feat: add Proof Before Action evidence workflow

[saagpatel]

Summary

Adds Proof Before Action as a local-first MCPAudit product surface. It runs a caller-supplied command as an unprivileged, capability-free user inside a disposable Docker observer, compares observed effects with a strict declaration, joins repository-local MCP dependencies to a read-only mcp-trust snapshot, and exports a portable JSON/offline-HTML evidence capsule.

This is evidence before action, not a general sandbox or release authority. The v1 final-state observer intentionally reports a clean final snapshot as unknown, not pass, because transient filesystem and database attempts are not traced. Persisted undeclared effects still block. No result proves container-escape resistance, macOS-native effects, exact-version applicability for unresolved dependencies, or authorization unless the capsule-index root is anchored independently.

Changes

• Adds the proof-before-action console script with inspect, verify, and versioned schema commands.
• Adds strict Pydantic contracts for declarations, observations, comparisons, trust manifests, capsules, and capsule indexes.
• Adds a disposable Docker observer with:
  • no host mounts or forwarded sockets;
  • --network=none, read-only image root, no-new-privileges, and resource/output limits;
  • a root-owned PID 1 observer limited to KILL, SETGID, SETPCAP, and SETUID, with exact Docker configuration readback;
  • the tested command running as UID/GID 65534:65534, with empty supplementary groups and all five Linux capability masks verified as zero from a root-protected runtime profile;
  • descendant termination and per-task quiescence readback before one attached workspace/evidence archive, closing the post-snapshot mutation window;
  • file, synthetic SQLite, and Linux network-counter observations;
  • deterministic cleanup of containers, staging images, and temporary roots.
• Resolves the caller's Docker reference once, then uses immutable base and committed image IDs for every tool-check, staging, and runtime step.
• Adds repository-only MCP dependency discovery and an explicit left join to mcp-trust evidence.
• Preserves unknown, stale, masked, unmatched, ambiguous, dirty, and version-unbound states instead of converting them into safety claims.
• Adds canonical JSON, escaped no-script offline HTML, artifact hashes, producer/subject commit bindings, external-root verification, and tamper detection.
• Adds threat-model, workflow, output-contract, README, changelog, and example declaration documentation.
• Restores portable local verification by using an installed system Python for macOS Seatbelt acceptance tests instead of a missing fixed path.
• Ignores only known generated local metadata during staging and distinguishes safe GitHub OIDC/persist-credentials configuration from literal credentials without weakening literal-secret blocking.
• Normalizes absolute user-home paths in recorded argv and hashes only the normalized/redacted argv.
• Uses the platform-secure temporary directory on Linux and macOS; CI prepares the local observer image before running the Docker acceptance suite.
• Treats semantic SQLite mutations as database effects during declaration comparison instead of requiring duplicate filesystem authority.
• Preserves malformed scalar/null server.json transport entries as unknown with partial-discovery diagnostics instead of raising an unstructured exception.
• Converts Docker CLI timeouts into structured inspection_blocked results, checks Docker cleanup exit codes and local temporary-root removal, and blocks otherwise-successful inspection when cleanup cannot be confirmed.
• Prevents background descendants from evading final-state observation, protects evidence from command rewrites, fixes option-like argv handling, and fails closed when command identity, capability state, task quiescence, archive collection, or cleanup cannot be confirmed.
• Downgrades every entry derived from a dirty or commit-unbound local mcp-trust source to detail-withholding unverifiable evidence, preventing modified grades from appearing current.
• Byte-compares every required mcp-trust input with the recorded trust commit, including ignored/untracked-file cases; clean status alone is insufficient authority.
• Adds an uv-backed PEP 517 provenance wrapper so clean wheels and sdists embed their exact producer revision and pre-build dirty state; installed commands consume only that metadata and cannot inherit an unrelated ancestor Git repository.
• Reports external-root mismatches as invalid and authority: unverified, reserving anchored for an actual digest match.
• Emits the environment-neutral docker provider while retaining the legacy docker-in-colima value only for v1 input compatibility; limitations describe the Docker engine and any optional VM/hypervisor as unobserved rather than asserting a runtime that was not detected.
• Validates every trust-input top-level and row shape so syntactically valid but wrong-shaped JSON produces structured unknown/unverifiable evidence instead of a traceback.
• Converts malformed declaration YAML into the documented single JSON inspection_blocked result with exit code 2 instead of leaking a parser traceback.
• Strictly type-validates nested seed identities and every grade-bearing snapshot field so malformed committed trust data degrades the complete source to UNKNOWN/unverifiable without exposing a grade.
• Rejects invalid, future, timezone-naive, or scan-preceding trust snapshot timestamps and prevents unproven network-isolation evidence from remaining current.
• Marks filesystem and database attempt coverage incomplete so create-delete, write-restore, and rolled-back transactions cannot become a false read-only claim.
• Adds IPv6 IP/UDP evidence alongside family-agnostic TCP counters, with missing or regressed required counters failing closed.
• Uses a deterministic UTC end-of-day freshness bound so valid same-day trust scans remain eligible to be current.
• Treats complete: true surfaces with any unknown attempted/decision/outcome/persisted state as non-passing, including legacy or alternate producer input.
• Treats schema-valid but contradictory complete-surface state tuples as non-passing instead of trusting complete: true.
• Fixes all three PEP 517 requirement hooks to delegate once to uv-build, with an isolated fake-backend regression covering sdist, wheel, and editable builds.
• Rejects contradictory trust state/match/authority combinations and converts malformed package, Python, and registry dependency-manifest shapes into exact-pointer partial-discovery diagnostics.
• Preserves whether a repository used mcpServers or servers when emitting exact JSON Pointers and pointer-bound dependency IDs.
• Marks a subject commit dirty/non-binding when a Git-ignored file enters the actual observer staging inventory, while leaving staging-excluded ignored caches and generated metadata out of that decision.
• Carries a pre-execution staged-tree hash, commit-byte binding, and dependency discovery from one immutable subject snapshot into the observation and manifest; capsule construction rejects any snapshot/manifest mismatch.
• Parses, hashes, and commit-compares one captured mcp-trust byte set, preventing a live file from being restored after an untrusted read and misreported as clean authority.
• Keeps legacy observation-v1 capsules parseable but invalidates them when either staged-subject binding is absent; every authoritative capsule must bind both the observation snapshot and trust manifest to the staged tree.
• Copies repository inputs from descriptor-relative, no-follow opens and validates the private copied bytes, preventing source-path replacement from redirecting staged content.
• Treats any directory-walk/reopen failure as a structured inspection block instead of silently issuing evidence over a partial staged subtree.
• Reconciles every accepted in-scope directory with every actual walk yield, catching CPython-silent subtree skips even when no walk error callback fires.
• Treats an explicit transient filesystem or database attempt from a complete observer as an effect even when no persisted delta survives, so undeclared attempts cannot pass comparison.
• Rejects raw URL whitespace/control characters and malformed ports as exact-pointer partial-discovery diagnostics before URL parsing can normalize or raise.
• Requires an independently sourced exact image ID and matches it before any image-provided observer utility runs.
• Keeps network observation incomplete because Unix-domain and abstract sockets are outside IP/TCP/UDP counter coverage.
• Preserves and binds executable mode through staging, runtime copying, archive collection, and post-run comparison.
• Streams the attached evidence archive to a bounded host temporary file instead of accumulating untrusted output in memory.

Checklist

• Tests added/updated
• Canonical verifier updated (when verification rules changed)
• Security implications considered
• CHANGELOG updated
• Documentation updated

Security implications

• Observation is intentionally partial. The Linux/Docker boundary cannot represent Keychain, TCC, XPC, Apple Events, GUI, device, or macOS-kernel effects.
• Docker network mode none prevents ordinary external interfaces but does not prove resistance to container, VM, or hypervisor escape.
• Linux IP/TCP/UDP counters show common network attempts but not the requested destination or Unix-domain/abstract socket activity; the network surface remains incomplete.
• Surviving descendants are terminated before final-state collection, but short-lived process identities and transient create-delete effects are not completely traced.
• Binary inputs, symlinks, special files, sensitive files, literal config credentials, oversized repositories, missing local images, incomplete collection, and unsafe capsule paths fail closed.
• mcp-trust grades are historical evidence, not endorsements. Missing, stale, masked, unmatched, ambiguous, dirty, network-unproven, or version-unbound evidence remains non-authoritative.
• Internal capsule hashes prove consistency only. --expect-root-sha256 is required for externally anchored authority.
• Raw command output is hashed and omitted. Argument redaction is best effort and low-entropy values may still be guessable from hashes.

Test plan

• uv sync --dev --locked
• Exact-head GitHub CI → all required Python 3.11, 3.12, and 3.13 jobs passed; CodeQL, self-audit, and agent-facing permission diff passed
• uv run pytest -q → 1008 passed
• uv run pytest -q tests/test_proof_before_action.py → 124 passed
• uv run ruff check . → passed
• uv run ruff format --check → 109 files formatted
• uv run mypy src → no issues in 51 source files
• uv lock --check and git diff --check → passed
• Gitleaks over the complete worktree (58.90 MB scanned) and diff credential-pattern scan → no leaks
• Diff whitespace and private-path checks → passed
• Real installed CLI workflow:
  • built both sdist and wheel with the repository's uv-backed provenance wrapper and installed the wheel into an isolated Python 3.11 environment;
  • installed distribution metadata exposes proof-before-action = mcp_audit.proof_cli:main; installed help and schema emission succeed;
  • example declaration + text-only committed repository fixture;
  • disposable observation and declaration comparison;
  • mcp-trust manifest with unresolved-version evidence retained as unverifiable;
  • capsule JSON, no-script offline HTML, and capsule index emission;
  • independent SHA-256 of capsule-index.json;
  • a mismatched expected image ID exits 2 with one structured inspection_blocked result before image-provided observer tools run;
  • installed-wheel inspection exits 1 with the documented unknown verdict, records provider docker, matched image ID sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d, provenance_source: build-metadata, producer commit 18dcf649a19437ef49f7f525cea911a720244a4d, and dirty: false; filesystem, database, and network coverage are explicitly incomplete, IPv4/IPv6 counters are present, and observation/manifest share the staged-subject binding;
  • verification against exact subject commit 77ad9d5a1ec5967635e78aaf584bfd3390cf232b, producer commit 18dcf649a19437ef49f7f525cea911a720244a4d, schema proof-before-action.capsule.v1, and independently supplied root 7e42ec501c1b9bf126523a8561ce7d5ba95db76efe1d4a632179d1320c8f228b → valid, authority anchored;
  • the same installed verifier given an all-zero wrong root exits 1 with authority_root_mismatch, valid: false, and authority: unverified.
  • removing one byte from the offline report exits 1 with artifact_tampered and report_projection_mismatch.
• Exit-code/failure checks:
  • the v1 clean final-state path → 1 with verdict unknown; exit 0 remains reserved for a complete observation mechanism;
  • undeclared persisted file write → 1 with verdict block;
  • tampered report or wrong root → 1 with structured verification errors;
  • malformed declaration YAML → 2 with one structured inspection_blocked JSON result and no traceback.
• Post-run Docker/temp scan → no Proof Before Action containers, staging images, volumes, mounts, or temporary roots.

Limitations and rollback

• No package publication, release, deployment, remote trust-source mutation, or external service change is included.
• Rollback is a normal revert of this PR. The feature is additive: removing the console-script entry and new modules/docs/tests restores the prior product surface without a data migration.

Related issues

None.

[github-actions]

Agent Permission Diff

• Base: 6980b28514fb666f3275db48d13e47b8916ec351
• Head: 18dcf649a19437ef49f7f525cea911a720244a4d
• Findings: 0
• Gate findings: 0
• Acknowledged findings: 0
• Permission changes: 0
• Gate: pass in observe mode
• Fail on: critical
• Exit code: 0

Gate Decision

No findings were produced.

Findings

No agent-facing permission findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fb94dbab0f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Please review current head 6a920e22715c5651a79f8065de5f6ca7be00cd33. The prior P1 SQLite double-authority finding and P2 malformed transport finding are fixed with regression coverage; the independent private-path P1 is also closed. Required local parent gates and exact-commit capsule verification are green.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6a920e2271

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Please review exact current head ab64774ba013b24646c74b7c4aa3df8718ee05e1. The prior Docker-timeout P2 is fixed with structured exit-2 regression coverage and cleanup hardening. Local exact-head gates: 904 tests passed, 87% coverage, Ruff/format/mypy clean, secret/private-path scans clean, and an exact-producer capsule verified with independently supplied root authority.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ab64774ba0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Please review superseding exact head df52cf45f802a061b8839fbd8d7b665eef88a188. In addition to the structured Docker-timeout fix, cleanup now checks nonzero Docker removal results and reads back local temporary-root removal; an otherwise-successful observation fails closed when cleanup is unconfirmed. Local exact-head gates: 905 tests passed, 87% coverage, focused 21 passed, Ruff/format/mypy and secret/private-path scans clean, no Docker/temp residue, and exact-producer capsule authority anchored at 9fda04faf202a11c00d2632c5b06b3fbc42b3587d1b1344fa52e50bf7d89568a.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df52cf45f8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Please perform a fresh independent review of exact head 1a5696b5719003cd050415d63f29980ee78bd5a3. The prior descendant-evasion, observer-evidence ownership, and staging-cleanup P1s are repaired and their threads resolved with exact-head evidence. Local gates: focused 25 passed; full 882 non-connector + 27 connector = 909 passed; 87% coverage; Ruff/format/mypy clean; gitleaks and private-path scans clean; installed-wheel entry point/help/schema verified; exact producer/subject/schema capsule authority anchored at 01076a53277d395a86f6d9b776ad383f67c17a2495a5a8977727c4856febd2e5; no Docker residue.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1a5696b571

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Please perform a fresh independent review of exact head 752bd4c8c685fc03527276d377336031d1b54365. The dirty-trust-source P1 is repaired and its thread resolved: dirty or commit-unbound trust sources now force entry-level unverifiable, with grade and scan details withheld and explicit UNKNOWN authority. Exact-head local gates: focused 26 passed; full 883 non-connector + 27 connector = 910 passed; 87% coverage; Ruff/format/mypy and gitleaks/private-path scans clean; exact producer capsule anchored at 0179eaef226c0290e8e3d9b9072fc3e37e297ba19c1ce496b2ca7427faa2aad4; no Docker residue.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 752bd4c8c6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Please perform a fresh independent review of exact head cd6ec4bde3820ff675fb185f63c7f857563200bd. The three prior findings are repaired and resolved: required trust inputs are byte-bound to the trust commit; installed wheels/sdists embed exact producer revision and dirty state without ancestor-repo discovery; wrong authority roots remain unverified. Local exact-head gates: focused 29 passed; full 886 non-connector + 27 connector = 913 passed; 87% coverage; Ruff/format/mypy, uv lock, gitleaks, and private-path scans clean. Clean sdist→wheel installation and installed CLI inspection verified producer cd6ec4b..., dirty false, exact subject/schema, and independently anchored root 8cc077fad5c8eff247a720871f5b4b1479b120c34556bcd801ba79a71de66786; no Docker residue.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cd6ec4bde3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Please perform a fresh independent review of the exact current head 1a41b18edaf17f0b716d779ad07de2475138677a. The prior provider and wrong-shaped trust-input findings are repaired with focused regressions; please review the full diff at this exact head and report any remaining merge-relevant correctness, security, evidence-integrity, or operator-contract issues.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1a41b18eda

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 74dbc3bad4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review Please perform a fresh independent merge-relevant review of exact head 93aefce. Re-review the complete Proof Before Action change, especially privacy-preserving full remote identity, npm package-selection/call handling, strict config/JSON types, command/semantic bindings, trust authority/freshness, cleanup, and fail-closed observation claims. Treat aliased, normalized, coerced, forged, noncanonical, self-consistently rehashed, contradictory, malformed, incomplete, unknown, stale, masked, unmatched, dirty, unbound, or unobservable evidence as non-authoritative. Report any remaining actionable correctness, security, provenance, cleanup, schema, packaging, CLI, or user-flow defect.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 93aefcecb4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review Please perform a fresh independent merge-relevant review of exact head 62aece8. Re-review the complete Proof Before Action change, especially exact remote path identity, Boolean-resistant trust schemas, npm selector handling, strict config/JSON types, command/semantic bindings, trust authority/freshness, cleanup, and fail-closed observation claims. Treat aliased, normalized, coerced, forged, noncanonical, self-consistently rehashed, contradictory, malformed, incomplete, unknown, stale, masked, unmatched, dirty, unbound, or unobservable evidence as non-authoritative. Report any remaining actionable correctness, security, provenance, cleanup, schema, packaging, CLI, or user-flow defect.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 62aece81bf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Please review exact head 38fb470574db0d8340edcc6bac2899a7488b6b4d for merge-relevant correctness, security, trust-boundary, and fail-closed issues. All prior review threads have been repaired and resolved; local focused 120/120 and full 1004/1004 gates pass.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 38fb470d09

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Correction: the exact local/remote/PR head is 38fb470d095e28ac72609ee7a378909921e89ea5 (the preceding request expanded the short SHA incorrectly). Please review this exact head for merge-relevant correctness, security, trust-boundary, and fail-closed issues. Focused 120/120, full 1004/1004, and installed exact-producer anchored verification pass.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 38fb470d09

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Please review exact head c527240be0d7297837b010172d1e6f564b2a7ab8 after the transient-filesystem/database-surface repair. Focus on merge-relevant correctness, security, trust-boundary, and fail-closed behavior. Local focused 120/120 and full 1004/1004 gates pass.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c527240be0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Please review exact head 95e53cfc9901f57c23c9fadc88275957949d628b after the trusted-image-identity and incomplete-Unix-socket-coverage repairs. Focus on merge-relevant correctness, security, trust-boundary, and fail-closed behavior. Local focused 121/121 and full 1005/1005 gates pass.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 95e53cfc99

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Please review exact head 29c74750c0364677c16bcd2a6735acfede5454ac after executable-mode preservation and staged-tree mode binding. Focus on merge-relevant correctness, security, trust-boundary, and fail-closed behavior. Local focused 122/122 and full 1006/1006 gates pass.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 29c74750c0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Please review exact head c7b39c7d1c929bb80693b0d83bc931597cedebf0 after runtime executable-mode preservation and archive mode restoration. Focus on merge-relevant correctness, security, trust-boundary, and fail-closed behavior. Local focused 123/123 and full 1007/1007 gates pass.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c7b39c7d1c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Please review exact head 18dcf649a19437ef49f7f525cea911a720244a4d after bounded host-side archive streaming. Focus on merge-relevant correctness, security, trust-boundary, resource limits, and fail-closed behavior. Local focused 124/124 and full 1008/1008 gates pass.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 18dcf649a1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Re-requesting now that exact-head CI is fully green. Please review commit 18dcf649a19437ef49f7f525cea911a720244a4d; the prior request has not produced a receipt. Focus on merge-relevant correctness, security, resource limits, and fail-closed behavior.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 18dcf649a1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".