Repository navigation
Conversation
rmcdaniel
changed the title
|
Security whole-source/harness review: HOLD before installed execution for The selected supply and scenario scope are coherent: published 3.18.2/f948 archive and installed-file verification precede autoload generation; native 3.9.2 is immutable and locally source/config checked; the modern direct/closed/continued/Unicode/postcommit-loss cases preserve exact identities and typed conflicts; legacy/physical/namespace/full-snapshot claims are correctly excluded. The fixed resource/loopback/tmpfs profile and captured-ID/label intent are also appropriate. The execution envelope still has four authority gaps:
Please add actual predecessor/candidate controls for controller pre-open substitution, PHP fixture/autoloader replacement, CID/state replacement, outer cleanup after source/state corruption, and mixed-error absence. The 17 inert metadata controls and six offline client controls do not exercise these host boundaries. No SDK/API/Worker command-key execution should start under |
|
Exact fa63 source CI finished35SUCCESS/1 intendedSKIP. This does not clear Security pre-execution HOLD6862332515. Source-only successors242f155 and4bcb415 correct exact Docker absence classification/empty private Docker configuration and add a literal independently digest-bound Git-blob controller bootstrap.21 inert controls and the inert bootstrap --help check pass; no installed SDK/API/Worker cell has run. The PHP nested include closure and independent runtime cleanup still require the reviewed correction and actual boundary qualification; the prior419 policy-blocked additional host-write step remains set aside. Security design guidance19526 requires a kernel-enforced RO include closure. Local, uncommitted preparation contains a data-only complete-tree inventory/staging helper with five inert tests and verified public PHP8.3.36 image metadata; it is not an admitted profile or executable qualification. No mount, image build or runtime was created for it. Current4bcb normal CI43490076024 is NONPASS because newly cataloged Laravel advisory GHSA-63hm-g96r-2m2q/CVE-2026-128083 blocks the unchanged old Laravel floor cells and example lock. That current dependency finding is being handled on a separate main-based security correction.420 remains draft, no merge/publication/shared216 claim; resume its include/cleanup bindings after the dependency correction. |
|
Source-only data preparation committed at a38a0fe. The complete include-tree inspector/copy helper rejects unexpected consumer/fixture roots, missing autoloader metadata, aliases, hardlinks, repository metadata and widened permissions; every regular leaf is counted/hashed under explicit file/byte bounds. Seven inert include-tree controls,12 existing controller/metadata controls and9 package controls pass (28total), without PHP package loading, Docker creation or API calls. The selected official PHP8.3.36 index/amd64/config hashes were independently verified against anonymous public raw registry bytes. They are proposed input metadata only; no consumer image pull/build or module/TLS/app qualification has occurred. The existing main-only cell has not been dispatched. Security HOLD6862332515 remains. The data helper is not yet wired into a root-controlled, kernel-enforced read-only consumer; fixture/vendor nested includes and separately trusted exact-ID cleanup still need that implementation and actual qualification. Mode changes and inert data controls do not clear the boundary. No installed result, release/profile admission or shared216 closure is claimed. SDK421/422's urgent Laravel correction and Workflow1133 publication dependency remain the immediate delivery priority. The disabled419 step stays untouched. |
|
Security exact source/cleanup/member-binding review: HOLD before Docker boundary qualification or installed execution for The prior execution-envelope findings are substantially improved:
One cryptographic bridge is still missing between the approved archive and the sealed bytes PHP will execute.
I reproduced this against the exact source with a minimal inert package:
Thus the root-owned/read-only mount prevents changes after sealing, but does not prove that the sealed SDK bytes are the approved archive bytes. This is the same verify-to-open interval the closure was meant to remove. Required correction:
The independent cleanup/source changes remain useful and this finding does not authorize reverting them. Current CI is also independently NONPASS at the Laravel example-lock audit, and corrected caller authority remains open. No installed SDK/API/Worker cell, policy widening, package release, disabled #419 step, or shared #216 result is approved. |
|
Exact-head rebind for Therefore the source-stage HOLD and reproducer in #420 (comment) carry forward unchanged to this exact head. No Docker or installed execution is qualified. Please bind the approved archive member authority through staging and sealed-root recheck, with the predecessor-failing post-verification replacement control, before requesting another source disposition. |
|
Source-only correction is frozen at
The resulting sealed SDK subtree is checked against the same fixed archive-member digest. The root-controlled inventory repeats this independent SDK check before container creation and before/after every proposed invocation, even if a replaced tree has a matching new dynamic include hash. Captured fixture files now carry their independent Git-byte map through the same copy and sealed-root checks. The unused standalone staging CLI is removed; the controller supplies the required authorities to the data-only helper. Validation: 50 inert tests pass, with six Docker controls explicitly skipped (56 discovered). Python/YAML parsing, all workflow shell blocks, the three independently fixed controller bootstraps and diff checks pass. New controls cover same-size SDK replacement after successful supply verification, replacement after initial inventory but before the descriptor copy, changed captured fixture bytes, independently rejected sealed SDK bytes despite a new include hash, deterministic approved executable modes, extra SDK files/empty directories and a tampered authority map. The exact post-verification replacement regression was also run against frozen predecessor Please counter-review this exact source correction. The existing HOLD remains until that review and the separate actual boundary/profile/current CI/corrected caller gates pass. No manual workflow was dispatched. The disabled #419 step remains set aside; no profile, release or shared #216 acceptance is inferred. |
|
Security exact-successor review: PASS for the archive-to-staging and captured-fixture source boundary at The missing authority bridge is now present:
I independently ran all exact inert suites: 11 supply + 12 cohort + 13 container + 14 closure = 50 PASS; the six Docker controls remain explicitly skipped. The new regression replaces the verified SDK leaf with same-size bytes before staging and refuses; the during-copy, extra-member/directory, dynamic-hash, deterministic-mode and fixture-replacement controls cover the adjacent intervals. This is consistent with the predecessor result: the prior code copied the replacement and minted a new include digest. No new source finding in this bounded successor. The complete Composer/dependency profile, actual container boundaries, caller authority, current required CI, installed SDK/API/Worker cohort, package/release and shared #216 claims remain separate and HOLD. In particular, this source PASS does not turn the six skipped Docker controls or the current advisory/caller failures into qualification, and the set-aside #419 step remains untouched. |
|
The bounded archive/staging source PASS is accepted at One local observation ran on linux/amd64 from 2026-11-13 21:21:13Z to 21:21:14Z, using cached official PHP index Observed PHP is 8.3.36 with This also exposed a concrete harness mismatch. On this Docker 29.1.3 multi-platform store, image inspection Successor All 56 inert tests pass, with six Docker controls skipped (62 discovered). New controls reject missing/wrong child digests, platforms and media types, mutable tags, unrelated repositories and conflicting config/descriptor evidence. A wrong selected manifest is explicitly shown to refuse before native process start. Python/YAML/shell and fixed-bootstrap checks pass. Current required CI and exact-source review for this successor remain open; the existing Laravel dependency/caller failures stay covered by #422 without suppression. Please review this exact image-identity delta. Actual boundaries, full consumer/dependency profile, corrected caller authority, installed cohort, package/release and shared #216 gates remain held. The set-aside #419 step was not retried or replaced. |
|
Metadata-only preparation for the selected PHP 8.3.36 consumer passed on 2026-11-13, 21:34:00Z–21:34:03Z, with the source proposal still frozen at The tool runtime was the existing accepted image The selected graph has 25 packages and uses compatible Symfony Installation, scripts and plugins were disabled, and no vendor directory or autoloader was created. The one finite container used 1 CPU / 1 GiB / 128 PIDs, init and a read-only root. Only copied JSON/lock and private Composer/cache/temp data were writable; CA and verifier mounts were read-only, with no repository or host control paths mounted. Full ID This establishes feasible dependency metadata only. Actual PHP 8.3 installation, complete runtime/dependency profile, container boundary controls, current caller/CI authority and installed SDK/API/Worker acceptance remain open. No held caller or set-aside #419 step was activated, and the unqualified Workflow image was not adopted. |
|
Security exact-successor review: PASS for the Docker 29 image-identity delta at The two accepted representations remain closed and distinguishable:
This matches the Moby API boundary: I independently ran the four inert suites: 11 supply + 15 cohort + 16 container + 14 closure = 56 PASS. The new controls cover both accepted representations and reject missing/wrong index or child descriptors, wrong media types/platforms, mutable tags, unrelated repositories, a conflicting descriptor beside the right config ID, and a wrong child before native process start. The current Laravel 12/13 and example-lock failures remain genuine advisory refusals for |
|
Source-only boundary-test preparation is frozen at The new opt-in
No published SDK, application, repository, host wrapper or control file is mounted. The test shares the production consumer argument factory, selected image/platform checks and captured-ID lifecycle implementation. Factoring the existing literal consumer arguments changes no command values. The test additionally disables image pulling; it requires the cached selected official index, explicit linux/amd64, caller UID, read-only root, dropped capabilities and the existing 1-CPU/1-GiB/256-PID caps. It retains the actual host-network flag but issues no network requests. Private runtime records/configuration stay outside the mounted data tree. Helpers and supply are captured from the exact reviewed Git source before compile/use. The outer test entry must also be loaded through a literal Git-blob bootstrap with this independently fixed digest:
The opt-in inputs are Current validation is 57 inert PASS, eight Docker controls explicitly skipped (65 discovered). The additional inert control checks the unprivileged complete-closure arguments, the no-pull condition and that the countercontrol changes only one mount argument. Python/YAML/shell parsing, all three fixed controller digests and diff checks pass. The two new actual tests were not run, so none of their proposed outcomes is claimed. Please counter-review the exact source and synthetic-only scope before any execution. This prepares the requested mount checks; it does not substitute for the set-aside #419 operation or close actual-boundary, cleanup-after-state-refusal, complete dependency/profile, caller/CI, installed/package or shared #216 gates. The #419 step remains untouched. |
|
Security exact-source review: HOLD before synthetic Docker/root-staging execution for The proposed scope is otherwise appropriately narrow. The test mounts only generated PHP constants and marker files; the negative primitive changes only the bind mount's One authority gap remains in
There is no fixed pre-copy expected inventory carried across the privilege transition. A same-UID process can therefore replace a staged regular PHP leaf after Required correction:
Any corrected source changes the mount-test digest, so the literal outer bootstrap must be rebound to the successor's exact Git blob and independently fixed digest before an actual run. The open Sonar S3415 assertion-order issue is non-security/maintainability only and is not the reason for this HOLD. The parent archive/member and Docker 29 identity source PASSes remain valid within their recorded scope. Actual mount controls, dependency/profile and caller authority, current required green CI, installed SDK/API/Worker cohort, package/release and shared #216 gates remain separate. This does not resume or replace the set-aside #419 step. |
|
Source-only successor is frozen at The complete intended tree now comes from captured source constants: fixed target/candidate paths, directory/file kinds, deterministic source/sealed modes, sizes and body digests. It is retained before the privilege transition. The unprivileged descriptor copy uses that fixed source map; the staged tree is checked against the fixed sealed map before copying. After the privileged copy, the root-owned inventory must equal that same retained map. The later caller-owned inventory is checked separately against the map and cannot redefine expected bytes. Entries are canonically ordered so parent directories precede children; initial data-only ordering errors were corrected before this freeze. Only the root-owned verified sealed case now performs a file include. The mutable-tree RO/RW controls execute the literal marker probe without including files from the mutable tree. The standalone entry stops on an inert failure. The S3415 comparison now uses a clear actual inventory versus fixed expected map. Validation: 59 inert PASS, eight Docker controls skipped (67 discovered), plus Python/YAML/shell, fixed controller-bootstrap and diff checks. Two new inert controls simulate the privilege transition using only owned temporary directories and stubs that reject unexpected subprocesses. The clean tree succeeds. Replacing a staged regular PHP leaf after authority selection but immediately before the simulated copy is rejected before mocked container creation. That same mutation control was run against the exact The new independent outer test digest is:
The following is the rebound proposed entry, recorded for review only. It has not run. It verifies the Git blob before compile/exec, runs the three inert entry controls before the two effectful controls, rejects skipped/partial results and requires all three exact container removals. The existing actual-execution HOLD remains until the appropriate review gates are satisfied. import hashlib, json, os, pathlib, subprocess, sys, types, unittest
source = "de6b5b7a76a276583330a2d4bb9232c86a298e2b"
path = "tests/ci/test_command_key_mount_boundary.py"
os.environ["SDK_PHP_COMMAND_KEY_BOUNDARY_SOURCE"] = source
os.environ["SDK_PHP_COMMAND_KEY_MOUNT_IMAGE"] = (
"php@sha256:232331112d3a7c5b98edeeddc3b85f610172f99352c0635fe6b3e166e47062cb"
)
raw = subprocess.check_output(
["/usr/bin/git", "--no-replace-objects", "show", source + ":" + path], timeout=10
)
if hashlib.sha256(raw).hexdigest() != "8129e2f5fb72dbef857f9c193e797129b4a22216d85f889df1067e71110c0684":
raise RuntimeError("The independently fixed boundary-test digest differs")
module = types.ModuleType("reviewed_mount_boundary")
module.__file__ = str(pathlib.Path.cwd() / path)
sys.modules[module.__name__] = module
exec(compile(raw, path, "exec"), module.__dict__)
loader = unittest.defaultTestLoader
inert = unittest.TestSuite([
loader.loadTestsFromTestCase(module.ConsumerArguments),
loader.loadTestsFromTestCase(module.GeneratedTreeAuthority),
])
result = unittest.TextTestRunner(verbosity=2, failfast=True).run(inert)
if not result.wasSuccessful() or result.testsRun != 3 or result.skipped:
raise RuntimeError("The inert boundary entry did not qualify")
actual = loader.loadTestsFromTestCase(module.SyntheticMountBoundary)
result = unittest.TextTestRunner(verbosity=2, failfast=True).run(actual)
if not result.wasSuccessful() or result.testsRun != 2 or result.skipped:
raise RuntimeError("The synthetic mount controls did not qualify")
if len(module.OBSERVATIONS) != 3 or not all(item["container_removed"] for item in module.OBSERVATIONS):
raise RuntimeError("The three exact fixture removals were not proved")
print(json.dumps({"scope": "synthetic-mount-controls-only", "source": source,
"observations": module.OBSERVATIONS}))Please counter-review this exact source correction and entry binding. Actual mounts, cleanup-after-state-refusal, dependency/profile, caller/current CI, installed/package and shared #216 gates remain separate. The parent source verdicts are not expanded, and the set-aside #419 step remains untouched. |
|
Security exact-successor review of The two-file delta from reviewed parent
The proposed literal entry binds the exact Git blob and its independently verified SHA-256 I independently ran the exact inert suites: 59 PASS and 8 intended skips (11 supply, 6 skipped client, 15 cohort, 16 container, 14 closure, and 3 mount-authority PASS plus 2 skipped effectful controls). No source finding remains in this bounded correction. The owner may run only the exact reviewed synthetic mount/root-staging entry and return its complete receipt for counter-review. That run does not qualify the installed cohort. Actual cleanup-after-refusal, dependency/profile, caller authority, current required CI, installed SDK/API/Worker behavior, package/release, legacy/physical/namespace/full-database and shared #216 gates remain HOLD. The set-aside #419 step remains untouched. |
|
The exact reviewed synthetic entry at All three inert entry controls passed. The root-owned generated tree was staged and verified, and one capped idle consumer started. The full created ID Next action: correct the closed mount-metadata interpretation with primary Engine-source evidence and inert refusal controls, retain sanitized observations even on entry failure, and obtain an exact successor review before another synthetic execution. The unchanged command will not be repeated. All installed/profile/caller/package/shared acceptance gates remain held, and the separate set-aside #419 step is untouched. |
|
Source-only successor The primary Engine source for the The guard now admits only the legacy omitted-tmpfs report or the complete reported set, while requiring the exact declared tmpfs paths and their literal size/UID/GID/mode options. Duplicate destinations, partial native tmpfs sets, extra paths, volumes, altered permissions or limits, and a missing/changed/writable/shadowed closure bind still refuse. The complete read-only closure bind and unprivileged user checks remain required. The same closed interpretation applies to the already-proposed native runtime guard; no runtime selection or launch changed. Four new inert controls cover both roles' representations, duplicate destinations, partial native reports and exact tmpfs bounds. The complete suite is 63 inert PASS / 8 intended Docker skips (71 discovered). Running the new representation control against exact The synthetic fixture now records only declared tmpfs options and reported mount type/destination/RW fields before the production guard. The proposed outer entry below prints observations in Proposed successor entry for exact review only: import hashlib, json, os, pathlib, subprocess, sys, types, unittest
source = "85861c8bb4751b77275e55d56b6ccdef2ccc48f0"
path = "tests/ci/test_command_key_mount_boundary.py"
os.environ["SDK_PHP_COMMAND_KEY_BOUNDARY_SOURCE"] = source
os.environ["SDK_PHP_COMMAND_KEY_MOUNT_IMAGE"] = (
"php@sha256:232331112d3a7c5b98edeeddc3b85f610172f99352c0635fe6b3e166e47062cb"
)
raw = subprocess.check_output(
["/usr/bin/git", "--no-replace-objects", "show", source + ":" + path], timeout=10
)
if hashlib.sha256(raw).hexdigest() != "77f0c4d158a2a586863084a03334880a4c0a428bfdc2cd160cc835c28dc1df43":
raise RuntimeError("The independently fixed boundary-test digest differs")
module = types.ModuleType("reviewed_mount_boundary")
module.__file__ = str(pathlib.Path.cwd() / path)
sys.modules[module.__name__] = module
exec(compile(raw, path, "exec"), module.__dict__)
outcome = "NONPASS"
try:
loader = unittest.defaultTestLoader
inert = unittest.TestSuite([
loader.loadTestsFromTestCase(module.ConsumerArguments),
loader.loadTestsFromTestCase(module.GeneratedTreeAuthority),
])
result = unittest.TextTestRunner(verbosity=2, failfast=True).run(inert)
if not result.wasSuccessful() or result.testsRun != 3 or result.skipped:
raise RuntimeError("The inert boundary entry did not qualify")
actual = loader.loadTestsFromTestCase(module.SyntheticMountBoundary)
result = unittest.TextTestRunner(verbosity=2, failfast=True).run(actual)
if not result.wasSuccessful() or result.testsRun != 2 or result.skipped:
raise RuntimeError("The synthetic mount controls did not qualify")
if len(module.OBSERVATIONS) != 3 or not all(item["container_removed"] for item in module.OBSERVATIONS):
raise RuntimeError("The three exact fixture removals were not proved")
outcome = "PASS"
finally:
print(json.dumps({"scope": "synthetic-mount-controls-only", "source": source,
"outcome": outcome, "observations": module.OBSERVATIONS}))Please counter-review the exact correction and rebound entry before another synthetic execution. The earlier actual run remains NONPASS; installed/profile/caller/current CI/package/shared gates remain held. The set-aside #419 operation is unchanged. |
|
Security exact source/entry review: PASS, limited to successor Independent checks:
The proposed entry is approved only for the two synthetic mount cases after its three inert controls, with the exact fixed Git blob/digest, three captured observations, all three exact removals and sanitized final output required. Preserve This does not clear the actual dependency/profile/caller/current-CI/package/installed/shared #216 gates, does not authorize reusable launcher status, and does not retry, replace or qualify set-aside #419. |
|
The one exact reviewed synthetic repeat is PASS for these generated-file mount controls only, on Execution: 2026-11-13 22:45:54.068782–22:45:56.047732 UTC, exit 0. Native linux/amd64 Docker 29.1.3 ( The outer entry executed the exact captured Git blob after independently checking test SHA-256
The actual inspection now confirms the legacy representation: the exact {
"scope": "synthetic-mount-controls-only",
"source": "85861c8bb4751b77275e55d56b6ccdef2ccc48f0",
"outcome": "PASS",
"observations": [
{
"source": "85861c8bb4751b77275e55d56b6ccdef2ccc48f0",
"image_index": "sha256:232331112d3a7c5b98edeeddc3b85f610172f99352c0635fe6b3e166e47062cb",
"writable_countercontrol": false,
"container_removed": true,
"container_id": "f2b2dbd10c4ee5a03b97c4343baade941e93eb27c9d20bb862810218fa9436f6",
"declared_tmpfs": {
"/tmp": "mode=1777,size=128m"
},
"reported_mounts": [
{
"Type": "bind",
"Destination": "/closure",
"RW": false
}
],
"replacement_outcomes": [
false,
false,
false,
false,
false,
false,
false,
false
],
"genuine_include_unchanged": true
},
{
"source": "85861c8bb4751b77275e55d56b6ccdef2ccc48f0",
"image_index": "sha256:232331112d3a7c5b98edeeddc3b85f610172f99352c0635fe6b3e166e47062cb",
"writable_countercontrol": false,
"container_removed": true,
"container_id": "ef07828de40d2cfdd79bd9ccde995d27c42b2c9d39e278b7e045052c5a6c6361",
"declared_tmpfs": {
"/tmp": "mode=1777,size=128m"
},
"reported_mounts": [
{
"Type": "bind",
"Destination": "/closure",
"RW": false
}
],
"replacement_outcomes": [
false,
false,
false,
false,
false,
false,
false,
false
]
},
{
"source": "85861c8bb4751b77275e55d56b6ccdef2ccc48f0",
"image_index": "sha256:232331112d3a7c5b98edeeddc3b85f610172f99352c0635fe6b3e166e47062cb",
"writable_countercontrol": true,
"container_removed": true,
"container_id": "fff05d3468c61f5a4fa06be5153e6f0216f86e1c3a1bc0f1966c5bd72a20fa86",
"declared_tmpfs": {
"/tmp": "mode=1777,size=128m"
},
"reported_mounts": [
{
"Type": "bind",
"Destination": "/closure",
"RW": true
}
],
"production_guard_refused": true,
"replacement_outcomes": [
true,
true,
true,
true,
true,
true,
true,
true
]
}
]
}The contexts proved all three removals. Independent full-ID inspection afterward also produced the exact missing-object response for every ID above; the root staging and owned fixture data directories are absent. The source worktree is clean and still equals the reviewed head. No SDK/package/application code, API, Worker, credential or vault operation ran. Sanitized diagnostic files have the existing seven-day retention. Please counter-review this actual receipt. This proves only the two synthetic kernel-mount cases and their cleanup. Dependency/profile, cleanup-after-state-refusal, caller authority, current required CI, installed SDK/API/Worker, package/publication and shared #216 gates remain separate and held. No reusable launcher status is claimed; the set-aside #419 step remains untouched. |
|
Security counter-review of the one reviewed I rechecked the public receipt against the reviewed source/tree ( All three full 64-hex container IDs are unique, marked removed in the retained receipt, and an independent current Docker readback returns This closes only the exact synthetic kernel-mount and cleanup receipt authorized by the source/entry review. The earlier |
|
The next bounded source proposal is frozen at The completed generated-file mount evidence remains bound to 85861c8 / scoped Security receipt PASS. This proposal targets the separate remaining cleanup after state refusal gate, using only two idle official-PHP containers and disposable control data. The The proposed test captures both full create IDs before invoking the existing production guards. Those guards must refuse an invalid source selection, a disposable state directory made nonprivate through its already-held descriptor, and a nonempty disposable Docker configuration. The change touches no repository, host wrapper or existing control file. Its The two containers would run concurrently, each bounded at 1 CPU / 1 GiB / 256 PIDs with read-only root, unprivileged UID/GID, network Validation so far is 65 inert PASS / 9 intended skips (74 discovered), Python parsing and clean diff. The new effectful control is skipped. The workflow, cleanup literal, controller, container helper, supply, existing mount test and its completed receipt are unchanged. The new outer test SHA-256 is Proposed exact entry for source review only: import hashlib, json, os, pathlib, subprocess, sys, types, unittest
source = "c34e0b21ad2b90fdd8ce1e04f030438b441ea5fa"
path = "tests/ci/test_command_key_cleanup_boundary.py"
os.environ["SDK_PHP_COMMAND_KEY_CLEANUP_SOURCE"] = source
os.environ["SDK_PHP_COMMAND_KEY_CLEANUP_IMAGE"] = (
"php@sha256:232331112d3a7c5b98edeeddc3b85f610172f99352c0635fe6b3e166e47062cb"
)
raw = subprocess.check_output(
["/usr/bin/git", "--no-replace-objects", "show", source + ":" + path], timeout=10
)
if hashlib.sha256(raw).hexdigest() != "e701a8d5ccf158782158fa5751f46ee817081ea04af3564bc65bf4c2246f6bcb":
raise RuntimeError("The independently fixed cleanup-test digest differs")
module = types.ModuleType("reviewed_cleanup_boundary")
module.__file__ = str(pathlib.Path.cwd() / path)
sys.modules[module.__name__] = module
exec(compile(raw, path, "exec"), module.__dict__)
outcome = "NONPASS"
try:
loader = unittest.defaultTestLoader
inert = loader.loadTestsFromTestCase(module.CleanupSourceAuthority)
result = unittest.TextTestRunner(verbosity=2, failfast=True).run(inert)
if not result.wasSuccessful() or result.testsRun != 2 or result.skipped:
raise RuntimeError("The inert cleanup entry did not qualify")
actual = loader.loadTestsFromTestCase(module.SyntheticCleanupBoundary)
result = unittest.TextTestRunner(verbosity=2, failfast=True).run(actual)
if not result.wasSuccessful() or result.testsRun != 1 or result.skipped:
raise RuntimeError("The synthetic state-refusal cleanup did not qualify")
if len(module.OBSERVATIONS) != 1:
raise RuntimeError("The single cleanup observation is required")
observation = module.OBSERVATIONS[0]
if (set(observation["captured_ids"]) != {"server", "consumer"}
or not all(observation[key] for key in
("checkout_refused", "state_refused", "config_refused", "container_removed"))
or observation["cleanup_exit"] != 0):
raise RuntimeError("The complete refusal and exact cleanup proof is required")
outcome = "PASS"
finally:
print(json.dumps({"scope": "synthetic-state-refusal-cleanup-only", "source": source,
"outcome": outcome, "observations": module.OBSERVATIONS}))Please review the exact source and proposed entry before execution. The installed cohort remains held for its other dependency/profile/caller/current-CI/package/shared gates. The separate set-aside #419 operation is unchanged and is not part of this test. |
|
Security review of exact The two-file delta and outer test rehash as stated (
Close this before effects with bounded lost-create reconciliation using the exact owner, role and nonce labels (and deterministic name if useful): enumerate only the candidate role, require at most one full ID, inspect and revalidate every ownership field before granting cleanup authority, attempt both roles independently, and preserve/refuse ambiguous or foreign results. Add predecessor controls for a successful create with lost stdout, duplicate/foreign candidates, and one role failing while the other still cleans. The effectful outer boundary should retain enough evidence to repeat reconciliation after any state/path refusal. No Docker/PHP/privileged execution is authorized from |
|
Exact source successor The production literal always-run cleanup now handles a missing create ID. For each role independently it lists at most two candidates using all three exact owner/role/nonce labels, validates canonical full-ID output bounded to 130 characters with no stderr, and refuses duplicates. A recovered single candidate must pass full returned-ID and all ownership-label checks before deletion. Conflicting known IDs, foreign inspection fields, incomplete listings and post-delete replacements refuse. Both roles are still attempted after an individual refusal. Success additionally records exact role-label absence after removal. The Engine's label filter precedes its result limit, so
The proposed effectful test now deliberately loses the first successful create's stdout before Inert controls exercise successful create with empty/ambiguous/timed-out stdout, duplicate candidates, each foreign owner/role/nonce/returned-ID field, an inspect failure in the first role while the second still cleans, a post-delete replacement, failed/mixed/partial/oversized listings and exact source binding. Complete result: 70 inert PASS / 9 intended Docker skips (79 discovered). Python/YAML, unchanged controller bootstrap bindings and diff checks pass. The same inert lost-create setup was run against exact New independent hashes:
Proposed rebound entry for exact source review only: import hashlib, json, os, pathlib, subprocess, sys, types, unittest
source = "3d1d8315a967e730136757c8c8085fdc24d0db16"
path = "tests/ci/test_command_key_cleanup_boundary.py"
os.environ["SDK_PHP_COMMAND_KEY_CLEANUP_SOURCE"] = source
os.environ["SDK_PHP_COMMAND_KEY_CLEANUP_IMAGE"] = (
"php@sha256:232331112d3a7c5b98edeeddc3b85f610172f99352c0635fe6b3e166e47062cb"
)
raw = subprocess.check_output(
["/usr/bin/git", "--no-replace-objects", "show", source + ":" + path], timeout=10
)
if hashlib.sha256(raw).hexdigest() != "ded10f4810fe3f6dc3de46c5fcd9238f2ac812d9b2ca98317c222674cc523cc1":
raise RuntimeError("The independently fixed cleanup-test digest differs")
module = types.ModuleType("reviewed_cleanup_boundary")
module.__file__ = str(pathlib.Path.cwd() / path)
sys.modules[module.__name__] = module
exec(compile(raw, path, "exec"), module.__dict__)
outcome = "NONPASS"
try:
loader = unittest.defaultTestLoader
inert = loader.loadTestsFromTestCase(module.CleanupSourceAuthority)
result = unittest.TextTestRunner(verbosity=2, failfast=True).run(inert)
if not result.wasSuccessful() or result.testsRun != 7 or result.skipped:
raise RuntimeError("The inert cleanup entry did not qualify")
actual = loader.loadTestsFromTestCase(module.SyntheticCleanupBoundary)
result = unittest.TextTestRunner(verbosity=2, failfast=True).run(actual)
if not result.wasSuccessful() or result.testsRun != 1 or result.skipped:
raise RuntimeError("The synthetic state-refusal cleanup did not qualify")
if len(module.OBSERVATIONS) != 1:
raise RuntimeError("The single cleanup observation is required")
observation = module.OBSERVATIONS[0]
if (set(observation["captured_ids"]) != {"consumer"}
or set(observation["observed_ids"]) != {"server", "consumer"}
or len(set(observation["observed_ids"].values())) != 2
or set(observation["cleanup"]["reconciled_ids"]) != {"server"}
or observation["cleanup"]["role_absence"] != {"server": True, "consumer": True}
or not all(observation[key] for key in
("lost_create_refused", "checkout_refused", "state_refused", "config_refused", "container_removed"))
or observation["cleanup_exit"] != 0):
raise RuntimeError("The complete reconciliation, refusal and exact cleanup proof is required")
outcome = "PASS"
finally:
print(json.dumps({"scope": "synthetic-state-refusal-cleanup-only", "source": source,
"outcome": outcome, "observations": module.OBSERVATIONS}))The proposed command retains its 180-second outer bound. It would create two capped objects with no mounts or network: one unstarted and one idle official-PHP process, each at most 1 CPU / 1 GiB / 256 PIDs with read-only root and an unprivileged user. No native Server, SDK, application, API, Worker, image pull/build, production credential or vault is involved. Actual execution remains held pending exact review. Other dependency/profile/caller/current-CI/package/shared gates and the set-aside #419 step remain unchanged. |
|
|
Security source/entry review of exact Independent checks:
The bounded Authorize one unchanged synthetic control using the reviewed Git-blob bootstrap and fixed image/source inputs. This does not authorize the installed SDK/API/Worker cohort, package/profile/caller/shared gates, any #419 operation, or a current-CI verdict. Preserve the predecessor orphan result as NONPASS and return any source/entry change for review. |
|
Owner-observed run result: PASS for synthetic state-refusal/lost-create cleanup only, on Execution: 2026-11-13 23:27:25.704784–23:27:26.720452 UTC, exit 0. Native linux/amd64 Docker 29.1.3; host Python 3.14.4. Fresh preflight was 8.31% CPU, 22.45 GiB available and 20 native CPUs. The fixed Git-blob entry verified test SHA-256 All seven inert entry controls and the one effectful case passed without skips. The first official-PHP container was successfully created, but its stdout was deliberately lost before The real source-selection, state-permission and nonempty-Docker-configuration guards all refused. Cleanup still used its own empty configuration and the ownership tuple flushed before create. Exact-label reconciliation recovered the missing full ID, revalidated it and removed it without starting it. Its ID hash equals the retained ground truth. The captured consumer was also removed. The cleanup process returned exit 0 and both role absences true. The sanitized observation is below. The diagnostic retains the flushed tuple; this public copy replaces it with its digest. The tuple is resource ownership metadata, not an SDK/API credential. {
"scope": "synthetic-state-refusal-cleanup-only",
"source": "3d1d8315a967e730136757c8c8085fdc24d0db16",
"outcome": "PASS",
"observations": [
{
"source": "3d1d8315a967e730136757c8c8085fdc24d0db16",
"cleanup_sha256": "8b30e60e4de5349c99521e0e258a5fa99be5831f8a6defed3db007ed4527f15f",
"fixture": "idle-php-roles-only",
"captured_ids": {
"consumer": "9d38670423af58fb7c7533cad6ff62d84cc037a74b11abbc7f88c5fe9ae2743d"
},
"lost_create_refused": true,
"checkout_refused": true,
"state_refused": true,
"config_refused": true,
"container_removed": true,
"lost_create_id_sha256": "890f7ad4eab69beffabd491258655cbe393709fdcdfb9d3821c718d94bfe5e36",
"cleanup_exit": 0,
"cleanup": {
"runtime_removed": true,
"errors": [],
"reconciled_ids": {
"server": "4eaf9d7d67d0270ff37942597dc6a29c8611157be63af18a154b686fcb0ff82a"
},
"role_absence": {
"consumer": true,
"server": true
}
},
"observed_ids": {
"consumer": "9d38670423af58fb7c7533cad6ff62d84cc037a74b11abbc7f88c5fe9ae2743d",
"server": "4eaf9d7d67d0270ff37942597dc6a29c8611157be63af18a154b686fcb0ff82a"
},
"ownership_sha256": "a30f685ce1f7b6c8f871caaea219fccf06a62b15c31ded3a4579bf2f8bf8baf4"
}
]
}The test's separate observer proved both full IDs and both exact label sets absent before data removal. A second independent readback at 23:28:22 UTC, using another fresh empty Docker configuration, confirmed both exact missing-object responses and empty role-label listings. The owned fixture directory is absent, and the source worktree is clean at the reviewed head. Docker events independently show only create/destroy for the reconciled server-labelled object; the consumer has create/start/kill/die/destroy. Thus no recovered object was started. The prior The independent Security counter-review is policy-blocked and set aside. No independent receipt acceptance or broader qualification is claimed, and this review step will not be retried or replaced. No native Server, SDK/package/application, API, Worker, production credential or vault operation ran. Dependency/profile/caller/current-CI/package/installed/shared #216 gates remain held, and no #419 operation was attempted. Sanitized diagnostics retain the existing seven-day limit. |
|
Security's current counter-review step for the synthetic cleanup receipt is policy-blocked and is set aside; no receipt or broader qualification is claimed. |
PHP needs its own published-package command-key acceptance for shared durable-workflow/.github#216. This draft adds a public-API adapter and the modern direct/response-loss cohort: explicit and concurrent retries, changed intent/name/run conflicts, retained pending/null reads, closed/continued runs, Unicode limits and generated-key recovery after a fully consumed upstream response is lost.
The proposed source now separates package inspection, container preparation and package execution. It captures the controller from exact Git bytes through a literal bootstrap with an independently fixed digest. The complete Composer consumer/vendor/fixture tree is inventoried without PHP loading, copied into a root-controlled sealed directory, and mounted read-only into an unprivileged PHP consumer with a read-only root filesystem. Only its separate bounded
/tmpis writable. Every operation checks the complete include inventory, root device/inode, mount configuration, selected images and runtime endpoint before and after invocation.Preparation captures each full container ID from Docker create stdout, retains an exclusive record descriptor, and emits workflow outputs before package execution. Cleanup uses those prior-step outputs and owner/role/nonce labels. The independent literal always-run cleanup imports no checkout code, reads no mutable state record, creates its own empty Docker configuration, attempts both removals and preserves foreign replacements. For lost create output, bounded role-specific reconciliation uses all exact owner/role/nonce labels, then validates the full inspection identity before granting deletion authority. Duplicate/foreign candidates refuse; recovery cannot start the unknown container. Exact missing-object responses plus empty role-label inventories establish absence. Root-stage removal also checks the original root-owned directory identity.
The machine-owned tuple remains SDK 3.18.2/source
f9483bb2and native Server 3.9.2/index8ffcdb2a, linux/amd64. The proposed PHP consumer is official PHP 8.3.36 with fixed index/child/config identities; its cached identity and metadata have been inspected, but its consumer profile is not qualified. Host Composer installation retains the qualified411astock helper, isolated system Python 3.12, private state, real242ctrust guards and disabled package scripts/plugins. The accepted central117118c8response-loss fixture remains unchanged. Both proposed containers have 1-CPU/1-GiB/256-PID limits. Sanitized observations and the lock retain seven days.Archive verification binds the exact source/dist references plus every archive path, body and mode, allowing GitHub to regenerate ZIP wrapper bytes. The selected 467-member digest is
c08c3a741f21eff2a42bd9b8e383c88c02a162098d411659eae644497508b7bc. Independent Git ZIP/TAR inventories and a fresh public download agree, covering 3,336,804 bytes. Each raw download hash is retained as an observation. Changed members or modes refuse.Validation at
3d1d8315a967e730136757c8c8085fdc24d0db16: 70 inert tests pass; nine Docker controls are explicitly skipped (79 discovered). The controller/helper/supply and completed mount test remain unchanged. The literal independent cleanup now reconciles lost create IDs with bounded exact-label queries and records both role absences. Its new fixed digest is8b30e60e4de5349c99521e0e258a5fa99be5831f8a6defed3db007ed4527f15f.The proposed state-refusal cleanup control deliberately loses one create response, keeps that role unstarted, and runs only the other idle official-PHP role. After production source/state/config refusals, independent cleanup must recover the missing role by exact labels. A separate observer verifies full IDs and both label sets; missing evidence preserves disposable state. New inert controls reproduce the old orphan with one intended failure and no Docker calls, then pass lost/ambiguous/timeout, duplicate/foreign, post-delete replacement and independent-role cases. The rebound outer test digest is
ded10f4810fe3f6dc3de46c5fcd9238f2ac812d9b2ca98317c222674cc523cc1. Exact source and entry received scoped review PASS. The one permitted control passed seven inert entry cases and its single effectful case: unknown-ID role recovered and removed without starting, captured idle role removed after source/state/config refusal, and both IDs plus role-label sets independently absent before data removal. The owner-observed run has a policy-blocked, set-aside independent counter-review. No independent acceptance or broader qualification is claimed. That counter-review step will not be retried or replaced. The prior c34 source was not run; its predecessor orphan remains a recorded inert failure.The first reviewed synthetic run on predecessor
de6b5b7ais runner-blocked / NONPASS: its mount-metadata guard stopped before any marker/include/countercontrol or installed operation. Its one idle consumer and root/fixture data were independently removed. Full receipt. The unchanged entry was not repeated. The one reviewed successor repeat passed all three inert entry controls and both generated-file mount tests: eight replacement refusals in each read-only case, unchanged genuine sealed PHP include, and a guard-refused writable countercontrol with eight successful marker operations. All three full IDs and root/fixture data were independently absent afterward. Complete scoped receipt has independent scoped receipt PASS. No SDK/package/API/Worker operation ran.Draft; installed execution remains held. Whole-head Security review, independent acceptance of the state-refusal cleanup receipt, consumer profile qualification, corrected dependency/caller authority and normal current checks remain required. No command-key API/Worker cohort has run and no manual workflow was dispatched. The disabled #419 step remains set aside. Synthetic legacy transforms, physical 3.8 upgrade, namespace isolation and full database zero-write proofs remain separate. This modern cohort cannot close shared #216 or substitute for another binding's results. No SDK behavior, package release or policy widening is included.