E3.2: Refuse unqualified occupied exec by omry · Pull Request #312 · omry/reploy

omry · 2026-10-30T19:53:32Z

Distinguish fresh-instance, occupied-container and host-native entry using a closed private mode and the existing locked owner state. Refuse unqualified mapped occupied and host-native requests before runtime effects, while preserving ordinary execution and the broad public mapped guards. Fresh classification grants no admission or fallback.

Retain an owned same-UID peer and private file, directory, socket, pidfd and high-descriptor test surfaces for future transition proposals. The harness verifies current refusal and cleanup; it does not qualify live occupied exec or proc/ptrace isolation. Final entry planning and all-controlled-entry wiring remain later E slices.

Validation: clean fresh independent full review; focused refusal/public-guard tests; Python packaging and CI-tool tests; targeted Go vet; complete shipping/conformance Go package tests; linux-amd64 build and CLI smoke. Retained WSL ordinary-tmpfs exclusion and explicit Docker skip apply. Exact-head remote CI and PR review remain required.

Distinguish fresh-instance, occupied-container and host-native entry using a closed private mode and the existing locked owner state. Refuse unqualified mapped occupied and host-native requests before runtime effects, while preserving ordinary execution and the broad public mapped guards. Fresh classification grants no admission or fallback. Retain an owned same-UID peer and private file, directory, socket, pidfd and high-descriptor test surfaces for future transition proposals. The harness verifies current refusal and cleanup; it does not qualify live occupied exec or proc/ptrace isolation. Final entry planning and all-controlled-entry wiring remain later E slices. Validation: clean fresh independent full review; focused refusal/public-guard tests; Python packaging and CI-tool tests; targeted Go vet; complete shipping/conformance Go package tests; linux-amd64 build and CLI smoke. Retained WSL ordinary-tmpfs exclusion and explicit Docker skip apply. Exact-head remote CI and PR review remain required.

gitar-bot · 2026-10-30T19:55:14Z

Code Review ✅ Approved

🟢 Low risk · The private classifier preserves the existing fresh-entry guard; occupied and host-native refusals are only exercised in tests, limiting runtime impact.

Distinguishes fresh-instance, occupied-container, and host-native entry using a closed private mode and existing locked owner state, refusing unqualified occupied and host-native requests before runtime effects. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

omry · 2026-10-30T20:04:24Z

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)

{
  "approval": {
    "candidate_revision_fingerprint": "sha256:9fd4fbfe33ee246b76ed94130ab144c459733bf0749fea0189b317cb5b109c7d",
    "evidence": {
      "attestations": [],
      "candidate_revision_fingerprint": "sha256:9fd4fbfe33ee246b76ed94130ab144c459733bf0749fea0189b317cb5b109c7d",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 124288212485
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 124280302603
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 124280297525
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 124280298029
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 124280298151
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 124280297911
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 124280298068
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 124280297964
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 124280297884
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "operation_identity": "sha256:a938889833317b5d70855c1f7f9cbf8e7ab751762bb906d01b321c5d3ccca900",
      "review_request": {
        "body_digest": "sha256:d680ff08b2b8f8ce6fcb78dba2111e9e19eaf43c80db92b5db12b279781130ab",
        "id": 6532454867
      },
      "review_result": {
        "body_digest": "sha256:4dc7efc827338182d6b914bcc902b19199a8babdc2868864d98c366f20af5306",
        "id": 6532468822
      }
    },
    "evidence_fingerprint": "sha256:bd55d87e682bf695391e394938f5f2b15c5e27c0d22bc5afd21d5e719425245d",
    "head_sha": "1d43511526c3b61ed1c086e8411c98f4ab452b69",
    "operation_identity": "sha256:a938889833317b5d70855c1f7f9cbf8e7ab751762bb906d01b321c5d3ccca900",
    "review_request_id": 6532454867,
    "review_result_id": 6532468822,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:9fd4fbfe33ee246b76ed94130ab144c459733bf0749fea0189b317cb5b109c7d",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Bash native evidence checks",
      "run_id": 124288212485
    },
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 124280302603
    },
    {
      "conclusion": "SUCCESS",
      "name": "Linux CI checks",
      "run_id": 124280297525
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-amd64)",
      "run_id": 124280298029
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-arm64)",
      "run_id": 124280298151
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-amd64)",
      "run_id": 124280297911
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-arm64)",
      "run_id": 124280298068
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-amd64)",
      "run_id": 124280297964
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-arm64)",
      "run_id": 124280297884
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 124288212485,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41118923589/job/124288212485"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 124280302603,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/124280302603"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 124280297525,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41118923589/job/124280297525"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 124280298029,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41118923589/job/124280298029"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 124280298151,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41118923589/job/124280298151"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 124280297911,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41118923589/job/124280297911"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 124280298068,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41118923589/job/124280298068"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 124280297964,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41118923589/job/124280297964"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 124280297884,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41118923589/job/124280297884"
        }
      ],
      "head_sha": "1d43511526c3b61ed1c086e8411c98f4ab452b69",
      "id": "sha256:9c52bc221ee4512d273b6787a94006add538a9275a2690cfcffa743adac433c3",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [],
  "pr": {
    "base_ref": "pr311",
    "base_sha": "510519727082428ed08262650927272dc14c36b1",
    "body_digest": "sha256:93076f0ac290ff37e9134b81703770f2518202462bdb263848171356909da7eb",
    "body_identity_version": 2,
    "diff_digest": "sha256:1120ca430d204bcb5a01d6f92ea9dc1e9aca53edb000bdb6d7ca3a779ba59d83",
    "head_ref": "pr312",
    "head_sha": "1d43511526c3b61ed1c086e8411c98f4ab452b69",
    "pr": 312,
    "repository": "omry/reploy",
    "scope_authority": [
      {
        "digest": "sha256:078e63e84d432c2aad03120ca30e40ec4572a8970e6bf6be9d5008608a30f435",
        "path": "docs/MULTI_IDENTITY_D_DESIGN.md"
      },
      {
        "digest": "sha256:f5058bb465d6af9d58b98eb6fde19edd4ed710aff1cc2588173757d37cdbbc58",
        "path": "docs/MULTI_IDENTITY_E_DESIGN.md"
      },
      {
        "digest": "sha256:3ef44a7a0be43648f5df1faad39b16101978662c58c87d6fa8e7409093a58fe9",
        "path": "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"
      },
      {
        "digest": "sha256:fe188bb8a80f7f235e99b023283749a3a9e3172e4adf70b70b495d80e50e9218",
        "path": "docs/MULTI_IDENTITY_MAIL_RECONCILIATION.md"
      },
      {
        "digest": "sha256:b049714f4a85d0f3fb204615897374377690564627bfcdd03e50c945fb042826",
        "path": "docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"
      }
    ],
    "title_digest": "sha256:688b6cc49a1f0bc15c3069b57f9c6a1d002fa7c923617a9d00f1e2e8996e04de"
  },
  "record_version": 4,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-30T19:53:34Z",
      "base_ref": "pr311",
      "base_sha": "510519727082428ed08262650927272dc14c36b1",
      "body_digest": "sha256:d680ff08b2b8f8ce6fcb78dba2111e9e19eaf43c80db92b5db12b279781130ab",
      "created_at": "2026-10-30T20:08:26Z",
      "head_sha": "1d43511526c3b61ed1c086e8411c98f4ab452b69",
      "id": 6532454867,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr311",
      "base_sha": "510519727082428ed08262650927272dc14c36b1",
      "body_digest": "sha256:4dc7efc827338182d6b914bcc902b19199a8babdc2868864d98c366f20af5306",
      "commit_id": "1d43511526c3b61ed1c086e8411c98f4ab452b69",
      "id": 6532468822,
      "inline_message_ids": [],
      "request_comment_id": 6532454867,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-30T20:09:17Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:9fd4fbfe33ee246b76ed94130ab144c459733bf0749fea0189b317cb5b109c7d",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:1120ca430d204bcb5a01d6f92ea9dc1e9aca53edb000bdb6d7ca3a779ba59d83",
      "finding_ids": [],
      "invariants": [
        "Closed entry modes refuse occupied mapped and host-native mapped entry without fallback.",
        "Public mapped activation remains inhibited.",
        "Fresh clean remote review, full six local validations and every ci.yml job passed at exact head."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "1d43511526c3b61ed1c086e8411c98f4ab452b69",
      "review_observation_id": null,
      "review_request_id": 6532454867,
      "review_result_id": 6532468822,
      "reviewed_head": "1d43511526c3b61ed1c086e8411c98f4ab452b69",
      "root_cause": "No review findings or corrections. The unchanged private entry refusal candidate passed independent review and current PR validation.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

chatgpt-codex-connector · 2026-10-30T20:04:56Z

The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins.

omry · 2026-10-30T20:08:26Z

@codex review

Exact head: 1d43511

chatgpt-codex-connector · 2026-10-30T20:08:43Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T20:09:18.517294Z	`1d43511`	Manual request
🔒 Security Review	⚠️ Failed 2026-10-30T20:04:54.199330Z We couldn’t complete this review. Comment `@codex security review` to try again.	`1d43511`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-10-30T20:09:17Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 1d43511526

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry changed the base branch from main to pr311 October 30, 2026 19:53

omry added this pull request to stack #308 October 30, 2026 19:53

omry marked this pull request as ready for review October 30, 2026 20:04

omry added the approved PR reviewed and approved label Oct 30, 2026

This was referenced Oct 30, 2026

E4.1.1: Construct the final entry plan #313

Open

E3.1.1: Own mapped instance completion #314

Open

Navigation Menu

Repository navigation

E3.2: Refuse unqualified occupied exec - #312

E3.2: Refuse unqualified occupied exec#312
omry wants to merge 1 commit into
pr311from
pr312

omry commented Oct 30, 2026 •

edited

Loading

Uh oh!

gitar-bot Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

omry commented Oct 30, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

omry commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

omry commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitar-bot Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omry commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

omry commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

omry commented Oct 30, 2026 •

edited

Loading

gitar-bot Bot commented Oct 30, 2026 •

edited

Loading

omry commented Oct 30, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 30, 2026 •

edited

Loading