E2.2: close private descriptors and bind protected code by omry · Pull Request #303 · omry/reploy

omry · 2026-10-29T16:20:44Z

Require exact, fresh protected-code and sandbox observations before releasing mapped startup. Refuse missing, stale or shadowed executable/dependency evidence through the existing effect owner.

Prove the shipped Go descriptor-close/exec tail with retained identity-based canaries and rejection controls. Preserve public mapped activation guards; production F observations and effective seccomp remain later gates.

Validation: full local CI, focused startup checks, detector mutation controls,111 retained actual-binary qualification cases, ARM64 compile, and full current-agent plus fresh independent Sol review.

Require exact, fresh protected-code and sandbox observations before releasing mapped startup. Refuse missing, stale or shadowed executable/dependency evidence through the existing effect owner. Prove the shipped Go descriptor-close/exec tail with retained identity-based canaries and rejection controls. Preserve public mapped activation guards; production F observations and effective seccomp remain later gates. Validation: full local CI, focused startup checks, detector mutation controls,111 retained actual-binary qualification cases, ARM64 compile, and full current-agent plus fresh independent Sol review.

gitar-bot · 2026-10-29T16:21:47Z

Code Review ✅ Approved

🔴 High risk · Requiring fresh protected-code and mount proofs before mapped startup changes a security gate; flawed observations could permit shadowed executable code or block launches.

Requires exact, fresh protected-code and sandbox observations before releasing mapped startup, refusing missing, stale, or shadowed executable and dependency evidence through the existing effect owner. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

omry · 2026-10-29T16:25:34Z

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)

{
  "approval": {
    "candidate_revision_fingerprint": "sha256:f384e36bf0efbec83ee625157086c998f696a49c1a795ebbb05e38fb0dc4c3f3",
    "evidence": {
      "attestations": [],
      "candidate_revision_fingerprint": "sha256:f384e36bf0efbec83ee625157086c998f696a49c1a795ebbb05e38fb0dc4c3f3",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 123588960202
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 123577391124
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 123577389014
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 123577389680
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 123577389534
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 123577389253
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 123577389541
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 123577389495
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 123577389672
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "operation_identity": "sha256:72a51b1bc19bc3e7ca454fc56887c994d78e9523b8b025bb1179a2e73916fe64",
      "review_request": {
        "body_digest": "sha256:52708d9cf661bafcc18d0408316942aca14b361d2e8379be2c55729a6167bdf0",
        "id": 6502403478
      },
      "review_result": {
        "body_digest": "sha256:a546b5691d564b442144f894dc2018568a2189be362c75b6e45ce29f6496c4ad",
        "id": 6502445653
      }
    },
    "evidence_fingerprint": "sha256:3e278aa76eaac74d86ac9b9aaa19c1c7d1782f34e8c0eaa5cb09176de6fc7c44",
    "head_sha": "9ce81ef698e0882e6b9559e49ee1bfd8443b1fde",
    "operation_identity": "sha256:72a51b1bc19bc3e7ca454fc56887c994d78e9523b8b025bb1179a2e73916fe64",
    "review_request_id": 6502403478,
    "review_result_id": 6502445653,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:f384e36bf0efbec83ee625157086c998f696a49c1a795ebbb05e38fb0dc4c3f3",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Bash native evidence checks",
      "run_id": 123588960202
    },
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 123577391124
    },
    {
      "conclusion": "SUCCESS",
      "name": "Linux CI checks",
      "run_id": 123577389014
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-amd64)",
      "run_id": 123577389680
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-arm64)",
      "run_id": 123577389534
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-amd64)",
      "run_id": 123577389253
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-arm64)",
      "run_id": 123577389541
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-amd64)",
      "run_id": 123577389495
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-arm64)",
      "run_id": 123577389672
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 123588960202,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40910652388/job/123588960202"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 123577391124,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/123577391124"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 123577389014,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40910652388/job/123577389014"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 123577389680,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40910652388/job/123577389680"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 123577389534,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40910652388/job/123577389534"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 123577389253,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40910652388/job/123577389253"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 123577389541,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40910652388/job/123577389541"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 123577389495,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40910652388/job/123577389495"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 123577389672,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40910652388/job/123577389672"
        }
      ],
      "head_sha": "9ce81ef698e0882e6b9559e49ee1bfd8443b1fde",
      "id": "sha256:af047d1d034ec1766372a1a866609ed77d9226eabb44ede255484fc60e883d35",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [],
  "pr": {
    "base_ref": "pr302",
    "base_sha": "4d219abf3d30cce50caedd8b337a160e8456b4ad",
    "body_digest": "sha256:f111bbc8387f63b7f105793a66db6c7c9a66239d94ab73d947782d79bb1289e4",
    "body_identity_version": 2,
    "diff_digest": "sha256:f6836226cc6f4c279eb35783c1535564e5c5f74e4b670ebcf138ae9a250d93b2",
    "head_ref": "pr303",
    "head_sha": "9ce81ef698e0882e6b9559e49ee1bfd8443b1fde",
    "pr": 303,
    "repository": "omry/reploy",
    "scope_authority": [
      {
        "digest": "sha256:078e63e84d432c2aad03120ca30e40ec4572a8970e6bf6be9d5008608a30f435",
        "path": "docs/MULTI_IDENTITY_D_DESIGN.md"
      },
      {
        "digest": "sha256:ab5e9be8075947bc37c863545efb1959fa7aca886226018729bfeff6f7032e1e",
        "path": "docs/MULTI_IDENTITY_E_DESIGN.md"
      },
      {
        "digest": "sha256:3ef44a7a0be43648f5df1faad39b16101978662c58c87d6fa8e7409093a58fe9",
        "path": "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"
      },
      {
        "digest": "sha256:fe188bb8a80f7f235e99b023283749a3a9e3172e4adf70b70b495d80e50e9218",
        "path": "docs/MULTI_IDENTITY_MAIL_RECONCILIATION.md"
      },
      {
        "digest": "sha256:b049714f4a85d0f3fb204615897374377690564627bfcdd03e50c945fb042826",
        "path": "docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"
      }
    ],
    "title_digest": "sha256:b4353cfb497b14edbc2676728d79b98c202702826ba0a5d47c9ec244b4b651db"
  },
  "record_version": 4,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-29T16:20:47Z",
      "base_ref": "pr302",
      "base_sha": "4d219abf3d30cce50caedd8b337a160e8456b4ad",
      "body_digest": "sha256:52708d9cf661bafcc18d0408316942aca14b361d2e8379be2c55729a6167bdf0",
      "created_at": "2026-10-29T16:29:28Z",
      "head_sha": "9ce81ef698e0882e6b9559e49ee1bfd8443b1fde",
      "id": 6502403478,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr302",
      "base_sha": "4d219abf3d30cce50caedd8b337a160e8456b4ad",
      "body_digest": "sha256:a546b5691d564b442144f894dc2018568a2189be362c75b6e45ce29f6496c4ad",
      "commit_id": "9ce81ef698e0882e6b9559e49ee1bfd8443b1fde",
      "id": 6502445653,
      "inline_message_ids": [],
      "request_comment_id": 6502403478,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-29T16:31:18Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:f384e36bf0efbec83ee625157086c998f696a49c1a795ebbb05e38fb0dc4c3f3",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:f6836226cc6f4c279eb35783c1535564e5c5f74e4b670ebcf138ae9a250d93b2",
      "finding_ids": [],
      "invariants": [
        "Private file, directory, socket, pidfd, high-fd and concurrent canaries do not cross the shipped exec tail.",
        "Mapped release requires fresh exact protected-code/dependency and sandbox observations; missing, stale or shadowed proof refuses.",
        "Public mapped guards remain closed; F observations, effective-policy and live runtime qualification remain later gates.",
        "Every exact-head ci.yml job must succeed before approval."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "9ce81ef698e0882e6b9559e49ee1bfd8443b1fde",
      "review_observation_id": null,
      "review_request_id": 6502403478,
      "review_result_id": 6502445653,
      "reviewed_head": "9ce81ef698e0882e6b9559e49ee1bfd8443b1fde",
      "root_cause": "No source defect found. Independent and remote reviews were clean; exact-head local validation and all nine observed checks passed. Initial collector rejected changing snapshots; one read-only recovery within its original deadline obtained stable success.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

chatgpt-codex-connector · 2026-10-29T16:27:01Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T16:31:19.409321Z	`9ce81ef`	Manual request
🔒 Security Review	✅ Completed 2026-10-29T16:29:23.567694Z	`9ce81ef`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

omry · 2026-10-29T16:29:28Z

@codex review

Exact head: 9ce81ef

chatgpt-codex-connector · 2026-10-29T16:31:18Z

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 9ce81ef698

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry changed the base branch from main to pr302 October 29, 2026 16:20

omry added this pull request to stack #297 October 29, 2026 16:21

omry marked this pull request as ready for review October 29, 2026 16:26

omry added the approved PR reviewed and approved label Oct 29, 2026

omry merged commit 944d564 into main Oct 30, 2026
9 checks passed

omry deleted the pr303 branch October 30, 2026 05:47

Navigation Menu

Repository navigation

E2.2: close private descriptors and bind protected code - #303

E2.2: close private descriptors and bind protected code#303
omry merged 1 commit into
pr302from
pr303

omry commented Oct 29, 2026 •

edited

Loading

Uh oh!

gitar-bot Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

omry commented Oct 29, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

omry commented Oct 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 29, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

omry commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitar-bot Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omry commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

omry commented Oct 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 29, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

omry commented Oct 29, 2026 •

edited

Loading

gitar-bot Bot commented Oct 29, 2026 •

edited

Loading

omry commented Oct 29, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 29, 2026 •

edited

Loading