[777genius]

Supported skills lifecycle qualified and merged into #520 — 2026-10-29

Merged into #520 as 63eb232b461c308160ebb71a01fde298ba89a9db, tree 00e600e229707f77ea7fa8984568ff0ad783b463, after every applicable exact-head workflow/check and required review passed. GitHub confirms this PR is closed and merged. The merge retains the tested Grok head and qualified Qoder/Copilot parent, with only the independently reviewed shared-code/document unions.

Qualified Grok source fcde007fec3918e8bd797048002bf0153cfae738, tree 20dfd4dee86db9357124b29ee7d64431d371e983, completed the genuine hosted full cycle in Project Native Runtime 40905390378, selected Grok job 123564695573, in 19.530 seconds. Admission and all four baseline client jobs also passed; the full six-job runtime matrix is green.

The primary audit and both independent complete raw audits are GO. Each closes API-bound outer/inner archives, CRCs, all four native/25 frontend ordinary closed members, exact clean source/build/compiler/scanner/vendor identities, 24 frontend stream joins, 271 embedded stream occurrences including all 68 command channels, 14 public operations, 20 complete fresh native catalogs and 18 ownership/state/source proof frames. The exact-source reader and merged-dispatch replay preserve the successful result.

The cycle proves A/B/User/foreign isolation, stable Prepared bindings and held identities, unchanged repeated add/update, intact repair, A-two source update, missing-owned-package repair, both removals, repeated-removal refusal, retained owned data and final fresh native absence. Original User/config/trust/foreign/caller controls remain held. The original User skill source retains its literal /./skills/ form; owned sources retain their independently held clean paths. Durable trust contains A and B only. Ordinary child cleanup and source preservation close.

Project lifecycle and native restart/removal are qualified for the supported skills surface. Activation remains Prepared. MCP initialize/list/call, vendor authentication and real-model qualification remain false.

Evidence:

• Native artifact 12914059006: 32,448 bytes; SHA-256 c6e7a87ab15f51dbffb85e2905e84db88522fb7455d2bd0e5ca2ab22e0f76181.
• Frontend artifact 12915875377: 3,272 bytes; SHA-256 a723aa3bbda324103158c51df88f0f55a4b153cda5d183a8166aa952960e69d0.

Both plan/code reviews, focused Go contracts, affected all-enabled whole-file lint and the full root required six-linter gate passed. All 11 exact-head workflows, including Core fast 40905390972, completed successfully: 53 successful check runs, two expected conditional skips, no pending/failed checks, no unresolved review threads and no legacy status contexts. The successful tested leaf was not modified or rebased.

The exact merge tree received two plan and two final code/composition approvals. Its five synthesized files preserve both complete source-bound histories, the finite shared dispatch and exact remaining parent/leaf blobs. Validation passed 88 workflow tests, focused shared/Grok/Qoder Go contracts, all three original qualified Grok/Qoder/Copilot reader replays, cross-client/unknown-mode refusals, affected all-enabled lint and the full required root six-linter gate. The reviewed local parent was rebound to actual 0a47b081 only after its tree and ordered ancestry proved identical; the source diff was empty. The expected-parent-guarded merge was read back with exact parents 0a47b081 and fcde007f, tree, branch and PR state.

Fresh assembled-parent Required 40931056124 and Project Native Runtime 40931056167 are the next aggregate gates. Earlier failed captures retain their original failed status and source identity; no main merge or release is claimed.

Preserved source-bound implementation and evidence history

Latest continuation: reviewed shared HTTP client fixture (2026-10-27)

Published 611f7dd79a923a3b8e445222cde8395bd1af1062 by normal fast-forward after two independent pre-code reviews, two exact code reviews and executed gates.

The genuine preceding a1af capture observed a rejected GET / before any accepted model request. Verified public Grok source supplies a shared-client opt-out; this fixture now sets GROK_SAMPLER_SHARED_CLIENT=0 only for Grok with its held private provider. Concrete tests cover all eight client/provider combinations, ambient conflicts, duplicate entries, original HOME/profile/state/key retention and no global mutation.

The strict provider is byte-identical: exact authenticated POST route, model/body grammar, response, cancellation and cleanup remain required. Client pin, trust, permission, command and timeout settings are unchanged. The public snapshot's equivalence to the shipping binary remains unproved; the next actual hosted run determines whether the setting is honored.

Executed gates: focused Go PASS (package 1.138s), 38 Python contracts PASS, affected and unfiltered six-linter gates both zero issues. Original a1af 20-member failed artifact re-admits with identical bodies and summary. No vendor binary ran locally.

Committed validation and review records.

Fresh native evidence is pending. Previous runtime/lifecycle/authentication/model qualifications remain false; this publication is not a main merge or release.

---

Current exact origin-route result — 2026-10-27

Current head: a1af0da362f020111a3af6a16e50cd265a708224, tree 87fb8a405c0e362fd5dad867e105523029ff7d12.

The genuine runtime run 40579668485, Grok job 122458819911, has now completed with failure. Public add succeeds Prepared; native inspect --json exits 0 and joins the exact project binding target and physical ID. The plugin remains disabled in an untrusted project, provides one skill, and has no loaded skill or MCP server.

The following actual native attempt is stopped after 322 ms by the provider's strict route rejection. The first request is now measured as exact GET /, with loopback peer, matching Host, relative URL, empty URL host/raw path and absent Content-Type. Provider request/response counters remain 0/0; no body or credential was admitted. Its ordinary shutdown succeeds without forced close. Authorization value/absence, body content and the shipping request's prewarm identity remain unobserved. The cancellation flag does not prove timeout expiration.

Independent audit verifies native artifact 12769367534 (4674 bytes; outer SHA256 2f7a5bfca938ffe30cb60fc4f216b7825b2d41e9c5ccca29b38af009969cae12; 20 closed members), frontend 12769462428 (25 members), exact source/tree and clean build, all 24 frontend stream joins, inspection-to-binding identity, and identical failed admission through the exact source reader. Runtime completion, all five qualification flags, authentication and real-model qualification remain false.

The published diagnostic-only change received two independent pre-code and two exact-code GOs. Focused Grok/shared Go contracts, 38 runtime Python tests, affected all-enabled lint and the unfiltered six-linter gate pass. Provider admission is unchanged: the exact authenticated POST /v1/chat/completions contract still rejects root GET. The preceding c6 failed artifact remains unchanged and failed on replay.

The official source snapshot contains an explicit shared-client opt-out that returns before the candidate origin prewarm. A separate plan to test that setting is under independent review; it is not implemented by this head. No shipping-source equivalence, root-route allowance, credential/trust relaxation, deadline change or native success is inferred. This PR remains a draft with full applicable lifecycle and integration gates outstanding.

Previous source-bound native result and implementation history

Latest genuine native result — 2026-10-27

Current source: c6c58579674e0bdb230a556f0bef1de38ce40612; tree: a9c7f08283d631d8e0af2e448601b89f201dbc43.

The new runtime run 40569312299, Grok job 122421982285, passed public project add and native inspect --json. Inspection joins the exact receipt-selected project plugin as visible but disabled, with one provided skill; the project is untrusted, and no skill or MCP server is loaded. This is the existing Prepared boundary.

The following native attempt failed after 325 ms when the strict loopback provider refused its first request: the measured method is GET, the finite URI category is other, and Content-Type is absent. No provider request body or response was admitted. The exact URI/path/query and Authorization value were not exported; no concrete endpoint or missing credential is claimed. The route failure cancels the supervisor context, which is recorded by the existing deadline boolean; the 325 ms observation does not prove expiration of the work timeout.

The original protected/immutable byte checks run after the child and before the recorded child/capture/cleanup fatal, so the earlier protected-config failure is no longer the stopping point. Provider shutdown completed without forced close. Full lifecycle/runtime completion, all five qualification flags, authentication and real-model qualification remain false.

Independent audit verified API-bound native artifact 12766872743 (20 closed members), frontend 12766048484 (25), exact clean source/tree, all 24 frontend stream joins, receipt-to-inspection identities, and unchanged failed admission through the immutable source reader. A separately reviewed bounded route diagnosis is the next step; no route/header/authentication allowance follows from other. This PR remains a draft.

Earlier source-bound continuation records

Purpose

Complete the supported Grok project skills-only E2E surface, stacked on #520, while keeping Prepared installation, actual discovery and native runtime proof distinct.

Current source and implemented observation

Published source: 84d7ec345e9e7d766aa0cc8fad72b4cbcf0aeadb.
Exact tree: 13dccf898c2efce4b831c46aa3b6eb2a06aa4c71.

Recovered, freshly reviewed route and privacy correction

The exact literal provider route predicate is unchanged. Only the first winning route failure can now record one optional observation under the existing mutex. It exposes finite method/URI classes, the original boolean predicates, content-type count and a bounded MIME classification. No raw arbitrary header, hostname, path, credential or request body is added. The Python envelope accepts only the exact optional field set/types/enums and rejects contradictions; old receipts without it remain valid failed observations.

The Grok privacy scanner now follows nested JSON strings, keys, arrays and JSONL records under one whole-member budget: existing 1 MiB size, four times the input byte-work, 16384 nodes and depth 64. Existing strict decoder/key/duplicate/resource limits remain. Only the static nonfinite-number error can invoke a budget-charged complete-syntax check; two Go RawMessage decodes plus exact EOF distinguish complete nonfinite JSON from ordinary numeric-looking metadata. The Python decision uses numeric placeholders without accepting nonstandard constants. Literal redaction and refusal occur before persistence/evidence encoding.

Scratch replacement lost the old unpublished complete files. This reconstructed five-file slice received fresh CLI and shell plan/code GOs; no old whole-file hash or old test result is reused. Focused Grok/shared inert contracts passed in 1.067 seconds, including an actual test-binary child proving nested private data is refused before capture persistence. All 28 runtime Python tests pass. Affected all-enabled and unfiltered whole-file lint each reported zero issues. The four contextless inert HTTP calls found by lint were corrected with the Go 1.22-compatible checked request helper and re-reviewed.

The original runtime 40460245073, job 122046695647, remains failed at source 6f001863. Its native artifact 12714288556 (outer SHA256 13a06bb7126bbee9fa8f2fe3e746cc3c60554fe6a73b72e66f0a6b9aa08cb181) and frontend 12714643098 (outer 8bb4db80ab143f3a97fdbe9bc707ed1b5582e3f38a00bc2c725c36c9ae9fa173) were reacquired with exact API sizes/hashes, inner hashes, bounded canonical ordinary members and CRCs. Source/tree/clean closure, all 24 frontend stream joins, all 20 raw-body privacy checks and unchanged failed/all-false admission pass. It records route failure, zero requests/responses and normal provider closure; neither unseen route attributes nor the TOML change are inferred.

The separately approved original-HOME TOML diagnostic plan is retained in this head; its implementation is the next slice. New route facts, config facts and full applicable lifecycle proof still require genuine current-source captures. No qualification, authentication or real-model flag is promoted.

The existing public add/receipt/source proof and genuine inspect --json observation remain intact. Their selected installed candidate must stay disabled/untrusted under the preserved inspection contract. Project MCP support is not introduced.

The latest slice tests the vendor's documented custom-provider configuration against pinned Grok1.0.70. It exclusively authors .grok/config.toml in the original disposable HOME before the preservation baseline, uses one held loopback HTTP listener and a fresh fixture-only environment key, and selects the fixed fixture model. Current official documentation supports this configuration; acceptance by the pinned executable remains an observation to obtain.

The listener admits one bounded exact-origin POST with held Host, loopback peer, exact credential/content type and strict model/stream/message shape. It returns a fixed text-only SSE sentinel. It neither asks the agent to call a tool nor derives its response from the installed skill. Unknown request content is captured only for first-run research and supplies no qualification.

Listener startup/shutdown belongs to the existing fixture cleanup lifetime and original deadlines. Ordinary completion requires the actual HTTP server and tracked connections to terminate; forced cleanup remains a failure. Deny-all native flags, original profile/source guards and other clients' environments are unchanged.

Private capture and independent review

Three exact optional provider members form a closed count/receipt envelope. Exact private fixture credentials are redacted before capture; raw and semantic whole-JSON/JSONL canaries refuse remaining private prefixes before storing or archiving evidence. The independent critic's escaped-key multi-record JSONL finding was fixed and re-reviewed, including first/last-record controls and provider-absent Python admission. The final scan is bounded by the existing one-MiB native member limit and preserves the Go1.22 source floor.

The plan received independent CLI and desktop GOs before implementation. Both critics reviewed the complete six-file implementation, the privacy correction and the final mechanical lint fixes. Separate plan, implementation and correction commits are retained, and root verified each published tree against the reviewed local tree.

Actual checks and observed boundary

Final focused inert Grok/provider/shared-CLI Go tests passed in1.026s. All23 Python admission tests passed in0.031s. Actual all-enabled affected lint and unfiltered whole-file size/complexity/architecture lint each reported zero issues; formatting/whitespace checks pass. No vendor executable ran locally.

The preceding genuine runtime40408742120, source b4a2d5dea1cc2cd9a0165660924732ec6e1df811, proves public Prepared installation and the exact inspected disabled/untrusted candidate; ordinary startup reached a sign-in boundary. Its19-member native envelope replays unchanged under the new admission code, retaining failed/incomplete and all lifecycle/MCP/auth/model flags false. Inner SHA256 is dfa0d82412f2654e51bcfcde0c856f00763774dd77c5617b99e284f85704b354.

The new source registered runtime40460245073 and research40460245074. The first custom-provider capture intentionally remains failed pending independent interpretation. No successful native settings acceptance, skill execution, complete lifecycle, vendor authentication or real model use is inferred from local HTTP fixtures.

Remaining merge gate and preserved history

Obtain and independently review the actual pinned native capture, then complete applicable original-user/A/B lifecycle, source update, exact-pin repair, fresh restart/removal and repeated removal with foreign/user/data preservation. All five qualification flags and auth/model claims remain false until their own required proof. Grok project MCP remains explicitly unsupported.

Earlier source-bound runs remain available: 40367357685, 40408742120, 40408742027, 40403181321. Prior installed framing, exact source/receipt guards, Go1.22-compatible helpers, parent Darwin cleanup and externally published runtime concurrency changes are preserved. Applicable current-source checks and native evidence remain mandatory before merge; this PR does not publish a release.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0914d9f4-c8c1-4976-8640-125ec8356098

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[777genius]

@coderabbitai full review

Owner requested independent review before merge. Observed head: b4a2d5dea1cc2cd9a0165660924732ec6e1df811, stacked on #520. Review only: no autofix, branch edits, ready-state transition, merge or release.

Prioritize installed/source digest framing, held authored/installed authority, strict Grok 1.0.70 inspect grammar, disabled Prepared candidate identity, original-user/A/B preservation, bounded 30-second inspection inside the original total budget, and complete artifact triples. Preserve skills-only/MCP-unsupported boundaries. Native auth refusal or research success cannot qualify lifecycle/restart/removal. Keep all native-host, pin, process, cleanup and artifact guards. Anchor concrete findings to the reviewed commit.

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 59 minutes.

[777genius]

Independent new-head observation + narrow diagnostic plan for review, not an implementation or another CI retry.

Genuine run40460245073/job122046695647 on 6f001863659da7fc9fae4302ec43c6e6a8c2f840 is now complete. Raw logs prove exact clean source and GitHub-hosted Azure Ubuntu24.04.5/image20261012.334.1. I independently downloaded native artifact12714288556, verified outer SHA256 13a06bb7126bbee9fa8f2fe3e746cc3c60554fe6a73b72e66f0a6b9aa08cb181, and inspected20 unique bounded ordinary ZIP members/CRCs.

Public add and exact installed inspect --json passed: the selected Prepared candidate is visible but disabled and project_trusted=false. The new provider receipt is started=true,requests=0,responses=0,credential_matched=false,failure=route,shutdown_complete=true,forced_close=false. Native startup was cancelled after428ms with empty streams. Source grokProjectProvider.admit checks the combined route tuple before credentials and fail("route") cancels the shared context. Thus deadline=true here does NOT establish that150/180s expired, and credential_matched=false does NOT establish rejected credentials. Do not increase budgets, claim the old Not-signed-in boundary recurred, or relax a guessed route/header condition. The actual mismatching route field is currently unobserved.

@coderabbitai Please independently review this narrowly proposed plan (GO/NO-GO, not full PR review or autofix). The active root/its separate critic must provide the other independent plan decision before implementation:

1. Keep the exact route predicate, rejection, cancellation, one-attempt limits and body-before-auth refusal unchanged. On that existing route refusal only, record a fixed boolean projection of the exact predicates already evaluated: literal IPv4 peer match, POST match, host match, exact expected RequestURI match, origin-form/nonabsolute status, URL.Host empty, RawPath empty, exact Content-Type match and single Content-Type value. No raw/hashed attacker-controlled method/URL/peer/host/header/body, credential bytes, error text or private path; no alternate request.
2. Keep the projection bounded to one optional fixed-schema object in the existing provider receipt; it is diagnostics only and cannot advance Requests/CredentialMatched/Responses, success or qualification. Preserve all source/profile/pin/auth/trust/process/cleanup/budget and artifact/key-redaction rules.
3. Inert contracts must exercise every false predicate independently, exact positive tuple, duplicate/unknown data rejection and canaries in each hostile field proving they never appear in serialized receipt. Ensure predicate results come from the same request evaluated for refusal, and test the actual refusal still cancels without reading body or responding with SSE.
4. Only after separate plan and code approvals, use a fresh genuine source-bound run to identify the observed mismatch. Any later admission correction requires actual pinned evidence and its own review; this diagnostic plan authorizes no permissive Content-Type parsing, extra route, credential workaround, new model or positive flag.

The original first-capture and full lifecycle remain unqualified. No code, ref, CI run, timeout or qualification was changed here.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
git rev-parse HEAD
git show -s --format='%H %T' 6f001863659da7fc9fae4302ec43c6e6a8c2f840
fd -a '^AGENTS\.md$|^CLAUDE\.md$'
rg -n -C3 'func .*grokProjectProvider.*admit|type grokProjectProvider|credential_matched|shutdown_complete' --glob '*.go' --glob '*.py' .

Length of output: 12317

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cat AGENTS.md
ast-grep outline repotests/agentplugins_grok_project_native_provider_test.go
ast-grep outline scripts/project_native_runtime.py
ast-grep outline scripts/test_project_native_runtime.py
sed -n '1,240p' repotests/agentplugins_grok_project_native_provider_test.go
sed -n '240,420p' repotests/agentplugins_grok_project_native_provider_test.go
sed -n '180,300p' scripts/project_native_runtime.py
rg -n -C4 'def strict_json|deadline|grok-provider.json|func .*fail|func .*receipt' scripts/project_native_runtime.py repotests/agentplugins_grok_project_native* --glob '*.go'

Length of output: 42320

---

@777genius GO for the diagnostic plan only, with the implementation checks below. This is not code approval, PR approval, or authorization to run CI.

I inspected source 6f001863659da7fc9fae4302ec43c6e6a8c2f840 and confirmed tree b272f10383728fff0da86f79566e43aa2a400dc2.

The source supports your interpretation:

• grokProjectProvider.admit checks the route before credentials.
• fail("route") cancels the shared context.
• A route refusal does not establish credential rejection or budget exhaustion.

Required implementation checks:

1. Use one predicate snapshot for admission and diagnostics. Compute the fixed booleans from the same request. Derive the existing route decision from their conjunction. Do not recompute a separate diagnostic result. The current expression short-circuits, so this change must preserve its acceptance set.

2. Preserve the exact predicate meanings. The peer boolean must include successful net.SplitHostPort parsing and literal 127.0.0.1 equality. The nonabsolute boolean must represent the existing !r.URL.IsAbs() check, not introduce a broader origin-form parser. Keep exact RequestURI, Host, Content-Type, and header-count comparisons.

3. Keep the diagnostic associated with its refusal. Protect receipt updates with the existing mutex. Define first-write behavior so a concurrent or later request cannot overwrite the selected diagnostic or attach it to a different failure. Preserve rejection, cancellation, and the fixed HTTP 400 response. A refusal must not reach body capture or SSE generation.

4. Extend both receipt production and admission. scripts/project_native_runtime.py, Line 252, currently requires an exact field set. Admit only the old schema or that schema plus the one optional object. Require all fixed keys and actual boolean values. Reject null, missing keys, extra keys, duplicate keys, and nonboolean values. Preserve the 2048-byte limit, provider-absent admission, historical receipt compatibility, and existing artifact membership rules.

5. Test behavior, not just serialization. Cover each false predicate independently and the exact positive tuple. Use hostile-field canaries and a body reader that detects reads. Verify cancellation, unchanged counters, no SSE, and bounded serialization. Include concurrent or repeated refusal coverage for diagnostic stability. Do not require zero counters for every possible route failure: a later refused request can follow an earlier admitted request.

I found no plan-level reason to relax admission or increase budgets. The separate independent plan decision and subsequent code review remain required before a fresh source-bound run.

I did not download the reported artifact or independently verify its checksum. Its observed mismatch remains unknown. Native execution, lifecycle, restart, removal, authentication, and real-model qualification remain unproven. Grok project MCP remains unsupported.

---

🧠 Learnings used

Learnt from: CR
Repo: 777genius/universal-agent-plugins PR: 0
File: examples/plugins/grok-basic/plugin/README.md:0-0
Timestamp: 2026-10-23T20:16:40.591Z
Learning: Applies to examples/plugins/grok-basic/.grok-plugin/plugin.json : Applicability reference:
examples/plugins/grok-basic/AGENTS.md: # Plugin Boundary
- Start with [`plugin/README.md`](./plugin/README.md) for the full plugin guide.

Source excerpt:
# grok-basic

This example demonstrates the current packaged Grok subset:

- generated `.grok-plugin/plugin.json` references the managed sidecar via `"mcpServers": "./.mcp.json"`

Learnt from: CR
Repo: 777genius/universal-agent-plugins PR: 0
File: examples/plugins/grok-basic/plugin/README.md:0-0
Timestamp: 2026-10-23T20:16:40.591Z
Learning: Applies to {examples/plugins/grok-basic/plugin/mcp/servers.yaml,examples/plugins/grok-basic/.mcp.json} : Applicability reference:
examples/plugins/grok-basic/AGENTS.md: # Plugin Boundary
- Start with [`plugin/README.md`](./plugin/README.md) for the full plugin guide.

Source excerpt:
# grok-basic

This example demonstrates the current packaged Grok subset:

- portable `plugin/mcp/servers.yaml` generated into the wrapped `.mcp.json` sidecar

Learnt from: CR
Repo: 777genius/universal-agent-plugins PR: 0
File: examples/plugins/grok-basic/plugin/README.md:0-0
Timestamp: 2026-10-23T20:06:39.482Z
Learning: Applies to examples/plugins/grok-basic/{plugin/skills/**,skills/**} : Applicability reference:
examples/plugins/grok-basic/AGENTS.md: # Plugin Boundary
- Start with [`plugin/README.md`](./plugin/README.md) for the full plugin guide.

Source excerpt:
# grok-basic

This example demonstrates the current packaged Grok subset:

- portable `plugin/skills/**` generated into root `skills/**`

_{You are interacting with an AI system.}

[strix-security]

Strix Security Review

✅ No open security findings.

PR summary: This PR extends the Grok project-plugin native end-to-end qualification work: it widens the accepted `grok inspect --json` version set to 1.0.70 in the Grok adapter, and adds the supporting Go lifecycle/provider fixtures plus Python evidence collectors, admission validators and documentation for the skills-only project cycle.

Review summary

Reviewed all 48 changed files, focusing on the three surfaces with real trust boundaries: the new Grok native provider/title/session-title fixtures (fixture bearer keys, loopback listeners, authored .grok config, child environment, evidence redaction), the new Python evidence admission and privacy-scanning code in scripts/project_native_runtime.py and scripts/project_native_grok_cycle.py, and the collector's descriptor-relative fixture authoring and probe handling in scripts/project_native_collectors/grok.py. The production change is a narrow literal version allowlist widening (1.0.70 alongside 1.0.67) in install/integrationctl/agentplugins/clients/grok/project_inspect.go, which keeps the exact-field, exact-cwd and projectRoot checks intact, plus user-facing message text in scope.go. Fixture credentials are per-run crypto/rand values for an in-process loopback server, listeners bind 127.0.0.1:0 with strict request admission, authored config carries only the env-key name, the vendor child receives a synthesized environment rather than an inherited one, and captured evidence is redacted and bounded before archival. No confirmed vulnerabilities were found; the failures that did surface were robustness and hardening observations in CI evidence tooling rather than exploitable issues, and no report was filed.

Ruled out (3)

• Does the Grok evidence privacy canary let an escaped fixture credential into the published artifact when the JSON document also contains NaN/Infinity?
  The fail-open is real, but the only value it protects is a per-run random bearer key for a loopback fixture server that is destroyed before the artifact is published, and reaching it requires nonstandard JSON that no natural capture produces.
• Can a descriptor held by the Grok collector leak into the untrusted vendor child because it is opened without `os.O_CLOEXEC`?
  Every descriptor is closed in a `finally`/`except` before any probe, CPython's PEP 446 default already sets `FD_CLOEXEC` on `os.open` descriptors, and `subprocess.Popen` runs with `close_fds=True`, so nothing reaches the child.
• Does the collector's directory walk accept a more permissive pre-existing fixture directory and thereby weaken fixture integrity?
  It accepts on uid ownership alone, but every ancestor is created mode `0700` owner-only, files are created `O_EXCL` at `0600` with `nlink == 1` and re-verified by identity before and after each probe, and the only process that could create such a directory already has the same full filesystem reach.

_{Review 1 on this PR · fcde007 · requested Oct 29 17:25 UTC when the PR was opened}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}