Skip to content

fix(g19): close PR14 P2 review-thread gaps #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rene-founder merged 9 commits into from
Jul 7, 2026
Merged

fix(g19): close PR14 P2 review-thread gaps #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
672cbbe
fix(g19): close PR14 P2 review-thread gaps
rene-founder Jul 7, 2026
3387dbb
fix(g19): harden P2 gaps found by adversarial red-team
rene-founder Jul 7, 2026
328e60b
fix(g19): harden trusted git proof execution
rene-founder Jul 7, 2026
65a8529
fix(g19): normalize trusted git root path
rene-founder Jul 7, 2026
f1bd945
fix(g19): seal git environment trust boundary
rene-founder Jul 7, 2026
a4ff621
fix(g19): update git environment fixture inventory
rene-founder Jul 7, 2026
521b909
fix(g19): align fixture manifest pin
rene-founder Jul 7, 2026
79cc81d
fix(g19): harden PR15 proof boundary
rene-founder Jul 7, 2026
ec8708d
fix(g19): reject GIT_PAGER in proof-critical env scan
rene-founder Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
190 changes: 171 additions & 19 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,44 +72,196 @@ jobs:
VT_G19_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
VT_G19_PR_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before || github.sha }}
VT_G19_CHECKOUT_SHA: ${{ github.sha }}
VT_G19_EXPECTED_WORKSPACE_HELPER_SHA: "e105de0bca00c509bfff6923515cccb9ab416013a20f17ff90a7159c52890a06"
run: |
if [ -n "${GIT_DIR:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_DIR)"
exit 1
fi
if [ -n "${GIT_WORK_TREE:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_WORK_TREE)"
exit 1
fi
if [ -n "${GIT_EXEC_PATH:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_EXEC_PATH)"
exit 1
fi
if [ -n "${GIT_INDEX_FILE:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_INDEX_FILE)"
exit 1
fi
if [ -n "${GIT_OBJECT_DIRECTORY:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_OBJECT_DIRECTORY)"
exit 1
fi
if [ -n "${GIT_ALTERNATE_OBJECT_DIRECTORIES:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_ALTERNATE_OBJECT_DIRECTORIES)"
exit 1
fi
if [ -n "${GIT_CONFIG:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_CONFIG)"
exit 1
fi
if [ -n "${GIT_CONFIG_GLOBAL:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_CONFIG_GLOBAL)"
exit 1
fi
if [ -n "${GIT_CONFIG_SYSTEM:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_CONFIG_SYSTEM)"
exit 1
fi
if [ -n "${GIT_CONFIG_NOSYSTEM:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_CONFIG_NOSYSTEM)"
exit 1
fi
if [ -n "${GIT_NAMESPACE:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_NAMESPACE)"
exit 1
fi
if [ -n "${GIT_CEILING_DIRECTORIES:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_CEILING_DIRECTORIES)"
exit 1
fi
if [ -n "${GIT_PAGER:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_PAGER)"
exit 1
fi
git_config_env="$(env | sed -n 's/^\(GIT_CONFIG_[^=]*\)=.*/\1/p' | head -n 1)"
if [ -n "$git_config_env" ]; then
echo "G-19 FAIL: proof-critical git config environment variable is set ($git_config_env)"
exit 1
fi
if ! GIT_BIN="$(command -v git)"; then
echo "G-19 FAIL: git executable is unavailable"
exit 1
fi
if [ ! -x "$GIT_BIN" ]; then
echo "G-19 FAIL: git executable is unavailable"
exit 1
fi
GIT_BIN_DIR="$(cd "$(dirname "$GIT_BIN")" && pwd -P)"
GIT_BIN="$GIT_BIN_DIR/$(basename "$GIT_BIN")"
WORKSPACE_PHYSICAL="$(pwd -P)"
if [[ "$GIT_BIN" == "$WORKSPACE_PHYSICAL"/* || "$GIT_BIN" == /tmp/* || "$GIT_BIN" == /var/tmp/* || "$GIT_BIN" == /dev/shm/* || "$GIT_BIN" == */AppData/Local/Temp/* || "$GIT_BIN" == */Temp/* || "$GIT_BIN" == */_temp/* ]]; then
echo "G-19 FAIL: git executable resolves outside trusted system paths ($GIT_BIN)"
exit 1
fi
ROOT_WORKSPACE="$PWD"
MATERIALIZED_WORKTREE="$(mktemp -d)"
cleanup_materialized_worktree() {
cd "$ROOT_WORKSPACE"
git worktree remove --force "$MATERIALIZED_WORKTREE" >/dev/null 2>&1 || rm -rf "$MATERIALIZED_WORKTREE"
"$GIT_BIN" worktree remove --force "$MATERIALIZED_WORKTREE" >/dev/null 2>&1 || rm -rf "$MATERIALIZED_WORKTREE"
}
trap cleanup_materialized_worktree EXIT
git config core.autocrlf false
git worktree add --detach "$MATERIALIZED_WORKTREE" "$VT_G19_CHECKOUT_SHA"
"$GIT_BIN" config core.autocrlf false
"$GIT_BIN" worktree add --detach "$MATERIALIZED_WORKTREE" "$VT_G19_CHECKOUT_SHA"
cd "$MATERIALIZED_WORKTREE"
git config core.autocrlf false
git reset --hard "$VT_G19_CHECKOUT_SHA"
source tests/lib/verify-tracked-workspace.sh
"$GIT_BIN" config core.autocrlf false
"$GIT_BIN" reset --hard "$VT_G19_CHECKOUT_SHA"
VERIFIED_WORKSPACE_HELPER="$MATERIALIZED_WORKTREE/.verified-workspace-helper"
"$GIT_BIN" cat-file blob "$VT_G19_CHECKOUT_SHA:tests/lib/verify-tracked-workspace.sh" > "$VERIFIED_WORKSPACE_HELPER"
WORKSPACE_HELPER_SHA="$(sha256sum "$VERIFIED_WORKSPACE_HELPER" | awk '{print $1}')"
if [ "$WORKSPACE_HELPER_SHA" != "$VT_G19_EXPECTED_WORKSPACE_HELPER_SHA" ]; then
echo "G-19 FAIL: verified workspace helper hash mismatch ($WORKSPACE_HELPER_SHA)"
exit 1
fi
source "$VERIFIED_WORKSPACE_HELPER"
verify_tracked_workspace_file .github/workflows/ci.yml
verify_tracked_workspace_file tests/lib/verify-tracked-workspace.sh
verify_tracked_workspace_file tests/run-gates.sh
verify_tracked_workspace_file tests/g19-v2-structural-check.sh
verify_tracked_workspace_file memoriaia/verify/verify-hashchain.py
verify_tracked_workspace_file verify/verify-hashchain.sh
git ls-files 'tests/fixtures/g19-v2/*.yml' | while IFS= read -r fixture; do
"$GIT_BIN" ls-files 'tests/fixtures/g19-v2/*.yml' | while IFS= read -r fixture; do
verify_tracked_workspace_file "$fixture"
done
bash tests/run-gates.sh

- name: G-19 CI anti-theater (run-gates execution proof required)
if: always()
env:
VT_G19_EXPECTED_RUN_GATES_SHA: "7dd87f48c59695a0985fcebcb916122c83150e44148592f81233892dd78804f1"
VT_G19_EXPECTED_STRUCTURAL_CHECK_SHA: "87d6f13710320d0178767664e6d37fc1a8e1c49e214fffab8d6ac9c44b705109"
VT_G19_EXPECTED_WORKSPACE_HELPER_SHA: "ecc05ac6690df69f5d1db7986bea397368fef247f2145c5965401d7b97384e31"
VT_G19_EXPECTED_RUN_GATES_SHA: "d1ec3239d04d0cd3e716a2a6054befb76723146396f2de25550b194c36ff234b"
VT_G19_EXPECTED_STRUCTURAL_CHECK_SHA: "4863e581cfa202621ca8a1529c0fca44faa348b4df30e1eb31e84addc1432716"
VT_G19_EXPECTED_WORKSPACE_HELPER_SHA: "e105de0bca00c509bfff6923515cccb9ab416013a20f17ff90a7159c52890a06"
VT_G19_EXPECTED_VERIFY_PY_SHA: "abedd126eac0227dddad9267d8863d1b3b4921ef0bdc69301f59b9c9d708683b"
VT_G19_EXPECTED_VERIFY_SH_SHA: "65694b5e0abe95f3322c45ab7c69b597d83121ec14001bdbba8e6e83f2224192"
VT_G19_EXPECTED_FIXTURE_MANIFEST_SHA: "82ab4918f9032d76ff0464e0fa5d75309374ef36c64765458354586f1598ea0a"
VT_G19_EXPECTED_FIXTURE_MANIFEST_SHA: "ed002608e565b853c03f868097e684361e43b49db6ae75f3567b8ef75dfea8ed"
VT_G19_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
VT_G19_PR_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before || github.sha }}
VT_G19_CHECKOUT_SHA: ${{ github.sha }}
run: |
if [ -n "${GIT_DIR:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_DIR)"
exit 1
fi
if [ -n "${GIT_WORK_TREE:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_WORK_TREE)"
exit 1
fi
if [ -n "${GIT_EXEC_PATH:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_EXEC_PATH)"
exit 1
fi
if [ -n "${GIT_INDEX_FILE:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_INDEX_FILE)"
exit 1
fi
if [ -n "${GIT_OBJECT_DIRECTORY:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_OBJECT_DIRECTORY)"
exit 1
fi
if [ -n "${GIT_ALTERNATE_OBJECT_DIRECTORIES:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_ALTERNATE_OBJECT_DIRECTORIES)"
exit 1
fi
if [ -n "${GIT_CONFIG:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_CONFIG)"
exit 1
fi
if [ -n "${GIT_CONFIG_GLOBAL:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_CONFIG_GLOBAL)"
exit 1
fi
if [ -n "${GIT_CONFIG_SYSTEM:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_CONFIG_SYSTEM)"
exit 1
fi
if [ -n "${GIT_CONFIG_NOSYSTEM:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_CONFIG_NOSYSTEM)"
exit 1
fi
if [ -n "${GIT_NAMESPACE:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_NAMESPACE)"
exit 1
fi
if [ -n "${GIT_CEILING_DIRECTORIES:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_CEILING_DIRECTORIES)"
exit 1
fi
if [ -n "${GIT_PAGER:-}" ]; then
echo "G-19 FAIL: proof-critical git environment variable is set (GIT_PAGER)"
exit 1
fi
git_config_env="$(env | sed -n 's/^\(GIT_CONFIG_[^=]*\)=.*/\1/p' | head -n 1)"
if [ -n "$git_config_env" ]; then
echo "G-19 FAIL: proof-critical git config environment variable is set ($git_config_env)"
exit 1
fi
if ! GIT_BIN="$(command -v git)"; then
echo "G-19 FAIL: git executable is unavailable"
exit 1
fi
if [ ! -x "$GIT_BIN" ]; then
echo "G-19 FAIL: git executable is unavailable"
exit 1
fi
GIT_BIN_DIR="$(cd "$(dirname "$GIT_BIN")" && pwd -P)"
GIT_BIN="$GIT_BIN_DIR/$(basename "$GIT_BIN")"
WORKSPACE_PHYSICAL="$(pwd -P)"
if [[ "$GIT_BIN" == "$WORKSPACE_PHYSICAL"/* || "$GIT_BIN" == /tmp/* || "$GIT_BIN" == /var/tmp/* || "$GIT_BIN" == /dev/shm/* || "$GIT_BIN" == */AppData/Local/Temp/* || "$GIT_BIN" == */Temp/* || "$GIT_BIN" == */_temp/* ]]; then
echo "G-19 FAIL: git executable resolves outside trusted system paths ($GIT_BIN)"
exit 1
fi
if [ "${{ steps.run_gates.outcome }}" != "success" ]; then
echo "G-19 FAIL: tests/run-gates.sh did not complete successfully (outcome: ${{ steps.run_gates.outcome }})"
exit 1
Expand All @@ -126,38 +278,38 @@ jobs:
echo "G-19 FAIL: checkout SHA is invalid ($VT_G19_CHECKOUT_SHA)"
exit 1
fi
CHECKOUT_SHA="$(git rev-parse HEAD)"
CHECKOUT_SHA="$("$GIT_BIN" rev-parse HEAD)"
if [ "$CHECKOUT_SHA" != "$VT_G19_CHECKOUT_SHA" ]; then
echo "G-19 FAIL: checkout SHA mismatch (expected $VT_G19_CHECKOUT_SHA, got $CHECKOUT_SHA)"
exit 1
fi
RUN_GATES_SHA="$(git cat-file blob "$CHECKOUT_SHA:tests/run-gates.sh" | sha256sum | awk '{print $1}')"
RUN_GATES_SHA="$("$GIT_BIN" cat-file blob "$CHECKOUT_SHA:tests/run-gates.sh" | sha256sum | awk '{print $1}')"
if [ "$RUN_GATES_SHA" != "$VT_G19_EXPECTED_RUN_GATES_SHA" ]; then
echo "G-19 FAIL: tests/run-gates.sh hash mismatch ($RUN_GATES_SHA)"
exit 1
fi
STRUCTURAL_CHECK_SHA="$(git cat-file blob "$CHECKOUT_SHA:tests/g19-v2-structural-check.sh" | sha256sum | awk '{print $1}')"
STRUCTURAL_CHECK_SHA="$("$GIT_BIN" cat-file blob "$CHECKOUT_SHA:tests/g19-v2-structural-check.sh" | sha256sum | awk '{print $1}')"
if [ "$STRUCTURAL_CHECK_SHA" != "$VT_G19_EXPECTED_STRUCTURAL_CHECK_SHA" ]; then
echo "G-19 FAIL: tests/g19-v2-structural-check.sh hash mismatch ($STRUCTURAL_CHECK_SHA)"
exit 1
fi
WORKSPACE_HELPER_SHA="$(git cat-file blob "$CHECKOUT_SHA:tests/lib/verify-tracked-workspace.sh" | sha256sum | awk '{print $1}')"
WORKSPACE_HELPER_SHA="$("$GIT_BIN" cat-file blob "$CHECKOUT_SHA:tests/lib/verify-tracked-workspace.sh" | sha256sum | awk '{print $1}')"
if [ "$WORKSPACE_HELPER_SHA" != "$VT_G19_EXPECTED_WORKSPACE_HELPER_SHA" ]; then
echo "G-19 FAIL: tests/lib/verify-tracked-workspace.sh hash mismatch ($WORKSPACE_HELPER_SHA)"
exit 1
fi
CI_YML_SHA="$(git cat-file blob "$CHECKOUT_SHA:.github/workflows/ci.yml" | sha256sum | awk '{print $1}')"
VERIFY_PY_SHA="$(git cat-file blob "$CHECKOUT_SHA:memoriaia/verify/verify-hashchain.py" | sha256sum | awk '{print $1}')"
CI_YML_SHA="$("$GIT_BIN" cat-file blob "$CHECKOUT_SHA:.github/workflows/ci.yml" | sha256sum | awk '{print $1}')"
VERIFY_PY_SHA="$("$GIT_BIN" cat-file blob "$CHECKOUT_SHA:memoriaia/verify/verify-hashchain.py" | sha256sum | awk '{print $1}')"
if [ "$VERIFY_PY_SHA" != "$VT_G19_EXPECTED_VERIFY_PY_SHA" ]; then
echo "G-19 FAIL: memoriaia/verify/verify-hashchain.py hash mismatch ($VERIFY_PY_SHA)"
exit 1
fi
VERIFY_SH_SHA="$(git cat-file blob "$CHECKOUT_SHA:verify/verify-hashchain.sh" | sha256sum | awk '{print $1}')"
VERIFY_SH_SHA="$("$GIT_BIN" cat-file blob "$CHECKOUT_SHA:verify/verify-hashchain.sh" | sha256sum | awk '{print $1}')"
if [ "$VERIFY_SH_SHA" != "$VT_G19_EXPECTED_VERIFY_SH_SHA" ]; then
echo "G-19 FAIL: verify/verify-hashchain.sh hash mismatch ($VERIFY_SH_SHA)"
exit 1
fi
FIXTURE_MANIFEST_SHA="$(git ls-files 'tests/fixtures/g19-v2/*.yml' | while IFS= read -r fixture; do fixture_sha="$(git cat-file blob "$CHECKOUT_SHA:$fixture" | sha256sum | awk '{print $1}')"; printf '%s %s\n' "$fixture_sha" "$fixture"; done | sha256sum | awk '{print $1}')"
FIXTURE_MANIFEST_SHA="$("$GIT_BIN" ls-files 'tests/fixtures/g19-v2/*.yml' | while IFS= read -r fixture; do fixture_sha="$("$GIT_BIN" cat-file blob "$CHECKOUT_SHA:$fixture" | sha256sum | awk '{print $1}')"; printf '%s %s\n' "$fixture_sha" "$fixture"; done | sha256sum | awk '{print $1}')"
if [ "$FIXTURE_MANIFEST_SHA" != "$VT_G19_EXPECTED_FIXTURE_MANIFEST_SHA" ]; then
echo "G-19 FAIL: G-19 fixture manifest hash mismatch ($FIXTURE_MANIFEST_SHA)"
exit 1
Expand Down
22 changes: 22 additions & 0 deletions tests/fixtures/g19-v2/mutant-gate-inline-git-checkout-before-run.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
name: Verification Tools CI
jobs:
gates:
steps:
- name: Run verification gate suite
id: run_gates
run: |
git checkout HEAD~1
bash tests/run-gates.sh
- name: G-19 CI anti-theater (run-gates execution proof required)
if: always()
run: |
if [ "${{ steps.run_gates.outcome }}" != "success" ]; then
exit 1
fi
PROOF="${{ steps.run_gates.outputs.vt_g19_exec_proof }}"
if [ -z "$PROOF" ]; then
exit 1
fi
if ! printf '%s\n' "$PROOF" | grep -qE '^[0-9a-f]{64}$'; then
exit 1
fi
23 changes: 23 additions & 0 deletions tests/fixtures/g19-v2/mutant-job-env-git-ceiling-directories.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
name: Verification Tools CI
jobs:
gates:
env:
GIT_CEILING_DIRECTORIES: /
steps:
- name: Run verification gate suite
id: run_gates
run: |
bash tests/run-gates.sh
- name: G-19 CI anti-theater (run-gates execution proof required)
if: always()
run: |
if [ "${{ steps.run_gates.outcome }}" != "success" ]; then
exit 1
fi
PROOF="${{ steps.run_gates.outputs.vt_g19_exec_proof }}"
if [ -z "$PROOF" ]; then
exit 1
fi
if ! printf '%s\n' "$PROOF" | grep -qE '^[0-9a-f]{64}$'; then
exit 1
fi
23 changes: 23 additions & 0 deletions tests/fixtures/g19-v2/mutant-job-env-git-pager.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
name: Verification Tools CI
jobs:
gates:
env:
GIT_PAGER: cat
steps:
- name: Run verification gate suite
id: run_gates
run: |
bash tests/run-gates.sh
- name: G-19 CI anti-theater (run-gates execution proof required)
if: always()
run: |
if [ "${{ steps.run_gates.outcome }}" != "success" ]; then
exit 1
fi
PROOF="${{ steps.run_gates.outputs.vt_g19_exec_proof }}"
if [ -z "$PROOF" ]; then
exit 1
fi
if ! printf '%s\n' "$PROOF" | grep -qE '^[0-9a-f]{64}$'; then
exit 1
fi
24 changes: 24 additions & 0 deletions tests/fixtures/g19-v2/mutant-job-env-git-work-tree.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: mutant job env GIT_WORK_TREE
on: [pull_request]
jobs:
gates:
runs-on: ubuntu-latest
env:
GIT_WORK_TREE: /tmp/poison-worktree
steps:
- name: Run verification gate suite
id: run_gates
run: bash tests/run-gates.sh
- name: G-19 CI anti-theater (run-gates execution proof required)
if: always()
run: |
if [ "${{ steps.run_gates.outcome }}" != "success" ]; then
exit 1
fi
PROOF="${{ steps.run_gates.outputs.vt_g19_exec_proof }}"
if [ -z "$PROOF" ]; then
exit 1
fi
if ! printf '%s\n' "$PROOF" | grep -qE '^[0-9a-f]{64}$'; then
exit 1
fi
24 changes: 24 additions & 0 deletions tests/fixtures/g19-v2/mutant-prestep-colon-redir-run-gates.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: Verification Tools CI
jobs:
gates:
steps:
- name: Colon redirect run-gates
run: |
: > tests/run-gates.sh
- name: Run verification gate suite
id: run_gates
run: |
bash tests/run-gates.sh
- name: G-19 CI anti-theater (run-gates execution proof required)
if: always()
run: |
if [ "${{ steps.run_gates.outcome }}" != "success" ]; then
exit 1
fi
PROOF="${{ steps.run_gates.outputs.vt_g19_exec_proof }}"
if [ -z "$PROOF" ]; then
exit 1
fi
if ! printf '%s\n' "$PROOF" | grep -qE '^[0-9a-f]{64}$'; then
exit 1
fi
Loading
Loading