fix(audit): bind MCP remediation commit by roodboi · Pull Request #71 · hack-dance/fclt

roodboi · 2026-07-15T20:30:11Z

Summary

version exact audit receipts so remediation bindings are part of the content-addressed report envelope
bind every fixable canonical MCP finding to one verified root, source object, and local destination identity
transform only bytes read from held no-follow descriptors and commit both canonical files descriptor-relatively with rollback before the irrevocable boundary
keep dry-run, agent audit, typed MCP audit, managed tool homes, report files, and legacy/default reads mutation-free

Security invariants

explicit --yes, exact fresh report, finding selection, protected-root, and current-root checks remain mandatory
old v2.25.4 reports cannot authorize mutation
source/destination/root/directory identity, ownership, mode, type, bytes, and name mappings are revalidated at the final commit boundary
source drift, replacement, rename, FIFO/symlink substitution, permission drift, destination appearance, and root/directory swaps fail closed
no pathname Bun.write, directory creation, managed sync, or external tool-home mutation is used

Verification

Local timing-sensitive Bun gates were intentionally not run under the HACK-924 quiet-host waiver. Static checks completed:

repo formatter/lint contract on all changed files
tsc --noEmit
git diff --check
changed-surface privacy scan

Hosted exact-head CI and latest-head Codex review are authoritative for this PR.

Linear: HACK-934

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

linear-code · 2026-07-15T20:30:14Z

HACK-934

roodboi · 2026-07-15T20:30:22Z

@codex review

roodboi · 2026-07-15T20:33:57Z

@codex review\n\nPlease review latest head 135a1b8; the prior head was superseded by hosted-CI contract fixes.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 135a1b89bf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T20:44:24Z

@codex review\n\nPlease re-review latest head 42027f1 after addressing and resolving both findings from 135a1b8.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 42027f14e0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T20:53:19Z

@codex review — please review latest head 2aa69d2 after addressing and resolving the dotted MCP container finding.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2aa69d2ebf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T21:02:33Z

@codex review — please review latest head c84aa06 after aligning static-audit and remediation container selection and resolving the mixed-container finding.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c84aa06a5b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T21:09:06Z

@codex review — please review latest head c9a2160 after aligning runtime, static audit, and remediation on the active MCP container and resolving the P1 finding.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9a2160152

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T21:22:08Z

@codex review — please review latest head c241452 after aligning the canonical-root scope guard and sharing the active MCP selector across scan/audit/runtime/remediation.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c241452c74

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T21:33:56Z

@codex review — please review latest head 1cc3ca6 after making the shared MCP selector fall through non-object candidates and resolving the finding.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1cc3ca633a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T21:42:52Z

@codex review — please review latest head 7ec9902 after preserving unsupported findings without bindings and safely initializing exact-bound empty local overlays.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7ec99022b3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T21:54:05Z

@codex review — please review latest head bbfea6e after binding Git exposure into the report and enforcing an outside-worktree policy at the synchronous commit boundary.

roodboi · 2026-07-15T21:58:51Z

@codex review — please review latest head 336b2b5 after keeping absent canonical MCP roots read-only and binding no remediation authority for those absent roots.

chatgpt-codex-connector · 2026-07-15T22:06:18Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 336b2b51ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T22:08:29Z

@codex review — please review exact head 15d7c50 after merging current main afc961f; prior exact-head review was clean, and this refresh prevents stale-base authorization/security validation.

roodboi · 2026-07-15T22:12:11Z

@codex review — please review exact head 3dc73ab. This only aligns public audit help/trust guidance and its TUI assertion with the already reviewed descriptor-bound --yes remediation contract; hosted checks are rerunning.

chatgpt-codex-connector · 2026-07-15T22:18:13Z

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 3dc73ab364

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T22:19:37Z

@codex review — please review exact head e8b29f8 after refreshing from current main 29800bd (v2.27.1). The HACK-934 diff is unchanged; this is the required stale-base refresh after PR #72 released.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e8b29f8fe1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

roodboi · 2026-07-15T22:28:56Z

@codex review — please review exact head 216d633 after addressing and resolving the multi-source selection finding with path-bound identities and a zero-artifact regression fixture.

chatgpt-codex-connector · 2026-07-15T22:35:24Z

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 216d6331c4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

github-actions · 2026-07-15T22:39:14Z

🎉 This PR is included in version 2.27.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

fix(audit): bind MCP remediation commit

ee35e75

test(audit): align envelope authorization proofs

135a1b8

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/audit/safe-openat.ts Outdated

Comment thread src/audit/report-persistence.ts Outdated

fix(audit): secure local remediation identity

42027f1

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/audit/fix.ts

fix(audit): support dotted MCP server containers

2aa69d2

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/audit/fix.ts

fix(audit): bind remediation container selection

c84aa06

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/mcp-config.ts Outdated

fix(audit): remediate the active MCP container

c9a2160

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/audit/fix.ts Outdated

Comment thread src/audit/static.ts

fix(audit): align canonical MCP scope

c241452

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/mcp-config.ts Outdated

fix(audit): skip invalid MCP containers

1cc3ca6

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/audit/report-persistence.ts

Comment thread src/audit/fix.ts Outdated

fix(audit): preserve unfixable MCP findings

7ec9902

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/audit/fix.ts

fix(audit): refuse Git-exposed secret overlays

bbfea6e

fix(audit): handle absent canonical MCP roots

336b2b5

Merge remote-tracking branch 'origin/main' into codex/HACK-934

15d7c50

docs(audit): document bound MCP remediation

3dc73ab

Merge remote-tracking branch 'origin/main' into codex/HACK-934

e8b29f8

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread src/audit/fix.ts

fix(audit): distinguish duplicate MCP sources

216d633

roodboi merged commit 11538f7 into main Jul 15, 2026
3 checks passed

roodboi deleted the codex/HACK-934 branch July 15, 2026 22:37

github-actions Bot added the released label Jul 15, 2026

Uh oh!

Conversation

roodboi commented Jul 15, 2026 • edited by blacksmith-sh Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Security invariants

Verification

Uh oh!

linear-code Bot commented Jul 15, 2026

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 15, 2026

Uh oh!

roodboi commented Jul 15, 2026

Uh oh!

roodboi commented Jul 15, 2026

roodboi commented Jul 15, 2026 •

edited by blacksmith-sh Bot

Loading