fix(core): constrain CP-06 context and worker recovery by 0xnotdev · Pull Request #12 · 0xnotdev/Software_factory

0xnotdev · 2026-10-01T13:14:01Z

Intent

Resume and ship the already authorized Factory CP-06 A1/C1 correction on top of the unchanged audited PR11 head while retaining PR8/PR9/PR10/PR11 ancestry and preserving all unrelated work. A1 must make the actual Pi 0.85.1 SDK worker require a structured creation-time integration evidence finding: reject absent, empty, duplicate, wrong, or contradictory evidence gaps; preserve canonical source identity, explicit fixture-origin versus semantic-acceptance distinction, exactly one complete original built-in read with no offset or limit, and executable actual-SDK DUMMY negative and valid-positive coverage. C1 must propagate exit status only after awaited cleanup in the runner and namespace supervisor, retain both primary and cleanup failures, and cover expired, near-expiry, setup, launch, timeout, audit, cleanup, and compound failures. Preserve PR11's public injected read-only credential store that denies mutation callbacks before refresh/persistence and its capability-free, no-new-privileges, securebits-locked, seccomp-isolated Linux x86-64 child; every destructive auth probe must remain DUMMY-only, with no real credential inspection, copying, export, mutation, remount, refresh, or fixture stream promoted as genuine semantic evidence. Preserve source-scope and provenance behavior, STANDARD offline semantic ten-pack evidence of 10/10 relevant with zero irrelevant, and P-07; disclose that strict-agent retrieval is separately PARTIAL/CONFLICTING rather than COMPLETE and do not widen filters to hide omissions. A genuine fresh semantic worker remains blocked/not verified unless both DUMMY protections and adequate non-refresh credential validity are safely preflighted. Validate the exact final SHA with install, format, lint, typecheck, full tests, DUMMY S1/S2 and A1/C1 proofs, STANDARD ten-pack, P-07, manifests, hashes, and diff/ancestry checks. Make no Firstmate routing, global credential/config/model, external-tool, merge, deployment, or release change. Open a new PR only; green CI does not complete CP-06, and a separate independent exact-head critical security/acceptance audit is still required before any conditional captain merge.

What Changed

Constrained CTX context generation to task-local context.required documents, falling back to mandatory project documents, with provenance checks that reject excerpts outside the selected retrieval scope.
Added CP-06 Pi SDK worker proof scripts for DUMMY-gated read-only credential handling, exact-original read auditing, auth-security replay, ten-pack replay, and P-07 replay.
Added worker lifecycle and namespace-supervisor cleanup handling/tests so exit status is reported only after cleanup and compound primary/cleanup failures are preserved.

Risk Assessment

⚠️ Medium: The reviewed changes are security-sensitive and broad, but I did not find a concrete source-verifiable defect in the changed code.

Testing

Verified exact target SHA 6b9b6e2, installed dependencies, ran focused A1/C1 behavioral tests for worker audit/outcome/lifecycle and credential isolation, then produced end-to-end CP-06 proof artifacts for the fresh SDK worker, cleanup failure propagation, auth security, STANDARD ten-pack, and P-07; the first worker proof attempt failed before its ten-pack fixture prerequisite existed, and the same proof passed after generating ten-pack evidence.

Evidence: Focused CP-06 behavioral test transcript

$ node --test test/cp06-worker-audit.test.mjs test/cp06-worker-outcome.test.mjs test/cp06-worker-lifecycle.test.mjs test/cp06-readonly-credentials.test.mjs test/cp06-credential-isolation.test.mjs
✔ live credential mount pins one inode behind distinct read-only regular mounts (12.800704ms)
✔ mount setup failure reports cleanup failure instead of discarding it (4.60522ms)
✔ unsupported isolation fails before credential access or provider work (1.819307ms)
✔ destructive DUMMY proof requires denied write unlink rename symlink and hardlink (1.162128ms)
✔ expired OAuth is rejected before refresh callback and persistence (11.146298ms)
✔ near-expiry OAuth is rejected before refresh callback and persistence (5.270598ms)
✔ unexpired OAuth resolves from a clone without mutation (4.671514ms)
✔ delete is denied without persistence (4.504697ms)
✔ credential store rejects API keys, malformed OAuth, symlinks, and oversized files (6.694927ms)
✔ worker read audit rejects omitted completion (2.216623ms)
✔ worker read audit rejects stub failed read completion (0.392007ms)
✔ worker read audit rejects partial read (0.320022ms)
✔ worker read audit rejects explicit first-line offset with complete bytes (0.348615ms)
✔ worker read audit rejects explicit limit with complete bytes (0.199154ms)
✔ worker read audit rejects wrong starting range (0.175042ms)
✔ worker read audit rejects mismatched completion id (0.215852ms)
✔ worker read audit rejects completion before start (0.242388ms)
✔ worker read audit rejects response before completion (0.486072ms)
✔ worker read audit rejects orphan non-read completion (0.641661ms)
✔ worker read audit rejects another project read (0.326241ms)
✔ worker missing-source identity accepts only the canonical original path (0.215228ms)
✔ worker read audit accepts one completed exact-original read before the response (0.259831ms)
✔ supervisor awaits cleanup and preserves failures: success (18.611763ms)
✔ supervisor awaits cleanup and preserves failures: expired (9.05053ms)
✔ supervisor awaits cleanup and preserves failures: near-expiry (8.353107ms)
✔ supervisor awaits cleanup and preserves failures: setup (2.445766ms)
✔ supervisor awaits cleanup and preserves failures: launch (8.64814ms)
✔ supervisor awaits cleanup and preserves failures: timeout (8.290872ms)
✔ supervisor awaits cleanup and preserves failures: audit (8.144863ms)
✔ supervisor awaits cleanup and preserves failures: cleanup (9.598792ms)
✔ supervisor awaits cleanup and preserves failures: primary-and-cleanup (8.602434ms)
✔ evaluation-home cleanup finishes before the blocked result is returned (1.370627ms)
✔ worker outcome accepts the required structured unverified creation checks (1.461542ms)
✔ worker outcome rejects missing creation evidence (0.158766ms)
✔ worker outcome rejects empty creation evidence (0.150894ms)
✔ worker outcome rejects legacy prose without a check disposition creation evidence (0.178781ms)
✔ worker outcome rejects contradictory passed disposition creation evidence (0.219068ms)
✔ worker outcome rejects contradictory verified flag creation evidence (0.152548ms)
✔ worker outcome rejects wrong gap creation evidence (0.235766ms)
✔ worker outcome rejects omitted ignored-owner check creation evidence (0.182841ms)
✔ worker outcome rejects duplicate checks creation evidence (0.468221ms)
✔ worker outcome rejects mixed unverified and passed creation evidence (3.530366ms)
✔ creation evidence cannot replace source recovery or relax the read outcome (0.292999ms)
ℹ tests 43
ℹ suites 0
ℹ pass 43
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 172.900166

Evidence: Fresh SDK worker proof transcript

$ npm run proof:cp06:worker (after ten-pack fixture generation)
npm notice run @factory/core@0.0.0-cp00 proof:cp06:worker
npm notice run node scripts/replay-cp06-worker.mjs
{"ok":true,"gate":"P-06-fresh-worker","tested_sha":"6b9b6e2e8b4ef11f48fb2ef0f3d09fd021692289","manifest_path":".factory/state/cp06-correction/worker/evidence.json","manifest_sha256":"4ec139043200061ec8db7f9623fb61f40cb1eced7415277ec4b0460ff813a73b","exit_code":0,"status":"MISSING_SOURCE","reads":["/home/ansh/.treehouse/Factory-86709f/13/Factory/.factory/state/n/h/.no-mistakes/worktrees/212160a2e779/01M3VRTZ4TD8H2RVDX7FCHS6D2/.factory/state/cp06-correction/ten-pack/repo/docs/AUTH.md"],"broad_scan":false}

Evidence: Fresh SDK worker evidence manifest

{
  "schema_version": 1,
  "gate": "P-06-fresh-worker",
  "tested_sha": "6b9b6e2e8b4ef11f48fb2ef0f3d09fd021692289",
  "recorded_at": "2026-10-01T13:10:47.338Z",
  "reviewer": "Pi CP-06 read-only auth correction worker",
  "worker": {
    "pi_version": "0.85.1",
    "interface": "public SDK with injected CredentialStore",
    "provider": "openai-codex",
    "model": "gpt-5.6-sol",
    "in_memory_session": true,
    "tools": [
      "read"
    ],
    "refresh_on_create": false,
    "model_catalog_network": false
  },
  "bounded_handoff": {
    "contract_path": "test/fixtures/cp06-context/cases/AUTH-worker-before.yaml",
    "contract_sha256": "9d573f04f622022be341901284420fb7dbf2164c39aaed366da155f0b1274c6c",
    "pack_path": ".factory/state/cp06-correction/ten-pack/raw/auth-worker-missing.pack.md",
    "pack_sha256": "0e9149e7a30d78fc31c24506e6bf3571d493ee7c5387b547b57101468323be0a",
    "original_path": ".factory/state/cp06-correction/ten-pack/repo/docs/AUTH.md",
    "original_sha256": "353572470edee8e83c022c1ce763d05bfa3e628a77fb5c42fc1b1eb91491abd1",
    "deliberately_omitted_constraint_sha256": "3763bc1b67af5245b59de88533aab757a5c3f23218ff9941a5437db304fe696e",
    "evidence": "in-memory auth 401 and concealed non-mutating cross-account 404 observations"
  },
  "isolation": {
    "supported_platform": "Linux x86-64",
    "dummy_security_preflight": {
      "schema_version": 1,
      "gate": "CP-06-read-only-auth-security",
      "result": "pass",
      "tested_sha": "6b9b6e2e8b4ef11f48fb2ef0f3d09fd021692289",
      "recorded_at": "2026-10-01T13:10:31.245Z",
      "reviewer": "Pi CP-06 read-only auth correction worker",
      "command": "npm run proof:cp06:auth-security",
      "exit_code": 0,
      "pi_version": "0.85.1",
      "platform": {
        "os": "linux",
        "architecture": "x64",
        "kernel": "6.18.33.2-microsoft-standard-WSL2",
        "user_mount_namespace": true,
        "libseccomp": true
      },
      "binaries": {
        "seccomp_helper_sha256": "6cf5e17fdb9ecb82b1575827f607267b394df3380d7a4398f2ef919acd2db628",
        "syscall_probe_sha256": "7460c690b25199725bdf6e1907b01c258db9c0ac63e5f344b80e9ae2c3bc0ea6"
      },
      "unsafe_control": {
        "retained_capabilities": "000001ffffffffff",
        "remount_succeeded": true,
        "unmount_succeeded": true,
        "parent_bind_succeeded": true,
        "dummy_source_changed": true
      },
      "hardened_child": {
        "capability_sets_zero": true,
        "no_new_privs": true,
        "seccomp_filter": true,
        "ordinary_child_allowed": true,
        "direct_writes_denied": true,
        "replacement_denied": true,
        "remount_unmount_denied": true,
        "namespace_entry_creation_denied": true,
        "uid_change_denied": true,
        "alternate_parent_bind_denied": true,
        "dummy_source_unchanged": true
      },
      "dummy_sdk": {
        "schema_version": 1,
        "result": "pass",
        "auth_cases": [
          {
            "scenario": "expired",
            "result": "blocked",
            "refresh_callbacks": 0,
            "to_auth_calls": 0,
            "credential_store": {
              "reads": 1,
              "lists": 0,
              "modify_denials": 1,
              "delete_denials": 0
            },
            "persistence_operations": 0,
            "source_unchanged": true
          },
          {
            "scenario": "near_expiry",
            "result": "blocked",
            "refresh_callbacks": 0,
            "to_auth_calls": 0,
            "credential_store": {
              "reads": 1,
              "lists": 0,
              "modify_denials": 1,
              "delete_denials": 0
            },
            "persistence_operations": 0,
            "source_unchanged": true
          },
          {
            "scenario": "unexpired",
            "result": "resolved",
            "refresh_callbacks": 0,
            "to_auth_calls": 1,
            "credential_store": {
              "reads": 1,
              "lists": 0,
              "modify_denials": 0,
              "delete_denials": 0
            },
            "persistence_operations": 0,
            "source_unchanged": true
          }
        ],
        "sdk_worker": {
          "active_tools": [
            "read"
          ],
          "in_memory_session": true,
          "event_count": 28,
          "event_sha256": "4d88a64f3f2e980c39db47e1b368c03bb3155ad7408e9b6b574b15a4eeeda780",
          "read_audit": {
            "read_count": 1,
            "project_read_count": 1,
            "project_read_paths": [
              "/tmp/factory-cp06-DUMMY-sdk-tnUFPj/DUMMY-worker/DUMMY-original.md"
            ],
            "rejected_read_paths": [],
            "other_tool_calls": [],
            "other_tool_completions": [],
            "completed_successfully": true,
            "exact_original": true,
            "expected_sha256": "de2a93a26588002754bceb3bab5578cf51ff5882e1c40e31a55ae6b00abf63d0",
            "returned_sha256": "de2a93a26588002754bceb3bab5578cf51ff5882e1c40e31a55ae6b00abf63d0",
            "returned_bytes": 117,
            "tool_call_id": "DUMMY-read",
            "start_event_index": 13,
            "end_event_index": 14,
            "response_event_index": 24
          },
          "refresh_callbacks": 0,
          "credential_store": {
            "reads": 203,
            "lists": 1,
            "modify_denials": 0,
            "delete_denials": 0
          }
        },
        "actual_sdk_outcomes": {
          "fixture_origin": true,
          "semantic_acceptance": false,
          "cases": [
            {
              "scenario": "valid",
              "exit_code": 0,
              "expected_exit_code": 0,
              "fixture_origin": true,
              "default_storage": 0,
              "network": 0,
              "refresh": 0,
              "to_auth": 3,
              "runtime_create": 1,
              "exit": 0,
              "source_unchanged": true,
              "read_audit": {
                "read_count": 1,
                "project_read_count": 1,
                "project_read_paths": [
                  "/tmp/factory-cp06-DUMMY-outcome-1k8yXV/docs/AUTH.md"
                ],
                "rejected_read_paths": [],
                "other_tool_calls": [],
                "other_tool_completions": [],
                "completed_successfully": true,
                "exact_original": true,
                "expected_sha256": "2f7733986416d852649ea440d39e26184f712fecdbd5daae3f19cb9d9a47837b",
                "returned_sha256": "2f7733986416d852649ea440d39e26184f712fecdbd5daae3f19cb9d9a47837b",
                "returned_bytes": 117,
                "tool_call_id": "DUMMY-actual-worker-read",
                "start_event_index": 12,
                "end_event_index": 13,
                "response_event_index": 47
              }
            },
            {
              "scenario": "empty-gap",
              "exit_code": 75,
              "expected_exit_code": 75,
              "fixture_origin": true,
              "default_storage": 0,
              "network": 0,
              "refresh": 0,
              "to_auth": 3,
              "runtime_create": 1,
              "exit": 75,
              "source_unchanged": true
            },
            {
              "scenario": "missing-gap",
              "exit_code": 75,
              "expected_exit_code": 75,
              "fixture_origin": true,
              "default_storage": 0,
              "network": 0,
              "refresh": 0,
              "to_auth": 3,
              "runtime_create": 1,
              "exit": 75,
              "source_unchanged": true
            },
            {
              "scenario": "contradictory-gap",
              "exit_code": 75,
              "expected_exit_code": 75,
              "fixture_origin": true,
              "default_storage": 0,
              "network": 0,
              "refresh": 0,
              "to_auth": 3,
              "runtime_create": 1,
              "exit": 75,
              "source_unchanged": true
            },
            {
              "scenario": "expired",
              "exit_code": 75,
              "expected_exit_code": 75,
              "fixture_origin": true,
              "default_storage": 0,
              "network": 0,
              "refresh": 0,
              "to_auth": 0,
              "runtime_create": 0,
              "exit": 75,
              "source_unchanged": true
            },
            {
              "scenario": "near-expiry",
              "exit_code": 75,
              "expected_exit_code": 75,
              "fixture_origin": true,
              "default_storage": 0,
              "network": 0,
              "refresh": 0,
              "to_auth": 0,
              "runtime_create": 0,
              "exit": 75,
              "source_unchanged": true
            },
            {
              "scenario": "timeout",
              "exit_code": 70,
              "expected_exit_code": 70,
              "fixture_origin": true,
              "default_storage": 0,
              "network": 0,
              "refresh": 0,
              "to_auth": 2,
              "runtime_create": 1,
              "exit": 70,
              "source_unchanged": true
            }
          ]
        },
        "fixture_origin": true,
        "semantic_acceptance": false,
        "network_calls": 0
      }
    },
    "source_and_target_distinct_read_only_mounts": true,
    "evaluated_child_capabilities": "all sets empty",
    "evaluated_child_no_new_privs": true,
    "evaluated_child_seccomp": true,
    "credential_store": "injected callback-denying read-only CredentialStore",
    "oauth_preflight": {
      "minimum_validity_ms": 900000,
      "remaining_validity_ms": 861528448,
      "refreshed": false
    },
    "credential_store_audit": {
      "reads": 4,
      "lists": 0,
      "modify_denials": 0,
      "delete_denials": 0
    },
    "credential_source_unchanged": true,
    "cleanup": "pass",
    "destructive_real_source_probe": false,
    "raw_transcript_retained": false
  },
  "event_stream": {
    "sha256": "5d180ed3e0cbb947ed77178d389769561d70c1a945eb21e18aa567c7013d803e",
    "event_count": 266,
    "read_audit": {
      "read_count": 1,
      "project_read_count": 1,
      "project_read_paths": [
        "/home/ansh/.treehouse/Factory-86709f/13/Factory/.factory/state/n/h/.no-mistakes/worktrees/212160a2e779/01M3VRTZ4TD8H2RVDX7FCHS6D2/.factory/state/cp06-correction/ten-pack/repo/docs/AUTH.md"
      ],
      "rejected_read_paths": [],
      "other_tool_calls": [],
      "other_tool_completions": [],
      "completed_successfully": true,
      "exact_original": true,
      "expected_sha256": "353572470edee8e83c022c1ce763d05bfa3e628a77fb5c42fc1b1eb91491abd1",
      "returned_sha256": "353572470edee8e83c022c1ce763d05bfa3e628a77fb5c42fc1b1eb91491abd1",
      "returned_bytes": 276,
      "tool_call_id": "call_CKYPMBXvCaCQxXs8F6dD6H84|fc_0b12d04fc4fa0195016abe5bcc859087d0a6d95736f13d880c",
      "start_event_index": 92,
      "end_event_index": 93,
      "response_event_index": 262
    }
  },
  "command": "Pi 0.85.1 createAgentSession({modelRuntime: injectedReadOnlyRuntime, tools: ['read'], inMemorySession}) inside capability-free seccomp child",
  "exit_code": 0,
  "response_sha256": "e0e9397f7b91a24b7174ef060fbc69fe34229083e8560cf0e615fc3fd1ab43fa",
  "response": {
    "status": "MISSING_SOURCE",
    "missing_source": "docs/AUTH.md",
    "reads": [
      "/home/ansh/.treehouse/Factory-86709f/13/Factory/.factory/state/n/h/.no-mistakes/worktrees/212160a2e779/01M3VRTZ4TD8H2RVDX7FCHS6D2/.factory/state/cp06-correction/ten-pack/repo/docs/AUTH.md"
    ],
    "corrected_constraints": [
      "Ownership comes only from the authenticated principal; request-supplied owner fields are ignored."
    ],
    "evidence_gaps": [
      {
        "id": "creation-time-ownership",
        "status": "unverified",
        "missing_checks": [
          "principal-derived-owner",
          "request-owner-ignored"
        ]
      }
    ],
    "broad_scan": false
  },
  "result": "pass",
  "limitation": "Live model wording is nondeterministic. The proof runner is Linux x86-64 only and exits blocked before credential access/provider use when user/mount namespaces, libseccomp, exact Pi 0.85.1, or adequate unexpired OAuth validity are unavailable."
}

Evidence: STANDARD ten-pack evidence manifest (local file: /home/ansh/.treehouse/Factory-86709f/13/Factory/.factory/state/n/h/.no-mistakes/evidence/01M3VRTZ4TD8H2RVDX7FCHS6D2/cp06-ten-pack-evidence.json)

Evidence: P-07 evidence manifest

{
  "schema_version": 1,
  "gate": "P-07",
  "tested_sha": "6b9b6e2e8b4ef11f48fb2ef0f3d09fd021692289",
  "recorded_at": "2026-10-01T13:10:08.503Z",
  "reviewer": "Pi CP-06 correction worker",
  "finding": {
    "path": "test/fixtures/workflow/history/finding.json",
    "sha256": "ac96d7c6100b3c163e0721af0e3b8706ec8718ae07308f120db0ba1e3e8cb059",
    "record": {
      "schema_version": 1,
      "finding_id": "P07-MALFORMED-JSON",
      "acceptance_id": "P-07",
      "reviewer": "CP-06 simulated task reviewer",
      "scenario": "PUT /v1/profile receives malformed JSON",
      "finding": "The normal API fixture throws SyntaxError instead of returning the stable 400 invalid_json response.",
      "disposition": "repaired",
      "repair": "Catch parse failure and return status 400 with error invalid_json.",
      "retest": "Execute the same malformed-JSON behavioral assertion against the checked-in final fixture."
    }
  },
  "sequence": [
    {
      "id": "build",
      "command": "npm run build",
      "expected_exit_code": 0,
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/p07/raw/build.txt",
      "output_sha256": "665ce072dffd18b1720107dc8ea47cd800e604fb62ea3164ec087fef5517c632",
      "expected_output_fragments": []
    },
    {
      "id": "fail-before",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node test/fixtures/workflow/history/malformed-json-probe.mjs",
      "expected_exit_code": 1,
      "exit_code": 1,
      "output_path": ".factory/state/cp06-correction/p07/raw/fail-before.txt",
      "output_sha256": "ac4fbaa73e23b6feee043e60128d9b87a9c4e7921365ed297278177ad88ab9ef",
      "expected_output_fragments": [
        "SyntaxError",
        "not valid JSON"
      ]
    },
    {
      "id": "fix-after",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node --test \"--test-name-pattern=normal API fixture rejects malformed\" dist/test/workflow.test.js",
      "expected_exit_code": 0,
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/p07/raw/fix-after.txt",
      "output_sha256": "16a23a0464ab49b2ae3c82cfe0e6a5dc06789cd8852429c395e7cb63ed444296",
      "expected_output_fragments": []
    },
    {
      "id": "critical-auth-retest",
      "command": "/home/ansh/.nvm/versions/node/v24.20.0/bin/node --test \"--test-name-pattern=critical auth fixture\" dist/test/workflow.test.js",
      "expected_exit_code": 0,
      "exit_code": 0,
      "output_path": ".factory/state/cp06-correction/p07/raw/critical-auth-retest.txt",
      "output_sha256": "0df99e688303276f646af1c14850b3a5175f105136642f8b466904875d8972d2",
      "expected_output_fragments": []
    }
  ],
  "result": "pass",
  "limitations": [
    "Behavioral fixtures are in-memory and make no network or real-account access.",
    "The historical module is a minimal retained reproduction, not a raw worker transcript."
  ]
}

Evidence: Auth security evidence manifest

{
  "schema_version": 1,
  "gate": "CP-06-read-only-auth-security",
  "result": "pass",
  "tested_sha": "6b9b6e2e8b4ef11f48fb2ef0f3d09fd021692289",
  "recorded_at": "2026-10-01T13:08:32.217Z",
  "reviewer": "Pi CP-06 read-only auth correction worker",
  "command": "npm run proof:cp06:auth-security",
  "exit_code": 0,
  "pi_version": "0.85.1",
  "platform": {
    "os": "linux",
    "architecture": "x64",
    "kernel": "6.18.33.2-microsoft-standard-WSL2",
    "user_mount_namespace": true,
    "libseccomp": true
  },
  "binaries": {
    "seccomp_helper_sha256": "6cf5e17fdb9ecb82b1575827f607267b394df3380d7a4398f2ef919acd2db628",
    "syscall_probe_sha256": "7460c690b25199725bdf6e1907b01c258db9c0ac63e5f344b80e9ae2c3bc0ea6"
  },
  "unsafe_control": {
    "retained_capabilities": "000001ffffffffff",
    "remount_succeeded": true,
    "unmount_succeeded": true,
    "parent_bind_succeeded": true,
    "dummy_source_changed": true
  },
  "hardened_child": {
    "capability_sets_zero": true,
    "no_new_privs": true,
    "seccomp_filter": true,
    "ordinary_child_allowed": true,
    "direct_writes_denied": true,
    "replacement_denied": true,
    "remount_unmount_denied": true,
    "namespace_entry_creation_denied": true,
    "uid_change_denied": true,
    "alternate_parent_bind_denied": true,
    "dummy_source_unchanged": true
  },
  "dummy_sdk": {
    "schema_version": 1,
    "result": "pass",
    "auth_cases": [
      {
        "scenario": "expired",
        "result": "blocked",
        "refresh_callbacks": 0,
        "to_auth_calls": 0,
        "credential_store": {
          "reads": 1,
          "lists": 0,
          "modify_denials": 1,
          "delete_denials": 0
        },
        "persistence_operations": 0,
        "source_unchanged": true
      },
      {
        "scenario": "near_expiry",
        "result": "blocked",
        "refresh_callbacks": 0,
        "to_auth_calls": 0,
        "credential_store": {
          "reads": 1,
          "lists": 0,
          "modify_denials": 1,
          "delete_denials": 0
        },
        "persistence_operations": 0,
        "source_unchanged": true
      },
      {
        "scenario": "unexpired",
        "result": "resolved",
        "refresh_callbacks": 0,
        "to_auth_calls": 1,
        "credential_store": {
          "reads": 1,
          "lists": 0,
          "modify_denials": 0,
          "delete_denials": 0
        },
        "persistence_operations": 0,
        "source_unchanged": true
      }
    ],
    "sdk_worker": {
      "active_tools": [
        "read"
      ],
      "in_memory_session": true,
      "event_count": 27,
      "event_sha256": "914762fcf8fa466aad149cc106cec5b2ab4f8851709efb8a6b426fbd7ddda473",
      "read_audit": {
        "read_count": 1,
        "project_read_count": 1,
        "project_read_paths": [
          "/tmp/factory-cp06-DUMMY-sdk-k2u9tG/DUMMY-worker/DUMMY-original.md"
        ],
        "rejected_read_paths": [],
        "other_tool_calls": [],
        "other_tool_completions": [],
        "completed_successfully": true,
        "exact_original": true,
        "expected_sha256": "de2a93a26588002754bceb3bab5578cf51ff5882e1c40e31a55ae6b00abf63d0",
        "returned_sha256": "de2a93a26588002754bceb3bab5578cf51ff5882e1c40e31a55ae6b00abf63d0",
        "returned_bytes": 117,
        "tool_call_id": "DUMMY-read",
        "start_event_index": 13,
        "end_event_index": 14,
        "response_event_index": 23
      },
      "refresh_callbacks": 0,
      "credential_store": {
        "reads": 203,
        "lists": 1,
        "modify_denials": 0,
        "delete_denials": 0
      }
    },
    "actual_sdk_outcomes": {
      "fixture_origin": true,
      "semantic_acceptance": false,
      "cases": [
        {
          "scenario": "valid",
          "exit_code": 0,
          "expected_exit_code": 0,
          "fixture_origin": true,
          "default_storage": 0,
          "network": 0,
          "refresh": 0,
          "to_auth": 3,
          "runtime_create": 1,
          "exit": 0,
          "source_unchanged": true,
          "read_audit": {
            "read_count": 1,
            "project_read_count": 1,
            "project_read_paths": [
              "/tmp/factory-cp06-DUMMY-outcome-dc6y7i/docs/AUTH.md"
            ],
            "rejected_read_paths": [],
            "other_tool_calls": [],
            "other_tool_completions": [],
            "completed_successfully": true,
            "exact_original": true,
            "expected_sha256": "2f7733986416d852649ea440d39e26184f712fecdbd5daae3f19cb9d9a47837b",
            "returned_sha256": "2f7733986416d852649ea440d39e26184f712fecdbd5daae3f19cb9d9a47837b",
            "returned_bytes": 117,
            "tool_call_id": "DUMMY-actual-worker-read",
            "start_event_index": 12,
            "end_event_index": 13,
            "response_event_index": 50
          }
        },
        {
          "scenario": "empty-gap",
          "exit_code": 75,
          "expected_exit_code": 75,
          "fixture_origin": true,
          "default_storage": 0,
          "network": 0,
          "refresh": 0,
          "to_auth": 3,
          "runtime_create": 1,
          "exit": 75,
          "source_unchanged": true
        },
        {
          "scenario": "missing-gap",
          "exit_code": 75,
          "expected_exit_code": 75,
          "fixture_origin": true,
          "default_storage": 0,
          "network": 0,
          "refresh": 0,
          "to_auth": 3,
          "runtime_create": 1,
          "exit": 75,
          "source_unchanged": true
        },
        {
          "scenario": "contradictory-gap",
          "exit_code": 75,
          "expected_exit_code": 75,
          "fixture_origin": true,
          "default_storage": 0,
          "network": 0,
          "refresh": 0,
          "to_auth": 3,
          "runtime_create": 1,
          "exit": 75,
          "source_unchanged": true
        },
        {
          "scenario": "expired",
          "exit_code": 75,
          "expected_exit_code": 75,
          "fixture_origin": true,
          "default_storage": 0,
          "network": 0,
          "refresh": 0,
          "to_auth": 0,
          "runtime_create": 0,
          "exit": 75,
          "source_unchanged": true
        },
        {
          "scenario": "near-expiry",
          "exit_code": 75,
          "expected_exit_code": 75,
          "fixture_origin": true,
          "default_storage": 0,
          "network": 0,
          "refresh": 0,
          "to_auth": 0,
          "runtime_create": 0,
          "exit": 75,
          "source_unchanged": true
        },
        {
          "scenario": "timeout",
          "exit_code": 70,
          "expected_exit_code": 70,
          "fixture_origin": true,
          "default_storage": 0,
          "network": 0,
          "refresh": 0,
          "to_auth": 2,
          "runtime_create": 1,
          "exit": 70,
          "source_unchanged": true
        }
      ]
    },
    "fixture_origin": true,
    "semantic_acceptance": false,
    "network_calls": 0
  }
}

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

🚨 scripts/cp06-worker-audit.mjs:9 - Intent requires preserving canonical source identity, and the prior user-selected fix required missing_source to be exactly docs/AUTH.md, but this resolver check still accepts any equivalent path. With referenceRoot set to the fixture root, ./docs/AUTH.md passes; an absolute fixture path also passes because path.resolve(referenceRoot, absolutePath) returns the absolute path. Compare the reported value exactly to docs/AUTH.md at the outcome boundary and add the requested negative cases.

🔧 Fix: Enforce canonical missing source identity
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

git status --short && git rev-parse HEAD && ls
npm ci
node --test test/cp06-worker-audit.test.mjs test/cp06-worker-outcome.test.mjs test/cp06-worker-lifecycle.test.mjs test/cp06-readonly-credentials.test.mjs test/cp06-credential-isolation.test.mjs
npm run proof:cp06:worker initial attempt before ten-pack generation, then rerun after ten-pack generation
npm run proof:cp06:worker-cleanup
npm run proof:cp06:auth-security
npm run proof:cp06:ten-pack
npm run proof:cp06:p07

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

Factory Maintainer and others added 20 commits September 28, 2026 19:13

feat(cp06): add risk-aware Pi review workflow

90ae0ef

docs(cp06): record review workflow exercise

75fed66

no-mistakes(document): Format workflow documentation table

8b945a4

fix(cp06): constrain context to task authority

8da6746

no-mistakes(review): Harden CP-06 replay evidence

461dea5

test(cp06): require successful bad-path retrieval

355854f

no-mistakes(document): Format changed documentation

cdaf5e5

fix(cp06): close final review gaps

cf10d9b

no-mistakes(review): Enforce scoped CTX provenance

c3eb0b7

fix(cp06): enforce isolated worker credential reads

6d02e46

no-mistakes(review): Harden CP-06 credential isolation

385b80e

fix(cp06): harden read-only Pi authentication

752152e

no-mistakes(review): Clarify CP-06 WSL2 proof limits

b835733

no-mistakes(review): Cover source destructive isolation attacks

2ec7c26

no-mistakes(test): Restore offline CTX model lookup

2e36a8f

no-mistakes(document): Document CP-06 auth-security proof

3abaa43

no-mistakes(review): Enforce exact original read arguments

33b2724

fix(cp06): enforce worker outcome and cleanup

641d7ca

no-mistakes(review): Enforce canonical missing source identity

6b9b6e2

no-mistakes(document): Document cleanup proof evidence

9491626

0xnotdev merged commit 9491626 into main Oct 6, 2026
2 checks passed

Navigation Menu

Repository navigation

fix(core): constrain CP-06 context and worker recovery - #12

fix(core): constrain CP-06 context and worker recovery#12
0xnotdev merged 20 commits into
mainfrom
fm/factory-cp06-a1-c1-recovery

0xnotdev commented Oct 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

0xnotdev commented Oct 1, 2026

Intent

What Changed

Risk Assessment

Testing

Pipeline

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant