39 lines
3.8 KiB
Markdown
39 lines
3.8 KiB
Markdown
# R5 independent verdict
|
|
|
|
Reviewer: Filbert. Author: Darkwing.
|
|
|
|
Verdict: APPROVED under Jason's transport-only contract. Exit 0 means checked tmux buffer load, one paste, and one Enter to a pinned pane. Application acceptance remains unknown by design. This approves no application delivery claim.
|
|
|
|
R4 remains NOT APPROVED on its own record; older rejections stand. This approval covers only the frozen r5 candidate.
|
|
|
|
Manifest SHA-256: `bc6063412ce2dd43bd7e929d7ef41cedcb4c53c7132c8e5d27f9481910e53ae8`. All nine listed hashes verified before and after testing. Reviewed only the frozen `2026-09-07_tmux-transport-r5-export/`. Tests used a disposable copy, fake ssh/tmux stubs, and private scratch tmux sockets. No live-seat sends, source or export edits, deployments, or commits.
|
|
|
|
## R4-F1 disposition verified
|
|
|
|
The diff from r4 is confined to `agent-send.sh` (retry validation before SSH, per-argument POSIX single-quote escaping of the remote command), a corrected README paragraph, and the new `test-agent-send-remote.py`. `send-message.sh` is byte-identical to r4.
|
|
|
|
I reran the exact R4-F1 attacks independently, with an ssh stub that executes the real command string through `/bin/sh` and a recording tmux stub:
|
|
|
|
- Session argument `x'; printf 'UNAUTHORIZED_EXTRA_EFFECT\n'; #` now reaches tmux literally (`=x'...:0.0` target, socket `-L` value verbatim), performs the normal transport sequence, and exits 0 with the acceptance-unknown line only.
|
|
- Retry argument with the same injection is refused exit 3 before any SSH call (ssh log empty). Extended invalid retries `-1`, `1.0`, empty, and ` 2` are also refused exit 3 with zero ssh calls.
|
|
- Additional quote-bearing adversarial targets and sockets (`'"$(`echo UNSAFE`)`, newlines, Unicode, shell metacharacters `; & | > < * ? [x]`) all pass through literally with no injected effect.
|
|
|
|
## Independent verification
|
|
|
|
All six suite entry points returned 0 in an isolated environment, each with its own log: `test-send-message-transport.sh`, `agent-send.test.sh`, `test-send-message-socket.sh`, `test-agent-send-socket-live.sh`, `test-send-message-verdict.sh`, and `test-agent-send-remote.py`.
|
|
|
|
My own controls beyond the supplied suites:
|
|
|
|
- Pane identity is pinned (`%id`) for paste and Enter across success and every failure path; no step re-resolves the target.
|
|
- The named buffer is deleted on every exit path, including a forced `delete-buffer` failure and each transport failure; no residue after any run.
|
|
- Effects stay bounded: at most one `paste-buffer` and one `send-keys Enter`; no `capture-pane` anywhere in the tool; `-r 999` adds no keys; `-v` prints metadata only and never the Unicode/multiline body.
|
|
- A real isolated hidden-draft fixture on tmux 3.7c: a raw-mode receiver that enables bracketed paste and never submits retained the exact payload; output stayed `transport dispatched; application acceptance unknown`; verbose output carried no private display; no buffer residue. Observed byte stream: one bracketed paste with the embedded newline delivered as carriage return inside the markers, then exactly one trailing CR. That is one paste plus one Enter under the contract; the newline-to-CR conversion inside bracketed paste is tmux 3.7c behavior worth knowing, not a contract violation.
|
|
|
|
## Limits
|
|
|
|
The remote fix is verified by executing the exact ssh command string through a real `/bin/sh` with stubs; no real network ssh hop was run, consistent with isolated tests only. The remote tmux path is the same code path exercised live on private sockets. Trusted runtime acknowledgement remains out of scope; hidden retained drafts still cannot become delivery claims.
|
|
|
|
Evidence: `/tmp/filbert-r5-PBElK5/` (`adversarial.py`/`adversarial.log`, `hidden-draft.py`/`hidden-draft.log`, per-suite logs).
|
|
|
|
Jason retains issue closure and user acceptance. This verdict grants no push or deployment authority by itself.
|