[EmergentMonk]

Daybreak scan provenance

Two completed RHEL-LAB repository scans at the exact base SHA 889248b59e4e2cb7c06d8a635c0a07cb2cd39c1e identified 8 source findings (3 medium, 5 low). Scan IDs:

• wfr_2ef0982c13d785cbdfbf9ecc157a3ccc863cb4085e09dcd70e9124f86bae68f2
• wfr_f166c5a69c210c6a14bdb64c37311e11fffd8e8dd8a0e0e5e0bd0e0dfb0cac99

Fix groups

• Directory trust boundaries for VM preparation and offline snapshots: trusted ancestor ownership/modes, pinned root/subdirectory descriptors, no-follow and exclusive creation, descriptor-backed qemu-img inputs and outputs.
• Evidence sealing/verification: descriptor-relative tree enumeration and file hashing, reject symlink/special-file swaps, detect observed concurrent metadata changes and require quiescent sources.
• Protect manifest metadata with 0600 no-clobber creation in a pinned private output directory; escape untrusted filename characters in CLI diagnostics.
• Tests cover raced substitutions, unsafe parent modes, no-follow file behaviour, manifest permissions, and simulated snapshot receipts.
• Update README, AGENTS.md, Virtual Testbed guide, Daybreak gate provenance.

Review and validation

• No RHEL VM, host installation, network scan or kernel experiment is run by this PR. All source checks run under Python standard library CI.
• These changes mitigate the eight original issues; not yet verified by a fresh Daybreak scan. Do not mark findings closed or claim security clearance without follow-up.
• Operator review and merge required, after checks and any subsequent Codex/Daybreak review findings are addressed.

Notes

• Directory FD pinning is intended for Linux /proc/self/fd and a trusted operator identity; no absolute guarantee against simultaneous same-UID/concurrent guest writers. Snapshot requires a manually coordinated, exclusive offline window.

Summary by Sourcery

Harden filesystem trust boundaries across VM preparation, offline snapshots, and evidence sealing and verification, while documenting audit findings and operational limitations.

Bug Fixes:

• Harden VM preparation, offline snapshotting, and evidence manifest operations against unsafe filesystem boundaries, symlink races, special files, concurrent changes, and manifest clobbering.
• Escape untrusted filenames in evidence command-line diagnostics to prevent terminal-control injection.

Enhancements:

• Introduce descriptor-pinned, no-follow filesystem handling with trusted ancestor and private-directory validation for state-changing and evidence operations.
• Require quiescent or externally snapshotted evidence sources and document the limitations of byte-level race checks and offline snapshot consistency.

Documentation:

• Update repository guidance, virtual testbed documentation, README usage, and Daybreak gate provenance with the new filesystem trust requirements and audit status.

Tests:

• Expand standard-library tests for filesystem races, unsafe parent permissions, symlink handling, private manifest and receipt modes, pinned destinations, and simulated snapshots.

[sourcery-ai]

Sorry @EmergentMonk, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 2 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-12T08:33:06.031626Z	a18ca67	Manual request
🔒 Security Review	✅ Completed 2026-11-12T08:34:08.993505Z	e7204d9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sourcery-ai]

Reviewer's Guide

Implementation

Add pinned, no-follow filesystem primitives that validate trusted ancestors and provide private directory and descriptor-relative file operations.

• scripts/safe_fs.py L1-120

Use pinned directory and file descriptors for evidence traversal, hashing, manifest creation, and verification, while rejecting observed races and escaping untrusted diagnostic text.

• scripts/evidence.py L13-21, L26-140, L145-157 (+1 small edits)

Pin lab state during VM preparation and offline snapshots, use descriptor-backed qemu-img paths and exclusive outputs, and detect observed source or output changes.

• scripts/testbed.py L264-284, L300-317, L326-389 (+5 small edits)

Documentation

Document filesystem trust requirements, private manifest handling, snapshot descriptor behavior, and the limits of audit claims.

• AGENTS.md L21-22
• README.md L47
• docs/DAYBREAK_GATE.md L3
• docs/VIRTUAL_TESTBED.md L11, L20, L79

Tests

Exercise evidence race rejection, private manifest creation, unsafe destinations, pinned output behavior, and escaped diagnostics.

• tests/test_evidence.py L137-198 (+6 small edits)

Exercise trusted-parent rejection, pinned VM preparation, snapshot symlink refusal, and private snapshot receipts.

• tests/test_testbed.py L13, L161, L206-273

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[EmergentMonk]

@codex Please Review this exact SHA a18ca67de09120a0c0d235f762763b648788d8d6against the existing contract. Report only actionable correctness defects, with a minimal reproduction, expected versus actual behavior, and affected lines. State whether each reproduction was executed or statically inferred. Don’t repeat fixed findings without a new failing case. Keep architectural suggestions separate and non-blocking.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: a18ca67de0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".