ROOT}, ${CLAUDE_PROJECT_DIR}
Configurable without editing the plugin	✓ Security binding is org-supplied; plugin carries schema + validator only
Plugin-form-safe	✓ No ../ reach-outs; persisted state anchors at ${CLAUDE_PLUGIN_DATA}
No PII/secrets	✓
Versioned	✓ plugin.json bumped 0.4.0 → 0.5.0
Security-reviewed (per-playbook)	✓ Near-duplicate audit present; no second egress/escalation channel; no agent-writable security axes

---

What looks right

• Two-surface split is the correct architectural choice. Binding security axes (isolation, merge policy, verification knobs, admission rules) in a settings-as-code home outside the agent's blast radius, with a non-forgeable bootstrap for security resolution, is exactly the right model.
• Fail-closed everywhere — absent/invalid binding blocks autonomous dispatch; absent evidence fails promotion cells to unpromoted; unattestable surface fails closed as unattestable. Consistent.
• Probe-before-bind is enforced by making probe_evidence schema-required on every level binding, not just advisory. The validator and schema agree.
• Pairwise joint-satisfiability check on runtime markers is the right level of rigor — subset/identity checks would miss non-conflicting union matches, which is exactly the ambiguity the dispatch seam can't resolve.
• Evaluation mode (--evidence) correctly models demotion as a ceiling-lowering read with no write-back — clean separation between the governance surface and runtime evidence.
• Fixture coverage — 15 fixtures exercising 14 negative paths (each with exactly one finding) plus the valid baseline and the evaluation-mode demonstration. The specificity counting in equal-specificity-tie.json is correct: rules[5] and rules[6] both have specificity 2 (two non-wildcard axes), producing exactly one tie finding.

---

One action required before merge: remove wp5-isolation-probe-demo.yml from the branch. Everything else is either a documentation clarification or a nitpick. The core package — guardrail hub, four leaves, security-binding schema, semantic validator, setup skill slice — is ready.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b3c218418a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 3m 14s —— View job

---

Claude finished reviewing @kyle-sexton's updates —

---

Review of d56ffc6 fixes

• Check if demo workflow blocker was resolved
• Review probe evidence verification fix (Codex P1)
• Review promotion epoch scoping fix (Codex P2)
• Review new fixtures added in d56ffc6
• Check for any remaining issues

---

Blocker still open: demo workflow not removed

.github/workflows/wp5-isolation-probe-demo.yml is still present at d56ffc6 — the latest HEAD. The file needs to be deleted and committed before squash-merge. I can't remove it myself (GitHub App permissions don't allow workflow file modifications), so this needs a manual commit from the branch author.

---

Codex P1 fix: probe evidence verified — correct ✓

The fix is comprehensive. verifyProbeTranscript() resolves probe_evidence as a file path (relative to --probe-evidence-root when given, else as written), reads and parses the transcript JSON, and validates all three capture-shape predicates: egress_denied.outcome === "denied", credentials_absent.outcome === "absent-or-denied", and outer_context_networked === true. An arbitrary non-empty string can no longer satisfy this check.

Under autonomous-enabled, an unverifiable L2/L3 entry produces a finding and the level is excluded from eligibility (fail-closed, lines 486–490). Under human-gated-only, unverifiable entries are reported in the verdict output but don't produce findings — correct, since there's no autonomous dispatch to protect. The posture-asymmetry is the right model.

New fixtures cover the path correctly: unverifiable-probe-evidence.json references a nonexistent transcript file and produces one finding; probe-transcripts/ci-pool-a-l2.json is a well-formed transcript that passes all three checks.

One observation (non-blocking): verifyProbeTranscript validates the three security-critical fields but does not check schema_version. If a future capture-shape revision changes the assertion field names, the verifier would silently accept old transcripts (they'd fail the outcome checks anyway). This is currently harmless but noting for when the capture shape evolves.

---

Codex P2 fix: promotion epoch scoping — correct ✓

The fix is correct. ratified_at is now required in both the JSON schema (PromotionEntry) and the structural validator (lines 258–262, with ISO 8601 parseability enforced). In resolveEffectivePromotion, contrary events are now filtered against ratifiedAt = Date.parse(entry.ratified_at):

• Events with at >= ratifiedAt → in-epoch, count as contrary
• Events with at < ratifiedAt → pre-epoch, ignored with an explanatory note
• Events with an unparseable at → treated as contrary (fail-closed)
• If ratifiedAt itself is NaN (malformed binding) → all parseable events are treated as in-epoch (fail-closed, consistent with the structural finding that would already block exit 0)

The fixture pair exercises this cleanly: promoted-c2.json has ratified_at: "2026-06-30T00:00:00Z". evidence-contrary.json (event at 2026-07-10) is post-ratification → demotes. evidence-stale.json (event at 2026-06-15) is pre-ratification → ignored with note, no demotion. Both cases are correctly handled.

---

Remaining open items from prior review

The previous review had two additional notes beyond the blocker:

• dispatch_posture schema default is annotation-only — still present, still non-blocking. A consumer using the schema alone (without the validator script) would not get the default materialized. The description in the schema accurately conveys the semantic; making the field required would be the clean fix but isn't required to merge.
• Mutable ubuntu:24.04 image tag in the demo workflow — moot once the workflow file is deleted.

---

Verdict

The two Codex findings are correctly and thoroughly addressed in d56ffc6. The architecture is sound and the fix-coverage is complete. One action still required before squash-merge: delete .github/workflows/wp5-isolation-probe-demo.yml from the branch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d56ffc60bd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 3m 18s —— View job

---

Claude finished reviewing @kyle-sexton's updates —

---

Review of ee93774 fixes

• Gather context and understand the request
• Check if demo workflow blocker is resolved (was still present at d56ffc6)
• Verify Codex P1 fix: probe evidence bound to surface/level/substrate (ee93774)
• Verify Codex P2 fix: credential paths checked independently in demo workflow (ee93774)
• Check for any remaining issues

---

Blocker still open: demo workflow not removed (third time flagging)

.github/workflows/wp5-isolation-probe-demo.yml is still present at ee93774 — the current HEAD. The file has been present across every commit in this branch and has been flagged as a merge blocker in every prior review cycle. As noted previously, I cannot modify files in .github/workflows/ due to GitHub App permission limits — this requires a manual commit from the branch author.

The file must be deleted before squash-merge. All other items below are non-blocking.

---

Codex P1 fix: surface/level/substrate binding — correct ✓

The fix is complete and correctly structured. verifyProbeTranscript now takes surfaceId, level, and substrate and performs three equality checks against the parsed transcript before proceeding to the assertion checks:

if (transcript.surface !== surfaceId)  → surface mismatch
if (transcript.level   !== level)      → level mismatch
if (transcript.substrate !== substrate)→ substrate mismatch

The call site at L488 correctly passes surfaceId, level, and entry.substrate. Mismatch returns the reason string; the caller treats it as unproven and produces a finding under autonomous-enabled (fail-closed).

Fixture: probe-evidence-level-mismatch.json has isolation_bindings["ci-pool-a"]["L3"] citing the existing L2 transcript (ci-pool-a-l2.json, which carries level: "L2"). The level mismatch fires exactly one finding; the suppression logic at L519 (!anyUnprovenL2Plus) correctly prevents a redundant no-L2 finding, keeping the fixture at exactly one finding.

Demo workflow: The jq step at L75 patches the binding's substrate to "nested-no-network-container" to match the live-generated transcript before running the checker. Without this patch the substrate check would fail (valid.json carries "egress-denied-container-pool"). The patch is correct and tight.

---

Codex P2 fix: independent credential path checking — correct ✓

The demo workflow now checks each credential path independently using a shell loop (L43–L53):

for p in "$HOME/.ssh" "$HOME/.netrc" "$HOME/.docker/config.json"; do
  if [ -e "$p" ]; then echo "credential path readable: $p"; present=1; fi
done
[ "$present" = "0" ] && exit 3 || exit 0

Exit 3 = all paths absent (probe passes); exit 0 = at least one readable (probe fails). The outer check requires exactly exit 3. This correctly catches a partial credential leak that the previous ls-on-three-args approach would have masked (any missing path caused ls to exit nonzero, which the old logic read as "absent").

Egress check: Exit code 4 now signals denial (not just non-zero), so a Docker infra error (exit 125/126/127) can no longer masquerade as proven egress denial. Both sentinel exit codes (4 = denied, 3 = all-absent) are documented in the failure message with concrete interpretations for each non-sentinel value.

---

Observation (non-blocking)

PR body fixture count is stale. The PR body says "15 fixtures" but the branch now has 18 fixture files (17 negative + valid.json): 3 were added in d56ffc6 (unverifiable-probe-evidence.json, promoted-c2.json, evidence-stale.json, evidence-contrary.json — actually 4 evidence fixtures) and 1 more in ee93774 (probe-evidence-level-mismatch.json). No action needed; the PR body can be updated at merge-close.

---

What looks right (unchanged from prior reviews)

The architecture, fail-closed semantics, probe-before-bind discipline, and evaluation-mode demotion are sound and internally consistent. The prior Claude and Codex reviews' substantive findings are all addressed. The only outstanding item is the workflow file deletion.

---

One action required before merge: delete .github/workflows/wp5-isolation-probe-demo.yml from the branch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ee937745e2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 2m 19s —— View job

---

Claude finished reviewing @kyle-sexton's updates —

---

Review of 10ae236 fixes

• Gather context and understand the request
• Check if demo workflow blocker (wp5-isolation-probe-demo.yml) is resolved
• Review 10ae236 fix: probe transcript exit_code nonzero validation
• Check for any remaining issues or regressions

---

Blocker still open: demo workflow not removed (fourth time flagging)

.github/workflows/wp5-isolation-probe-demo.yml is present at 10ae236 — the current HEAD. This has been flagged as a merge blocker in every prior review cycle. As documented previously, I cannot modify files in .github/workflows/ due to GitHub App permission limits — this requires a manual commit from the branch author.

The file must be deleted before squash-merge. All other items are non-blocking.

---

Codex P1 fix (10ae236): nonzero exit_code validation — correct ✓

The fix at L400–L405 is correct.

const nonzeroExit = (value) => typeof value === "string" && /^[1-9][0-9]*$/.test(value);

The regex ^[1-9][0-9]*$ correctly rejects: "0" (starts with 0), numeric 0, null, undefined, "", "-1", "01" (leading zero). It accepts "1", "3", "4", "123". No implicit coercions — the typeof guard fires first.

Null safety: The two new checks at L401/L404 access transcript.assertions.egress_denied.exit_code and transcript.assertions.credentials_absent.exit_code without optional chaining. This is safe: the preceding checks at L390–L394 use ?.outcome !== "denied/absent-or-denied", which would return early if either assertions or the nested object were absent. By the time L401 executes, both objects are guaranteed to exist.

Fixture: ci-pool-a-l2-zero-exit.json records egress_denied.exit_code: "0" (fires first, returns UNPROVEN) and credentials_absent.exit_code: "1" (valid, never reached). probe-evidence-zero-exit.json cites it under autonomous-enabled — the unproven L2 produces exactly one finding and autonomous dispatch is blocked fail-closed. Correct.

One observation (non-blocking): there's no fixture testing credentials_absent.exit_code: "0" while egress_denied passes. Since both checks use the same nonzeroExit helper and the convention is one-finding-per-fixture, current coverage is sufficient — noting for completeness.

---

Remaining open items from prior reviews

• dispatch_posture schema default annotation-only — still present, still non-blocking. Making the field required would be the clean fix; not required to merge.
• PR body fixture count stale — now 19 fixture files in the branch vs. "15" in the PR body. Non-blocking; update at merge-close.

---

Summary

10ae236's fix is correct and well-exercised by the new fixture pair. The prior Codex findings (P1 surface/level/substrate binding, P2 promotion epochs, this round's exit_code nonzero check) are all addressed. One action still required before squash-merge: delete .github/workflows/wp5-isolation-probe-demo.yml from the branch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 10ae23637a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 2m 8s —— View job

---

Claude finished reviewing @kyle-sexton's updates —

---

Review of 539c033 fixes

• Gather context and understand the request
• Check if demo workflow blocker (wp5-isolation-probe-demo.yml) is resolved
• Review 539c033 fix: probe transcript target field validation
• Check for any remaining issues or regressions

---

Blocker still open: demo workflow not removed (fifth time flagging)

.github/workflows/wp5-isolation-probe-demo.yml is present at 539c033 — the current HEAD. As documented in every prior review cycle, I cannot modify files in .github/workflows/ due to GitHub App permission limits — this requires a manual commit from the branch author.

The file must be deleted before squash-merge. All items below are non-blocking.

---

Codex P1 fix (539c033): probe target field validation — correct ✓

The fix at L410–L416 is correct.

const egressHost = transcript.assertions.egress_denied.host;
if (typeof egressHost !== "string" || egressHost.length === 0 || /\s/.test(egressHost)) {
  return `transcript ${path} records assertions.egress_denied.host ... — requires the probed external host (non-empty, no whitespace)`;
}
if (!isNonEmptyString(transcript.assertions.credentials_absent.path)) {
  return `transcript ${path} records assertions.credentials_absent.path ... — requires the probed host-credential path`;
}

Both checks are correctly gated after the outcome and exit_code checks that guarantee assertions.egress_denied and assertions.credentials_absent are already present — no optional-chaining needed at L410/L414.

Backward compatibility verified: Both existing valid transcripts ci-pool-a-l2.json and ci-pool-b-l2.json carry "host": "resolver.example" and a non-empty path — both pass the new check. The demo workflow's dynamically generated transcript at L65 includes "host": "example.com" — also compatible.

Fixture: ci-pool-a-l2-no-host.json omits egress_denied.host while carrying valid outcomes and non-zero exit codes. probe-evidence-missing-target.json cites it under autonomous-enabled. The checker returns UNPROVEN at the host check, producing exactly one finding and blocking autonomous dispatch fail-closed. Correct.

One observation (non-blocking): there is no dedicated fixture for the credentials_absent.path missing case in isolation (where egress_denied.host is present). The validator returns early on the first failure, so the current no-host fixture cannot also exercise the path-missing branch in the same run. A second transcript/fixture pair would close that gap, but it follows the established one-finding-per-fixture pattern and is not required to merge.

---

All prior Codex findings addressed

Finding	Commit	Status
Probe evidence not verified (arbitrary string passes)	d56ffc6	✓ Fixed
Promotion epoch not scoped (stale events demote forever)	d56ffc6	✓ Fixed
Probe evidence not bound to surface/level/substrate	ee93774	✓ Fixed
Credential path check masks partial leak	ee93774	✓ Fixed
Probe exit codes not required to be nonzero	10ae236	✓ Fixed
Probe targets not checked (any failing command qualifies)	539c033	✓ Fixed

---

Remaining open items from prior reviews

• dispatch_posture schema default annotation-only — still present, still non-blocking. Making the field required is the clean fix; not required to merge.
• PR body fixture count stale — the PR body says "15 fixtures" but the branch now has 20 fixture files across the security-binding directory plus 4 probe transcripts. Non-blocking; update at merge-close.

---

Summary

539c033's fix is correct, backward-compatible, and exercised by the new ci-pool-a-l2-no-host.json / probe-evidence-missing-target.json pair. All six Codex findings across five review cycles are correctly addressed. The architecture, fail-closed semantics, and fixture discipline are sound.

One action still required before squash-merge: delete .github/workflows/wp5-isolation-probe-demo.yml from the branch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 539c033dfd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 3m 49s —— View job

---

Claude finished reviewing @kyle-sexton's updates —

---

Review of 18228fc fixes

• Check if demo workflow blocker (wp5-isolation-probe-demo.yml) is resolved
• Review 18228fc fix: strict ISO promotion timestamps
• Review 18228fc fix: same-surface level-marker ambiguity rejected
• Check for any remaining issues or regressions

---

Blocker still open: demo workflow not removed (sixth time flagging)

.github/workflows/wp5-isolation-probe-demo.yml is present at 18228fc — the current HEAD. As documented in every prior review cycle, I cannot modify files in .github/workflows/ due to GitHub App permission limits — this requires a manual commit from the branch author.

The file must be deleted before squash-merge. All items below are non-blocking.

---

Codex P1 fix (18228fc): strict ISO promotion timestamps — correct ✓

The fix is correct and thorough. parseIsoStrict() gates Date.parse behind a regex:

const ISO_DATE_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
function parseIsoStrict(value) {
  return typeof value === "string" && ISO_DATE_TIME.test(value) ? Date.parse(value) : Number.NaN;
}

This rejects "06/30/2026" (US-style, no time component), "2026-06-30" (date-only), and "2026-06-30T00:00:00" (no explicit offset) — all of which the bare Date.parse would have accepted with timezone-dependent results. The fix is applied in both places that need it: validateStructure L267 (structural validation of ratified_at) and resolveEffectivePromotion (epoch scoping of evidence at timestamps). Both parse paths now use the strict function — no regressions from partial application.

Fixture: ratified-at-non-iso.json carries promotion_state.C2-auto-merge.ratified_at: "06/30/2026" with state: "promoted". The structural check fires at L267, producing exactly one finding. Correct.

---

Codex P2 fix (18228fc): same-surface level-marker ambiguity rejected — correct ✓

The fix is correct and precisely scoped. The old if (a.surfaceId === b.surfaceId) continue; guard that allowed levels within a single surface to bypass the joint-satisfiability check has been removed. Same-surface pairs are now evaluated, but the pairKey differentiates them from cross-surface pairs to prevent duplicate findings:

const sameSurface = a.surfaceId === b.surfaceId;
const pairKey = sameSurface
  ? JSON.stringify([a.surfaceId, a.level, b.level])
  : JSON.stringify([a.surfaceId, b.surfaceId]);

The finding message correctly distinguishes the two cases, naming the ambiguous levels and suggesting the fix (conflicting markers on a shared key, or split into distinct surfaces).

The comment at L503–L509 now accurately states that max-proven-level aggregation is sound only because the joint-satisfiability check above enforces that same-surface level entries carry conflicting markers — the two checks form a coherent pair.

Fixtures:

• same-surface-level-ambiguity.json — L2 markers {runner-pool: "ci-pool-a", region: "us-east"}, L3 markers {runner-pool: "ci-pool-a", tier: "metal"}. No shared key conflict (runner-pool matches, region/tier are disjoint) → jointly satisfiable → one finding. Correct.
• two-level-surface-valid.json — L2 markers {runner-pool: "ci-pool-a", region: "us-east"}, L3 markers {runner-pool: "ci-pool-a-metal", region: "us-east"}. runner-pool has distinct values → not jointly satisfiable → no finding → exits 0. Correct.
• New ci-pool-a-l3.json probe transcript: surface: "ci-pool-a", level: "L3", substrate: "microvm-pool", both exit codes nonzero (7 and 1), host and path non-empty. Passes all verifier checks. ✓

---

All Codex findings addressed

Finding	Commit	Status
Probe evidence not verified (arbitrary string passes)	d56ffc6	✓ Fixed
Promotion epoch not scoped (stale events demote forever)	d56ffc6	✓ Fixed
Probe evidence not bound to surface/level/substrate	ee93774	✓ Fixed
Credential path check masks partial leak	ee93774	✓ Fixed
Probe exit codes not required to be nonzero	10ae236	✓ Fixed
Probe targets not checked (any failing command qualifies)	539c033	✓ Fixed
Non-ISO promotion timestamps accepted timezone-dependent	18228fc	✓ Fixed
Heterogeneous levels aggregated under one surface verdict	18228fc	✓ Fixed

---

Remaining open items from prior reviews

• dispatch_posture schema default is annotation-only — still present, still non-blocking. Making the field required is the clean fix; not required to merge.
• PR body fixture count stale — the PR body says "15 fixtures" but the branch now has 23 binding fixture files and 5 probe transcripts. Non-blocking; update at merge-close.

---

Summary

18228fc's two fixes are correct, mutually consistent, and well-covered by the three new fixtures. All eight Codex findings across six review cycles are correctly addressed. The architecture, fail-closed semantics, and fixture discipline remain sound throughout.

One action still required before squash-merge: delete .github/workflows/wp5-isolation-probe-demo.yml from the branch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 18228fcc9c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 2m 52s —— View job

---

Claude finished reviewing @kyle-sexton's updates —

---

Review of 8b39025 fixes

• Gather context and check current branch state
• Check if demo workflow blocker (wp5-isolation-probe-demo.yml) is resolved
• Review 8b39025 fix: own-property marker comparisons
• Review new fixture marker-prototype-key.json
• Check for any remaining issues or regressions

---

Blocker still open: demo workflow not removed (seventh time flagging)

.github/workflows/wp5-isolation-probe-demo.yml is present at 8b39025 — the current HEAD. As documented in every prior review cycle, I cannot modify files in .github/workflows/ due to GitHub App permission limits — this requires a manual commit from the branch author.

The file must be deleted before squash-merge. All items below are non-blocking.

---

Codex P2 fix (8b39025): own-property marker comparisons — correct ✓

The fix is correct. jointlySatisfiable() now uses Object.hasOwn(markersB, key) instead of key in markersB:

function jointlySatisfiable(markersA, markersB) {
  for (const [key, value] of Object.entries(markersA)) {
    if (Object.hasOwn(markersB, key) && markersB[key] !== value) return false;
  }
  return true;
}

Why this matters: With the old key in markersB, a marker key of "toString" in markersA would always find it in markersB (via Object.prototype), then compare markersB["toString"] (the prototype function) against any string value — which would always differ, causing jointlySatisfiable to incorrectly return false. This means two marker sets that are actually jointly satisfiable (e.g. L2 { toString: "l2" } + L3 { tier: "metal" }) would pass the ambiguity check without a finding, enabling an L3/C5 surface verdict from a phantom conflict.

Fixture: marker-prototype-key.json has L2 { "toString": "l2" } and L3 { "tier": "metal" } on ci-pool-a. With Object.hasOwn, "toString" is not an own property of { "tier": "metal" }, so no conflict is detected, jointlySatisfiable returns true, and the same-surface ambiguity finding fires. Exactly one finding, exit 1. Correct.

Complete audit: grep -c "Object.hasOwn" returns 20 — all membership checks across the 822-line script now use Object.hasOwn. A separate grep for remaining in-operator lookups on parsed JSON objects returns zero hits. The commit message's "20 sites audited" claim is consistent with what's in the file.

Logic correctness: The one-direction iteration (for key of Object.entries(markersA), check against B) is sufficient — "jointly satisfiable" requires checking only shared keys for conflicts, and any shared key appears in markersA when iterating it. Unshared keys impose no mutual constraint. The function is sound.

---

All Codex findings addressed

Finding	Commit	Status
Probe evidence not verified (arbitrary string passes)	d56ffc6	✓ Fixed
Promotion epoch not scoped (stale events demote forever)	d56ffc6	✓ Fixed
Probe evidence not bound to surface/level/substrate	ee93774	✓ Fixed
Credential path check masks partial leak	ee93774	✓ Fixed
Probe exit codes not required to be nonzero	10ae236	✓ Fixed
Probe targets not checked (any failing command qualifies)	539c033	✓ Fixed
Non-ISO promotion timestamps accepted timezone-dependent	18228fc	✓ Fixed
Heterogeneous levels aggregated under one surface verdict	18228fc	✓ Fixed
Prototype keys can fake marker conflict, masking ambiguity	8b39025	✓ Fixed

---

Remaining open items from prior reviews

• dispatch_posture schema default is annotation-only — still present, still non-blocking. Making the field required is the clean fix; not required to merge.
• PR body fixture count stale — 24 binding fixture files + 5 probe transcripts in the branch; PR body says "15 fixtures". Non-blocking; update at merge-close.

---

Summary

8b39025's fix is correct, comprehensive (all 20 membership checks audited), and exercised by marker-prototype-key.json. All nine Codex findings across seven review cycles are correctly addressed. The architecture, fail-closed semantics, and fixture discipline remain sound throughout.

One action still required before squash-merge: delete .github/workflows/wp5-isolation-probe-demo.yml from the branch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8b39025899

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 3m 23s —— View job

---

Claude finished reviewing @kyle-sexton's updates —

---

Review of 680b077 fixes

• Gather context and understand the request
• Check if demo workflow blocker (wp5-isolation-probe-demo.yml) is resolved
• Review 680b077 fix: L3 probe evidence requires kernel-separated substrate class
• Check new fixtures (probe-evidence-l3-container.json, ci-pool-a-l3-container.json)
• Verify all prior Codex findings remain addressed
• Check for any remaining issues or regressions

---

Blocker still open: demo workflow not removed (eighth time flagging)

.github/workflows/wp5-isolation-probe-demo.yml is present at 680b077 — the current HEAD. As documented in every prior review cycle, I cannot modify files in .github/workflows/ due to GitHub App permission limits — this requires a manual commit from the branch author.

The file must be deleted before squash-merge. All items below are non-blocking.

---

Codex P1 fix (680b077): L3 substrate_class validation — correct ✓

The fix is correctly placed and thorough. verifyProbeTranscript now gates L2/L3 acceptance on a two-tier class check:

const SUBSTRATE_CLASSES = new Set(["container", "os-sandbox", "vm-microvm"]); // L57

// Tier 1: unknown class → UNPROVEN
if (!SUBSTRATE_CLASSES.has(transcript.substrate_class)) {
  return `transcript ${path} records substrate_class ... — required, one of container | os-sandbox | vm-microvm`;
}
// Tier 2: L3 floor — only kernel-separated substrates qualify
if (level === "L3" && transcript.substrate_class !== "vm-microvm") {
  return `transcript ${path} records substrate_class ... for an L3 entry — L3 requires kernel separation, which only substrate_class "vm-microvm" provides`;
}

Sequencing is correct: the substrate_class checks at L405–410 are inserted after the surface/level/substrate identity checks (L392–400) and before the assertion checks (L411+). Since the identity checks guarantee the transcript claims to be L3 before the class check fires, the attack path ("relabel an L2 container transcript to level L3") is blocked at the class check regardless of whether the attacker also changes the level field.

Backward compatibility: All 6 probe transcripts have been backfilled with substrate_class. All prior L2 entries now carry substrate_class: "container" — they pass tier-1 (known class) and are not subject to tier-2 (L3-only check). Zero regressions on the existing fixture suite.

Template updated: isolation-probe.md now includes substrate_class in the transcript capture shape and the per-substrate-class section explicitly maps container/os-sandbox to L2 and vm-microvm to L3. The template and validator are now in sync.

New fixtures:

• ci-pool-a-l3-container.json: level: "L3", substrate_class: "container" → passes identity checks, fails tier-2 class check → UNPROVEN
• probe-evidence-l3-container.json: cites the container transcript under an L3 entry under autonomous-enabled → exactly one finding, no C5 eligibility. Correct.
• ci-pool-a-l3.json: substrate: "microvm-pool", substrate_class: "vm-microvm" → passes all checks. Referenced by two-level-surface-valid.json's L3 entry (substrate matches). C5 eligible on that entry. Correct.

Demo workflow: The live-generated transcript at L62 correctly emits "substrate_class": "container" for the L2 demo boundary (a nested docker run --network none container). The demo binding is L2, so the tier-2 check does not fire — consistent.

---

All Codex findings addressed

Finding	Commit	Status
Probe evidence not verified (arbitrary string passes)	d56ffc6	✓ Fixed
Promotion epoch not scoped (stale events demote forever)	d56ffc6	✓ Fixed
Probe evidence not bound to surface/level/substrate	ee93774	✓ Fixed
Credential path check masks partial leak	ee93774	✓ Fixed
Probe exit codes not required to be nonzero	10ae236	✓ Fixed
Probe targets not checked (any failing command qualifies)	539c033	✓ Fixed
Non-ISO promotion timestamps accepted timezone-dependent	18228fc	✓ Fixed
Heterogeneous levels aggregated under one surface verdict	18228fc	✓ Fixed
Prototype keys can fake marker conflict, masking ambiguity	8b39025	✓ Fixed
Container transcripts accepted for L3 bindings	680b077	✓ Fixed

---

Remaining open items from prior reviews

• dispatch_posture schema default is annotation-only — still present, still non-blocking. Making the field required is the clean fix; not required to merge.
• PR body fixture count stale — the PR body says "15 fixtures" but the branch now has 25 binding fixture files and 6 probe transcripts. Non-blocking; update at merge-close.

---

Summary

680b077's fix is correct, sequenced properly within the verifier, and covered by the ci-pool-a-l3-container.json / probe-evidence-l3-container.json pair plus a valid positive path in ci-pool-a-l3.json. All ten Codex findings across eight review cycles are correctly addressed. The architecture, fail-closed semantics, probe verification chain, and fixture discipline remain sound throughout.

One action still required before squash-merge: delete .github/workflows/wp5-isolation-probe-demo.yml from the branch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 680b077be4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 2m 46s —— View job

---

Claude finished @kyle-sexton's task in 3m 23s —— View job

---

Claude finished reviewing @kyle-sexton's updates —

---

Review of 1a1c4b9 fixes

• Gather context and understand the request
• Check if demo workflow blocker (wp5-isolation-probe-demo.yml) is resolved
• Review 1a1c4b9 fix: calendar-valid promotion timestamp round-trip
• Check for any remaining issues or regressions

---

Blocker still open: demo workflow not removed (ninth time flagging)

.github/workflows/wp5-isolation-probe-demo.yml is present at 1a1c4b9 — the current HEAD. As documented in every prior review cycle, I cannot modify files in .github/workflows/ due to GitHub App permission limits — this requires a manual commit from the branch author.

The file must be deleted before squash-merge. All items below are non-blocking.

---

Codex P1 fix (1a1c4b9): calendar-valid promotion timestamps — correct ✓

The fix is correct and complete. parseIsoStrict() now derives the epoch from captured regex groups via Date.UTC, then round-trips through all six UTC getters before accepting the value:

const utc = new Date(Date.UTC(+year, +month - 1, +day, +hour, +minute, +second, ms));
if (
  utc.getUTCFullYear() !== +year  ||
  utc.getUTCMonth()   !== +month - 1 ||
  utc.getUTCDate()    !== +day    ||
  utc.getUTCHours()   !== +hour   ||
  utc.getUTCMinutes() !== +minute ||
  utc.getUTCSeconds() !== +second
) { return Number.NaN; }

Date.UTC silently normalizes out-of-range fields (Feb 30 → Mar 2; hour 25 → next day hour 1). The round-trip check catches any such normalization. No Date.parse path remains — the epoch is derived entirely from Date.UTC over the captured components, so no engine-specific parsing behavior is load-bearing.

Offset math is correct: for +05:30, (5 * 60 + 30) * 60000 = 19,800,000 ms, then utc.getTime() - 19_800_000 yields the correct UTC epoch (a +05:30 local time is 5½ hours ahead of UTC, so we subtract to convert). Negative offsets flip the multiplier to -1, which correctly adds back to UTC. Both directions verified.

Backward compatibility: for any previously-valid, calendar-valid ISO 8601 timestamp, Date.UTC produces the same epoch as Date.parse would have (they're equivalent for well-formed inputs with explicit offsets). No regressions on the existing fixture suite.

Fixture: ratified-at-calendar-invalid.json carries ratified_at: "2026-02-30T00:00:00Z". Date.UTC(2026, 1, 30) normalizes to March 2; utc.getUTCDate() = 2 ≠ 30 → NaN → structural finding fires. Exactly one finding, exit 1. Correct. The structural validator's finding message at L297–L300 is updated to name both the prior non-ISO form and the new calendar-validity requirement.

One observation (non-blocking): the offset field is validated by the regex's (Z|[+-]\d{2}:\d{2}) pattern, which accepts offsets like ±99:59. Valid IANA timezone offsets are bounded at UTC±14:00 (840 minutes). An extreme offset could shift the computed epoch by up to ~100 hours, making a contrary evidence event (e.g. timestamped 2026-07-03) appear pre-ratification (if a large negative offset pushes the epoch to 2026-07-05) and therefore ignored — suppressing a legitimate demotion. The attack surface is narrow: the settings-as-code home is human-gated and not agent-writable, and a ±99:59 offset would be immediately visible to a human reviewer. Adding a check that the offset's hours/minutes are within the IANA-valid range (hours ≤ 14, minutes in {0, 30, 45} or simply ≤ 59 with hours ≤ 14) would close this completely, but it is not required to merge.

---

All Codex findings addressed

Finding	Commit	Status
Probe evidence not verified (arbitrary string passes)	d56ffc6	✓ Fixed
Promotion epoch not scoped (stale events demote forever)	d56ffc6	✓ Fixed
Probe evidence not bound to surface/level/substrate	ee93774	✓ Fixed
Credential path check masks partial leak	ee93774	✓ Fixed
Probe exit codes not required to be nonzero	10ae236	✓ Fixed
Probe targets not checked (any failing command qualifies)	539c033	✓ Fixed
Non-ISO promotion timestamps accepted timezone-dependent	18228fc	✓ Fixed
Heterogeneous levels aggregated under one surface verdict	18228fc	✓ Fixed
Prototype keys can fake marker conflict, masking ambiguity	8b39025	✓ Fixed
Container transcripts accepted for L3 bindings	680b077	✓ Fixed
Calendar-invalid ratification dates silently normalized	1a1c4b9	✓ Fixed

---

Remaining open items from prior reviews

• dispatch_posture schema default is annotation-only — still present, still non-blocking. Making the field required is the clean fix; not required to merge.
• PR body fixture count stale — the PR body says "15 fixtures" but the branch now has 26 binding fixture files and 6 probe transcripts. Non-blocking; update at merge-close.

---

Summary

1a1c4b9's fix is correct, backward-compatible, and exercised by ratified-at-calendar-invalid.json. All eleven Codex findings across nine review cycles are correctly addressed. The architecture, fail-closed semantics, probe verification chain, and fixture discipline remain sound throughout.

One action still required before squash-merge: delete .github/workflows/wp5-isolation-probe-demo.yml from the branch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1a1c4b99b0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kyle-sexton]

#549 redesign implemented — landing blocked on concurrent-worker collision (escalating)

The deny-by-default redesign from #549 is complete and verified, but I am not pushing it onto this branch this cycle because a second, differently-identified autonomous session (git co-author "Claude Fable 5") is actively extending the superseded point-fix approach on the same branch (commits cca4d2c, 6c940b6 at 21:03Z/21:39Z) while I held the worker lease. Racing it would thrash; the landing needs that session stopped first (coordination gap corroborated on #524).

Redesign preserved on branch redesign/549-security-binding-allowlists (commit c35ff65). What it does:

• Egress: removes the special-use-range enumeration entirely (isNonExternalEgressHost, expandIpv6, foldInetAton, isDeniedV4, IANA/RFC tables). External-egress evidence now requires the probed host to be on the operator's --egress-hosts allowlist; unconfigured => untrusted, fail-closed. Membership is the sole test, so the class converges by construction.
• Credentials: adds --credential-roots. A filesystem credential path is accepted only when its recorded host_expanded resolves (lexical, filesystem-independent, ..-safe) under a configured trusted root; unconfigured => untrusted, fail-closed. Cloud-metadata routes and well-known credential env tokens stay bounded closed sets. Expansion tail-consistency retained.
• Dissolves the two deferred P1 threads (L184 credential rooting, L659-class IPv6 discard-only): the mechanisms they were about no longer exist.
• Prunes the enumeration/rooting-heuristic fixtures that tested the removed code; keeps 100::/64, NAT64, documentation hosts as not-on-allowlist regressions and /home/definitely-not-a-host-user/.ssh + /host-home as not-under-root regressions. Full local corpus (53 fixtures) passes, each for its intended vector. Docs + 0.5.0->0.6.0 bump included.

Reconciliation note for whoever lands it: Fable 5's two commits are a mix — the required --probe-evidence-root and the new hosted-ephemeral-executor L3 class are orthogonal/compatible and should be KEPT; transport_outcome and credential outer_exit_code need a per-merit call (the redesign supersedes the target-recognition enumeration, not every structural check). A trial merge shows 25 conflicts (1 in the validator, 23 modify/delete on removed fixtures, 1 transcript) — semantic, not mechanical.

[claude]

Claude finished @kyle-sexton's task in 5m 21s —— View job

---

Claude Code Review — 474b63a

Commit: 474b63a — fix(autonomy): credential entries must end at a concrete secret file
Scope: check-security-binding.mjs · 8 probe-transcript fixtures · 3 binding fixtures · isolation-probe.md template

---

Summary

This commit addresses the final Codex P1 finding: $HOME/.ssh/known_hosts was accepted as credential evidence because the old code checked for .ssh anywhere in the path. An attacker could probe against a non-secret sibling file (e.g. known_hosts, authorized_keys) — which the outer context can confirm exists — while the actual private key remains readable inside the boundary. The fix shifts from segment-anywhere matching to terminal-form matching: the path must end at a statically-enumerable secret file, not merely contain a credential directory name.

---

Core change — isRecognizedCredentialEntry

Old logic (segment-anywhere):

const CREDENTIAL_SEGMENTS = new Set([".ssh", ".netrc", ".aws", ".gnupg", "id_rsa", "credentials", ".credentials"]);
const CREDENTIAL_SEGMENT_PAIRS = [[".kube", "config"], [".docker", "config.json"], [".config", "gh"]];
// findIndex — any occurrence of a recognized segment in any position

New logic (terminal-form):

const TERMINAL_SECRET_FILES = new Set(["id_rsa", "id_dsa", "id_ecdsa", "id_ed25519", ".netrc", "credentials", ".credentials"]);
const TERMINAL_SECRET_PAIRS = [[".kube", "config"], [".docker", "config.json"]];
const TERMINAL_SECRET_TRIPLES = [[".config", "gh", "hosts.yml"]];
// Checks ONLY segments[last], segments[last-1..last], segments[last-2..last]

Verdict: correct and complete. The three categories cover all static credential file names that can be named at probe time. Deliberately excluded (and correctly so):

Excluded pattern	Reason
.ssh (directory alone)	Directory, not a file — now rejected. $HOME/.ssh/known_hosts → terminal known_hosts ∉ any set.
.aws (directory alone)	Same; $HOME/.aws/credentials still accepted (terminal credentials ∈ TERMINAL_SECRET_FILES).
.gnupg/*	GPG key grip filenames are dynamic hex strings — no static terminal form possible.
.config/gh (pair)	Elevated to triple .config/gh/hosts.yml; bare directory is now rejected.

Edge cases verified:

• id_rsa.pub → rejected (.pub suffix ∉ set). ✓
• $HOME/.aws/config → rejected (config ∉ set; only credentials is). ✓
• $HOME/.config/gh (directory) → rejected (terminal gh ∉ set; no pair match). ✓
• $HOME/.config/gh/hosts.yml → accepted by triple. ✓

---

New fixtures — correctness

Fixture	Path	Expected outcome	Logic
ci-pool-a-l2-known-hosts.json	$HOME/.ssh/known_hosts	UNPROVEN → 1 finding	known_hosts ∉ TERMINAL_SECRET_FILES
ci-pool-a-l2-ssh-dir.json	$HOME/.ssh	UNPROVEN → 1 finding	.ssh ∉ TERMINAL_SECRET_FILES
ci-pool-a-l2-id-rsa.json	$HOME/.ssh/id_rsa	PROVEN → 0 findings	id_rsa ∈ TERMINAL_SECRET_FILES; anchor $HOME; outer_exit_code=0

All three are structurally consistent with existing transcript fixtures (schema-valid, outer_context_networked: true, correct transport outcomes). ✓

---

Updated existing negative fixtures — single-defect invariant preserved

Each existing negative fixture had its path field updated from a directory form to a terminal file form so the ONE intended defect remains the only reason for rejection:

Fixture	Was (path)	Now (path)	Defect (unchanged)
cred-outer-nonzero	/root/.ssh	/root/.ssh/id_rsa	outer_exit_code: 1
invented-home-user	/home/definitely-not-a-host-user/.ssh	/home/definitely-not-a-host-user/.ssh/id_rsa	Non-existent user in home path
dot-traversal	/root/../var/empty/.ssh	/root/../var/empty/.ssh/id_rsa	Dot-segment /../ rejection
expansion-ephemeral	$HOME/.ssh → /tmp/.ssh	$HOME/.ssh/id_rsa → /tmp/.ssh/id_rsa	Expansion to ephemeral /tmp/ base
expansion-tail-mismatch	$HOME/.ssh → /home/runner/.gnupg	$HOME/.ssh/id_rsa → /home/runner/.gnupg/id_rsa	Tail /.ssh/id_rsa ≠ /.gnupg/id_rsa

All five correctly isolate the same single defect after the path update. ✓

The expansion-tail-mismatch case deserves a note: the new host_expanded ends in /id_rsa and the path tail is /.ssh/id_rsa — the suffixes share /id_rsa but the tail mismatch is still detected because the full 12-char tail /.ssh/id_rsa ≠ any suffix of /.gnupg/id_rsa. ✓

---

Template update

isolation-probe.md now reads: "ending at a concrete secret file rather than a directory or an arbitrary file beneath one". This accurately documents the new requirement for operators writing probe transcripts. ✓

---

No issues found

The fix is minimal, targeted, and complete. All 54 prior Codex findings remain addressed; this commit resolves the final P1 (credential directory bypass). The single-defect-per-fixture invariant is maintained across all eight modified fixtures. The terminal-form enumeration is correct for the SSH, AWS, kubeconfig, Docker, and GitHub CLI credential families.

This PR is ready to squash-merge.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 474b63a7a0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 3m 56s —— View job

---

Review — commit 918a8e5

Scope: P1 finding — "Bind L3 substrate class to attested runner state." Prior to this commit, substrate_class was accepted solely from the probe transcript, a file an executing agent could modify after the human ratified the binding. The attack: relabel an L2 container transcript to substrate_class: "vm-microvm" and level: "L3" to falsely claim C5 eligibility.

---

Fix is correct

The commit closes the attack on all three layers:

1. Schema (guardrails-security-binding.schema.json)
substrate_class is added to required on LevelBinding with additionalProperties: false already in force — the JSON Schema validator rejects any binding entry that omits it before the semantic validator even runs. The enum (container | os-sandbox | vm-microvm | hosted-ephemeral-executor) is complete and matches SUBSTRATE_CLASSES / L3_SUBSTRATE_CLASSES in the script. L126–L134

2. Structural validation (validateStructure)
Two binding-side checks added: (a) !SUBSTRATE_CLASSES.has(entry.substrate_class) → structural finding for any unrecognized class; (b) level === "L3" && !L3_SUBSTRATE_CLASSES.has(entry.substrate_class) → structural finding when the ratified class is not kernel-separated. Level/class coherence is enforced against what the human wrote, never what a transcript records. L447–L463

3. Semantic verification (verifyProbeTranscript)
substrateClass (the ratified value) is threaded in as a new parameter. The transcript's recorded substrate_class is checked for equality against it before any capture-shape validation. A mismatch returns immediately unverified — the relabeling attack fails closed here: the transcript proves a different substrate than the ratified assertion names. L912–L924

Call-site: checkSemantics passes entry.substrate_class (the ratified field) through to verifyProbeTranscript — if the field is absent, undefined propagates, the mismatch check fires for any transcript that has a class set, and the entry is unproven. Fail-closed throughout. L1216

---

Three new fixtures cover the three new failure paths

Fixture	Scenario	Expected outcome
l3-ratified-class-container.json	L3 binding with substrate_class: "container"	Structural finding — ratified class is not kernel-separated
missing-substrate-class.json	L2 binding with no substrate_class field	Structural finding — required field absent
probe-evidence-ratified-class-mismatch.json	L3 binding with substrate_class: "vm-microvm" but transcript records a container	Semantic finding — transcript proves a different substrate than ratified

All three fixtures are well-formed in every other dimension (admission policy, escalation routes, merge policy) so only the targeted finding fires.

---

One minor observation (non-blocking)

In verifyProbeTranscript, the ratified-vs-transcript class mismatch check (transcript.substrate_class !== substrateClass) fires before the recognized-class check (!SUBSTRATE_CLASSES.has(transcript.substrate_class)). If the transcript carries a completely unrecognized class, the returned error says "mismatch" rather than "unrecognized class" — slightly less precise. Both paths return non-null (transcript unverified), so the fail-closed guarantee holds. Worth a note in the comment block for future readers, but no code change needed.

---

Verdict

The attack vector is fully closed. The fix places the eligibility decision exclusively on the human-ratified governance surface, validates that surface structurally before any transcript is read, and then cross-checks the transcript's capture against the ratified assertion. The three fixture files cover the three distinct failure modes introduced by the new requirement.

LGTM — ready to squash-merge.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 918a8e5337

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 7m 11s —— View job

---

PR #377 — Security review: feat(autonomy): guardrails matrix, security binding, setup slice (WP5)

Final review — commit 1f3dacf

---

Summary

This PR introduces a fail-closed security binding validator, an isolation-ladder reference, a five-class × five-column guardrail matrix, and the setup skill slice. The review ran across 45 commits; 55+ security findings were raised and addressed. The final commit (1f3dacf) closes the last open issue: credential path recognition accepted any anchor-descendant file whose basename matched a recognized name, allowing an adversarial probe to pick a benign existing file ($HOME/scratch/credentials, /etc/example/credentials) whose outer existence check passes and inner read fails — producing a false credential-absence proof while real host credentials stayed exposed.

---

Commit 1f3dacf — Exact-path credential recognition

What changed:

TERMINAL_SECRET_FILES / TERMINAL_SECRET_PAIRS / TERMINAL_SECRET_TRIPLES (basename-suffix matching) were replaced with two exact-form lists:

• HOME_SECRET_RELATIVE_FORMS — exact relative segments under a home anchor ($HOME/%USERPROFILE%//root)
• FIXED_SECRET_PATHS — exact absolute segments for fixed system locations

isRecognizedCredentialEntry now does full-array comparison via segmentsEqual (length + element-wise) rather than checking only the last 1–3 segments:

if (isHomeEnvToken(segments[0]) || segments[0] === "root") {
  const relativeForm = segments.slice(1);
  return HOME_SECRET_RELATIVE_FORMS.some((form) => segmentsEqual(form, relativeForm));
}
return FIXED_SECRET_PATHS.some((form) => segmentsEqual(form, segments));

Correctness verified for key cases:

Entry	Old result	New result	Correct?
$HOME/scratch/credentials	ACCEPTED (basename credentials matched)	REJECTED (["scratch","credentials"] ∉ HOME_SECRET_RELATIVE_FORMS)	✅
/etc/example/credentials	ACCEPTED (etc anchor + credentials basename)	REJECTED (["etc","example","credentials"] ∉ FIXED_SECRET_PATHS)	✅
$HOME/.ssh/id_rsa	ACCEPTED	ACCEPTED ([".ssh","id_rsa"] ∈ forms)	✅
$HOME/.aws/credentials	ACCEPTED (bare credentials basename)	ACCEPTED ([".aws","credentials"] ∈ forms, explicit)	✅
/root/.ssh/id_rsa	ACCEPTED	ACCEPTED (segments[0]==="root", relativeForm=[".ssh","id_rsa"])	✅
/etc/ssh/ssh_host_rsa_key	REJECTED (not in old terminal files)	ACCEPTED (new FIXED_SECRET_PATHS)	✅ new
$HOME/.git-credentials	REJECTED (not in old terminal files)	ACCEPTED (new HOME_SECRET_RELATIVE_FORMS)	✅ new
$HOME/.credentials	ACCEPTED	REJECTED (removed — not a well-known tool file)	✅
$HOME/id_rsa	ACCEPTED (id_rsa basename + home anchor)	REJECTED (["id_rsa"] ∉ forms — must be under .ssh/)	✅
/root/$HOME/.ssh/id_rsa	ACCEPTED (dot-traversal gate aside)	REJECTED (["$home",".ssh","id_rsa"] ∉ relative forms)	✅

Corner cases confirmed correct:

• UNC-form rejection (normalized.startsWith("//")) at L214 fires before segment matching
• Dot-segment rejection at L208 fires before segment matching
• Ephemeral segment rejection at L223 fires before segment matching
• Bare $HOME (single segment) routes through the env-token branch at L199–L202, not recognized → REJECTED ✅
• %USERPROFILE%\.ssh\id_rsa — after replaceAll("\\","/")→ %userprofile%/.ssh/id_rsa, isHomeEnvToken matches → relativeForm=[".ssh","id_rsa"] → ACCEPTED ✅

Fixture integrity verified:

• probe-evidence-etc-descendant-credpath.json: probes /etc/example/credentials — not in FIXED_SECRET_PATHS → 1 finding ✅
• probe-evidence-home-descendant-credpath.json: probes $HOME/scratch/credentials — ["scratch","credentials"] ∉ HOME_SECRET_RELATIVE_FORMS → 1 finding ✅

Backfill verified (~40 transcripts): Every transcript that previously used $HOME/.credentials (no longer in the recognized set) was updated to $HOME/.netrc (still recognized as [".netrc"]). Each fixture's intended single defect — egress host classification, exit code validation, etc. — is preserved because the credential path change is neutral to those defects.

Error message updated at L1093 to enumerate exact required forms rather than basenames, eliminating the old confusing "probe genuine host credential locations ending at…" phrasing that implied basename matching was sufficient.

---

Non-blocking observation

Fixture corpus has no automated CI driver. The 93 binding fixtures in evals/fixtures/security-binding/ are not exercised by CI. scripts/run-plugin-tests.sh runs *.test.sh files; there are none for the autonomy plugin. The fixtures are invaluable as regression documentation and can be run manually against the checker, but a future logic regression in check-security-binding.mjs will not be caught by a CI lane. Suggest adding a check-security-binding.test.sh that runs the checker against every fixture and asserts exit-code 1 for negatives and exit-code 0 for positives (the valid/multi-surface fixtures). Not a blocker for this PR — the current fixture set is correct — but worth tracking.

---

Overall assessment

The fix is correct and complete. The exact-path matching approach eliminates the entire class of anchor-descendant attacks by construction, the new credential forms are well-chosen (system SSH host keys, .git-credentials, .aws/credentials explicit pairing), the removed forms ($HOME/.credentials, bare basename under /etc) are correctly de-listed, and the 40-transcript backfill preserves each fixture's single intended defect.

All 55+ prior findings from this review cycle remain addressed. The schema (substrate_class as a required binding-side assertion), the validator semantics (fail-closed, probe-before-bind, egress-host classification, credential-path exactness), and the guardrail reference documents are consistent with each other.

Approved.