Distillation

Date: Sep 8, 2026

• 🔴 [requested-security-review] (06:45) User requested a substantive independent READ-ONLY security review of the exact current files under /home/byk/.local/share/opencode-v2-pilot/supervisor, plus /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts, /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts, /home/byk/.local/share/opencode-v2-pilot/opencode-v2.service, and /home/byk/.local/share/opencode-v2-pilot/CUTOVER.md; described it as a fresh review after a major revision.
• 🟡 (06:45) User requested inspection of every changed source, test, unit, and document, as well as all three binaries; requested verification of hashes and reproducible source builds.
• 🟡 (06:45) User specified the security threat model: same-UID malicious descendants; inherited/passed authenticated file descriptors; PID reuse/service restart; untrusted model command/input/output; protocol abuse; D-Bus/systemd compromise; Docker/lxd/sudo supplementary groups; ptrace/same-UID process attacks; cgroup/process escape; cwd TOCTOU; resource exhaustion; orphan units; and root parser attack surface.
• 🟡 (06:45) User requested verification of correct systemd interfaces and property types; SO_PEERCRED/SO_PEERPIDFD/InvocationID pinning through start; helper inability to connect or accept paths; CLOEXEC and fd-inheritance behavior; root/transient hardening; external delegation paths; admission/rate bounds; fail-closed cleanup; readiness-marker content binding; and absence of direct-spawn fallback.
• 🔴 [enforced-read-only-workflow] (06:45) User prohibited editing files, installing or starting services, and privileged operations; permitted unprivileged tests and offline analyzers.
• 🟡 (06:45) User required current file:line evidence, PASS/CONCERN/MUST-FIX classifications, exact blocker names, and a final line ending exactly with MERGE or DO-NOT-MERGE.
• 🟡 (06:45) Assistant committed to first freezing the review scope by inventorying every target file and binary and capturing hashes and metadata, then tracing protocol, authentication, systemd lifecycle, containment, tests, and build path against the exact on-disk revision.
• 🟡 (06:45) Assistant committed to read-only actions using only unprivileged offline checks.