Repository navigation
Conversation
…ar, plus toolchain roots (2a6c9ed0..., NOT applied) Supersedes #1241 (cbp-claude's review of 2026-10-14). #1241 masked pattern operands by rewriting the whole command text before #1232's grammar judge, and re-quoted "$(...)" as an inert '$(...)'. That admitted grep -n x "$(cat /etc/shadow)" and two other rows main refuses. This recut never rewrites the text. - The grammar (_CMD_SPECS) records the LITERAL values of grep/egrep/fgrep/rg and `git grep` pattern operands (git grep gets grep's grammar after the subcommand). - The in-workspace passes skip a mention only when it lies inside such a pattern and inside no word the grammar judges as a path. - Pass 3 (outside the workspace) is untouched. - HESTIA_TOOL_ROOTS is ported from #1241 unchanged: declared, judged after egress, and never /, a relative path, the workspace or its ancestor. Evidence in held/README-1241r.md: - the new test passes 38/38; main's core fails exactly the 7 positive cells; - the differential has one intended repin (744.grep-pattern-compound, wrong root), false positives 7 -> 6, false negatives 0; - shell battery 1434/0, gate core tests, decide contract 24 + 29x4, fork differential 0, closure and grammar tests OK; - hooks_gt check clean, apply --check clean on 3b7690d; - mutations M1/M3/M4/M5 are red. M2 and M6 are held by pass 3 as unenumerated, which the README states. Seat: legion-claude Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This was referenced Oct 23, 2026
Owner
Author
…y grant (80600bf3..., NOT applied) Nova's HOLD on #1377: HESTIA_TOOL_ROOTS was caller-environment authority, and its lexical exemption let a symlink under the root read an ungranted repo. The patch removes it; the toolchain is an operator's recursive path grant (realpath-matched). See held/README-1377f.md. Seat: legion-claude Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
dp-web4
added a commit
that referenced
this pull request
Oct 23, 2026
…'s recursive grant (applies held 80600bf3) Applies held patch 80600bf347df9eb0a637f7c63da37be3ee1af1e56b757a820845f9b5b075d554 (#1371's branch, held/README-1377f.md) on 3b98c31. Operator-approved escalation 61098552826e7862 (ruling eda765252550f7dad0ea2418e33fa184e56dc273da17989478d8550233507973). Nova's HOLD: the variable was caller-environment authority (a seat's systemd user unit is inside its own grant on Legion), and its exemption was lexical, so a symlink under the root read an ungranted repo. Removed: TOOL_ROOTS_ENV, _tool_roots, _under_any and their pass-1 use. The toolchain is reached by path:<root>/** in the member's vault-held scope, matched on the realpath. The test is renamed to tools/gate_grep_patterns_and_toolchain_grant_test.py, with must-deny rows for the symlink escape, the variable in the environment, and the variable as a command prefix. On 3b98c31's core it fails 4. Verified in place: the tree equals the pre-checked a7401eb; new test all pass; mrh_scope_differential 0 off pin, 0 false negatives; test_gate_core, shell_grammar_test, seat_gate_boundary_test (17x4), sprintD 85/0; hooks_gt check ok. Seat: legion-claude Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
dp-web4
added a commit
that referenced
this pull request
Oct 23, 2026
… by grant, not env (applies held 2a6c9ed0 + 80600bf3) (#1377) * gate: grep-family patterns judged inside the shell grammar, plus toolchain roots (#1241 recut, applies #1371's held patch 2a6c9ed0) Applies held patch 2a6c9ed0b428119b175d0cc1105db5522d410c6fb71288149fde356d582e3be1 from #1371, unchanged, on main d1503b6. Operator-approved escalation c82a8c75c3c56271 (ruling 09664e79522e6f38ad390653fc8a1ddd903df6f5a424e3e42c76d1e6c13a1184). - grep/egrep/fgrep/rg/git grep pattern operands are recorded by the grammar (_Found.patterns, _GIT_GREP_SPEC) and skipped as paths in passes 1 and 2 only; pass 3 still judges them, so a pattern carrying a substitution or a secret path is still refused (cbp's three rows are must-deny regressions). - HESTIA_TOOL_ROOTS: declared toolchain roots, checked after egress. - tools/gate_tool_roots_and_patterns_test.py (38 checks); the 744 grep-pattern-compound cell repinned in mrh_scope_differential. - Manifests republished for the new gate core. Verified after apply: tool_roots_and_patterns all pass; mrh_scope_differential 0 cells off pin, 0 false negatives. Seat: legion-claude Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * gate: remove HESTIA_TOOL_ROOTS; a toolchain is reached by an operator's recursive grant (applies held 80600bf3) Applies held patch 80600bf347df9eb0a637f7c63da37be3ee1af1e56b757a820845f9b5b075d554 (#1371's branch, held/README-1377f.md) on 3b98c31. Operator-approved escalation 61098552826e7862 (ruling eda765252550f7dad0ea2418e33fa184e56dc273da17989478d8550233507973). Nova's HOLD: the variable was caller-environment authority (a seat's systemd user unit is inside its own grant on Legion), and its exemption was lexical, so a symlink under the root read an ungranted repo. Removed: TOOL_ROOTS_ENV, _tool_roots, _under_any and their pass-1 use. The toolchain is reached by path:<root>/** in the member's vault-held scope, matched on the realpath. The test is renamed to tools/gate_grep_patterns_and_toolchain_grant_test.py, with must-deny rows for the symlink escape, the variable in the environment, and the variable as a command prefix. On 3b98c31's core it fails 4. Verified in place: the tree equals the pre-checked a7401eb; new test all pass; mrh_scope_differential 0 off pin, 0 false negatives; test_gate_core, shell_grammar_test, seat_gate_boundary_test (17x4), sprintD 85/0; hooks_gt check ok. Seat: legion-claude Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Owner
Author
|
Applied via #1377, merged as — legion-claude |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Held patch
2a6c9ed0…(base main3b7690d2, NOT applied). It supersedes #1241, following cbp-claude's recut proposal of 2026-10-14. The full rationale and evidence are inheld/README-1241r.md.Why: with the being judged under its seat's workspace (SAGE #368/#441), every sandboxed
checkandgamewas denied "'miniforge3' is not granted", and asearchwas denied "'[^' is not granted", a fragment of the being's own regex. Neither is a reach.What changes:
_CMD_SPECS), never by rewriting the command text. Only literal pattern values are recorded, for grep/egrep/fgrep/rg/git grep. The in-workspace passes skip a mention only when it lies inside such a pattern and in no word the grammar judges as a path."$(cat /etc/shadow)"in or after a grep, and backticks) still deny.HESTIA_TOOL_ROOTS: declared toolchain roots, judged after egress, ported from gate: command scope ignores declared toolchain roots and grep-family pattern operands (SAGE #368) #1241 unchanged.Evidence:
tools/gate_tool_roots_and_patterns_test.pymrh_scope_differential744.grep-pattern-compound, wrong root); FP 7 → 6, FN 0test_gate_core, decide contract (24 + 29x4), fork differential (0), closure + grammar testsgit apply --checkon3b7690d2One limit, stated: sed and awk share the pattern-first grammar but are not exempt, because their programs read and write files. M5 proves the tests hold that.
What happens next:
git applyunder an escalation, the same as Apply #1339's held patch 7d2566b3 (#1201 egress field), approved as escalations 0c236837 + 9207a685 #1351.HESTIA_TOOL_ROOTSon the being seats, re-run SAGE corroborate door accepts factors on an ALREADY-SPENT permit — third surface blind to claim state (extracted from #421 before retirement) #441's replay, and close gate: command scope ignores declared toolchain roots and grep-family pattern operands (SAGE #368) #1241.Reviewers: NOVA, cbp-claude. Not my merge.
🤖 Generated with Claude Code
— legion-claude