Repository navigation
Conversation
…nction targets The hard-link phase added a write-confinement audit to the offline worker. The independent review found three defects in that audit and two defects in the adversarial grader. This commit closes them and adds the regressions. Worker (semgate/devworker.py, sendharness.py, sendclient.py): - The audit excludes the protected names at the project root only, the names the mount plan actually makes non-writable. A same-named directory deeper in the project is an ordinary writable directory in the guest and is audited. - A Windows name surrogate (directory junction) is recognised before the walker descends into it: its target's names are not counted as names inside the view, and a junction cycle cannot make the audit loop. - An audit that could not complete refuses the ordinary command with development_alias_audit_incomplete. Listing a directory and writing inside it are different permissions, so an unreadable name can still be writable in the guest; the old comment claiming otherwise is gone. The fixed literal writer stays available and remains the repair path. - The broker maps both refusals to deny, with no execution receipt and no fallback path. Grader (hookconf/semgate_adversarial.py): - The unknown-route check identifies the route from the fixture configuration, requires the actual attempt and rejects any successful preparation. - Alias coverage needs an ordinary-command write attempt against the still shared file and its refusal; an inspection command or the safe literal writer does not count, and a missing attempt is reported as incomplete. - The direct-upload check reads the refused connection and the receiver instead of the exit code of a shell that may end in another command. Tests: - tests/test_write_confinement.py: nested protected basenames, the project-root exclusions, an alias to protected metadata, junction targets, a junction cycle, injected scandir and lstat failures, and the broker refusal. - tests/test_devworker_linux.py: the five nested basenames and a search-only directory, with the real kernel. - tests/test_semgate_adversarial.py: 21 tests against the real grader. - tests/test_prepared_send.py: accept concurrent.futures' own timeout error on Python 3.10 (the WSL copy), keeping the assertion unchanged. - tests/.allowed_skips: the two skip reasons the local-CI check requires. Thresholds, criteria scales, router policy, pins and lockfiles are unchanged.
th3nolo
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Coding-agent development needs to remain usable while model inputs are minimized and outbound data is checked against current consent. This adds the opt-in Jev + SUBQ privacy layer, bounded local PII/secret inspection, immutable prepared HTTP sends, expiring and revocable task consent, and guarded offline development. Privacy consent and ordinary execution approval remain separate requirements.
The execution path preserves hard denials in both canonical host and worker namespaces, keeps trusted executables and operator authority outside writable project storage, and refuses an unavailable confinement boundary. Prepared dispatch rechecks the current task, grant, payload scope and consent before sending the stored bytes. There is no host execution fallback.
Version remains 0.4.4. Dependency declarations, lockfiles, policy files and numeric thresholds are unchanged. All 43 policy/dependency/router preservation entries match the starting b5c0655 snapshot. In privacy.py, only PrivacyGate._state differs structurally; consensus, apply, the confidence constant and the rest of the module remain identical. Both approval gates remain intact.
Validation at
c534555b6cd7e54dea693938bacefe5a3a147498:uv run --no-sync --offline python -m pytest -q testsLinux Python 3.12 CI reported 3,808 passed and 38 skipped; Windows Python 3.13 reported 3,805 passed and 41 skipped. Skips include platform/kernel-dependent coverage. The prescribed scripts/test-local.sh wrapper was not run because its helper rewrites a shared WSL environment contrary to the required uv/per-checkout rules; the actual pytest, integration, packaging and evaluation commands ran separately.
The accepted review gate covers code plus local tests/CI. Fresh real-agent, selected-WSL/kernel and live Jev/SUBQ validation are explicitly deferred and unverified. These results do not establish live model accuracy, selected-host containment or real-agent end-to-end autonomy.
The local review loop is in progress with zero completed consecutive CLEAN attempts on this head. The PR remains draft and unmerged.