Distillation

Date: Sep 9, 2026

• 🟡 (04:53) Descriptor-read audit task ses_f7b8ca00fffeK5RfdeqsSmHa25 completed with DO-NOT-MERGE; it made no repository changes, used temporary directories with bytecode and pytest caching disabled, and reported the scoped files as untracked in scoped git status.
• 🟡 (04:53) MUST-FIX in src/institution_lab/governance_adjudication.py: os.open() creates a raw descriptor at line 97, but ownership transfers only if os.fdopen() succeeds at line 100. Directory input raises IsADirectoryError at line 100 before the intended type check at lines 101–103, and injected fdopen(...)=ENOMEM likewise leaks the raw descriptor, allowing repeated hostile inputs to exhaust descriptors.
• 🟡 (04:53) Required descriptor-cleanup regressions: open a directory and assert a controlled ValueError, then verify the captured descriptor returns EBADF; make os.fdopen raise and assert the raw descriptor is closed; ensure failing tests close any leaked descriptors during cleanup.
• 🟡 (04:53) MUST-FIX symlink finding in src/institution_lab/governance_adjudication.py: O_NOFOLLOW at line 95 protects only the final path component, so a file beneath a symlinked parent directory was followed and accepted. getattr(os, "O_NOFOLLOW", 0) at line 95 also silently disables protection when unavailable; removing the attribute caused a final symlink to be followed and read.
• 🟡 (04:53) Required symlink regressions: reject a symlinked parent directory; fail before opening the path when O_NOFOLLOW is unavailable; preserve existing final-component symlink rejection behavior.
• 🟡 (04:53) Device-opening concern: line 97 opens an object for reading before fstat() classifies it at lines 101–103. O_NONBLOCK prevented the tested FIFO from blocking, but device drivers do not guarantee nonblocking or side-effect-free open(). /dev/null and synthetic block-device metadata were rejected; no live block device was opened.
• 🟡 (04:53) Required device regression: use a controlled syscall mock for synthetic character/block-device metadata and assert that no readable device open occurs before rejection.
• 🔴 (04:53) User stated direct reader regression coverage is FIFO-only and never covers directories, sockets, devices, symlinked parents, missing O_NOFOLLOW, size boundaries, races, partial reads, or descriptor cleanup; the only direct reader test is tests/test_governance_adjudication.py:931-951, which checks FIFO rejection with a one-second timeout.
• 🟡 (04:53) Descriptor audit verified: FIFO rejection did not block and its focused test passed in 0.38 seconds; final-component symlinks were rejected on the Linux host; Unix sockets and /dev/null were rejected; synthetic block-device mode was rejected and closed after fdopen succeeded.
• 🟡 (04:53) Descriptor audit verified exact size behavior: the 7-byte boundary accepted 7 bytes and rejected 8; growth after fstat() was detected by the max_bytes + 1 read at lines 106–108; buffered reading accumulated repeated two-byte partial reads and detected the excess byte.
• 🟡 (04:53) Descriptor audit verified race and cleanup behavior: replacing the pathname after os.open() still read the already-opened inode; success, oversize rejection, fstat failure, and read failure closed descriptors once fdopen had succeeded.
• 🟡 (04:53) Descriptor-read limits are 16 MiB and 32 MiB at src/institution_lab/governance_adjudication.py:65-66.
• 🟡 (04:53) Assistant identified descriptor leaks on directory/fdopen failures and fail-open symlink handling as the two blockers. Fixes were deferred until the active JSON/pin and ZIP audits complete; the existing single follow-up remained scheduled.