[jcdavis131]

#85 has merged to main. This draft now targets main.

Stacked Trackio work from #86, merged onto origin/main at 09b07651d9e7233c771fe3552c089a535bb84410 (includes #89 leakgate fixtures). Normal merge commit, no rebase, no force-push.

Adds optional local-only Trackio experiment tracking to the HELPER FT path. pip install trackio is enough; missing or raising Trackio logs a warning and the run continues. Integrity gate outcomes are unchanged: a REFUSED kick still refuses.

Trackio is a dashboard, never stamp-gate evidence. Verdicts come only from the sha-pinned results files and the HQ events.

Merge resolution (#89 + Trackio)

• Kept main's leakgate (collect_state_leaks gold-predictive detector, generated leakgate_eval fixtures, pack_dir on enforce_pack_gates).
• Kept feat(dottie-os): local fail-open Trackio for HELPER FT #86 Trackio: completion logs sha256_evidence, result, and exit_code from kick()'s return only; smoke logs smoke=true and is never scorable; refused kicks log status=refused with the reason.
• .github/workflows, trust/, CODEOWNERS, and pack-guard steps are unchanged from main.
• HANDOFF.md restamped so check_handoff_fresh.py stays under the 20-commit budget on this unsquashed stack (main itself was only 9 behind).

Tests

python3 -m unittest discover -s apps/dottie-os/tests -v — 201 OK.

Head: 17e7c33a9107b27bebf34708adb1fd521102e8e9. Draft. Do not merge until review.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
arxiviq	Ready	Preview	Oct 23, 2026 1:39pm UTC
dottie-os-console	Ready	Preview	Oct 23, 2026 1:39pm UTC

[cursor]

Approved. Cursor Bugbot was not present after the first check poll, so that signal was skipped; remaining configured signals and approval policies do not require human review. This automation had no prior approval on the current head.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Agentic security review of the HELPER FT Trackio sidecar found two medium issues: trainer-log parsing can break the fail-open MATCH/REFUSED invariant, and refused kickoff requests can mkdir a Trackio store from attacker-supplied evidence_path.

  

_{Sent by Cursor Security Agent: Security Reviewer}

[cursor]

🔒 Agentic Security Review
Severity: MEDIUM

log_losses_from_text() does int(step) on trainer stdout/log mappings with no fail-open wrapper. kick() then treats any exception after that call as KickRefused('kickoff'), and :8765 _handle_train_kickoff calls the same helper before re-hash, outside _track_kickoff_result's try/except. A HuggingFace-style line such as {'loss': 0.1, 'step': 1e309} parses to inf and raises OverflowError, so a run that would have matched hashes is refused (or the WSGI handler 500s) because of dashboard parsing.

Impact: Untrusted trainer logs become a live control-plane input to the HELPER FT integrity gate, violating the fail-open invariant that Trackio must not change MATCH/REFUSED.

 

^{Reviewed by Cursor Security Reviewer for commit 17e7c33. Configure here.}

[cursor]

🔒 Agentic Security Review
Severity: MEDIUM

Unauthenticated POST /train/kickoff (127.0.0.1:8765) takes evidence_path from the JSON body, sets run_dir to its parent, and on every non-ok result calls session.refuse() → start() → mkdir(parents=True) of <parent>/trackio. That write happens even when the request is already refused (inbox latest, missing trust, bad mode), as long as run_id is a non-empty string. The path is not lstat'd, not required to exist, and is only filtered by a substring blocklist (/trust/, /dataset(s)/, /factory/).

Impact: Any local peer who can reach the loopback kickoff port can make the training-host process create arbitrary directory trees (and Trackio jsonl under them) with the daemon's uid, including paths that never existed.

 

^{Reviewed by Cursor Security Reviewer for commit 17e7c33. Configure here.}