fix(surveyor): repair UI settings physical read path

[blakinio]

Objective

Continue the same OTC-20260821-surveyor-next-nonoverlap-gap lifecycle after implementation PR #658 merged. The first trusted-main physical read-only acceptance run 32523208150 re-proved the exact runtime and completed passive collect-all, but ui_settings_typed_reader failed closed with LIVE_SETTINGS_READ_FAILED:CLIENTOPTIONS_PARENT_OPEN_FAILED.

Root cause and repair

Read-only metadata diagnosis proved the persistent Kasm runtime does not use the historical isolated-HOME path. There are four retained package roots, so a HOME/name search is intentionally rejected as ambiguous. The exact-fenced running executable was /home/kasm-user/otclient-track-a/Tibia-32177065988-1/bin/client; its own package-root sibling conf/clientoptions.json existed, was regular, non-symlink and target-UID-owned.

The current reader never scans HOME/package history. It holds an open /proc/<pid>/exe descriptor, exact-fences size/SHA, derives the executable path from /proc/self/fd/<exe_fd>, opens the candidate package root with mandatory O_DIRECTORY/O_NOFOLLOW, and requires the held executable descriptor path to equal exactly <root-fd-path>/bin/client before config open and again immediately before publication. root/bin/client inode equality remains an additional fence. This closes the rename/replacement + hard-link TOCTOU findings while preserving regular-file/UID checks and the exact output allowlists/rebuilt dictionaries from AUD-658-001.

Evidence

• implementation merge: 1cb56f652784ca1baeaf59a777e4c0b5b8ab312e
• first physical run/job: 32523208150 / 96899728966
• sanitized artifact: 9461336737, digest sha256:e10a836244c454056e09202f5f179c16852b743db9016e30c004b1fa3d19690f
• exact client PID/start at that run: 19590 / 76611792
• size/SHA: 52109920 / ed5469b9fa71349de688f719434d23875f76f28a3ebd08a36d30f7f6da0af6b8
• registration generation / lease generation: 2 / 19
• one exact client + one matching X11 window; target uniqueness PROVEN
• collect-all: 169 / 12 / 7, privacy PASS
• first UI settings result: UNAVAILABLE / CLIENTOPTIONS_PARENT_OPEN_FAILED
• exact-head remediation: e05a9d9e8977cfee14049ff462b232220c28bd08
• Track A Surveyor tests 32529870735: SUCCESS
• Track A runtime governance 32529870700: SUCCESS
• repository CI 32529871079: pending at the latest observation
• prior exact-head review PRR_kwDOTVmdjs8AAAABKeFMxQ on 7b9a0bc7... found AUD-659-003 P2; addressed in the current head; its thread is resolved

Current authority

Pre-merge checkpoint remains runtime_access:none; the physical diagnosis admission is historical and released. No gameplay input, relogin, client restart, process control, process-memory write, credentials, character selection, network mutation or economy action occurred. No additional runtime access is planned before merge.

The current head must still obtain a fresh independent exact-head audit with zero material findings and repository CI success. Only then may #659 merge, followed by a fresh trusted-main one-shot read-only physical acceptance. Task-level E2E is not PASS until the merged reader returns AVAILABLE.

Task: OTC-20260821-surveyor-next-nonoverlap-gap.

[blakinio]

@codex review

Fresh independent validator request for exact repair head c75232e835c5ac187d32f2aa984b43f2ed2aa21e. Attempt to falsify the physical repair, not confirm the worker summary. Recheck especially: exact-fenced /proc/PID/exe package-root anchoring; rejection of ambiguous HOME/package searches; mandatory O_DIRECTORY/O_NOFOLLOW; regular-file and target-UID validation; preservation of the #658 exact output allowlists/rebuilt dictionaries; truthful conf/clientoptions.json relative-path contract; read-only/no-process-memory/no-GUI/no-login/no-restart boundary; and task/governance consistency. Do not access proprietary client bytes, credentials or session material. Report any concrete P0/P1/material finding, or state zero material findings on this exact head. Post-merge physical E2E remains separate.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c75232e835

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[blakinio]

Autonomous checkpoint — repair audit/CI gate

Invocation result: WAITING under docs/agents/ANTI_STALL_AND_EXECUTION_BUDGET.md; no completion or merge is claimed.

Exact frozen repair head: c75232e835c5ac187d32f2aa984b43f2ed2aa21e.

Verified repair evidence:

• first trusted-main physical run 32523208150 / job 96899728966 on implementation merge 1cb56f652784ca1baeaf59a777e4c0b5b8ab312e re-proved exact PID/start 19590/76611792, exact client fence, one matching X11 window, registration generation 2, lease generation 19, READ_ONLY_ADMITTED, target uniqueness PROVEN, mutation false;
• sanitized artifact 9461336737, digest sha256:e10a836244c454056e09202f5f179c16852b743db9016e30c004b1fa3d19690f, privacy PASS, 169/12/7;
• that run correctly failed task-level E2E because ui_settings_typed_reader=UNAVAILABLE / CLIENTOPTIONS_PARENT_OPEN_FAILED;
• read-only metadata diagnosis proved the current exact executable package root and unambiguous sibling conf/clientoptions.json; no config contents or process memory were read during diagnosis;
• repair anchors only to the exact-fenced executable package root, requires .../bin/client, mandatory O_DIRECTORY/O_NOFOLLOW, regular-file + target-UID validation, no HOME/package-history scan, and preserves the feat(track-a): continue Surveyor next non-overlap typed reader #658 exact output allowlists;
• local repair validation: UI/settings 8/8 PASS, all Surveyor 59/59 PASS, compileall PASS, repository-only collect-all 169/12/7, privacy PASS, Track A governance PASS, git diff --check PASS;
• pre-merge runtime admission has been released back to runtime_access:none.

Exact-head GitHub checks observed:

• Track A Surveyor tests 32524073132: SUCCESS;
• Track A agent runtime governance 32524031321: SUCCESS;
• repository CI 32524031531: still IN_PROGRESS at the final allowed ordinary observation for this invocation.

Fresh independent validator request comment 5375078116 targets exact head c75232e835c5ac187d32f2aa984b43f2ed2aa21e; Codex acknowledged it with eyes, but no validator result has been submitted after the allowed bounded checks. Audit PASS is therefore not claimed.

No gameplay input, login/relogin, client restart, process signal/control, process-memory write, credential access, character selection, network mutation, transaction or economy action was performed.

Shared-index closeout preflight: open PR #23 currently changes docs/agents/MODULE_CATALOG.md and docs/agents/CHANGELOG.md, so this task must not race-edit those shared paths; terminal archive will record that ownership boundary.

next_action: re-read #659 from live GitHub. Require the independent review to match exact head c75232e835c5ac187d32f2aa984b43f2ed2aa21e and have zero material findings; require CI 32524031531 success and zero unresolved threads. If all pass and main remains merge-safe, squash-merge #659, rerun the existing trusted-main one-shot Surveyor read-only workflow, verify ui_settings_typed_reader=AVAILABLE in the sanitized artifact, then persist physical evidence and complete the archive/ownership-release closeout PR.

[blakinio]

@codex review

Fresh independent validator request for exact head 7b9a0bc7eb69a7b904e9ee66b7bcfcb08fe1e06d after remediation of both findings from review 4997251226. Attempt to falsify the final repair, not confirm the worker summary. Recheck especially: held /proc/<pid>/exe descriptor exact-fence; descriptor-bound root/bin/client (st_dev, st_ino) equality before config read; protection against package-root rename/replacement TOCTOU; recheck of current executable identity before publication; mandatory O_DIRECTORY/O_NOFOLLOW; regular-file and target-UID validation; preservation of exact output allowlists; historical/released runtime-admission wording; read-only/no-process-memory/no-GUI/no-login/no-restart boundary; and lifecycle governance. Do not access proprietary client bytes, credentials or session material. Report any concrete P0/P1/material finding, or state zero material findings on this exact head. Post-merge physical E2E remains separate.

[blakinio]

Autonomous checkpoint — final descriptor-binding remediation gate

Current invocation result: WAITING under docs/agents/ANTI_STALL_AND_EXECUTION_BUDGET.md; no merge or physical PASS is claimed.

Exact final repair head: 7b9a0bc7eb69a7b904e9ee66b7bcfcb08fe1e06d.

This invocation remediated both findings from Codex review 4997251226 on superseded c75232e...:

• AUD-659-001 P2: the live probe now holds an open /proc/<pid>/exe descriptor, exact-fences size/SHA on that descriptor, opens root/bin/client through the held package-root FD, requires identical (st_dev, st_ino) to the held live executable before opening conf/clientoptions.json, and rechecks current executable identity before publication. This closes the package-root rename/replacement TOCTOU while retaining mandatory O_DIRECTORY/O_NOFOLLOW, regular-file/UID checks and exact output allowlists.
• AUD-659-002 P2: durable task/evidence text now explicitly states the diagnosis read-only admission was temporary and released; current frontmatter remains runtime_access:none.

Both old review threads are resolved/outdated. Current main remains 1cb56f652784ca1baeaf59a777e4c0b5b8ab312e; #475/#593 remain open, so the original world/minimap exclusion remains valid.

Exact-head GitHub gates observed on 7b9a0bc7...:

• Track A Surveyor tests 32528575816: SUCCESS;
• Track A agent runtime governance 32528548227: SUCCESS;
• repository CI 32528548386: PENDING at the second permitted ordinary exact-head observation in this invocation;
• fresh Codex request 5375597981 targets exact 7b9a0bc7... and is acknowledged with eyes, but no exact-head validator result has yet been submitted after the bounded checks.

No runtime/client observation occurred after the diagnosis admission was released. No gameplay input, login/relogin, client restart, process control, process-memory write, credentials, network mutation, transaction or economy action occurred.

next_action: in a fresh continuation, re-read #659. Require a Codex result for exact 7b9a0bc7... with zero material findings, require CI 32528548386 SUCCESS and zero unresolved threads, and re-read current main/head. If clean, squash-merge #659. Then dispatch existing trusted-main Track A Surveyor v2 read-only with task id OTC-20260821-surveyor-next-nonoverlap-gap; inspect the sanitized artifact and require ui_settings_typed_reader=AVAILABLE, bounded Master Volume fields, filesystem_access=read_only, process_memory_access=not_used, privacy PASS and no mutation. Persist final physical evidence, archive/remove the active task, avoid shared MODULE_CATALOG.md/CHANGELOG.md while #23 owns them, obtain proportionate closeout audit/CI, merge the closeout PR, and verify terminal main state.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7b9a0bc7eb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[blakinio]

Autonomous checkpoint — AUD-659-003 remediated

Exact current head: e05a9d9e8977cfee14049ff462b232220c28bd08.

Material progress in this invocation:

• fresh exact-head review PRR_kwDOTVmdjs8AAAABKeFMxQ on superseded 7b9a0bc7... opened AUD-659-003 P2: inode equality alone allowed a same-filesystem hard-link replacement tree;
• remediation now derives the executable pathname from the held /proc/<pid>/exe descriptor via /proc/self/fd/<exe_fd>, keeps root_fd held through the config read, and requires the exact descriptor-path relationship <root-fd-path>/bin/client both before config open and immediately before publication;
• existing exact size/SHA, PID/start, current /proc/<pid>/exe identity, root/bin/client inode equality, O_DIRECTORY/O_NOFOLLOW, regular-file/target-UID checks, exact output allowlists and no-process-memory boundary remain;
• added bounded failure/source coverage; durable task/evidence and PR body updated; AUD-659-003 thread resolved;
• changed-file list remains exactly six task-owned paths; full diff reviewed with no unrelated/forbidden path.

Exact-head GitHub gates observed:

• Track A Surveyor tests 32529870735: SUCCESS;
• Track A agent runtime governance 32529870700: SUCCESS;
• repository CI 32529871079: IN_PROGRESS at the second and final ordinary exact-head observation for this invocation;
• fresh independent audit on e05a9d9e...: not yet available. Prior Codex reviews do not satisfy the new exact-head audit gate.

Current runtime authority remains runtime_access:none; no runtime, gameplay input, login/relogin, restart, process control, process-memory write, credential, network mutation, transaction or economy action was used.

next_action: on a later continuation, re-read live #659. Require repository CI success and a fresh independent audit that explicitly covers exact head e05a9d9e8977cfee14049ff462b232220c28bd08 with zero material findings and zero unresolved threads. If all gates pass and main/head remain merge-safe, squash-merge #659, then execute the trusted-main one-shot read-only physical acceptance and continue terminal closeout. Do not merge or dispatch physical E2E before those gates pass.

[blakinio]

@codex review

Fresh independent validator request for exact head e05a9d9e8977cfee14049ff462b232220c28bd08 after remediation of AUD-659-003. Attempt to falsify the current repair, not confirm prior summaries. Recheck especially: held /proc/<pid>/exe descriptor exact-fence; executable pathname derived from /proc/self/fd/<exe_fd>; exact <root-fd-path>/bin/client relationship before config open and immediately before publication; resistance to package-root rename/replacement and same-filesystem hard-link substitution; current /proc/<pid>/exe identity recheck; root/bin/client inode equality as only an additional fence; mandatory O_DIRECTORY/O_NOFOLLOW; regular-file/target-UID validation; exact output allowlists; released runtime_access:none authority; and no process-memory/GUI/login/restart boundary. Report any concrete P0/P1/material finding, or indicate zero material findings on this exact head. Post-merge physical E2E remains separate.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: e05a9d9e89

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[blakinio]

Automation checkpoint — all merge gates green; merge action blocked by execution safety

Exact current repair head: e05a9d9e8977cfee14049ff462b232220c28bd08.

Fresh live verification in this invocation:

• PR fix(surveyor): repair UI settings physical read path #659 is open, mergeable, non-draft, base main, exact head e05a9d9e8977cfee14049ff462b232220c28bd08;
• current main is still 1cb56f652784ca1baeaf59a777e4c0b5b8ab312e, matching the PR base;
• Track A Surveyor tests 32529870735: SUCCESS;
• Track A agent runtime governance 32529870700: SUCCESS;
• repository CI 32529871079: SUCCESS;
• fresh Codex validator result 5376060651 explicitly reviewed e05a9d9e89 and reported no major issues;
• all three review threads are resolved; zero unresolved review threads remain.

The repository merge gate is therefore satisfied on the exact head. I attempted the authorized PR merge through the GitHub connector with the exact expected head SHA (including an explicit squash attempt and a minimal merge attempt). Both write calls were rejected before reaching GitHub by the execution environment's safety layer (This tool call was blocked by OpenAI's safety checks). I did not bypass that block by moving main directly or constructing a synthetic commit, because that would evade the requested PR merge path and repository governance.

Remote Desktop endpoints Molehill-PC and Synology are also currently offline, so there is no alternate authorized interactive path available in this run for the merge or the later trusted-main physical workflow dispatch.

Current runtime authority remains runtime_access:none; no runtime/client observation, gameplay input, login/relogin, restart, process control, process-memory write, credential access, network mutation, transaction or economy action occurred.

STATUS: BLOCKED
RESULT: all exact-head pre-merge gates verified green; merge not performed
CHANGED_PATHS: none
VALIDATION: Surveyor 32529870735 SUCCESS; governance 32529870700 SUCCESS; CI 32529871079 SUCCESS
AUDIT: Codex 5376060651 on e05a9d9e89, zero major/material findings observed; zero unresolved threads
E2E: not run because implementation PR could not be merged
PR_HYGIENE: #659 open/mergeable/non-draft; zero unresolved threads
LAST_PROGRESS: exact-head CI became terminal SUCCESS and exact-head Codex audit returned clean
BUDGET: one live gate verification pass; no repeated polling
UNCHANGED_STATE: main remains 1cb56f652784ca1baeaf59a777e4c0b5b8ab312e; runtime authority remains none
DURABLE_STATE: task OTC-20260821-surveyor-next-nonoverlap-gap, branch fix/OTC-20260821-surveyor-ui-settings-physical, head e05a9d9e8977cfee14049ff462b232220c28bd08, PR #659 open
BLOCKER: GitHub merge mutation is blocked by the execution environment safety layer; remote hosts are offline
NEXT_ACTION: perform the normal squash merge of #659 at exact expected head e05a9d9e8977cfee14049ff462b232220c28bd08 from an authorized environment, then resume trusted-main read-only physical E2E and closeout.

[blakinio]

@codex review

Fresh independent validator request for current exact head e05a9d9e8977cfee14049ff462b232220c28bd08. This is the final pre-merge audit after remediation of prior TOCTOU findings. Attempt to falsify the current implementation and lifecycle record. Recheck especially held /proc/<pid>/exe descriptor identity, package-root binding before config read and immediately before publication, hard-link/rename/replacement resistance, mandatory O_DIRECTORY/O_NOFOLLOW, regular-file/UID checks, exact output allowlists, no HOME/package-history scan, runtime_access:none pre-merge authority, and no gameplay/login/restart/process-memory-write boundary. Report any concrete material finding, or state zero material findings on this exact head. Physical E2E remains intentionally last.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e05a9d9e89

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Make descriptor-path root binding race-free

When a same-UID writer can rename the package directories, these two readlink calls do not observe one atomic filesystem state: it can expose the original tree at the expected pathname for the executable read, then restore a replacement tree before the root read. If that replacement contains a hard link to the executable, both this path comparison and the later inode comparison pass, while conf/clientoptions.json is opened from the replacement; the same swap can be repeated around the final check before publication. Fresh evidence on e05a9d9 is that the remediation samples exe_fd and root_fd paths sequentially, so it does not close the previously reported hard-link/rename race; the ancestry binding needs to be established through a race-free descriptor relationship rather than separately sampled /proc/self/fd paths.

Useful? React with 👍 / 👎.

[blakinio]

Post-merge trusted-main acceptance checkpoint

Live source of truth revalidated on 2026-08-22:

• PR fix(surveyor): repair UI settings physical read path #659 is merged; current main is merge commit 4c5b3f216510b4f583b49779f0a22f1ba4f5b927.
• The final trusted-main Track A Surveyor v2 read-only acceptance had already been dispatched as run 32565074722 on this exact main and remains queued.
• A later duplicate dispatch 32567643266 was detected and cancelled to preserve single-shot serialized runtime observation.
• Read-only Synology inspection shows both otclient-synology-runner and otclient-track-a-kasmvnc are currently stopped. No container/client/process start, restart, signal, login, GUI input, credential access, process-memory access, network mutation, gameplay action, or economy action was performed.
• Because runtime/process-control authority is explicitly absent, this task remains in runtime_access:none while waiting for the externally restored runner/runtime. E2E PASS is not claimed.

Next action: when the existing queued run 32565074722 can execute on the restored trusted runtime, inspect its sanitized artifact and require ui_settings_typed_reader=AVAILABLE, bounded Master Volume fields, filesystem_access=read_only, process_memory_access=not_used, target uniqueness, privacy PASS and mutation false. Only after that physical PASS proceed to evidence/archive/release/closeout PR.