T100, 16.3a: a served repository's bindings are trusted per machine (plan 034)

[brettheap]

Lane: openxfactory-4 (openXfactory-4-openDox_extraction)

Arc: neutral-product-standalone-operability

Plan 034 T100. #1144 box 16.3a: a served repository's bindings are trusted per machine. RULED by Brett Heap on 2026-10-02 in openxFactory#656 comment 5962785556, item 2: "Trust per machine (Recommended)". The text this conforms to is T007 batch M (openxFactory#1219, merged as cc775fea): box 16.3a and F16.1's batch M block. What openxFactory registers when it hosts openDox was RULED on 5970369724; that registration is T094's (below).

Phase 3. The base is main. T100's After line (T080, openDox-code#64 and T084) is met: #64 landed as 8e377823, and #77 (T084) as e49b17c3.

• This branch merged Broker-path credential hardening (follows T080): a minted token keeps a built-in credential's rules (plan 034) #64's final pre-squash head 04bcb68e.
• It then merged main 8e377823 with git merge-tree --merge-base 04bcb68e, both parents recorded.
• It then merged main e49b17c3 (T084, 4.3: the last deferred reaches through declared seams; consumer_reach retired (plan 034) #77), 390e2c28 (T103, every loopback route checks the Host (DNS rebinding) (plan 034) #80), 0116293a (T102, the staging workbench offers the editors and the chat rail by scope (plan 034) #81), c4b55cc4 (T102 follow-on: the chat rail reads a thread only with a branch session (plan 034) #85) and ca9e1bd5 (T082, 16.5: every other surface works with no model (plan 034) #76) with ordinary merge commits. The branch held none of T102, the staging workbench offers the editors and the chat rail by scope (plan 034) #81's, T102 follow-on: the chat rail reads a thread only with a branch session (plan 034) #85's or T082, 16.5: every other surface works with no model (plan 034) #76's commits.

Nothing was rebased. The diff against main is T100's 12 files only.

The defect

The entry points read the bindings document of the repository they SERVE (declared_model_port_factory over bindings_path(checkout_root)). A binding written into that file by hand, or arriving with a clone, needed no approval. The adversarial review of 2026-10-02 showed two things:

• A committed broker_argv of ["/bin/sh", "-c", "id > $PWD/pwned"] ran on the first chat turn.
• A committed env: reference sent an unrelated secret of the operator's to the file's endpoint as a bearer token (repo_binding_exfil.py).

The first two cases of tests/test_model_binding_trust.py are those two findings, run as the review ran them. On main 8e377823 without this change, they fail for the defect's own reasons:

AssertionError: the endpoint was contacted, and was sent ['Bearer cloud-secret-NOT-A-MODEL-KEY-7d41e9a2c0b85f36']
AssertionError: the repository's program ran: uid=1000(brett) gid=1000(brett) groups=1000(brett),1001(docker-host)

The rule, and where it is enforced

A binding read from the served repository runs a broker, resolves a credential reference (env:, keyring: or a broker's), or contacts its endpoint ONLY after the operator has trusted THAT EXACT binding on THIS machine. The auth kind none is included, because it still sends chat content to the endpoint the file chose.

• src/opendox/doxbench_trust.py (new, standard library only).

  • The key is (the repository root's resolved path, the binding id, sha256 of the binding's canonical full record). The canonical record is as_record(), every field, sorted, compact, ASCII. So any edit untrusts the binding, and so does the same file under another root.
  • The store is one private file, model-binding-trust.json, in openDox's state directory (OPENDOX_STATE_DIR, through T072, 13.1: the bundled PostgreSQL server, the local install's own child (plan 034) #69's config.state_dir). It holds no credential and is written owner-only, through an exclusive, no-follow temporary file and a rename.
  • Its checks. It is read only once it passes the checks T072, 13.1: the bundled PostgreSQL server, the local install's own child (plan 034) #69's bundle makes of its own tree: no symbolic link, owned by this user, writable by no one else, and every directory above it this user's or root's, sticky where another user can write it. A store that fails a check trusts nothing, and the refusal names it. The store and its lock file are opened without waiting (O_NONBLOCK), so a FIFO in either place is refused by the type check on the opened descriptor rather than waited on.
  • Its size. The store writes nothing larger than it reads (MAX_TRUST_STORE_BYTES). A record that would outgrow it is refused before anything is replaced, so every trust already held stays held.
  • Its lock. Every record holds an exclusive lock on model-binding-trust.lock, beside the store, across its read, its change and its replace. So two processes recording at once keep both trusts, and neither restores a form the other replaced. The lock file gets the same link and permission checks as the store, and is then set to exactly 0600, whatever the umask. Where no lock can be taken, the record is refused by name and nothing is written. Readers take no lock: the replace is atomic.
  • A state directory equal to the served root, or nested under it, is refused naming OPENDOX_STATE_DIR, before anything is written. So is one that cannot be resolved, such as a link loop.
  • A platform without the primitives the store needs has nothing trusted, with a refusal that names the platform and the gaps (unsupported_platform(), following T072, 13.1: the bundled PostgreSQL server, the local install's own child (plan 034) #69's form). The primitives are os.getuid, O_DIRECTORY, O_NOFOLLOW, O_NONBLOCK, fchmod, mkdir with dir_fd, and fcntl.flock. So every verdict reads untrusted rather than raising.
  • A link to nothing on the way to the store, whoever owns it, is refused by name. So is any OSError the store's tree raises that no check named: it becomes a TrustStoreRefused naming the store and the system's short word for it, in record and in verdict.

• A binding the model catalog refuses is never trusted (unservable_because). Its id or its label is one the catalog cannot list, so no turn could use it. The check builds the same catalog the factory declares (brokered_catalog), and it runs BEFORE any policy is asked:

  • verdict_for refuses such a binding, even under a host policy that trusts every binding or with a store entry recorded earlier. The start declares the refusing port over an empty catalog and never fails.
  • recorded_for refuses such a binding, so add, edit and trust record nothing and write nothing.
  • Its refusals print no trust command, because trust cannot repair it. They name the actual remedy instead (REMEDY_UNSERVABLE): correct the binding with opendox model-binding edit (to keep the id) or remove then add (to change the id). Each of those records trust for the binding it writes.

• Every answer a policy gives is held to the binding AND the root asked about.

  • verdict_for passes on a verdict for this root that admits exactly this binding, or an untrusted one for exactly this record at this root. Anything else becomes an untrusted verdict for THIS binding at THIS root:

    • a verdict for another binding, trusted or not;
    • another form of this one;
    • a verdict minted for another repository root;
    • a non-verdict;
    • a policy that raised.

    So every refusal names the right binding, root and command, and the per-repository key holds against a host policy too.

  • recorded_for refuses by name (TrustNotRecorded) a policy that declines to record, records another binding or root, or raises. It names what a policy raised, never its words. Only openDox's own store's TrustStoreRefused passes through as written, and only from exactly MachineTrust, not a host's subclass. A host policy's refusal of any class, BindingRefused included, is named by its class alone.

• doxbench_install. The factory asks verdict_for about the first approved binding (trust_gated_model_port_factory).

  • Trusted: the brokered port, handed the verdict.
  • Untrusted: UntrustedBindingPort. Its catalog lists the binding available: false, every dispatch is refused by name, and the factory writes a notice on stderr naming the id and the command that trusts it.
  • A checkout with no bindings never asks the policy, so it never touches the state directory.

• In depth, doxbench_provider. These all refuse a binding that no verdict covers:

  • every broker operation (mint, hand_off_credential, revoke, list_references), in _broker_operation, before the argv is built and before either runner's branch;
  • the built-in resolver, after its two route assertions and before its first read;
  • the port's dispatch and catalog.

  A verdict covers only the id and digest it was given for.

• cli_model_binding.

  • add and edit record trust for the binding they write. They record it FIRST, so a store or a policy that refuses leaves nothing written and nothing printed as "trusted".

  • trust <id> (positional, no --yes) prints what it trusts, then records trust for exactly that record: the broker argv it would run, the endpoint, the auth kind and the credential REFERENCE, never the credential. It resolves no reference, spawns nothing and contacts nothing.

  • The command every refusal, notice and list prints is opendox model-binding trust --repo-root ROOT [--bindings DOCUMENT] ID. It is printed only from operands a POSIX shell reads back exactly (trust_command):

    • an id the catalog accepts: ASCII letters, digits, ., _ and -, beginning with a letter or a digit, so no shell expands it and no option parser reads it as an option;
    • paths quoted by shlex.quote, and only where every character is printable.

    A root that is not printable is never printed: the command names it ., to be run from that repository's root. --bindings appears where the binding was read from a document given by one (list --bindings, or the factory's bindings_path). Run as printed, the command trusts exactly the binding it names.

  • set-credential is refused before its broker spawns when the binding is untrusted, and it leaves the binding untrusted. It re-trusts a TRUSTED binding after rewriting its reference.

  • list reads the bindings document ONCE, and derives everything it prints from that reading. It adds two lines per binding:

    • trust: trusted, or why not and the command that trusts it;
    • console: the one binding a console serving this repository declares, by the factory's own rule. A pending declaration is passed over, an unreadable declarations document declares nothing pending, and the console declares the first of the rest. Where list was given another document, the line says the console does not read it.

  • Every value a repository wrote is printed in a JSON string's form, by list, trust, the refusals and the notice. A newline or \x1b[2J in a field cannot forge or hide a line.

• serve_workbench.

  • A turn on an untrusted binding is refused model_unavailable with a FIXED sentence (UNTRUSTED_TURN_MESSAGE) saying how to trust it. The catalog's shape is closed, so the reason travels in the refusal, the notice and list. Where the catalog cannot list the binding, the sentence is UNSERVABLE_TURN_MESSAGE instead, which names the remedy and no command that trusts (turn_message_for). Both fit within the released failure envelope's 500-character message bound.
  • The console's model approval answers APPROVAL_NOTICE ("becomes an available catalog entry") only where the registered trust policy admits the binding it approved. That is a governed host's approval, or a binding this machine trusts. Otherwise it answers APPROVED_UNTRUSTED_NOTICE, a fixed sentence saying the binding is not yet trusted and how to trust it. A binding the catalog cannot list is checked first, under any policy and without reading a store, and answers APPROVED_UNSERVABLE_NOTICE, which names the remedy and no command that trusts. Approval asks only a policy that is already registered, so where nothing is registered it registers nothing and reads no store. It reads the registration once, under the seam's lock (registered_verdict_for), so a host that unregisters meanwhile never has the default installed in its place.
  • The console intake follows batch M. Its hand-off runs a broker the served repository's ideation/dashboard/model-declarations.yaml names, and that broker belongs to no binding. So it asks the registered policy its OWN question, intake_verdict_for, which no binding's trust can answer.
    • openDox's strict default (MachineTrust.intake_verdict) always says no, refused by name (intake_refused, reason INTAKE_BROKER_UNTRUSTED, a fixed sentence). That happens before any byte of the body is read, and the body is drained unread.
    • A host admits the intake only through its own intake_verdict, an optional third callable on the seam. A policy without one admits no intake.
    • So a repository that declares a binding with the intake's exact fields, and gets it trusted, gains nothing. No command trusts an intake declaration's broker.

• The chat rail (web/views/doxbench-chat.js). It has its own visible line, UNTRUSTED_BINDING_REMEDY (Python twin doxbench_trust.UNTRUSTED_BINDING_REMEDY), beside T081, 16.4: "no model configured" is a state, shown before any turn (plan 034) #74's no-model line.

  • It shows when the catalog has answered, is not empty, and offers nothing available, and it is announced once.
  • It names "opendox model-binding list --repo-root <repository>", which shows whether each binding is trusted, and "opendox model-binding trust --repo-root <repository> <id>". It also says that a binding already trusted, which a provider's refusal also leaves unavailable, is unavailable for the reason the console printed when its provider refused.
  • --repo-root is in every quoted command. --repo-root is required by every model-binding verb. Each command a fixed sentence quotes (the refused turn's, the rail's and the approval's) is parsed by the real parser in a test, with its placeholders filled in.
  • T081, 16.4: "no model configured" is a state, shown before any turn (plan 034) #74's no-model line stays hidden, because a model IS configured.
  • The sentence says "where it would connect" rather than naming a credential, because test_doxbench_privacy.py bans that word from both chat modules.

• Bindings stay committable. The bindings document is unchanged, and no trust is ever read from it.

Whose rule: the neutral default, and the seam

doxbench_trust is a policy seam (register / register_default / current / policy / unregister), with the same window rule as projection_seams: the default is replaceable until it is read, a host over a host is refused, and the same registration again is a no-op. A policy carries verdict and record, and optionally intake_verdict. openDox's strict per-machine store is the NEUTRAL default.

Why the default is registered lazily, which departs from R1Q10 (a)'s entry-point registration (accepted by the holder): the CONSUMERS register it, the first time one asks and only where nothing is registered yet. Those consumers are declared_model_port_factory, the model-binding verbs and the intake hand-off. The console's approval is not one of them: it asks only a policy that is already registered. So this PR adds no hunk to cli.py or serve.py, which stay out of the phase-3 single-writer order. It also fails closed: a bare process is held to the strict default too. A host's registration at process start wins.

How this relates to 4.2's seam tests. Each seam module's tests enumerate and test that module's own seams: tests/test_projection_seams.py, tests/test_doxbench_seams.py (the doxBench validators and rail), and #77's tests/test_column_seams.py (SEAMS = (cs.gate, cs.scope, cs.kickoff, cs.register)). No test enumerates every seam of the package, so none needs this one added. doxbench_trust.current() refuses by naming its own seam and the registration call (TrustPolicyNotRegistered), as 4.2's discipline asks, and tests/test_model_binding_trust.py holds that. tests/test_consumer_reach.py derives its record over the whole package and passes with the new module, which imports no sibling.

What T094 must register

RULED by Brett Heap on openxFactory#656 comment 5970369724, "Governance approval (Recommended)": openxFactory registers its own policy, GovernedBindingTrust, as a sixth seams() entry with an undo. Under it:

1. A binding whose declaration the governance flow APPROVED is trusted.
2. A binding a repository declared that is still PENDING is refused.
3. A binding with NO declaration is trusted: the operator's own, or the console intake's new binding while its broker runs.
4. Where the declarations document cannot be read, nothing is admitted.
5. record() writes nothing.
6. intake_verdict must answer too, as the policy answers for a binding with no declaration. The console intake asks that question and no other, so without it the governed host's intake would be refused. With it, the intake stays as it is today, which the ruling keeps.

_GovernedHostPolicy in tests/test_model_binding_trust.py is that policy as a test-local stand-in. The tests that compose it in process:

• test_a_governed_host_policy_keeps_the_governed_flow[approved|undeclared]: the factory resolves the brokered port, and a turn reaches the listener, exactly as before this change.
• test_a_governed_host_policy_keeps_the_console_intake: the governed intake runs its broker.
• test_a_governed_host_policy_refuses_a_pending_declaration: the pending and unreadable cases, and recorded_for refusing a policy that declines.

In the same checkout, the strict default refuses each of these until trust, and always refuses the intake.

Evidence

Run	Tree	Result
Red: the final test file with no other change	main 8e377823	14 failed, 1 passed (test_the_edits_cover_every_field_of_the_record), 1 xfailed, 56 errors (ImportError: cannot import name 'doxbench_trust'). The two defect cases fail as quoted above.
Red: each Copilot round's new cases, before their fixes	the code before each fix	Round 1: 8 failed. Round 2: 7 failed. Round 3: 3 failed. Round 4: the 4 new cases failed. One example: the two-process case kept only first-binding.
Red: round 8's cases, before their fix	42c98f9d	2 failed, 1 passed. The store's verdict waited on a FIFO, and the platform check did not name O_NONBLOCK. The lock file's FIFO case passes there too, because Linux opens a FIFO read-write without waiting.
Red: round 7's cases, before their fix	735d0c14	2 failed. Under umask 0777 the second record was refused ("the lock file cannot be opened"). The approval installed MachineTrust after a host's teardown and answered APPROVAL_NOTICE from its store.
Red: round 6's cases, before their fix	e05c475c	7 failed, 9 passed. Both sites the thread named told the operator to trust a binding past the catalog's bounds: the approval's availability, and a served turn's message.
Red: round 5's cases and the self-pass's, before their fixes	7012cda3	32 failed, 5 passed. Three hostile repository names made CANARY when sh ran their printed command: a newline, a terminal escape and a non-ASCII character, each followed by $(touch CANARY). The factory raised InvalidCatalogEntryError on a trusted binding past the catalog's bounds, and record raised FileNotFoundError through a link to nothing.
Green: the trust module, with the census, chat-configuration and deploy-shape modules	735d0c14 (the merge's tree, run just before it was committed); the trust module alone again at adb19f1e	336 passed, nothing skipped or xfailed; 135 passed at adb19f1e
Whole suite (tests + tests_runtime), in a venv installed by CI's own command (pip install --only-binary :all: -c constraints-cpython312-linux.txt -e ".[runtime,test]")	head adb19f1e	3945 passed, 177 skipped, 0 failed. The 177 are the database-backed runtime cases, which need CI's PostgreSQL service (OPENDOX_TEST_DATABASE_URL). #76 reads the same skips on its own local run.
The 10 local reds of earlier rounds	a6c2a844 (the 10 alone), then the head (in the whole suite above)	They were this machine's first venv: it was installed without the test extra, so it lacked the local extra's pixeltable-pgserver, and generate-and-open with --local refused ("the local install's PostgreSQL server is not installed"). In the CI-command venv, all 10 pass, with a short TMPDIR (~/.local/state/t1) and with the long one (~/.local/state/t100-tmp) alike. The socket-path length was not the cause here.
Mutants (mutate_t100.py, one textual edit each)	head adb19f1e	94 of 94 killed, in one run (mutants-run-17).
openxFactory's existing tests (tests/ideation-dashboard -m "not postgres", in a clone named openxFactory, TMPDIR holding the basetemp)	openxFactory main 1f670bc3, openDox code leg at main 8e377823, then at T100 7a04590d	4 failed, 1477 passed both times; the failure sets diff IDENTICAL (all 4 pre-existing). openxFactory injects its own model_port_factory and commits no bindings document, so its governed flow never reaches the gate before T094. The later rounds change only the store, how verdicts are held, and the rail's sentence.

The mutants killed:

• The digest: each of the ten fields, each by its own hand-edit case.
• The root key: ignored, or not resolved.
• The factory gate: by-passed, or accepting a verdict for another binding.
• The in-depth refusals: the broker operations, the resolver, dispatch and catalog; and a verdict admitting by id alone.
• The store:
  • accepting a writable file;
  • following a link to its file;
  • skipping the link check or the tree check;
  • being written with mode 0666;
  • following a temporary-file link planted in the race window.
• The CLI:
  • add and edit recording no trust, or writing before recording;
  • set-credential skipping the gate, or not re-trusting what it rewrote;
  • trust recording nothing or printing nothing;
  • list, the disclosure and the refusals printing raw values;
  • list saying nothing of trust.
• The intake and the state directory: the intake gate; the state-directory check, skipped or blind to nesting.
• The default and the notice: the lazy default never registered; a silent factory notice.
• The rail line: shown beside an available model, for an empty catalog, or where a host offers intake; or never announced.
• Copilot round 1:
  • recording without the cross-process lock, or never taking it;
  • the lock file opened through a link, or its owner and mode unchecked;
  • a declined record taken as trust;
  • a policy's failure to record escaping;
  • an untrusted verdict for another binding passed through;
  • the intake asking the binding question;
  • the per-machine store admitting the intake.
• Copilot rounds 2 and 3:
  • the platform check skipped, or forgetting the file lock;
  • an unresolvable state directory escaping;
  • the rail line still claiming list says why;
  • a verdict for another root passed through;
  • a host policy's refusal text passing through, of either class;
  • openDox's own store's refusal sanitized too.
• Copilot round 4:
  • a host's MachineTrust subclass passing its refusal text;
  • the writer outgrowing the read bound.
  • Round 4's "a dashed id printed where an option is read" is RETIRED with the -- it mutated: no id the catalog accepts begins with -, and no command is printed for one that does.
• Copilot round 5 and the self-pass:
  • a printed path not shell-quoted;
  • an unprintable path printed in a command;
  • an id the catalog refuses printed in a command;
  • a binding trust cannot repair told to trust;
  • a verdict trusting, or a record recording, a binding the catalog refuses;
  • servability judged by the id alone;
  • list judging a second reading;
  • list's command, the factory's notice and the refusing port each omitting the document read;
  • a link to nothing gone through;
  • a system refusal escaping record or verdict raw;
  • the console line ignoring pending declarations or the document listed, or naming the last approved binding;
  • an approval always saying available, or registering and reading the default;
  • the turn message's list command or the rail's trust command dropping --repo-root.
• Copilot round 6:
  • an approval of a binding the catalog refuses saying to trust it;
  • a turn on such a binding saying to trust it;
  • a refused turn naming no cause.
• Copilot round 7:
  • the lock file keeping the umask's mode;
  • an approval reading the seam twice;
  • the registered verdict registering the default.
• Copilot round 8:
  • the store waiting on a FIFO in its place;
  • the platform check forgetting the nonblocking open.

The F16.1 batch M cases each serve a fresh git init with a fresh OPENDOX_STATE_DIR. They run over three bindings in turn:

• a broker that writes a marker file;
• an env: reference whose environment records every name read;
• a keyring: reference whose stand-in backend records every lookup.

The listener records every request. One test per case of the block.

set-credential on an env: or keyring: binding is refused by the refusal it already had, "names no broker", which also comes before any read or spawn. Naming trust there would point at a command that cannot make the verb work.

Review

Every Copilot finding was accepted and fixed with a case that failed first and its mutant, then answered on its thread and resolved:

• Round 1, at 1ef4c71d, fixed in 7a04590d:
  • r4173513738: a policy that declines to record;
  • r4173513761: the lock across processes;
  • r4173513782: the intake's own question;
  • r4173513795: a verdict for another binding.
• Round 2, at 7a04590d, fixed in e4b145d1:
  • r4173876800: a platform without the store's primitives;
  • r4173876823: an unresolvable state directory;
  • r4173876849: what the rail line says list shows.
• Round 3, at 8270dffc, fixed in e4b145d1:
  • r4174310794: a verdict for another root;
  • review 5402101086's "previously missed" item: a host policy's refusal text.
• Round 4, at cb691b18, fixed in 24a1c25e:
  • r4174632006: only the exact MachineTrust passes its refusal;
  • r4174632060: the printed trust command runs as printed;
  • r4174632086: the write bound.
• Round 5, at 7012cda3, fixed in db77c4ea:
  • r4174783197: a printed command a shell reads back exactly;
  • r4174783250: list reads its bindings once;
  • r4174783280: a binding the catalog refuses is never trusted, and never fails the start;
  • r4174783301: a link to nothing, and any unnamed OSError, refused by name.
• Round 6, at e05c475c, fixed in a6c2a844:
  • r4175203889: a binding the catalog cannot list is told its remedy, at the approval and in a refused turn, and never to trust it.
• Round 7, at 735d0c14, fixed in 42c98f9d:
  • r4177946237: the lock file is 0600 whatever the umask;
  • r4177946288: the approval reads the trust seam once.
• Round 8, at 42c98f9d, fixed in adb19f1e:
  • r4178064601: the store and its lock file are opened without waiting on a FIFO.

The adversarial self-pass, in the same commit. It covered two things:

• Every command printed for a human to paste. That is each refusal, the notice and list, plus each command a fixed sentence quotes. Hostile values in every interpolated operand were run through sh, bash and zsh.
• The trust-state machine, for whether what is printed, what is stored and what is enforced agree: pending, approved, undeclared, unreadable declarations, and a stale record.

It found three gaps, each now fixed with its case and mutant:

• list did not say which binding a console declares;
• an approval said "available" for a binding the strict default still refuses;
• the fixed sentences quoted model-binding commands without the required --repo-root.

SonarCloud. The quality gate's one failure was python:S5332: the trust disclosure spelled a plain-HTTP URL scheme, and now says "plain HTTP". The two functions over the cognitive-complexity bound (_unsafe_because, _refuse_an_unsafe_tree) are split into named parts, with the same rules. The gate passes from 7a04590d on.

CI's triple

EXPECT_SKIPPED is 11, main's own value. It moved to 14 for three strict-xfail cases, each waiting on a draft and naming it:

• the store's default home (T072, 13.1: the bundled PostgreSQL server, the local install's own child (plan 034) #69);
• the rail's trust line (T081, 16.4: "no model configured" is a state, shown before any turn (plan 034) #74);
• a served turn that reaches its model step standalone (T084, 4.3: the last deferred reaches through declared seams; consumer_reach retired (plan 034) #77).

It stepped back by one, with its reason in the workflow, as each draft reached this branch (1ef4c71d, 32646871, 78d1e904). All three cases now run and pass. The floors are not moved.

The web census's class-A total is re-derived from the merged tree at every merge of main. It is 18526 at the head: main's 18486 plus this change's 40 lines in views/doxbench-chat.js (1890 to 1930). Round 5 changed that file within one line, so its count holds, and #76 touched no web file. The floors are #76's re-pin (3977 / 3966, T082). T100 moves neither, since it only adds cases. The merge kept both reasons for EXPECT_SKIPPED holding at 11, T082's and T100's. #84 (T104) also moves EXPECT_SKIPPED and class A. Whichever of the two lands second re-derives both values from its own merged tree.

#77, and other notes

• T084, 4.3: the last deferred reaches through declared seams; consumer_reach retired (plan 034) #77 refuses the console intake standalone when no gate-record writer is registered (5961364221 item 1). So this file's intake cases use a stand-in host that registers a host gate at opendox.column_seams.gate, as T084, 4.3: the last deferred reaches through declared seams; consumer_reach retired (plan 034) #77's own tests do.
• T084, 4.3: the last deferred reaches through declared seams; consumer_reach retired (plan 034) #77's host fixture runs model-binding add in a CHILD with a private OPENDOX_STATE_DIR. The parent's factory reads its own store, so a turn there still reads the binding untrusted until that store trusts it.
• T072, 13.1: the bundled PostgreSQL server, the local install's own child (plan 034) #69's tree checks are DUPLICATED here, not imported. runtime/bundle.py's helpers take a different signature, raise BundleRefused with the bundle's wording, and the module imports heavier modules. They are kept in step by rule, and the tests hold both.

Gates

• pyflakes is clean over the changed modules.
• tests/test_provider_boundary.py passes. No module outside doxbench_provider spells its banned needles.
• No closing keyword appears in any commit message on this branch or in this body.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Printed remediation commands permit shell substitution, and additional trust-state consistency failures remain.

Review effort: Balanced
Findings: 1 · 3

Open (4)

• Prevent shell injection from JSON-escaped IDs · New
• Use one binding snapshot for disclosure and trust verdicts · New
• Validate catalog compatibility before recording trust · New
• Reject dangling store symlinks with TrustStoreRefused · New

Resolved since last review (3)

• Prevent host policy exceptions from leaking sensitive text
• Enforce maximum trust store size before writing
• Handle binding IDs beginning with hyphens

[Copilot]

Copilot review overview

🟡 Changes recommended

Unservable bindings receive remediation commands that cannot succeed in approval and turn responses.

Review effort: Balanced
Findings: 1

Open (1)

• Preserve unservable verdict instead of suggesting trust · New

Resolved since last review (4)

• Prevent shell injection from JSON-escaped IDs
• Reject dangling store symlinks with TrustStoreRefused
• Validate catalog compatibility before recording trust
• Use one binding snapshot for disclosure and trust verdicts

[Copilot]

Copilot review overview

🟡 Changes recommended

Lock-file permissions, platform capability checks, and an approval-policy race remain unresolved.

Review effort: Balanced
Findings: 2

Open (2)

• Normalize lock file permissions after creation · New
• Eliminate race between policy registration check and verdict · New

Resolved since last review (1)

• Preserve unservable verdict instead of suggesting trust

[Copilot]

Copilot review overview

🟡 Changes recommended

Trust-store reads can block indefinitely on a FIFO before validating that the path is a regular file.

Review effort: Balanced
Findings: 1

Open (1)

• Avoid blocking when opening FIFO trust store · New

Resolved since last review (2)

• Eliminate race between policy registration check and verdict
• Normalize lock file permissions after creation

[sonarqubecloud]

Quality Gate passed

Issues
38 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Copilot review overview

🔵 Needs a closer look

The large security-sensitive trust store, policy seam, and provider enforcement boundary warrant final human review.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Avoid blocking when opening FIFO trust store

[brettheap]

READY at adb19f1 — Lane: openxfactory-4 (openXfactory-4-openDox_extraction)

Holder: T100 (16.3a): a served repository's bindings are trusted per machine. Its After line is met, and the head merges main ca9e1bd5.

• Tests at the head.
  • Full suite: 3945 passed, 177 skipped, 0 failed, in a venv built with CI's own install command. The 177 are DB-backed runtime cases that need CI's PostgreSQL service.
  • Mutants: 94 of 94 killed.
  • validate and Sonar pass.
• Copilot at the head: "Needs a closer look", findings none. It asks for a final human review of the security-sensitive trust store and policy seam. 0 threads are open, and 7 rounds' findings are fixed, answered and resolved: shell-quoted remediation commands, trust-state consistency, lock-file permissions, platform checks, an approval race, impossible-remedy text, and FIFO-safe store opening.
• The holder's judgment. The closer look is an independent adversarial review the holder commissioned for this PR. Anything it substantiates is fixed in a T100 follow-on openDox-code PR that lands BEFORE T087. No release ships before that pin, because T099 publishes only the commit the openDox root pins. Landing now unblocks T083.

[sourcery-ai]

Sorry @brettheap, your pull request is larger than the review limit of 150,000 diff characters

[brettheap]

Lane: openxfactory-4 (openXfactory-4-openDox_extraction)

LANDED — lane openxfactory-4, 2026-10-04T15:48:11Z, PR #82 → 38d3350 (opensoft/openDox-code main; plain gate)

Brett: land phase 1 / phase 2 PRs when green