fix(g19): close PR14 P2 review-thread gaps

[rene-founder]

G-19 v2 static/dynamic trust-boundary hardening

Authority token: CEO_GO_VTOOLS_PR15_STATIC_DYNAMIC_TRUST_BOUNDARY_HARDENING_02

This PR remains Draft. It does not authorize ready-for-review, merge, release, tag, package publish, deploy, signing, branch deletion, public-release readiness, CISO/NASA clean-close, enterprise-ready, SLSA/provenance claims, or PR #14 review-thread resolution.

Base / head

• Base: 9b7e8456e96771f9285b728aa104a5ed985e8f2b
• Prior audited head: 79cc81d93a7c86a0cb31c2427c11889dd338f3b6
• Current head: ec8708d68aa018c186af7789201960d94b7d9382
• PR state: OPEN / DRAFT / not merged
• Changed files: 25, tests/workflow only

Static/dynamic trust model

Surface	Role	Hardened behavior
tests/g19-v2-structural-check.sh	Static workflow syntax defense	Rejects enumerated proof-critical GIT_* env keys, including GIT_PAGER; block/inline workflow_dispatch; protected-file writers including indirect path variables; trusted git path rewrites; prefixed git mutation; and sentinel side effects.
tests/run-gates.sh	Dynamic proof execution evidence	Fails closed before proof output if any enumerated proof-critical GIT_* exists, git substrate is untrusted, object store is poisoned, checkout SHA drifts, or executed bytes differ from committed blobs.
.github/workflows/ci.yml	Remote execution harness	Rejects enumerated proof-critical GIT_* env before first git use, materializes the merge checkout, verifies proof-bound blobs, and recomputes the proof from committed material.

Static PASS is not treated as proof of dynamic execution. Dynamic proof is emitted only after substrate, object-store, checkout, and disk/blob checks pass.

Hardening applied

• Enumerated proof-critical GIT_* variables are rejected before proof-critical git use; this covers GIT_NAMESPACE, GIT_CEILING_DIRECTORIES, and GIT_PAGER (P2-01 red-team residual), not only the earlier list. A blanket GIT_* class scan is intentionally not used because Windows Git Bash exports harmless vars such as GIT_SEQUENCE_EDITOR and GIT_EDITOR.
• /usr/local/bin/git was removed from the trusted dynamic git path set.
• Static checker rejects writes to trusted git binary paths/directories.
• Static checker rejects path-variable indirection such as TARGET=tests/run-gates.sh; printf ... > "$TARGET".
• Static checker rejects workflow_dispatch in block sequence form under on:.
• CI pins were recalculated for the current proof-bound blobs and fixture manifest.

Proof-bound pins @ ec8708d

• RUN_GATES: d1ec3239d04d0cd3e716a2a6054befb76723146396f2de25550b194c36ff234b
• STRUCTURAL: 4863e581cfa202621ca8a1529c0fca44faa348b4df30e1eb31e84addc1432716
• WORKSPACE_HELPER: e105de0bca00c509bfff6923515cccb9ab416013a20f17ff90a7159c52890a06
• VERIFY_PY: abedd126eac0227dddad9267d8863d1b3b4921ef0bdc69301f59b9c9d708683b
• VERIFY_SH: 65694b5e0abe95f3322c45ab7c69b597d83121ec14001bdbba8e6e83f2224192
• FIXTURE_MANIFEST: ed002608e565b853c03f868097e684361e43b49db6ae75f3567b8ef75dfea8ed

Changed files (25)

1. .github/workflows/ci.yml
2. tests/g19-v2-structural-check.sh
3. tests/lib/verify-tracked-workspace.sh
4. tests/run-gates.sh
5. tests/fixtures/g19-v2/mutant-gate-inline-git-checkout-before-run.yml
6. tests/fixtures/g19-v2/mutant-job-env-git-ceiling-directories.yml
7. tests/fixtures/g19-v2/mutant-job-env-git-pager.yml
8. tests/fixtures/g19-v2/mutant-job-env-git-work-tree.yml
9. tests/fixtures/g19-v2/mutant-prestep-colon-redir-run-gates.yml
10. tests/fixtures/g19-v2/mutant-prestep-command-git-checkout-head-drift.yml
11. tests/fixtures/g19-v2/mutant-prestep-env-git-checkout-head-drift.yml
12. tests/fixtures/g19-v2/mutant-prestep-git-C-checkout-head-drift.yml
13. tests/fixtures/g19-v2/mutant-prestep-tee-run-gates.yml
14. tests/fixtures/g19-v2/mutant-prestep-truncate-run-gates.yml
15. tests/fixtures/g19-v2/mutant-prestep-usrbin-git-checkout-head-drift.yml
16. tests/fixtures/g19-v2/mutant-prestep-var-run-gates-writer.yml
17. tests/fixtures/g19-v2/mutant-prestep-write-trusted-git.yml
18. tests/fixtures/g19-v2/mutant-sentinel-builtin-printf-side-effect.yml
19. tests/fixtures/g19-v2/mutant-sentinel-exec-printf-side-effect.yml
20. tests/fixtures/g19-v2/mutant-sentinel-printf-redirect-side-effect.yml
21. tests/fixtures/g19-v2/mutant-step-env-git-object-directory.yml
22. tests/fixtures/g19-v2/mutant-workflow-dispatch-block-sequence.yml
23. tests/fixtures/g19-v2/mutant-workflow-dispatch-flow-sequence.yml
24. tests/fixtures/g19-v2/mutant-workflow-env-git-dir.yml
25. tests/fixtures/g19-v2/mutant-workflow-env-git-namespace.yml

Local gates

Local gate shell: C:\Program Files\Git\bin\bash.exe with GIT_PAGER unset. The default Cygwin-style bash environment is not used as authority because it exports GIT_PAGER=cat, which the hardened gate correctly treats as proof-critical GIT_* contamination.

• git diff --check: PASS
• bash -n tests/run-gates.sh: PASS
• bash -n tests/g19-v2-structural-check.sh: PASS
• bash tests/g19-v2-structural-check.sh .github/workflows/ci.yml: G-19 STRUCTURAL CHECK PASS
• bash tests/run-gates.sh: ALL GATES PASS
• Local HEAD proof hash: b9c9f974c033b7fde21c4253445d1c74de028a9453ea15ac0c872d36780c031b

Focused adversarial probes @ ec8708d

• GIT_PAGER=cat: exit 2, proof count 0, diagnostic SETUP FAIL: proof-critical git environment variable is set (GIT_PAGER).
• GIT_NAMESPACE=poison: exit 2, proof count 0, diagnostic SETUP FAIL: proof-critical git environment variable is set (GIT_NAMESPACE).
• GIT_CEILING_DIRECTORIES=/: exit 2, proof count 0, diagnostic SETUP FAIL: proof-critical git environment variable is set (GIT_CEILING_DIRECTORIES).
• mutant-job-env-git-pager.yml: structural checker exits 1.
• Block-sequence workflow_dispatch: structural checker exits 1.
• Indirect gate-file writer through TARGET=tests/run-gates.sh: structural checker exits 1.
• Trusted git binary path writer to /usr/local/bin/git: structural checker exits 1.
• Fake-git PATH: exit 2, proof count 0, diagnostic SETUP FAIL: git executable resolves outside trusted system paths.
• Checkout mismatch: exit 2, proof count 0, diagnostic SETUP FAIL: VT_G19_CHECKOUT_SHA does not match executed worktree HEAD.
• Prior object-store poisoning, disk/blob drift, missing-object, and writer probes remain covered by tests/run-gates.sh and fixtures.

Remote CI

• Current run @ ec8708d: 28894080030
• gates (ubuntu-latest): PASS, job 85714054039, 37s
• gates (windows-latest): PASS, job 85714053990, 3m21s
• Artifacts: 0
• Remote PR head: ec8708d68aa018c186af7789201960d94b7d9382
• Remote PR base: 9b7e8456e96771f9285b728aa104a5ed985e8f2b
• Remote checkout / synthetic merge SHA: c1ec457730c7e75260fe476f4d333d3f45e906e2
• Remote merge-ref proof hash: dc514a8cf3e8fd252f5fe646d0fab7eb5f7781b0f3fc93e044a11769d28a540e

Review-thread boundary

• PR fix(g19): close PR14 P2 review-thread gaps #15 review threads: 0
• PR fix(g19): harden TOCTOU proof v4 #14 review threads: 6 unresolved / not outdated, intentionally not resolved until PR fix(g19): close PR14 P2 review-thread gaps #15 is merged and postverified under a separate CEO token.

Explicit boundaries

• NO_RELEASE_NO_TAG_NO_PACKAGE_PUBLISH_NO_DEPLOY_NO_SIGNING
• NO_PUBLIC_RELEASE_READY
• NO_CISO_NASA_CLEAN_DECLARED
• NO_ENTERPRISE_READY_CLAIM
• NO_SLSA_PROVENANCE_CLAIM
• NO_PRODUCTION_READY_CLAIM
• PR14_THREADS_NOT_RESOLVED_UNTIL_PR15_POSTVERIFY
• CLEAN_ESTATE_NOT_DECLARED

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.