Distillation

Date: Sep 8, 2026

• 🟡 (08:13) User requested a final, substantive, independent, READ-ONLY security review of the exact current source and artifacts under /home/byk/.local/share/opencode-v2-pilot/supervisor; plugin files /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts and /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts; canonical config/tsconfig/package files; candidate unit; CUTOVER.md; and persistent/temp PTY tests.
• 🔴 (08:13) User specified immutable claimed source-manifest SHA-256 fff146df36754bc59d473a070985c4310cb57bdad64473ec7f68b5be5014286f.
• 🔴 (08:13) User specified claimed artifact SHA-256 hashes: supervisor ff03df72fc6a401e8070db776ceba524e9111d9d907c6f4939244354564a86f2; launcher d833c859476f021565e8f425e6ee51353909060fa5f64ce629fb07d3411987dd; client fb8739d98ff7882782005e04ef731b6120e8daf0719e606362a1fe620adc2cde.
• 🟡 (08:13) User asked to verify every prior security blocker: Service ControlGroup; forge-proof cleanup using independent bounded state proof and safe signal handling; bounded STOP; bounded pre-listener output; no fd leak on MSG_CTRUNC; same-UID deployment-blocker truth and marker gate; flood resistance preserving access for the real MainPID; exact marker paths/order/source binding; canonical tsgo; helper runtime-open wording; and the Node 26 gate.
• 🟡 (08:13) User asked to reassess the full threat model: same-UID ptrace/fd delegation, PID reuse, cgroups, cwd handling, protocol/parser behavior, D-Bus sender/signals, systemd properties, root attack surface, supplementary groups, external sockets, resources, orphan units, and malicious output/input.
• 🟡 (08:13) User asked to inspect all changed files and tests, verify the manifest/hashes and reproducible builds, and run unprivileged checks if useful.
• 🔴 (08:13) User directed: never edit or install anything, never start or stop services, and never perform privileged actions.
• 🔴 (08:13) User requires source approval to be distinguished from root-host deployment acceptance.
• 🔴 (08:13) User requires current file:line evidence, PASS/CONCERN/MUST-FIX classifications, and a final answer ending exactly MERGE or DO-NOT-MERGE.
• 🟡 (08:13) Assistant committed to freeze scope by hashing the claimed tree and artifacts first, trace each blocker through source/tests/unit/config/cutover documentation, keep checks unprivileged, build only under /tmp/opencode, and avoid changing files or service state.
• 🟡 (08:14) Review work plan was ordered as: 1. Inventory and hash exact supervisor, plugin, config, unit, CUTOVER, and PTY-test scope (in_progress, high); 2. Trace every prior blocker and full threat model through current source/tests (pending, high); 3. Run unprivileged tests, canonical typecheck, and reproducible artifact builds in /tmp/opencode (pending, high); 4. Deliver an evidence-backed PASS/CONCERN/MUST-FIX verdict separating source approval from host acceptance (pending, high).
• 🟡 (08:14) Supervisor scope inventory contained: review-source-hash, verify-readiness, ROOT-ACCEPTANCE.md, PROTOCOL.md, bin/opencode-pty-client, bin/opencode-pty-launcher, bin/opencode-pty-supervisor, opencode-pty.slice, opencode-pty-supervisor.service, go.sum, cmd/client/main_test.go, cmd/client/main.go, cmd/supervisor/main.go, cmd/launcher/main.go, cmd/launcher/main_test.go, internal/supervisor/auth_test.go, internal/supervisor/server.go, internal/supervisor/auth.go, internal/supervisor/systemd.go, internal/supervisor/server_test.go, internal/supervisor/systemd_test.go, internal/protocol/frame_test.go, internal/protocol/frame.go, and go.mod, all under /home/byk/.local/share/opencode-v2-pilot/supervisor/.
• 🟡 (08:14) Additional reviewed-scope artifacts found included /home/byk/.local/share/opencode-v2-pilot/CUTOVER.md, /home/byk/.local/share/opencode-v2-pilot/opencode-v2.service, /home/byk/.local/share/opencode-v2-pilot/config/opencode/tsconfig.json, /home/byk/.local/share/opencode-v2-pilot/config/opencode/package.json, /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty.ts, /home/byk/.local/share/opencode-v2-pilot/config/opencode/plugins/pty-transport.ts, the three supervisor binaries/unit/slice, and installed dependency package/config/native artifacts under /home/byk/.local/share/opencode-v2-pilot/config/opencode/node_modules/.
• 🟡 (08:14) /home/byk/.local/share/opencode-v2-pilot contained exactly the listed entries cache/, config/, CUTOVER.md, data/, opencode-v2.service, state/, and supervisor/.
• 🟡 (08:14) One ripgrep execution failed; a later search returned 100 matches with more available and warned that results were truncated.
• 🟡 (08:14) supervisor/review-source-hash computes a content-bound manifest by hashing sorted unique paths from supervisor Go source/tests, /home/byk/Code/opencode-v2-pilot/packages/plugin/src/*.ts, supervisor/go.mod, supervisor/go.sum, supervisor/opencode-pty.slice, supervisor/opencode-pty-supervisor.service, config/opencode/plugins/pty.ts, config/opencode/plugins/pty-transport.ts, config/opencode/tsconfig.json, config/opencode/package.json, config/opencode/bun.lock, opencode-v2.service, /home/byk/Code/opencode-v2-pilot/packages/plugin/package.json, and /home/byk/Code/opencode-v2-pilot/bun.lock; it uses /usr/bin/find, LC_ALL=C /usr/bin/sort -u, /usr/bin/sha256sum, and /usr/bin/cut.
• 🟡 (08:15) supervisor/verify-readiness defines MARKER=/etc/opencode/pty-supervisor-verified and exact expected line revision=opencode-v2-pilot:git:2ac698d65aa4690a694307e9cbdf44537ea9a4fb;pty-source:sha256:fff146df36754bc59d473a070985c4310cb57bdad64473ec7f68b5be5014286f.
• 🟡 (08:15) supervisor/verify-readiness requires the marker to be a non-symlink regular file with exact ownership/mode 0:0:644, exactly four lines with no trailing line, and the exact expected revision/source-manifest line followed by exact standard sha256sum records for /usr/local/libexec/opencode-pty-supervisor, /usr/local/libexec/opencode-pty-launcher, and /usr/local/libexec/opencode-pty-client.
• 🔴 (08:15) User’s cutover policy requires proof that Session deletion, plugin unload, runtime expiry, explicit kill, client disconnect, and every ambiguous start path remove the complete transient cgroup, including descendants escaping the original process group; the readiness marker must never be created before this proof passes.
• 🔴 (08:15) User’s deployment gate requires the final exact Node 26.4 SEA binary to prove that the reviewed runtime gives the authenticated socket and cwd only to the fixed helper; Node 24 never satisfies this gate.
• 🔴 (08:15) User requires cutover to be blocked if another same-UID process can use ptrace, /proc descriptor access, inheritance, process control, or descriptor delegation to impersonate the service MainPID or use its socket.
• 🔴 (08:15) User stated workspace and network access are explicit pilot behavior and the PTY is not a general sandbox.
• 🔴 (08:15) User stated source tests never prove exact-host same-UID isolation and never substitute for target-host root acceptance.
• 🔴 (08:15) User requires /etc/opencode/pty-supervisor-verified to be created root-owned, mode 0644, only after every root-acceptance and review gate passes; arbitrary revision hex, duplicate/trailing lines, absent/symlinked/empty/stale/writable/wrong-owner/wrong-mode markers, and source or binary hash mismatches must never grant readiness.
• 🔴 (08:15) User requires cutover never to occur while root acceptance, independent reviews, or the content-bound readiness marker remain incomplete.
• 🟡 (08:15) CUTOVER.md preflight requires: 1. Production healthy on port 4096; 2. Candidate revision and smoke build confirmed with git -C /home/byk/Code/opencode-v2-pilot rev-parse HEAD and /home/byk/Code/opencode-v2-pilot/packages/cli/dist-v2-pilot-final/cli-node-linux-x64/bin/opencode2-node --version; 3. Candidate health/UI confirmed on port 14102; 4. Both local plugins active after POST /api/plugin/await-activation; 5. /home/byk/.local/share/opencode-v2-pilot/server.env mode 0600 containing OPENCODE_PASSWORD=<password>; 6. All supervisor/ROOT-ACCEPTANCE.md checks completed against freshly built root-owned binaries; 7. Complete transient-cgroup cleanup proof; 8. Exact Node 26.4 SEA and same-UID isolation proof; 9. Fresh independent correctness/security approval; 10. Root-controlled verifier and exact marker; 11. systemd-analyze verify of service/slice/candidate unit without modifying production.
• 🟡 (08:15) CUTOVER.md cutover order is: 1. Install candidate as /etc/systemd/system/opencode-v2.service; 2. sudo systemctl daemon-reload; 3. sudo systemctl stop opencode.service; 4. sudo systemctl start opencode-v2.service; 5. Verify /api/health, /, /site.webmanifest, /sw.js, and /openapi.json on port 4096; 6. Call POST /api/plugin/await-activation and confirm followup and local-pty via GET /api/plugin; 7. Observe browser traffic and run one follow-up plus one PTY smoke session; 8. Enable opencode-v2.service only after all checks pass, retaining opencode.service installed and disabled for rollback.
• 🟡 (08:15) CUTOVER.md rollback order is: 1. sudo systemctl stop opencode-v2.service; 2. sudo systemctl start opencode.service; 3. Verify legacy health and browser UI on port 4096; 4. Disable opencode-v2.service only after legacy health is confirmed. V2 data remains isolated under /home/byk/.local/share/opencode-v2-pilot/data, and rollback never rewrites or deletes either database.
• 🟡 (08:15) ROOT-ACCEPTANCE.md requires reproducible double builds of all three binaries using CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags=-buildid=, matching build sets, recorded source revision/Go version/dependency sums/commands/SHA-256 hashes, and installation only into root-controlled /usr/local/libexec.
• 🟡 (08:15) ROOT-ACCEPTANCE.md requires proving the socket peer is the Node SEA MainPID, not the helper, with exact UID, GID, MainPID, active/running, /system.slice/opencode-v2.service, 16-byte InvocationID, mandatory SO_PEERPIDFD, and rejection after MainPID or invocation replacement between authentication and start.
• 🟡 (08:15) ROOT-ACCEPTANCE.md defines the helper invariant: no initiated socket connection, caller-path resolution, or application-selected path open; only stdio plus fd 3 (duplicate of Node’s connected socket) and fd 4 (approved directory); one bounded start frame with one SCM_RIGHTS descriptor; close-on-exec received descriptors; and no unrelated child inheritance. Reviewed Go runtime metadata reads such as /sys/kernel/mm/transparent_hugepage/hpage_pmd_size may be accepted only when observed on the exact build.
• 🟡 (08:15) ROOT-ACCEPTANCE.md requires unauthenticated quota/rate limits not to consume authenticated capacity, valid authentication after rejected floods, and every handshake D-Bus operation to finish within five seconds.
• 🟡 (08:15) ROOT-ACCEPTANCE.md requires one valid session to create only names matching opencode-pty-[0-9a-f]{32}.service, run as byk:byk with an empty supplementary-group list, and have empty capability/ambient sets, closed devices, no cgroup delegation, restricted proc/namespaces/address families/syscalls, fixed environment, descriptor-selected cwd, and no access to supervisor, Docker, system D-Bus, or user D-Bus sockets.
• 🟡 (08:15) Exact protocol acceptance limits are: 4,096 command bytes; 128 arguments; 16,384 bytes per argument; 65,536 aggregate argument bytes; 3,600 seconds maximum runtime; and 65,536-byte writes split into 32,768-byte frames. Required rejections include malformed UTF-8, NUL, missing/extra descriptors, MSG_CTRUNC, metadata mismatch, wrong frame direction, unknown types, and oversized frames.
• 🟡 (08:15) PTY acceptance must cover the fixed /bin/sh -i inner shell, spaces, quotes, shell metacharacters, newlines, terminal input/modes, stdout/stderr ordering, EOF, script -e, zero/nonzero exits, signal exits, and preserved argv boundaries.
• 🟡 (08:15) Concurrency/cleanup acceptance must exercise 16 concurrent sessions and reject the 17th; cover slow/disconnected readers, blocked input plus disconnect, backpressure, maximum output, runtime expiry, TERM-to-KILL escalation, protocol failure, server shutdown, closed D-Bus signal channels, D-Bus timeouts, startup cancellation, and every StartTransientUnit non-done or ambiguous result; and after every start attempt confirm bounded StopUnit, complete cgroup removal, surfaced cleanup errors, and strict-name plus exact-BindsTo orphan cleanup.
• 🟡 (08:15) Plugin acceptance requires running bun /tmp/opencode/pty-plugin-smoke.ts ten times outside the auto-discovered plugin directory, then against a freshly built helper and isolated disposable supervisor, covering permissions, source identity, ownership, deletion, in-flight deletion, reservations, JSON envelopes, regex bounds, UTF-8 write bounds, pre-listener output bounds, saturated STOP bounds, transport framing, helper transfer, notifications, timeouts, and cleanup.
• 🟡 (08:15) PROTOCOL.md:48 states the transient launcher receives PTY stream on stdin/stdout and approved cwd descriptor on stderr, calls fchdir(2), replaces stderr with stdout, validates only canonical a[A-Za-z0-9_-]* URL-safe unpadded base64 arguments, clears the environment, binds its reviewed executable to fd 3, and executes /usr/bin/script -q -e -f -c "/bin/sh -i -c 'exec /proc/self/fd/3 --exec'" /dev/null; the inner launcher decodes argv, clears the temporary value, restores the fixed environment, closes fd 3, and directly calls execve.
• 🟡 (08:15) Temporary review artifacts under /tmp/opencode included the reviewed harness /tmp/opencode/pty-plugin-smoke.ts, many numbered smoke-result JSON files, /tmp/opencode/pty-supervisor-security.txt, /tmp/opencode/v2-pty-server.log, several current/final opencode-pty-{supervisor,launcher,client} builds, and paired build directories including /tmp/opencode/pty-review-fresh-a/ and /tmp/opencode/pty-review-fresh-b/; the listing was truncated after 100 results.
• 🟡 (08:15) Unprivileged hash evidence matched all claims exactly: source manifest fff146df36754bc59d473a070985c4310cb57bdad64473ec7f68b5be5014286f; bin/opencode-pty-supervisor ff03df72fc6a401e8070db776ceba524e9111d9d907c6f4939244354564a86f2; bin/opencode-pty-launcher d833c859476f021565e8f425e6ee51353909060fa5f64ce629fb07d3411987dd; bin/opencode-pty-client fb8739d98ff7882782005e04ef731b6120e8daf0719e606362a1fe620adc2cde.
• 🟡 (08:15) Current artifact metadata: bin/opencode-pty-supervisor is a regular file owned byk:byk, mode 755, size 4430463; bin/opencode-pty-launcher is byk:byk, mode 755, size 2098942; bin/opencode-pty-client is byk:byk, mode 755, size 2109912; review-source-hash is byk:byk, mode 755, size 965; verify-readiness is byk:byk, mode 755, size 1376.
• 🟡 (08:15) Observed tool/runtime versions were Go go1.22.2 linux/amd64, Bun 1.3.14, and Node v24.16.0; the observed Node version does not satisfy the explicit Node 26.4 deployment gate.