Why
The heap fence exists so untrusted page content never reaches the orchestrator unfenced. The audit log routes around it: an injected actor writes attacker prose into it, and the orchestrator later ingests those bytes verbatim.
What
- Every successful fetch is audited with the full attacker-chosen path:
{origin, path: u.pathname, method} (peerd-egress/fetch/web-fetch.js:205), no narrowing, no length cap (the log caps entry count only).
inspect({kind:'audit_log'}) returns entries as raw JSON.stringify (peerd-runtime/tools/defs/inspect.js:184-199) - no wrapUntrusted, therefore no disarmText (prompt-wrap.js is the only CDR call site).inspect is on the main agent surface.
How
Verified by reading: inspect.js contains no wrapUntrusted call. This is the same laundering that origin-lock-report.js and redactActorError exist to close, so the fix likely mirrors them (fence the facet, or narrow what the path audit records).
Found by an adversarial multi-agent review of the merged #255 arc: each claim was checked by a separate agent instructed to refute it, and the code references below were re-verified by hand. Empirical status is stated per issue - most are verified by reading, not by a working exploit.
Why
The heap fence exists so untrusted page content never reaches the orchestrator unfenced. The audit log routes around it: an injected actor writes attacker prose into it, and the orchestrator later ingests those bytes verbatim.
What
{origin, path: u.pathname, method}(peerd-egress/fetch/web-fetch.js:205), no narrowing, no length cap (the log caps entry count only).inspect({kind:'audit_log'})returns entries as rawJSON.stringify(peerd-runtime/tools/defs/inspect.js:184-199) - nowrapUntrusted, therefore nodisarmText(prompt-wrap.js is the only CDR call site).inspectis on the main agent surface.How
Verified by reading:
inspect.jscontains nowrapUntrustedcall. This is the same laundering thatorigin-lock-report.jsandredactActorErrorexist to close, so the fix likely mirrors them (fence the facet, or narrow what the path audit records).Found by an adversarial multi-agent review of the merged #255 arc: each claim was checked by a separate agent instructed to refute it, and the code references below were re-verified by hand. Empirical status is stated per issue - most are verified by reading, not by a working exploit.