Skip to content

Repository navigation

Handoff: CS-RG managed-execution suspension (#75) and the DevGuard boundary revalidation (2026-09-27) #76

Open
Open
Handoff: CS-RG managed-execution suspension (#75) and the DevGuard boundary revalidation (2026-09-27)#76
Labels
documentationImprovements or additions to documentation

Description

@novelKR
novelKR
opened on Sep 27, 2026

What this issue is

The CodeSpace-side entry point for continuing the work of the 2026-09-27 session without access to that session. It is a living tracker: when the state changes, add a comment (date, what changed, evidence link) and tick the boxes below. The primary tracker for the cross-repository work is novelKR/DevGuard#14. This issue covers what a CodeSpace agent must know, must not do, and still has to check. The dated snapshot is the CodeSpace note .github/notes/pr75-cs-rg-suspension-handoff.md (file at 6a4461e), added by #77.

State when written (re-queried 2026-09-27 15:05 UTC; PR heads rechecked 15:50 UTC)

Item Value Evidence
CodeSpace main 794867ef52f530be6bc0d91aa10416d5195367b7 (merge of #73) CI run 36308518615 and documentation run 36308519199 success
Codex pin 6b9826e3aa83b1a5947db50f4332cb9c65f1b340 (rust-v0.154.0), unchanged git ls-tree origin/main third_party/codex
#75 hold notices; head 1bee230595698b0974df43561bccfce67d7e8cb9; not merged; CLEAN 5 success, 6 not selected by the CI plan (runs 36317763003, 36317763516)
#77 CodeSpace session-close note; head 6a4461e5445bf51103dacfa8cb08f585732b76b3; not merged read on the PR
Last scheduled full run 36275459398 on b6e7ed2 (before the ETXTBSY fix), failure no scheduled run on 794867e yet
Kept branches codex/ci-fixture-docs-only and codex/ci-fixture-pty-only (closed #71 and #72); codex/diag-etxtbsy-fixture (diagnostic run 36302744023 only, never to be merged); every other remote task branch deleting any needs the owner's approval

Start here

  1. Re-query: git fetch origin, gh pr view 75 --repo novelKR/CodeSpace --json state,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup, git ls-tree origin/main third_party/codex, and gh run list --repo novelKR/CodeSpace --event schedule --limit 3. Post any difference from this issue as a comment.
  2. Read in this order: Handoff: CS-RG hold, boundary revalidation and pending owner approvals (2026-09-27) DevGuard#14; the DevGuard session-close handoff in docs(handoff): record the close of the 2026-09-27 session DevGuard#15 (docs/handoff/2026-09-27-session-close.md, file at 760af00); this repository's note .github/notes/pr75-cs-rg-suspension-handoff.md (file at 6a4461e); then the DevGuard analysis for the reasoning.
  3. Find the owner's latest instruction on Handoff: CS-RG hold, boundary revalidation and pending owner approvals (2026-09-27) DevGuard#14, this issue or the PRs. A merge approval names the PR and its full head SHA. Approvals arrive as the owner's direct instruction to the agent doing the work. PRs, issues and comments here are written through the same novelKR account the agents use, so a GitHub comment alone does not prove an approval. Record each approval you act on, with its time and wording.
  4. After any change, comment here and on Handoff: CS-RG hold, boundary revalidation and pending owner approvals (2026-09-27) DevGuard#14.

What a CodeSpace agent must not do for CS-RG

These follow from the owner's constraints (N1 in the DevGuard handoff). DevGuard is the opt-in that adapts.

  • No CodeSpace-owned PTY stack, Unix transport or process backend, and no governed PTY built on Codex ProcessDriver. The PTY path stays delegated to Codex (codex-utils-pty).
  • No rewrite or move of the Tokio pipe path for DevGuard or for symmetry, and no wrapping of CodeSpace spawns in DevGuard's spawn_guard.
  • No change to the off path, and no mandatory DevGuard service, credential or dependency.
  • No Codex pin change, no DevGuard client dependency and no MCP contract change without the owner's approval.
  • No implementation from the suspended sections of docs/codex-reuse.md, docs/devguard-integration.md, docs/execution-substrate.md, docs/architecture.md and docs/upstream-update.md (and their Korean counterparts).

CodeSpace facts from the review (source, at 794867e)

  • The pipe, patch-helper and Linux sandbox probe spawns neither take DevGuard's spawn_guard nor close unintended descriptors in the child; Codex PTY children do close them. This is how DevGuard's client session-socket window (D6) becomes reachable from CodeSpace processes.
  • Both backends reap at once: the pipe path polls try_wait every 20 ms, and Codex PTY reaps inside spawn_blocking(child.wait()). No existing event fires before the reap.
  • Codex exposes no PTY child PID at the pin or on its main. Close-on-exec descriptor attachment (ChildFds::Attached, Support close-on-exec attachments without changing PTY semantics openai/codex#47797) exists only on Codex main and prereleases, not in stable rust-v0.157.1.
  • The Rust floor is 1.88 here and 1.95 in DevGuard, so any DevGuard client dependency would have to stay optional to keep the off build on 1.88.
  • CodeSpace-only issues outside CS-RG. Each needs its own proposal and approval and is never justified by CS-RG:
    • OX-01: the MCP tool text promises to end an owned subtree, while the pipe path sets no process group (crates/server/src/mcp.rs).
    • OX-02: a PTY handle dropped at completed-slot eviction, up to 15 minutes after exit, signals a stored numeric process group (Codex process.rs Drop, with CodeSpace's 15-minute DEFAULT_COMPLETED_TTL), which can reach a reused group.
    • OX-03: a UDS worker setup failure before the handshake leaves the worker process and its directory (crates/server/src/runtime.rs).

Checklist

Activity

  1. novelKR
    added
    documentationImprovements or additions to documentation
    on Sep 27, 2026
  2. novelKR
    added a commit that references this issue on Sep 27, 2026

    docs: address the independent review of the CS-RG suspension handoff …

    6a4461e

  3. novelKR commented on Sep 27, 2026

    @novelKR
    novelKR
    on Sep 27, 2026
    OwnerAuthor

    2026-09-27 15:55 UTC. Tracker opened at session close (first log entry).

  4. novelKR commented on Sep 27, 2026

    @novelKR
    novelKR
    on Sep 27, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    2026-09-28 owner direction (new session).

    • Preserve CodeSpace's selective Codex-upstream consumption strategy and flexible explicit pin-update policy.
    • DevGuard is explicitly allowed to use Codex and other external dependencies behind adapters; this does not make any DevGuard dependency mandatory for the CodeSpace off path.
    • No specific CodeSpace Codex pin change, DevGuard dependency, runtime implementation or upstream submission is approved merely by this policy direction.
    • CS-RG still must not introduce a CodeSpace-owned PTY/process backend or rewrite unaffected execution paths for DevGuard.
    • The owner has instructed the agent to proceed with the previously recommended merge plan. Exact-head checks remain required; docs: mark the planned CS-RG managed-execution design as suspended #75 is first priority in this repository, docs: record the CS-RG suspension handoff note #77 follows after base re-verification.

  5. novelKR commented on Sep 27, 2026

    @novelKR
    novelKR
    on Sep 27, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    2026-09-28 merge-plan execution.

    • Merged docs: mark the planned CS-RG managed-execution design as suspended #75 at exact head 1bee230595698b0974df43561bccfce67d7e8cb9; merge commit 8a5a924679e0fcec35b74d2fcf59ec64bbb256a4.
    • Re-verified the moved base, then merged docs: record the CS-RG suspension handoff note #77 at exact head 6a4461e5445bf51103dacfa8cb08f585732b76b3; merge commit 326bdcb181f62f61bcb3c4e9c3de7535d50b0232.
    • Current CodeSpace main is 326bdcb181f62f61bcb3c4e9c3de7535d50b0232. Documentation publication has succeeded; the full post-merge Rust CI run 36336337315 is currently in progress.
    • No Codex pin, dependency, runtime or MCP change was made.

  6. novelKR commented on Sep 28, 2026

    @novelKR
    novelKR
    on Sep 28, 2026
    OwnerAuthor

    2026-09-28 01:40 UTC. W0 intake delta for CS-DG-UPSTREAM-ADAPTER-WORK-SPEC-1 v1.0 (new session).

    The latest state is the owner direction and the merge-plan execution above; they are not restated here. The issue body is a dated snapshot from 2026-09-27 15:05–15:50Z. The cross-repository delta, with evidence digests, is on novelKR/DevGuard#14.

    Baseline (re-queried at 01:20Z)

    • main is 326bdcb181f62f61bcb3c4e9c3de7535d50b0232.
    • The Codex gitlink is 6b9826e3aa83b1a5947db50f4332cb9c65f1b340 (rust-v0.154.0), unchanged.
    • No CodeSpace PR is open.

    Post-merge verification

    Local alignment

    Scheduled run

    • The old task "read the first scheduled run on 794867e" no longer applies: main moved to 326bdcb before any scheduled run on 794867e.
    • In its place, the first scheduled run on 326bdcb was read: run 36355653598, created 22:32Z, succeeded with 16 jobs.
    • linux_sandbox::tests::prepare_unread_large_stdin_times_out passed, and the Integration log contains no ETXTBSY, "text file busy" or "os error 26".
    • So the test(runner): write sandbox helper fixtures from a child process #74 fixture fix showed no recurrence in this run. One run does not prove the race is gone.

    Next: a CodeSpace .github/notes/ pointer PR will link the DevGuard packet. It changes no policy page, pin, dependency or off behaviour, and a .github/** change runs full CI by policy. No CS-RG CodeSpace work, pin change or dependency is authorized by this pass.

  7. novelKR commented on Sep 28, 2026

    @novelKR
    novelKR
    on Sep 28, 2026
    OwnerAuthor

    2026-09-28 04:24 UTC. W1–W2 result and W3 owner gate for CS-DG-UPSTREAM-ADAPTER-WORK-SPEC-1 v1.0 (CodeSpace side).

    This follows the W0 intake delta. The cross-repository result, with evidence digests and all nine owner decisions, is on novelKR/DevGuard#14. This comment adds only the CodeSpace-side delta.

    Records

    • #78 is the pointer note .github/notes/devguard-upstream-adapter-packet.md.
      • Head c8912abf50ee090bdc6eaa6054a0ab524210f276, base 326bdcb.
      • At the single read (04:21Z): documentation run 36377211672 succeeded; CI 36377211087 was in progress. The in-progress run was recorded, not polled. Read it once before any merge.
    • novelKR/DevGuard#16 is the packet itself, at head a67facbbebb192d83126c5afa1a9ef2d713c2e2e.
    • Unchanged in CodeSpace:
      • main 326bdcb and the Codex gitlink 6b9826e (rust-v0.154.0);
      • every page, including the CS-RG hold notices;
      • manifests, locks, scripts and CI policy;
      • the off path.

    Findings that concern CodeSpace

    • PTY adapter. From rust-v0.159.0-alpha.11 (72b8d8b) and Codex main, spawn_pty_process takes ChildFds<'_>. A pin move past stable rust-v0.157.1 would need a coordinated edit of crates/pty/src/lib.rs:66-77, for example ChildFds::Inherited(&[]). No pin change is proposed.
    • Descriptor inheritance on macOS.
      • Rust std and tokio create pipes and sockets non-atomically, and std Command does not use POSIX_SPAWN_CLOEXEC_DEFAULT.
      • In the BD-1 scratch diagnostic, unrelated std and tokio children received transient PTY masters (104/2000) and pipe ends (39/2000) from other threads' creation windows.
      • By inference this applies to the Tokio pipe path, the patch helper and the sandbox probe. The effect on CodeSpace was not measured.
    • Dependency gates. check-no-model-deps.sh checks direct codex-* keys only. upstream_dependencies.py rejects the named FORBIDDEN and RUNNER_FORBIDDEN crates only. So a transitive codex-utils-pty arriving through a DevGuard client would not be flagged today. The packet drafts a check for the PR in which such a crate first appears; nothing is applied.
    • Pipe observation. Tokio 1.53.1 has no non-reaping exit observation, and no thin, backend-owned pipe facility is identified. A CodeSpace wait-loop peek is not recommended.

    Decisions that touch CodeSpace (numbering as on #14)

    • 2: merge docs(notes): point to the DevGuard upstream-adapter packet #78 at its exact head.
    • 7: when to prepare the CodeSpace wording PR for docs/codex-reuse.md:78 and docs/upstream-update.md:90-131, with their Korean pages.
    • 9: optionally, an independent CodeSpace descriptor-hygiene proposal (N1.5), not justified by CS-RG.

    No CS-RG CodeSpace work, pin change or dependency is authorized.

    Stop boundary: there is no merge, no experiment, no normative PR, no pin, dependency, service or credential change, and no upstream submission until the owner decides.

  8. novelKR commented on Sep 28, 2026

    @novelKR
    novelKR
    on Sep 28, 2026
    OwnerAuthor

    2026-09-28 06:40 UTC. W3 owner decisions received; evidence housekeeping done (CodeSpace side).

    This follows the W1–W2 result. The full delta, with evidence digests, is on novelKR/DevGuard#14.

    • Final CI of docs(notes): point to the DevGuard upstream-adapter packet #78 at c8912abf50ee090bdc6eaa6054a0ab524210f276: CI 36377211087 succeeded, 16/16 jobs; documentation 36377211672 succeeded. Both are preserved locally.
    • Decisions that touch CodeSpace:
      • The owner approved merging docs(notes): point to the DevGuard upstream-adapter packet #78 at c8912ab, after docs(handoff): record the upstream-adapter W0-W2 packet DevGuard#16 is merged at a67facb and once the note is confirmed to still name that merged head. A changed head in either PR means stop for renewed approval.
      • Experiment C runs in a scratch harness outside both repositories. It uses std, tokio and Codex children, and synthetic sessions only.
      • A separate, non-implementation CodeSpace descriptor-hygiene issue is authorized. It is justified on CodeSpace's own correctness terms, not by CS-RG. Any implementation needs its own approval.
      • No normative policy PR, pin change, dependency or integration is authorized. The CS-RG suspension stays in force.
    • Unchanged: main 326bdcb, the gitlink 6b9826e and the off path.

  9. novelKR commented on Sep 28, 2026

    @novelKR
    novelKR
    on Sep 28, 2026
    OwnerAuthor

    2026-09-28 07:23 UTC. #78 merged and verified.

    • #78 merged at its approved head c8912abf50ee090bdc6eaa6054a0ab524210f276 as ab0341b5cf5eda8c82730487d4475f1ac922daf5.
    • Post-merge main: CI 36388007427 succeeded (16/16), and documentation 36388008255 succeeded, including deploy.
    • Anomaly. A second, identical push event for main at 06:50Z produced a second successful pair (36388426590, 36388427669). main did not move and this agent pushed nothing; the cause is undetermined.
    • Local: main fast-forwarded; the pointer worktree and its local branch removed; remote branches kept.
    • Details are on novelKR/DevGuard#14.

  10. novelKR commented on Sep 28, 2026

    @novelKR
    novelKR
    on Sep 28, 2026
    OwnerAuthor

    2026-09-28 10:19 UTC. W3 result (CodeSpace side): experiments done; stopped at the next owner gate.

    This follows the #78 merge record. The full result, with evidence digests and all seven decisions, is on novelKR/DevGuard#14. The record itself is novelKR/DevGuard#17 at head 70c814c93a96f383e3241b6817fe6d42aea9ea48, not merged.

    New in CodeSpace

    • #79 was opened as a non-implementation investigation of descriptor inheritance between concurrent spawns on macOS.
      • It is justified on CodeSpace's own correctness terms: delayed EOF, lost stdin EOF, PTYs kept open.
      • It is not CS-RG. Any implementation needs its own approval.
    • Unchanged: main ab0341b, the gitlink 6b9826e, every page, script and CI policy, and the off path. No CodeSpace process was run or modified by the experiments.

    Findings that concern CodeSpace (scratch harnesses outside the repository, macOS, one host; behavioural evidence, not proof)

    • Inheritance.
      • Children spawned with std or Tokio Command inherited transient sockets and pipes that another thread was creating: in two samples of 400 per cell, up to about 12 % under continuous creation.
      • Children spawned with Codex's local Command and DescriptorPolicy::Explicit (POSIX_SPAWN_CLOEXEC_DEFAULT) held none in any cell.
      • This is the evidence base for Investigate descriptor inheritance between concurrent spawns on macOS #79's candidate directions.
    • PTY.
      • Codex's unmodified ChildFds::Attached at 72b8d8b delivered DevGuard's launch attachments to the intended child only, and a launch through it needed no DevGuard spawn.
      • A scratch observation patch kept Codex's waiter as the only reaper and needed no CodeSpace reaper.
      • A pin move past stable would still need the ChildFds adapter edit noted before; no pin change is proposed.
      • When a PTY root exits, a same-group background descendant receives SIGHUP.
    • Pipe. No backend-owned exit-observation facility was identified. CodeSpace's pipe path was not changed; the stand-in used was Tokio with a child-side step.

    Decisions that touch CodeSpace (numbering as on #14)

    Stop boundary: there is no pin change, dependency, integration, CodeSpace code change, normative PR or upstream submission until the owner decides.

  11. novelKR commented on Sep 28, 2026

    @novelKR
    novelKR
    on Sep 28, 2026
    OwnerAuthor

    2026-09-28 11:41 UTC. Session close (CodeSpace side).

    This is a session-close delta, following the W3 result. The full session-close state, the open decisions and the CI classification of DevGuard #17 are in the DevGuard #14 session-close comment. They are not repeated here.

  12. novelKR commented on Sep 30, 2026

    @novelKR
    novelKR
    on Sep 30, 2026
    OwnerAuthor

    2026-09-30 09:17 UTC. W3 record merged on the DevGuard side.

    This is a delta since the session-close comment. The full delta, including the remaining owner decisions, is in the latest DevGuard #14 comment. Next agent: start there.

    • The W3 record is merged. On the owner's decision 1, docs(handoff): record the W3 experiments and decision packet DevGuard#17 was merged at its exact head 70c814c93a96f383e3241b6817fe6d42aea9ea48, as merge commit 4898259a8a5b7c2ed0b3a46a3567cb419b0a73d5.
    • CodeSpace is unchanged.
      • main is ab0341b5cf5eda8c82730487d4475f1ac922daf5; the Codex gitlink is 6b9826e3aa83b1a5947db50f4332cb9c65f1b340 (rust-v0.154.0).
      • There was no implementation, pin, dependency, execution-backend or off-path change.
    • #79 remains an investigation and proposal only. Its bounded diagnostic is not authorized.
    • Upstream note for Investigate descriptor inheritance between concurrent spawns on macOS #79's first candidate direction. This is a source-level fact only; no pin change is proposed.
      • The stable Codex releases rust-v0.159.0 and rust-v0.159.1, published 2026-09-29, carry the same codex-rs/utils/pty tree as the prerelease 72b8d8b that W3 used.
      • rust-v0.159.0 and rust-v0.159.2 both define DescriptorPolicy::Explicit (POSIX_SPAWN_CLOEXEC_DEFAULT on macOS) and ChildFds::Attached. Investigate descriptor inheritance between concurrent spawns on macOS #79 had recorded Explicit only at the prerelease and Codex main.

  13. novelKR commented on Sep 30, 2026

    @novelKR
    novelKR
    on Sep 30, 2026
    OwnerAuthor

    2026-09-30 15:33 UTC. The counterpart PR for DevGuard design revision 2 is prepared, not merged.

  14. novelKR commented on Sep 30, 2026

    @novelKR
    novelKR
    on Sep 30, 2026
    OwnerAuthor

    2026-09-30 19:04 UTC. #79's single bounded rust-v0.154.0 baseline run is done: results, DevGuard evidence manifest 10beb5fd9319e66ac78a827617e8bfcec9bc8d6b385709458482c90207ef7cb7. No CodeSpace change is proposed, and step 3 needs its own decision.

  15. novelKR commented on Oct 1, 2026

    @novelKR
    novelKR
    on Oct 1, 2026
    OwnerAuthor

    2026-10-01 07:05 UTC. #80 is merged at 8a414e8 (merge 1bf99cf, main CI green; gitlink still 6b9826e). The #79 fix is in review as #81 (8afb701, CI green, verified against the 0.154 baseline); it is an independent defect fix, not CS-RG progress. Merges, evidence and the proposed first CS-RG unit: DevGuard #14.

  16. novelKR commented on Oct 2, 2026

    @novelKR
    novelKR
    on Oct 2, 2026
    OwnerAuthor

    2026-10-02 06:54 UTC. #81 is at a new exact head, 2629f1875a6ac16c32c23309e948af357f20003e. Its descriptor walk is now bounded by the descriptor table instead of RLIMIT_NOFILE, it fails closed, and macOS CI now runs its tests. It is verified against the 0.154 baseline, and its CI is green, including that macOS leg. It awaits exact-head merge approval. It is an independent defect fix, not CS-RG progress. Details: #79.

  17. novelKR commented on Oct 2, 2026

    @novelKR
    novelKR
    on Oct 2, 2026
    OwnerAuthor

    2026-10-02 14:03 UTC.

    • runner: keep only standard descriptors in spawned children (#79) #81 merged as dcf8c51, and its post-merge main CI passed.
    • CSRG-U1 merged. The owner merged devguard: opt-in, status-only DevGuard connection (CSRG-U1) #82 at 595f7d2 as f0a3322, and its PR CI and post-merge main CI passed.
      • What it is. An opt-in, status-only DevGuard connection, behind the devguard Cargo feature and --devguard status.
      • What it does. It reports DevGuard's status in workspace_info. It admits and launches nothing, and governs_execution is always false.
    • Verified against the U1 scope. It meets the scope, with five deviations, recorded in DevGuard #14.
    • Next unit. U2, execution-owner registration and participation readiness, is not started; it needs the owner's go-ahead.

  18. novelKR commented on Oct 7, 2026

    @novelKR
    novelKR
    on Oct 7, 2026 – with Claude
    OwnerAuthor

    2026-10-07 UTC.

    Generated by Claude Code

  19. novelKR commented on Oct 7, 2026

    @novelKR
    novelKR
    on Oct 7, 2026 – with Claude
    OwnerAuthor

    2026-10-07 10:30 UTC.

    Generated by Claude Code

  20. novelKR commented on Oct 8, 2026

    @novelKR
    novelKR
    on Oct 8, 2026 – with Claude
    OwnerAuthor

    2026-10-08 14:00 UTC.

    Generated by Claude Code

  21. novelKR commented on Oct 9, 2026

    @novelKR
    novelKR
    on Oct 9, 2026 – with Claude
    OwnerAuthor

    2026-10-09 14:45 UTC.

    • CSRG-U4 is merged. devguard, runner, server: launch governed executions once under DevGuard (CSRG-U4) #90 merged at c1c7859 as 3e5e3e8, and its post-merge main CI passed.
      • With --devguard register and --devguard-launch-helper, an execution in a required workspace is launched once under DevGuard: BeginLaunch, a one-time permit, DevGuard's devguard-launch started by CodeSpace's own pipe or PTY spawner, then the command. exec_command returns dispatch_status: confirmed or unknown, or a refusal, and never runs the command outside DevGuard.
      • Without a helper, U3's admit-then-refuse stays. Supported on macOS with native host evidence: InProcess and UDS with --runtime-bin, pipe and PTY.
      • The pins are unchanged: Codex 6b9826e and DevGuard 6e7e065. The runner wire protocol stays 7.
    • DevGuard docs: record CSRG-U4 as merged DevGuard#29 records U4 as merged-verified. Its CI passed, and it waits for the owner's merge.
    • Release. The installed DevGuard's launch helper keeps the permit reader from before Credential reader rejects an already-buffered secret when its thread stalls for 250 ms DevGuard#24. The owner chose to cut the next DevGuard release just before CSRG-U6.
    • Next: CSRG-U5, observation, reaping and release, only after the owner's separate approval.
    • Details: DevGuard #14.

    Generated by Claude Code

  22. novelKR commented on Oct 11, 2026

    @novelKR
    novelKR
    on Oct 11, 2026 – with Claude
    OwnerAuthor

    2026-10-11 15:30 UTC. Updated 15:39 UTC: novelKR/DevGuard#30 is merged.

    Generated by Claude Code

  23. novelKR commented on Oct 11, 2026

    @novelKR
    novelKR
    on Oct 11, 2026 – with Claude
    OwnerAuthor

    2026-10-11 17:50 UTC, edited 18:05 and 23:35 UTC and 2026-10-12 05:10, 05:40, 07:30 and 10:16 UTC.

    Generated by Claude Code

  24. novelKR commented on Oct 12, 2026

    @novelKR
    novelKR
    on Oct 12, 2026 – with Claude
    OwnerAuthor

    2026-10-12 14:45 UTC, edited 14:50, 15:08, 15:31 and 17:20 UTC.

    • CSRG-U6 has started on the owner's direction. It qualifies the exact CodeSpace, DevGuard and Codex candidate for the modes it supports; nothing is claimed qualified until that evidence is in and the owner approves the exact head.
    • DevGuard release first. The owner's Mac now runs 0.1.0-6e7e065-94d85365, built from 6e7e065, this repository's DevGuard pin, so the installed launch helper carries the fix for Credential reader rejects an already-buffered secret when its thread stalls for 250 ms DevGuard#24. It replaced 0.1.0-5daee5d-b3fa569e by upgrade, and status and doctor pass. It is not SLO-qualified until it is measured, about five hours with the Mac set aside, and promoted.
      • The Mac's memory pressure was at warning when the service restarted, and a starting DevGuard service admits nothing until memory has been normal for 30 seconds. Governed executions on the Mac were refused until 15:25 UTC; since then the service admits at half capacity under memory warning, and a governed Cargo build passed.
    • Consumer. CSRG-U6 runs CodeSpace against the installed service, so the Mac's DevGuard configuration now has a codespace control-service consumer (generation codespace-g1, one instance, 150 mCPU, 512 MiB and 40 tasks reserved), added on the owner's approval before the measurement. After one restart, a gateway from 7024f74 built with --features devguard registered with the service and left nothing charged.
    • Harness. scripts, docs: CS-RG qualification harness and protocol (CSRG-U6) #97 (draft) adds scripts/qualify-devguard.py, the protocol it implements (docs/cs-rg-qualification.md, English and Korean) and the decision record that keeps participation off as the compatibility path. It is validated on the Mac before its merge request.
    • No pin change. Codex 6b9826e plus the recorded patch, DevGuard 6e7e065. The next Codex pin move (0.159.x) is a separate PR.
    • DevGuard ledger. docs: record CSRG-U6 as the active unit DevGuard#33 records U6 as active. It merged at 8fca59c as ea98d7f, and its post-merge CI passed.
    • Details: DevGuard #14.

    Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    documentationImprovements or additions to documentation

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions