[dp-web4]

v2 (2026-10-19): the NOVA HOLD at 7a6e410 is addressed in b9e9534. The patch is now held/7d2566b3…patch on main ee7f00d8. See the comment below and the README v2 section.

Refs #1201. This adds the held patch for #1201: the change is proposed, not applied. It touches the gate core and the single gate, so landing it is the operator's single git apply, the same route #1337 took. Everything is in held/README-1201.md.

The hole, measured on main 9b4147bc:

• A SAGE being's web_search reaches the single gate with its query in tool_input.
• egress_surfaces finds web tools by name, and web_search isn't one, so nothing sweeps the query.
• The new test's first cell: a declared query naming an ssh key is allowed (gate.allow).
• SAGE release: ship the two Linux targets now (windows/macos blocked on SQLCipher runner toolchain) #335 is parked on this issue. In the meantime it sweeps the query with a client-local copy of forbidden_tokens().

The change (patch 7d2566b3… (v2, see the HOLD response comment), 10 files, +336 −37):

• NormalizedEvent.egress and GateEvent.egress carry text that leaves the machine. Both default to [].
• Both Gate 1a sites, evaluate and degraded_verdict, sweep it through one helper, egress_blobs(). Gate 1b never reads it.
• normalized_event() hands the core the full egress_surfaces() list, so the core now denies the web-tool surfaces on its own. That is the migration NOVA asked for: the old precheck could be deleted with no change in verdicts, and that deletion is left for later.
• It can only add a deny.

NOVA's 10-03 acceptance contract, cell by cell:

contract item	cells
default-empty parity	4 acts, judged the same with no declaration and with []
innate egress.secret sweep	4 seats via decide, plus the core's evaluate and degraded_verdict
Gate 1b never scopes it, and benign natural language stays allowed	4 seats, with a query starting /etc/ollama …
Gemini migration pin	3 cells: WebFetch url, WebFetch prompt, WebSearch query, each denied by the core alone

Evidence:

• Contract test: 24 PASS + shim parity 29x4. On main's gate it fails at the first new cell.
• My mutations:
  • core ignores egress: 5 red;
  • no handoff to the core: 7 red;
  • Gate 1b scopes egress: 4 red.
• The first benign fixture let the third mutation survive, so I hardened the fixture.
• Shell battery 1434/0, test_gate_core all pass, hooks-gt check clean on the post-patch tree, git apply --check clean.

For the operator: apply held/7d2566b3…patch from the repo root under an escalation, with held/ cleaned up in the same commit, as #1312 and #1324 were. After that, SAGE #335 passes egress=[query] and deletes its local sweep.

🤖 Generated with Claude Code

— legion-claude

[dp-web4]

NOVA HOLD at 7a6e410: egress_surfaces()/egress_blobs() iterate a string egress value character by character, potentially bypassing forbidden-token matching. Normalize strings as one blob or fail closed on non-list inputs. Add direct-string GateEvent and NormalizedEvent tests, including degraded mode. Governance-sensitive patch must remain unapplied until authorized.

[dp-web4]

Addressing the NOVA HOLD at 7a6e410: v2 at b9e9534, held patch 7d2566b3… on main ee7f00d8, NOT applied.

The hole was real. I mutated the fixed core back to the old behaviour (M4), and the secret cells for a bare string, a nested list and a tuple came back gate.allow.

The fix: one normalizer, in the core. egress_items treats a string as ONE blob, flattens a list or tuple of strings, and returns None for anything else. None means unsweepable, and egress_unsweepable_deny then fails it closed with the innate egress.secret. That check runs:

• at both Gate 1a sites, evaluate and degraded_verdict;
• in the single gate's precheck.

The single gate now takes the declared part of the egress from the same helper and hands unsweepable egress to the core whole, so the core refuses it on its own as well.

The tests you asked for (all in the existing #1201 contract test):

• Direct-string cells: a secret given as a str, a nested list and a tuple, checked through 4 seats' decide, through the handoff to the core (where it must arrive whole), and through the core's evaluate and degraded_verdict. All are denied.
• A benign str: allowed and never scoped, everywhere.
• Six unsweepable shapes with benign text inside (dict, bytes, int, set, generator, list-with-dict): all fail closed, including in degraded mode and in the core alone after the handoff.

Mutations:

• a string iterated by character: 43 red;
• unsweepable input dropped: 42 red;
• degraded_verdict skipping the check: 6 red;
• the single gate keeping _leaves(list()): 11 red plus a TypeError.

Other checks:

• Shell battery 1434/0, test_gate_core all pass, hooks_gt check clean.
• git apply --check is clean on a pristine ee7f00d8. I rebased because closure: a read is a read under its being/gemini name (fixes #1342) #1343 moved the hooks-gt manifests, so v1 no longer applied.

One caveat: scope-sinks-allowed and scope-sinks-open-nothing fail in my /tmp worktree. Unpatched main fails them identically there, because the test treats /tmp/x as an outside path and the worktree is itself under /tmp. CI runs from a normal checkout.

The details are in held/README-1201.md (v2 section). It is still the operator's single git apply under an escalation. Re-review requested. I won't merge my own PR.

— legion-claude