The parent-escape rejection grep used a double-escaped ERE ('\\.\\.'), which
matches a literal backslash followed by any character - never a normal '..'
component - so an absolute HOME containing '/../' traversed to a planted tree
and executed it (rev-code-02 delta probe: rc 0, no diagnostic, sentinel
present). Corrected to the single-escaped ERE ('\.\.'), which matches a
literal dot-dot component.
Suite: A8 parent-escape hostile arm added (absolute HOME
<base>/../escape-target, executable planted at the resolved tree outside the
seat home) - the real launcher must refuse with the parent-escape diagnostic
and leave the sentinel absent, and a guard-bypassed mutant copy MUST execute
the same plant under the identical arm (sentinel present), proving the check
is what stands. The arm's HOME traversal was also corrected during authoring:
the first draft double-prefixed the worktree path, which made the candidate
nonexistent and would have let the mutant pass vacuously (the same
wrong-resolved-path class B3 caught).
Marker T110-DISPATCH-TOPHER-1N2O / ORCH-T110-B2FIX-X8Y9.
B1 (rev-code-02): fleet/bin/** made keep-mode update prune existing estate
executables absent from the package source. Replaced with exact entries
(fleet/bin/mosaic, fleet/bin/test-mosaic-launcher.sh); parity spec gains a
dedicated ownership probe asserting the two shipped files are framework-owned
while seat-up.sh, launch-seat.sh and the directory itself stay operator-owned,
on both resolvers.
B2: a relative HOME bypassed the fallback guard (component probes were
absolute-prefixed, so a relative candidate walked nonexistent absolute paths
and a planted cwd-relative CLI executed). The untrusted fallback candidate is
now refused unless absolute, with parent-escape (..) components refused as
well; the symlink walk then applies.
B3: A6 planted the executable off the resolved candidate path, so a
guard-bypass mutant stayed green (nothing executable at the candidate). The
symlink now points at $PLANT/.npm-global so the candidate resolves exactly to
the planted binary, and the suite gains two mutation controls: a
guard-bypassed copy MUST execute both the absolute-symlink plant and the new
relative-HOME plant (sentinels asserted present), while the real launcher
refuses both (rc 127, diagnostics, sentinels absent).
Marker T110-DISPATCH-TOPHER-1N2O / ORCH-T110-REWORK-M5N6.
Ships fleet/bin/mosaic in the framework so the T106 shipped-first launcher
contract survives split-home layouts. The shipped npm mosaic resolves from the
passwd real home instead of $HOME: under a seat home (HOME=seat dir) the
operator's npm prefix is still found, so 'HOME=<seat-home> fleet/bin/mosaic
--version' returns the shipped version. The $HOME/.npm-global candidate is
consulted only when the passwd lookup fails, and then every path component
must be a non-symlink (secure descriptor traversal; a planted descriptor is
refused without execution).
T106 behavior preserved verbatim: worktree builds are MOSAIC_CLI_WORKTREE
opt-in only, health-checked, shipped fallback on doubt; MOSAIC_FLEET_CLI_OFF
forces pure pass-through; no runnable candidate exits 127 with the documented
stderr line; stale worktree candidates never regain default precedence
(without the opt-in env the worktree path is never read).
Manifest: fleet/bin/** added to the [framework] section so the updater and
installer both own the subtree (manifest-parity 17/17 green). Hermetic suite
test-mosaic-launcher.sh covers the split-home positive, typed failure,
stale-worktree non-precedence, opt-in healthy/unhealthy, OFF pass-through, and
descriptor-refusal arms. Marker T110-DISPATCH-TOPHER-1N2O.
Per ops-ci-01's procedure (comments 23386/23394, brain D27): pipeline config
travels with the commit under test, so the controlled rerun requires the pinned
anchor in the PR head itself. This merge absorbs everything next took since the
original merge parent (1bdeed62): the ci-base pin (cb9a0d1, lock-9cb7ffcd8828),
the legacy-credential removal (#1325), and the ci-queue-wait statuses:null fix
(#1129 — the branch from the divergence analysis, now landed).
One conflict, same file as round 1: test:framework-shell union — our 54-entry
chain plus next's new test-ci-queue-wait-no-status.sh entry at its position
(55 entries, every target existence-verified). Enumeration guard green:
population 61, enumerated 46, excluded (signed) 16.
topher
marcieandorch-01
fred
ops-deploy-01
code-be-02andorch-01
veronicaandorch-01
code-infra-01andorch-01
code-be-01andorch-01
fargoandfred
ops-01