stack/docs/plans/reviews/2026-09-07_tmux-transport-r4-verdict.md

R4 independent verdict

Reviewer: Filbert. Author: Darkwing.

Verdict: NOT APPROVED. Request changes.

Reviewed only the frozen 2026-09-07_tmux-transport-r4-export/ candidate under Jason's transport-only contract. R2/R3 remain NOT APPROVED; their application-delivery failures are not reclassified as successes.

Manifest SHA-256: 343099f890ad4e3db14ffae7603bf49b9383aa8f40c5123b524361371874026f. All eight listed hashes passed before and after testing. Tests used a disposable copy, fake commands, and private scratch tmux sockets. No live-seat sends, source edits, deployment, or commits.

Blocking finding R4-F1: remote argument injection defeats the transport contract

The final remote ssh invocation in tools/tmux/agent-send.sh interpolates DST_TARGET and RETRIES inside literal single quotes without escaping embedded quotes. Neither input is restricted enough to make that safe. Local validation of -r in the shipped sender cannot protect shell parsing that occurs before the sender runs.

Independent reproductions replaced ssh with a local stub that executes its final command using bash -c, with the shipped script still on stdin. Tmux was a recording fake, so no remote connection or real pane was involved.

• Session argument x'; printf 'UNAUTHORIZED_EXTRA_EFFECT\n'; # returned exit 0 and printed the injected marker. There were zero tmux calls and no application-acceptance-unknown output. Exit 0 therefore did not establish even the approved transport sequence.
• Retry argument 2'; printf 'UNAUTHORIZED_EXTRA_EFFECT\n'; # returned exit 0, performed the normal transport calls, then executed the extra command. The compatibility option can cause effects beyond one paste and one Enter.

This is a transport failure and extra-effect defect, not a demand for application confirmation. README's claim that base64 avoids all shell-quoting hazards does not hold for these non-body arguments.

Required correction: shell-quote every remote argument independently, validate retry syntax before invoking ssh, and add executable remote-shell regression tests for quote-bearing arguments. A stub that merely records the ssh string misses this defect. Keep the frozen R4 export unchanged; corrections need a new candidate.

Verification and limits

Evidence directory: /tmp/filbert-r4-CPbHGs/. Reproducer: probe.py; observed results: probe.log. Run with python3 /tmp/filbert-r4-CPbHGs/probe.py.

All five supplied entry points independently returned 0, with separate logs named after each script:

• test-send-message-transport.sh, target/load/paste/key failures and success, Unicode/multiline body, -r 999, verbose metadata, no capture calls, at most one paste/key.
• agent-send.test.sh, wrapper grammar and sender identity.
• test-send-message-socket.sh, real private named/default sockets, concurrent buffers, exact/prefix targets, ambiguity, and routing.
• test-agent-send-socket-live.sh, C1-C6 and sabotage controls.
• test-send-message-verdict.sh, compatibility delegation to transport tests, not an additional screen-verdict test.

The direct sender checks each transport operation, pins the resolved pane ID, attempts named-buffer cleanup on exit, and does not parse a screen or issue retry keys. Its normal success wording correctly leaves application acceptance unknown. No application acknowledgement is inferred. A separate real hidden-draft application fixture, forced cleanup failure, and pane replacement race were not run in this review; the remote injection already blocks approval. Supplied passing suites do not cover the demonstrated remote-shell execution defect.

Jason retains issue closure and user acceptance. This verdict grants no push or deployment authority.