fix(cp06): harden read-only Pi authentication proof

[0xnotdev]

Intent

Implement and independently validate the captain-authorized CP-06 security correction on top of PR10 head 385b80e while preserving PR8/PR9 ancestry and all corrected R1-R3 behavior. Replace Pi 0.85.1 CLI-default writable AuthStorage with the public SDK: inject a tiny private CredentialStore whose modify/delete reject before callback entry or persistence, use ModelRuntime.create with refreshOnCreate:false/allowModelNetwork:false/modelsPath:null, and createAgentSession with an explicit empty resource loader, in-memory session/settings, exactly built-in read, one exact-original read, and compact hashed event audit. Accept only expected openai-codex OAuth and explicit built-in model; require enough unexpired validity for the bounded worker, and block expired/near-expiry/unsupported Pi before provider request with no refresh, fallback, token export, persistent copy, credential contents, or raw transcript.

Harden the Linux x86-64 proof runner by pinning the regular credential inode O_RDONLY|O_NOFOLLOW, creating distinct source and regular target bind mounts verified ro,nosuid,nodev,noexec in a private user/mount namespace, closing inherited credential FDs, and launching the evaluated SDK child with empty capability sets, locked noroot/no_setuid_fixup securebits, no_new_privs, parent-death handling, and inherited seccomp denial of mount/unmount and new mount APIs, unshare/setns/namespace-bearing clone and clone3, handle-based inode access, ptrace/process memory writes, and child escape tricks. DUMMY-only actual evaluated-child adversarial proofs must cover direct write/unlink/rename/symlink/hardlink, remount/unmount/parent bind, nested user namespace/setns/clone/clone3, UID changes and subprocesses; retain an unsafe CAP_SYS_ADMIN DUMMY control that reproduces mutation. Expired and near-expiry local fake-provider cases must prove zero refresh callback and zero persistence, while normal unexpired OAuth and offline faux SDK event behavior pass without network. Abort before any real credential mount/model when DUMMY preflight, exact Pi version, namespaces, libseccomp, capabilities, seccomp, setup or cleanup is unavailable; unsupported platforms exit blocked with no fallback. Never run a destructive probe against real credentials. Real model proof may run only after the DUMMY and no-refresh protections demonstrably pass and ordinary auth preflight has sufficient validity; otherwise record blocked, never passed. State Linux/WSL2-only limits and make no Windows/macOS claim.

Preserve the existing 98-test-expanded suite (formerly 90), ten-pack 10/10 relevant and zero irrelevant topical provenance, P-07 replay, exact-original/recovered creation rule, budgets, hashes, dates, reviewer and command/exit manifests. Do not change production Factory CLI behavior, Firstmate routing/shipping, CP-07, external tools, or create another orchestrator/gate. Validate npm ci, format check, lint, typecheck, full tests, actual DUMMY OS proof, real offline CTX ten-pack, P-07, and git diff check at the exact final SHA. Ship through this isolated Pi-backed no-mistakes run to a new green PR; never merge. The PR must request independent exact-head critical security/acceptance audit and must not claim CP-06 completed from green CI alone.

What Changed

• Updated context pack generation to pass task-required documents, or project-required fallback documents, as CTX --document filters and block provenance outside that selected retrieval scope.
• Added CP-06 proof runners and npm scripts for auth security, credential isolation, worker audit, ten-pack relevance replay, and P-07 replay coverage.
• Expanded CP-06 documentation, workflow guidance, fixtures, and tests for exact-original reads, critical auth isolation behavior, and evidence expectations.

Risk Assessment

⚠️ Medium: The change is security-sensitive and broad, but the reviewed source changes are internally consistent and I found no substantiated blocking defects.

Testing

Exercised the focused worker read-audit regression, DUMMY OS/auth-security proof, real offline CTX ten-pack proof, P-07 replay, and isolated real SDK worker proof; all passed and reviewer-visible JSON evidence was copied to the no-mistakes evidence directory, with transient worktree build/state artifacts removed afterward.

Evidence: CP-06 auth-security DUMMY OS proof evidence

{
  "schema_version": 1,
  "gate": "CP-06-read-only-auth-security",
  "result": "pass",
  "tested_sha": "33b2724e3316272aac1c563086d2ce5e77d496ca",
  "recorded_at": "2026-09-30T18:53:09.367Z",
  "reviewer": "Pi CP-06 read-only auth correction worker",
  "command": "npm run proof:cp06:auth-security",
  "exit_code": 0,
  "pi_version": "0.85.1",
  "platform": {
    "os": "linux",
    "architecture": "x64",
    "kernel": "6.18.33.2-microsoft-standard-WSL2",
    "user_mount_namespace": true,
    "libseccomp": true
  },
  "binaries": {
    "seccomp_helper_sha256": "6cf5e17fdb9ecb82b1575827f607267b394df3380d7a4398f2ef919acd2db628",
    "syscall_probe_sha256": "7460c690b25199725bdf6e1907b01c258db9c0ac63e5f344b80e9ae2c3bc0ea6"
  },
  "unsafe_control": {
    "retained_capabilities": "000001ffffffffff",
    "remount_succeeded": true,
    "unmount_succeeded": true,
    "parent_bind_succeeded": true,
    "dummy_source_changed": true
  },
  "hardened_child": {
    "capability_sets_zero": true,
    "no_new_privs": true,
    "seccomp_filter": true,
    "ordinary_child_allowed": true,
    "direct_writes_denied": true,
    "replacement_denied": true,
    "remount_unmount_denied": true,
    "namespace_entry_creation_denied": true,
    "uid_change_denied": true,
    "alternate_parent_bind_denied": true,
    "dummy_source_unchanged": true
  },
  "dummy_sdk": {
    "schema_version": 1,
    "result": "pass",
    "auth_cases": [
      {
        "scenario": "expired",
        "result": "blocked",
        "refresh_callbacks": 0,
        "to_auth_calls": 0,
        "credential_store": {
          "reads": 1,
          "lists": 0,
          "modify_denials": 1,
          "delete_denials": 0
        },
        "persistence_operations": 0,
        "source_unchanged": true
      },
      {
        "scenario": "near_expiry",
        "result": "blocked",
        "refresh_callbacks": 0,
        "to_auth_calls": 0,
        "credential_store": {
          "reads": 1,
          "lists": 0,
          "modify_denials": 1,
          "delete_denials": 0
        },
        "persistence_operations": 0,
        "source_unchanged": true
      },
      {
        "scenario": "unexpired",
        "result": "resolved",
        "refresh_callbacks": 0,
        "to_auth_calls": 1,
        "credential_store": {
          "reads": 1,
          "lists": 0,
          "modify_denials": 0,
          "delete_denials": 0
        },
        "persistence_operations": 0,
        "source_unchanged": true
      }
    ],
    "sdk_worker": {
      "active_tools": [
        "read"
      ],
      "in_memory_session": true,
      "event_count": 27,
      "event_sha256": "adf7e6cbca3b6e7227a5ca2103aaed7e51fe3067ceb7cc105391294d1a4ddd8f",
      "read_audit": {
        "read_count": 1,
        "project_read_count": 1,
        "project_read_paths": [
          "/tmp/factory-cp06-DUMMY-sdk-NZxuBK/DUMMY-worker/DUMMY-original.md"
        ],
        "rejected_read_paths": [],
        "other_tool_calls": [],
        "other_tool_completions": [],
        "completed_successfully": true,
        "exact_original": true,
        "expected_sha256": "de2a93a26588002754bceb3bab5578cf51ff5882e1c40e31a55ae6b00abf63d0",
        "returned_sha256": "de2a93a26588002754bceb3bab5578cf51ff5882e1c40e31a55ae6b00abf63d0",
        "returned_bytes": 117,
        "tool_call_id": "DUMMY-read",
        "start_event_index": 13,
        "end_event_index": 14,
        "response_event_index": 23
      },
      "refresh_callbacks": 0,
      "credential_store": {
        "reads": 203,
        "lists": 1,
        "modify_denials": 0,
        "delete_denials": 0
      }
    },
    "network_calls": 0
  }
}

Evidence: CP-06 ten-pack offline CTX proof evidence

{
  "schema_version": 1,
  "gate": "P-06",
  "tested_sha": "33b2724e3316272aac1c563086d2ce5e77d496ca",
  "recorded_at": "2026-09-30T18:55:11.949Z",
  "reviewer": "Pi CP-06 correction worker",
  "fixture": {
    "tracked_root": "test/fixtures/cp06-context",
    "files": {
      ".factory/project.yaml": "59ee6b589f4eae84ac6fd8c5a9c914e2ea501c4205baf14e0944dd24d7ca2abf",
      ".factory/completion.yaml": "20806c54a9d3493208776acf73a46d5bed4d3bed5b5b434e7c102cf213043c3c",
      "PROJECT.md": "66ebc1d1dbab841fbc3f2b1f2c56f31b46eed62c4669bc80fd1f737cbca02a34",
      "ARCHITECTURE.md": "7c1db3b878bff687f8526c19d0477b7c23c3b864374bd59af7c4337d2feebe6f",
      "oracle.json": "3bbee93babb5c6e65962f03eeef13347fc650f662cd38bdaa4a10aefcc9aa60e",
      "cases/AUTH-before.yaml": "1463c777fcc44b45285a47711abe01a2514ce092cf245566af1c9e629996a927",
      "cases/AUTH-worker-before.yaml": "9d573f04f622022be341901284420fb7dbf2164c39aaed366da155f0b1274c6c",
      ".factory/tasks/COPY-001.yaml": "1fdede6ffec46443ad3ce6f151954563603e7cfb6a7aa1b8256a06f018022216",
      ".factory/tasks/CONFIG-001.yaml": "b6835f95a421d9ae39370788e2315d34ef837ba500687eec133a4bd623f0f4f3",
      ".factory/tasks/API-001.yaml": "95287f422708788226a79b54bb98aa748de129183f4628e81e405ae69e9f8200",
      ".factory/tasks/PERSIST-001.yaml": "98a60c7b75aae66c0cd533837df87d6ab88d024c4a3d4b740bb1d31cf4025cf9",
      ".factory/tasks/UI-001.yaml": "2777cb61b8a666154f7502c6a7cc9147d7c5b64d5918f1d2e1ee541065e0df12",
      ".factory/tasks/IMPORT-001.yaml": "6cca201d15e4b35e37db6d5c9b08162432c0f9f327935c15fe65f16375604d4d",
      ".factory/tasks/LOG-001.yaml": "ca4dce7f6df4a1adddb1d5ca0a1630c160b9ad8c020d4a5957a0dba851c7a773",
      ".factory/tasks/EXPORT-001.yaml": "756641f3945c04d36c1217059945464ee986860c7b2c9ab9dbaf8843f3cda4d7",
      ".factory/tasks/DELETE-001.yaml": "52e90669244d2dec5293c99c4753b32fc3be25e9f16ac7f853655b33dddebd80",
      ".factory/tasks/AUTH-001.yaml": "cc3b394217bcfeb28a4d996e5b36d5dfdf5ae45edcbbba279732c347819d7dfa",
      "docs/STYLE.md": "0694cd4e159073ddec0a2ca911387b6b684decc427118358df09a366ff1879aa",
      "docs/CONFIG.md": "6f018812db1b3e573b3936402c83ad6b8e155e08dc1923a4efa15c588c04af36",
      "docs/API.md": "3eec185c2fd091631294fe0484434eb55f53304e8ba829820833fdacc8d79253",
      "docs/PERSISTENCE.md": "3bf5f9a14539c614097e6ebb9e87e120e374490e51b1f6ee75aa8bb0d2cfd078",
      "docs/UI.md": "55d08793a354bdbc30f927c6df42a5210883ec11d4b7a879cdbdbb2a400b7af8",
      "docs/IMPORT.md": "7ecf640af4652b3238d4f29577657a5f0a016f5e36fb2c1a7676ec78cb6e9661",
      "docs/OBSERVABILITY.md": "3b0d76216e259f913afe366acd7f18facda9574a62633513b335b30714b9ee36",
      "docs/EXPORT.md": "ed126125a6c570da168a4d80566666f78ab7b8cffcbf16357eb64941ab7effb4",
      "docs/DELETION.md": "f8f9e9796fee494435ddfb9aa99ef5016fc93179d94be60cc06d8e5e4a4982d8",
      "docs/AUTH.md": "353572470edee8e83c022c1ce763d05bfa3e628a77fb5c42fc1b1eb91491abd1"
    }
  },
  "ctx": {
    "version": "ctx 1.0.0",
    "index_generation": 2,
    "retrieval_mode": "HYBRID_SEMANTIC",
    "active_channels": [
      "structural",
      "lexical",
      "semantic"
    ],
    "offline_ready": true,
    "network_attempted": false
  },
  "original_failed_measurement_preserved": {
    "packs": 10,
    "topical_excerpts": 24,
    "irrelevant_topical_excerpts": 15,
    "packs_with_irrelevant_excerpt": 10,
    "missing_targets": 1,
    "source": "docs/probes/CP-06.md at PR #8 head 8b945a4ed6fcbb43a8b7aa7ce3a6532a4a23d145",
    "disposition": "fail"
  },
  "diagnosis": {
    "bad_unscoped_path": {
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/bad-unscoped-auth.txt",
      "output_sha256": "20fd9b7d9af129037ba0d6a9bc21ff98c3aca839068ab268373ffe08a5b196cd",
      "provenance": [
        "ARCHITECTURE.md",
        "docs/DELETION.md",
        "docs/OBSERVABILITY.md"
      ],
      "irrelevant_topical_sources": [
        "docs/DELETION.md",
        "docs/OBSERVABILITY.md"
      ],
      "irrelevant_topical_originals": [
        {
          "path": "docs/DELETION.md",
          "document_sha256": "f8f9e9796fee494435ddfb9aa99ef5016fc93179d94be60cc06d8e5e4a4982d8"
        },
        {
          "path": "docs/OBSERVABILITY.md",
          "document_sha256": "3b0d76216e259f913afe366acd7f18facda9574a62633513b335b30714b9ee36"
        }
      ],
      "missing_target": true
    },
    "empty_selection": {
      "semantics": "empty task-local authority falls back to mandatory global document filters",
      "factory_exit_code": 0,
      "factory_output_path": ".factory/state/cp06-correction/ten-pack/raw/empty-selection-factory.txt",
      "factory_output_sha256": "b9e4854af821db445d9d7792a97810fec9e544625e79c22a634d769ef605d49a",
      "factory_topical_source_digests": [],
      "ctx_exit_code": 0,
      "ctx_output_path": ".factory/state/cp06-correction/ten-pack/raw/empty-selection-real-ctx.txt",
      "ctx_output_sha256": "ee2004ce1d6f1d220b1b255ae7120777c6c50a8cd2a71b629a4d5816dee2f34d",
      "ctx_completeness_status": "COMPLETE",
      "ctx_provenance": [
        {
          "path": "PROJECT.md",
          "document_sha256": "66ebc1d1dbab841fbc3f2b1f2c56f31b46eed62c4669bc80fd1f737cbca02a34"
        },
        {
          "path": "ARCHITECTURE.md",
          "document_sha256": "7c1db3b878bff687f8526c19d0477b7c23c3b864374bd59af7c4337d2feebe6f"
        }
      ]
    },
    "one_condition_counterfactual": {
      "unchanged_fields": "all AUTH task fields except context.required",
      "before_required": [
        "PROJECT.md",
        "ARCHITECTURE.md"
      ],
      "after_required": [
        "PROJECT.md",
        "ARCHITECTURE.md",
        "docs/AUTH.md"
      ],
      "before_contract_sha256": "1463c777fcc44b45285a47711abe01a2514ce092cf245566af1c9e629996a927",
      "after_contract_sha256": "cc3b394217bcfeb28a4d996e5b36d5dfdf5ae45edcbbba279732c347819d7dfa",
      "before_pack_sha256": "40761975df3a564baf0b4db77c39df719d664aa57d9f9b6bbdf556b87886f61c",
      "after_pack_sha256": "82f56459b9ba2976308148939b0a1d574ba52c8405e784de65236fcb51f1bf89",
      "corrected_constraints": [
        "principal-derived ownership",
        "request owner ignored",
        "missing or forged credential is 401",
        "cross-account read/update/delete is non-mutating non-disclosing 404"
      ]
    },
    "disconfirming_partial_case": {
      "condition": "a successful document-scoped real-CTX call can remain PARTIAL",
      "exit_code": 0,
      "completeness_status": "PARTIAL",
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/disconfirming-partial-ctx.txt",
      "output_sha256": "946d942db3a9a15843cb773080bce026a4558ff08fbcf32586d6c1d56f4c6e82"
    },
    "disconfirming_missing_original_case": {
      "condition": "declared required original docs/ABSENT.md does not exist",
      "exit_code": 3,
      "error_code": "CONTEXT_BLOCKED",
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/disconfirming-missing-original.txt",
      "output_sha256": "811f24ba790c074c54b091a8ce82aee4a97362df30c0527dbd3aee130f2dd1fa",
      "pack_fabricated": false
    }
  },
  "fixed_sample": {
    "pack_count": 10,
    "relevant_pack_count": 10,
    "irrelevant_topical_excerpts": 0,
    "packs_with_irrelevant_excerpt": 0,
    "missing_targets": 0,
    "packs": [
      {
        "task_id": "COPY-001",
        "risk": "bounded",
        "contract": {
          "path": "test/fixtures/cp06-context/.factory/tasks/COPY-001.yaml",
          "sha256": "1fdede6ffec46443ad3ce6f151954563603e7cfb6a7aa1b8256a06f018022216"
        },
        "target_source": {
          "path": "test/fixtures/cp06-context/docs/STYLE.md",
          "sha256": "0694cd4e159073ddec0a2ca911387b6b684decc427118358df09a366ff1879aa"
        },
        "pack": {
          "path": ".factory/state/cp06-correction/ten-pack/raw/COPY-001.pack.md",
          "sha256": "65c6df07edfdd68eed9b1e05d06a697888d6f23b4a60ad3a8d6fec7f5ab6aa08"
        },
        "receipt": {
          "path": ".factory/state/cp06-correction/ten-pack/raw/COPY-001.receipt.json",
          "sha256": "25455cde0c63e67820da2b0dfaa95901176a57d2a4ce58a287219c7fd2479aef"
        },
   

... [33614 bytes truncated] ...

",
      "cwd": "/home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z",
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/fixed-COPY-001.txt",
      "output_sha256": "c696560578135e422e37417184a4b3a7a18da77fd4f7ef1ee351c93224fe4055"
    },
    {
      "id": "fixed-CONFIG-001",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/dist/src/cli.js context CONFIG-001 --root /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/.factory/state/cp06-correction/ten-pack/repo --ctx-bin /home/ansh/.local/bin/ctx --json",
      "cwd": "/home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z",
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/fixed-CONFIG-001.txt",
      "output_sha256": "5a71c2caacce0363bc5db9f5530d3217e62384d4a41720633785386d60d5d37b"
    },
    {
      "id": "fixed-API-001",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/dist/src/cli.js context API-001 --root /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/.factory/state/cp06-correction/ten-pack/repo --ctx-bin /home/ansh/.local/bin/ctx --json",
      "cwd": "/home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z",
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/fixed-API-001.txt",
      "output_sha256": "a8f42463738826888b27aacbd0618d6a750174a57fd1d57e326abae93f7166f8"
    },
    {
      "id": "fixed-PERSIST-001",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/dist/src/cli.js context PERSIST-001 --root /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/.factory/state/cp06-correction/ten-pack/repo --ctx-bin /home/ansh/.local/bin/ctx --json",
      "cwd": "/home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z",
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/fixed-PERSIST-001.txt",
      "output_sha256": "f95a481085575bd02c169ab94a2f18e4811b39bcf6575db1d9abab7c16ca46b7"
    },
    {
      "id": "fixed-UI-001",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/dist/src/cli.js context UI-001 --root /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/.factory/state/cp06-correction/ten-pack/repo --ctx-bin /home/ansh/.local/bin/ctx --json",
      "cwd": "/home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z",
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/fixed-UI-001.txt",
      "output_sha256": "d7bd4d4e788738cdc13318a9eb690b085ac5fc1c76775507b81698ed96120e37"
    },
    {
      "id": "fixed-IMPORT-001",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/dist/src/cli.js context IMPORT-001 --root /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/.factory/state/cp06-correction/ten-pack/repo --ctx-bin /home/ansh/.local/bin/ctx --json",
      "cwd": "/home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z",
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/fixed-IMPORT-001.txt",
      "output_sha256": "a623f2ac36c9d22bc272fb92837444d0f794a9bf907eeaffb22370c62e786401"
    },
    {
      "id": "fixed-LOG-001",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/dist/src/cli.js context LOG-001 --root /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/.factory/state/cp06-correction/ten-pack/repo --ctx-bin /home/ansh/.local/bin/ctx --json",
      "cwd": "/home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z",
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/fixed-LOG-001.txt",
      "output_sha256": "8894b5dd83e5faf467c50e4d87a00e39ea3422783b9691c899602333d217cb71"
    },
    {
      "id": "fixed-EXPORT-001",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/dist/src/cli.js context EXPORT-001 --root /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/.factory/state/cp06-correction/ten-pack/repo --ctx-bin /home/ansh/.local/bin/ctx --json",
      "cwd": "/home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z",
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/fixed-EXPORT-001.txt",
      "output_sha256": "ce919ce64f596039995367ff2cad4750a88d1dd346ef7a85a5432a16cde1359c"
    },
    {
      "id": "fixed-DELETE-001",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/dist/src/cli.js context DELETE-001 --root /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/.factory/state/cp06-correction/ten-pack/repo --ctx-bin /home/ansh/.local/bin/ctx --json",
      "cwd": "/home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z",
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/fixed-DELETE-001.txt",
      "output_sha256": "f9bdbc76ee2b78892d9567d1244dc710a34dac0754a6adcdadfd16d9c189484a"
    },
    {
      "id": "fixed-AUTH-001",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/dist/src/cli.js context AUTH-001 --root /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/.factory/state/cp06-correction/ten-pack/repo --ctx-bin /home/ansh/.local/bin/ctx --json",
      "cwd": "/home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z",
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/fixed-AUTH-001.txt",
      "output_sha256": "cc4aa1c4b326f27525180e12c5fd16da4f30702d0803684769b80ca9682cc8e4"
    },
    {
      "id": "disconfirming-missing-original",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/dist/src/cli.js context AUTH-001 --root /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/.factory/state/cp06-correction/ten-pack/repo --ctx-bin /home/ansh/.local/bin/ctx --json",
      "cwd": "/home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z",
      "exit_code": 3,
      "output_path": ".factory/state/cp06-correction/ten-pack/raw/disconfirming-missing-original.txt",
      "output_sha256": "811f24ba790c074c54b091a8ce82aee4a97362df30c0527dbd3aee130f2dd1fa"
    }
  ],
  "result": "pass",
  "limitations": [
    "The semantic replay is verified on Linux with CTX 1.0.0 and the locally installed model.",
    "The small fixture demonstrates this fixed sample, not universal retrieval precision.",
    "Raw CTX JSON, packs, receipts, and command logs remain ignored scratch under .factory/state."
  ]
}

Evidence: CP-06 P-07 replay evidence

{
  "schema_version": 1,
  "gate": "P-07",
  "tested_sha": "33b2724e3316272aac1c563086d2ce5e77d496ca",
  "recorded_at": "2026-09-30T18:55:21.761Z",
  "reviewer": "Pi CP-06 correction worker",
  "finding": {
    "path": "test/fixtures/workflow/history/finding.json",
    "sha256": "ac96d7c6100b3c163e0721af0e3b8706ec8718ae07308f120db0ba1e3e8cb059",
    "record": {
      "schema_version": 1,
      "finding_id": "P07-MALFORMED-JSON",
      "acceptance_id": "P-07",
      "reviewer": "CP-06 simulated task reviewer",
      "scenario": "PUT /v1/profile receives malformed JSON",
      "finding": "The normal API fixture throws SyntaxError instead of returning the stable 400 invalid_json response.",
      "disposition": "repaired",
      "repair": "Catch parse failure and return status 400 with error invalid_json.",
      "retest": "Execute the same malformed-JSON behavioral assertion against the checked-in final fixture."
    }
  },
  "sequence": [
    {
      "id": "build",
      "command": "npm run build",
      "expected_exit_code": 0,
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/p07/raw/build.txt",
      "output_sha256": "665ce072dffd18b1720107dc8ea47cd800e604fb62ea3164ec087fef5517c632",
      "expected_output_fragments": []
    },
    {
      "id": "fail-before",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node test/fixtures/workflow/history/malformed-json-probe.mjs",
      "expected_exit_code": 1,
      "exit_code": 1,
      "output_path": ".factory/state/cp06-correction/p07/raw/fail-before.txt",
      "output_sha256": "e2b25dd456295de24fcb322710e007e7e3c6d7753c9b4eed180eadaa180103ec",
      "expected_output_fragments": [
        "SyntaxError",
        "not valid JSON"
      ]
    },
    {
      "id": "fix-after",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node --test \"--test-name-pattern=normal API fixture rejects malformed\" dist/test/workflow.test.js",
      "expected_exit_code": 0,
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/p07/raw/fix-after.txt",
      "output_sha256": "ff580903ca4df6066dfa35a92cdebf985697156d4011e477d828269df1714be6",
      "expected_output_fragments": []
    },
    {
      "id": "critical-auth-retest",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node --test \"--test-name-pattern=critical auth fixture\" dist/test/workflow.test.js",
      "expected_exit_code": 0,
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/p07/raw/critical-auth-retest.txt",
      "output_sha256": "050c748855e8299aee5792fc0da59f14b8b8dd9002199b76966d1798c2285b39",
      "expected_output_fragments": []
    }
  ],
  "result": "pass",
  "limitations": [
    "Behavioral fixtures are in-memory and make no network or real-account access.",
    "The historical module is a minimal retained reproduction, not a raw worker transcript."
  ]
}

Evidence: CP-06 isolated SDK worker evidence

{
  "schema_version": 1,
  "gate": "P-06-fresh-worker",
  "tested_sha": "33b2724e3316272aac1c563086d2ce5e77d496ca",
  "recorded_at": "2026-09-30T18:55:49.851Z",
  "reviewer": "Pi CP-06 read-only auth correction worker",
  "worker": {
    "pi_version": "0.85.1",
    "interface": "public SDK with injected CredentialStore",
    "provider": "openai-codex",
    "model": "gpt-5.6-sol",
    "in_memory_session": true,
    "tools": [
      "read"
    ],
    "refresh_on_create": false,
    "model_catalog_network": false
  },
  "bounded_handoff": {
    "contract_path": "test/fixtures/cp06-context/cases/AUTH-worker-before.yaml",
    "contract_sha256": "9d573f04f622022be341901284420fb7dbf2164c39aaed366da155f0b1274c6c",
    "pack_path": ".factory/state/cp06-correction/ten-pack/raw/auth-worker-missing.pack.md",
    "pack_sha256": "0e9149e7a30d78fc31c24506e6bf3571d493ee7c5387b547b57101468323be0a",
    "original_path": ".factory/state/cp06-correction/ten-pack/repo/docs/AUTH.md",
    "original_sha256": "353572470edee8e83c022c1ce763d05bfa3e628a77fb5c42fc1b1eb91491abd1",
    "deliberately_omitted_constraint_sha256": "3763bc1b67af5245b59de88533aab757a5c3f23218ff9941a5437db304fe696e",
    "evidence": "in-memory auth 401 and concealed non-mutating cross-account 404 observations"
  },
  "isolation": {
    "supported_platform": "Linux x86-64",
    "dummy_security_preflight": {
      "schema_version": 1,
      "gate": "CP-06-read-only-auth-security",
      "result": "pass",
      "tested_sha": "33b2724e3316272aac1c563086d2ce5e77d496ca",
      "recorded_at": "2026-09-30T18:55:34.967Z",
      "reviewer": "Pi CP-06 read-only auth correction worker",
      "command": "npm run proof:cp06:auth-security",
      "exit_code": 0,
      "pi_version": "0.85.1",
      "platform": {
        "os": "linux",
        "architecture": "x64",
        "kernel": "6.18.33.2-microsoft-standard-WSL2",
        "user_mount_namespace": true,
        "libseccomp": true
      },
      "binaries": {
        "seccomp_helper_sha256": "6cf5e17fdb9ecb82b1575827f607267b394df3380d7a4398f2ef919acd2db628",
        "syscall_probe_sha256": "7460c690b25199725bdf6e1907b01c258db9c0ac63e5f344b80e9ae2c3bc0ea6"
      },
      "unsafe_control": {
        "retained_capabilities": "000001ffffffffff",
        "remount_succeeded": true,
        "unmount_succeeded": true,
        "parent_bind_succeeded": true,
        "dummy_source_changed": true
      },
      "hardened_child": {
        "capability_sets_zero": true,
        "no_new_privs": true,
        "seccomp_filter": true,
        "ordinary_child_allowed": true,
        "direct_writes_denied": true,
        "replacement_denied": true,
        "remount_unmount_denied": true,
        "namespace_entry_creation_denied": true,
        "uid_change_denied": true,
        "alternate_parent_bind_denied": true,
        "dummy_source_unchanged": true
      },
      "dummy_sdk": {
        "schema_version": 1,
        "result": "pass",
        "auth_cases": [
          {
            "scenario": "expired",
            "result": "blocked",
            "refresh_callbacks": 0,
            "to_auth_calls": 0,
            "credential_store": {
              "reads": 1,
              "lists": 0,
              "modify_denials": 1,
              "delete_denials": 0
            },
            "persistence_operations": 0,
            "source_unchanged": true
          },
          {
            "scenario": "near_expiry",
            "result": "blocked",
            "refresh_callbacks": 0,
            "to_auth_calls": 0,
            "credential_store": {
              "reads": 1,
              "lists": 0,
              "modify_denials": 1,
              "delete_denials": 0
            },
            "persistence_operations": 0,
            "source_unchanged": true
          },
          {
            "scenario": "unexpired",
            "result": "resolved",
            "refresh_callbacks": 0,
            "to_auth_calls": 1,
            "credential_store": {
              "reads": 1,
              "lists": 0,
              "modify_denials": 0,
              "delete_denials": 0
            },
            "persistence_operations": 0,
            "source_unchanged": true
          }
        ],
        "sdk_worker": {
          "active_tools": [
            "read"
          ],
          "in_memory_session": true,
          "event_count": 28,
          "event_sha256": "a519f01d8191c225505aa8a140441792462f4929c18aeb7a9947ef05726cb78e",
          "read_audit": {
            "read_count": 1,
            "project_read_count": 1,
            "project_read_paths": [
              "/tmp/factory-cp06-DUMMY-sdk-HuY7lO/DUMMY-worker/DUMMY-original.md"
            ],
            "rejected_read_paths": [],
            "other_tool_calls": [],
            "other_tool_completions": [],
            "completed_successfully": true,
            "exact_original": true,
            "expected_sha256": "de2a93a26588002754bceb3bab5578cf51ff5882e1c40e31a55ae6b00abf63d0",
            "returned_sha256": "de2a93a26588002754bceb3bab5578cf51ff5882e1c40e31a55ae6b00abf63d0",
            "returned_bytes": 117,
            "tool_call_id": "DUMMY-read",
            "start_event_index": 13,
            "end_event_index": 14,
            "response_event_index": 24
          },
          "refresh_callbacks": 0,
          "credential_store": {
            "reads": 203,
            "lists": 1,
            "modify_denials": 0,
            "delete_denials": 0
          }
        },
        "network_calls": 0
      }
    },
    "source_and_target_distinct_read_only_mounts": true,
    "evaluated_child_capabilities": "all sets empty",
    "evaluated_child_no_new_privs": true,
    "evaluated_child_seccomp": true,
    "credential_store": "injected callback-denying read-only CredentialStore",
    "oauth_preflight": {
      "minimum_validity_ms": 900000,
      "remaining_validity_ms": 858603765,
      "refreshed": false
    },
    "credential_store_audit": {
      "reads": 4,
      "lists": 0,
      "modify_denials": 0,
      "delete_denials": 0
    },
    "credential_source_unchanged": true,
    "cleanup": "pass",
    "destructive_real_source_probe": false,
    "raw_transcript_retained": false
  },
  "event_stream": {
    "sha256": "b5978bf2ab975ec6fd5f49e52ea55e33707e9d2997374f44c973d9fc62507244",
    "event_count": 213,
    "read_audit": {
      "read_count": 1,
      "project_read_count": 1,
      "project_read_paths": [
        "/home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/.factory/state/cp06-correction/ten-pack/repo/docs/AUTH.md"
      ],
      "rejected_read_paths": [],
      "other_tool_calls": [],
      "other_tool_completions": [],
      "completed_successfully": true,
      "exact_original": true,
      "expected_sha256": "353572470edee8e83c022c1ce763d05bfa3e628a77fb5c42fc1b1eb91491abd1",
      "returned_sha256": "353572470edee8e83c022c1ce763d05bfa3e628a77fb5c42fc1b1eb91491abd1",
      "returned_bytes": 276,
      "tool_call_id": "call_FC4yOhjsWdOuu3O0iHOZS1yD|fc_027c12feac5cc19e016abd5b2ad50087d0b133b70a5560355a",
      "start_event_index": 72,
      "end_event_index": 73,
      "response_event_index": 209
    }
  },
  "command": "Pi 0.85.1 createAgentSession({modelRuntime: injectedReadOnlyRuntime, tools: ['read'], inMemorySession}) inside capability-free seccomp child",
  "exit_code": 0,
  "response_sha256": "96ecb783dc6309def3a1340f4386e63ad3e41f8c3e90e03dcc219dc742e2cd9d",
  "response": {
    "status": "MISSING_SOURCE",
    "missing_source": "docs/AUTH.md",
    "reads": [
      "/home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6-worktrees/01M3ST105N1602TMRXJVFQNY2Z/.factory/state/cp06-correction/ten-pack/repo/docs/AUTH.md"
    ],
    "corrected_constraints": [
      "Creation ownership comes only from the authenticated principal; request-supplied owner fields are ignored."
    ],
    "evidence_gaps": [
      "Existing evidence does not establish creation-time ownership behavior."
    ],
    "broad_scan": false
  },
  "result": "pass",
  "limitation": "Live model wording is nondeterministic. The proof runner is Linux x86-64 only and exits blocked before credential access/provider use when user/mount namespaces, libseccomp, exact Pi 0.85.1, or adequate unexpired OAuth validity are unavailable."
}

• Evidence: Worker read-audit offset/limit behavior evidence (local file: /home/ansh/.treehouse/Factory-86709f/10/Factory/.factory/nm6/.no-mistakes/evidence/01M3ST105N1602TMRXJVFQNY2Z/cp06-worker-read-audit-behavior.json)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• 🚨 scripts/cp06-worker-audit.mjs:78 - User intent requires the worker use "one exact-original read" and the prompt requires it "without offset or limit", but the audit accepts a read event with args { path: originalPath, offset: 1 } as long as the returned bytes equal the original. That leaves the proof able to pass a non-conforming SDK read invocation instead of enforcing no offset/limit.

🔧 Fix: Enforce exact original read arguments
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• node --test test/cp06-worker-audit.test.mjs
• npm run proof:cp06:auth-security
• npm run proof:cp06:ten-pack
• npm run proof:cp06:p07
• npm run proof:cp06:worker
• Generated cp06-worker-read-audit-behavior.json evidence showing valid exact-original read accepted and explicit offset/limit rejected even with complete returned bytes

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.