Dashboard › institutional-transition-lab › Distillation
036cf608-985c-4d94-aaa1-ea7afe90a21f["lore_tm_v1_pdMGB9MjgsN-LvvPsD5uz33H58yR5OcsGJ36qBdiXMw","lore_tm_v1_Z2_84g-WNHzQwlrMLK6xQ5liVhsW1Bc5S_9uDu-9H-M","lore_tm_v1_eX4yPNT00e9V3pj1bVlJr0rAVv9z1FZZURl18wfvGIM","lore_tm_v1_0gRbfCyiJVRwkNDQvUbs-mhxN-u0BeVWMTBVEFOBS5M","lore_tm_v1_YHWsd_TRf3Q81jSRMudH9WEMBDceSPWoxD8NpnY8tNU","lore_tm_v1_uHHTBhTay1DpfEMZu1qbDaFnkBmJsKjMTpz0KlmTOpg","lore_tm_v1_USBMXHf8iQKR-b9b83IFLlmcn791_RQK_6oDd5Qm5Zo","lore_tm_v1_GNQ8JAvxymSLsv9S0xN0mMtKwq3-CAP3ppuJETj84Sk","lore_tm_v1_80z4EK57N-Z8TmfYToV305adTiuceGgIAn57diGjstI","lore_tm_v1_YxZ57OqihIKlOkixwOhqW65zHrpRyN1_1SZythX8erk","lore_tm_v1_f9KnTYuu--dHOoOEnN3dQuipAToOaR2zxPcuPSrSxG8","lore_tm_v1_VqyBeMffPDTo3gqoO8HZrItbX8arp7o1LexR3QVB6WQ","lore_tm_v1_NPOHI9mwd69hjF5CClrwPGNAbhjux5DxSG5eB2f-mQM","lore_tm_v1_v8z6hQafjWulJXe2voO2dc5tEYI8QjB65oyCeZ3gNfU","lore_tm_v1_odXCVHO7FWAu1J0ZbREdXYkdUmoI3ZDOckjcSknF1mo","lore_tm_v1_AyGlXwO2IeyhBYV8xZ6062eZIRA0kWdfhr-GKz3Rr_4","lore_tm_v1_0Lj6FqoQe-FWtRvh8WhcTs3xrgd4CnoVbUU5qsof3hs"]
Date: Sep 9, 2026
/home/byk/Code/institutional-transition-lab, replacing a reviewer that had returned empty results twice._read_regular_file and directly related constants/tests: rejection of symlinks, FIFOs, sockets, block/character devices, directories, and other special files without blocking or following links; descriptor/path TOCTOU; exact byte-limit enforcement; short/partial reads; descriptor cleanup; and error behavior.file:line references, PASS/CONCERN/MUST-FIX/BLOCKED labels, and a deterministic regression for every defect. If clean, the response had to state PASS with tests/probes and residual risks. Response had to end exactly MERGE or DO-NOT-MERGE.src/institution_lab/governance_adjudication.py: MAX_INPUT_BYTES = 16 * 1024 * 1024 at line 65; MAX_ARTIFACT_BYTES = 32 * 1024 * 1024 at line 66; _read_regular_file() at lines 94–109 uses os.O_RDONLY | os.O_NONBLOCK | getattr(os, "O_NOFOLLOW", 0), calls os.open() at line 97, wraps with os.fdopen() at line 100, classifies via os.fstat() and stat.S_ISREG() at lines 101–103, checks st_size > max_bytes at lines 104–105, reads max_bytes + 1 at line 106, and rejects excess length at lines 107–108.tests/test_governance_adjudication.py:931-951: test_regular_file_reader_rejects_fifo_without_blocking() creates a FIFO with os.mkfifo(), invokes _read_regular_file() in a subprocess with timeout=1, and asserts nonzero exit plus "input path is not a regular file" in stderr.1 passed in 0.38s.os.fdopen(descriptor, "rb") at src/institution_lab/governance_adjudication.py:100 raised IsADirectoryError before type classification.ValueError; missing path rejected with controlled ValueError; FIFO rejected without blocking; Unix socket rejected; /dev/null character device rejected; a synthetic block-device mode rejected; an exact 7-byte file accepted while 8 bytes was rejected; growth after fstat() was caught by the max_bytes + 1 read; replacement of the pathname after os.open() read the already-opened inode; a partial-read stream exceeding 7 bytes was rejected after 4 raw reads; block-device rejection closed the descriptor after fdopen() succeeded; and injected fstat() failure propagated while closing the descriptor.IsADirectoryError and leaked 1 descriptor.os.fdopen() construction failure leaked 1 descriptor.O_NOFOLLOW was unavailable because getattr(os, "O_NOFOLLOW", 0) silently substituted 0.git status reported src/institution_lab/governance_adjudication.py and tests/test_governance_adjudication.py as untracked (??).os.open() creates the descriptor at src/institution_lab/governance_adjudication.py:97, but ownership transfers only if os.fdopen() succeeds at line 100. A real directory and injected fdopen(...)=ENOMEM failure both leaked the raw descriptor, creating a hostile-input descriptor-exhaustion risk.ValueError, then verify the captured descriptor returns EBADF; 2. Make os.fdopen() raise and verify the raw descriptor is closed; 3. Ensure failing tests close leaked descriptors during cleanup.O_NOFOLLOW at src/institution_lab/governance_adjudication.py:95 protects only the final path component; a file under a symlinked parent was followed and accepted; and fallback to 0 when O_NOFOLLOW is unavailable allowed a final symlink to be followed and read.O_NOFOLLOW is unavailable; 3. Preserve final-component symlink rejection behavior.fstat() classifies it at lines 101–103. O_NONBLOCK prevented the tested FIFO from blocking, but device drivers do not universally guarantee nonblocking or side-effect-free open(). /dev/null and synthetic block-device metadata were rejected; no live block device was opened.tests/test_governance_adjudication.py:931-951, with no direct coverage for directories, sockets, devices, symlinked parents, missing O_NOFOLLOW, exact size boundaries, races, partial reads, or descriptor cleanup./dev/null were rejected; synthetic block-device mode was rejected and closed after successful fdopen(); the 7-byte boundary was exact; post-fstat() growth was detected; buffered reads accumulated repeated 2-byte partial reads and detected the excess byte; pathname replacement after os.open() preserved the opened inode; and success, oversize rejection, fstat() failure, and read failure closed descriptors once fdopen() had succeeded.DO-NOT-MERGE.