Omar SobhandClaude Opus 5.5 5f69e88878 feat(gate): untrusted-target in shadow — stage 2 of argument provenance ...

Records (never refuses) a curl/wget to a host fetched content named, when the
command expands something at run time: the GET-exfil shape the floor leaves
open. The designed rule — body-carrying calls to tainted hosts — is dominated
by curl-body/curl-upload/wget-body, which already refuse every body, so it
would have shadowed nothing and looked like a clean result.

One case table drives the Rust predicate and the generated shell; they agree on
all ten cases (attack spellings, link-following, untainted expansion, subdomain
limit, non-fetches), and every case exits 0. The gate reads the file the tap
writes on both tiers (tested).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2026-09-22 18:45:08 -05:00

..

routes

feat(door): a calibrated governor with three outcomes — allow, deny, HELD for a person

2026-09-21 13:54:33 -05:00

agent_lifecycle.rs

feat(agents): make delete permanent, and expose the census

2026-08-14 18:04:43 -07:00

agent_names.rs

fix(workforce): a crew should not read as an alphabetical run

2026-08-10 15:57:54 -07:00

auto_merge.rs

feat(delivery): record WHICH files a phase touched, not just how many

2026-08-10 22:34:39 -07:00

benchmark_runner.rs

refactor: the missions root has one definition, not five

2026-08-09 06:18:01 -07:00

beszel.rs

fix(metrics): GPU, network and disk IO were arriving and being dropped

2026-08-11 17:53:16 -07:00

brain_seed.rs

slice 3.5d: agent_template_link + brain seed helper + skills merge

2026-07-19 14:16:16 -07:00

cleanup_sweeper.rs

Reaping: sandbox orphan reaper + DB expiry/retention sweeper + volume-init retry

2026-06-19 04:55:27 -07:00

container_exec.rs

fix(diag): "turn timed out" now says what the agent was doing

2026-08-10 08:56:51 -07:00

container_tool_hooks.rs

fix(taint): record taint.hosts once per phase, not once per sweep tick

2026-09-22 18:43:24 -05:00

continuous_research.rs

fix(triage): a relevance score on a pre-filtered corpus ranks nothing — measure evidence instead

2026-09-22 08:19:41 -05:00

corpus.rs

feat(library): attribute a run to a mission, and prove what it contributed

2026-08-03 11:43:41 -07:00

error.rs

feat(missions): a human can finally reach the plan/roster review gate

2026-08-19 11:56:54 -07:00

evaluator_tools.rs

perf(judge): a command may return 64 KB, so a deliverable is read once

2026-09-18 22:34:05 -05:00

evaluator.rs

feat(judge): the judge commits to a verification plan before it reads the evidence

2026-09-20 22:07:39 -05:00

extract.rs

Rebrand: TeamClaw -> Clawmates (clawmates.work)

2026-06-10 12:31:25 -05:00

fleet_herdr.rs

ci fixes: cargo fmt, eslint entities, max-lines split

2026-07-20 12:03:43 -07:00

fleet.rs

feat(observability): stream a microVM turn's stdout/stderr to the platform live

2026-08-07 21:07:12 -07:00

gateway_preflight.rs

fix(security): a signed Slack request could be replayed forever

2026-08-19 12:24:09 -07:00

harvest.rs

feat(missions): Continuous Research harvests at launch, and cards launch by clicking

2026-08-17 15:05:37 -07:00

level_up.rs

sec(door): closed by default, governor fails closed; self-authoring off by default

2026-09-20 22:07:39 -05:00

lib.rs

feat(decide): cm-decide — typed calibrated decisions; Jev + local NLI backends; skill triage in shadow

2026-09-21 10:08:31 -05:00

library.rs

fix(research): the manifest belongs to the mission, and a brittle phrase must not mean silence

2026-08-18 07:18:11 -07:00

live_bus.rs

feat(telemetry): push bus for live agent frames

2026-08-15 16:29:12 -07:00

mcp_door.rs

feat(door): a calibrated governor with three outcomes — allow, deny, HELD for a person

2026-09-21 13:54:33 -05:00

mcp_skills.rs

feat(skill-use): progressive disclosure, as an arm and not a switch

2026-08-25 07:17:55 -05:00

microvm_client.rs

feat(observability): stream a microVM turn's stdout/stderr to the platform live

2026-08-07 21:07:12 -07:00

microvm_executor.rs

feat(taint): stage 1 of argument provenance — the tap records hosts fetched content named

2026-09-22 18:27:07 -05:00

microvm_turn_executor.rs

feat(taint): stage 1 of argument provenance — the tap records hosts fetched content named

2026-09-22 18:27:07 -05:00

mission_delivery.rs

feat(continuous-research): the digest reaches the vault, and the renderer stops racing a reaper

2026-09-22 10:43:09 -05:00

mission_events.rs

feat(skill-use): red-first is observable from what the RUNS reported

2026-08-21 12:45:20 -07:00

mission_fs.rs

feat(skills): a files arm — progressive disclosure through Read, not a deferred tool

2026-09-12 22:33:41 -05:00

mission_gc.rs

feat(skills): deliver on every tier, record what agents receive, let them self-author

2026-08-19 10:24:35 -07:00

mission_memory.rs

fix(memory): verdict lines carry the brief and a distinguishing mission id

2026-09-22 17:42:37 -05:00

mission_orchestrator.rs

feat(self-audit): continuous_improvement audits the project record it can actually reach

2026-09-22 15:27:09 -05:00

mission_outputs.rs

style: rustfmt the four files the repo-less mission fix touched

2026-08-13 12:19:43 -07:00

mission_plan.rs

feat(missions): W1/#13 — let a model author the mission's phases

2026-08-06 20:05:28 -07:00

mission_refiner.rs

fix(models): coding runs on sonnet-5, judging on opus-5, haiku only as last resort

2026-08-16 12:36:19 -07:00

mission_roster.rs

fix(missions): a bootable rootfs is not a runnable one

2026-08-06 16:27:25 -07:00

mission_runtime.rs

feat(gate): task permission — the work surface is allowed, the platform is not

2026-09-22 10:07:58 -05:00

mission_schedule.rs

feat(missions): Continuous Research harvests at launch, and cards launch by clicking

2026-08-17 15:05:37 -07:00

mission_workspace.rs

refactor: the missions root has one definition, not five

2026-08-09 06:18:01 -07:00

node_rules.rs

CI: remove k8s stages, fix the Docker-level pipeline green

2026-06-26 18:15:31 -07:00

papers.rs

fix(research): the manifest belongs to the mission, and a brittle phrase must not mean silence

2026-08-18 07:18:11 -07:00

phase_config.rs

feat(gate): task permission — the work surface is allowed, the platform is not

2026-09-22 10:07:58 -05:00

phase_runner.rs

fix(taint): record taint.hosts once per phase, not once per sweep tick

2026-09-22 18:43:24 -05:00

phase_summarizer.rs

feat(judge): room to analyse — and a panic in the evidence path

2026-08-16 21:59:01 -07:00

podcast.rs

fix(podcast): a tombstone must not be permanent

2026-09-22 13:16:47 -05:00

quota.rs

chore: cargo fmt --all — clean up a2a merge's fmt violations

2026-07-05 18:54:15 -07:00

recursive_exec.rs

feat(billing): agent-side spend records who was paid

2026-09-14 08:17:20 -05:00

repo_digest.rs

feat(missions): give the planner the repository's contents, not just its names

2026-08-07 05:01:02 -07:00

root_copy.rs

fix(exec): mission work runs as uid 65532, so it stops creating debris it cannot delete

2026-08-09 10:47:59 -07:00

runtime_preflight.rs

chore(runtime): promote v0.8.4 from canary to the default image

2026-08-11 13:57:08 -07:00

runtime_provision.rs

feat(missions): install the skills door, with a credential it is safe to leave

2026-08-21 11:47:13 -07:00

security_scan.rs

fix(missions): the security scan phase now scans, and task upserts work

2026-08-19 08:08:27 -07:00

session_executor.rs

feat(missions): run a phase as one direct session, behind a flag

2026-08-03 22:56:22 -07:00

skill_delivery.rs

feat(skills): files is the default delivery arm

2026-09-13 09:41:45 -05:00

skill_self_authoring.rs

sec(door): closed by default, governor fails closed; self-authoring off by default

2026-09-20 22:07:39 -05:00

skill_triage.rs

feat(decide): cm-decide — typed calibrated decisions; Jev + local NLI backends; skill triage in shadow

2026-09-21 10:08:31 -05:00

skill_use.rs

feat(decide): cm-decide — typed calibrated decisions; Jev + local NLI backends; skill triage in shadow

2026-09-21 10:08:31 -05:00

skills_loader.rs

feat(skills): always_inject belongs beside the skill, not in one database

2026-09-07 04:19:52 -07:00

subscription.rs

fix(models): coding runs on sonnet-5, judging on opus-5, haiku only as last resort

2026-08-16 12:36:19 -07:00

swarm.rs

feat(billing): agent-side spend records who was paid

2026-09-14 08:17:20 -05:00

task_card_parser.rs

feat(missions): a human can finally reach the plan/roster review gate

2026-08-19 11:56:54 -07:00

task_card_worker.rs

slice 5: task-card parser + background worker

2026-07-19 15:04:57 -07:00

team_template_loader.rs

feat(missions): a human can finally reach the plan/roster review gate

2026-08-19 11:56:54 -07:00

tool_versions.rs

Fleet tools: add Rust version card (probe rustc + nightly latest + rustup update)

2026-06-27 13:04:16 -07:00

topology_exec.rs

sec(door): closed by default, governor fails closed; self-authoring off by default

2026-09-20 22:07:39 -05:00

topology_worker.rs

feat(billing): agent-side spend records who was paid

2026-09-14 08:17:20 -05:00

validator_preflight.rs

feat(missions): say at boot whether the independent judge can be reached

2026-08-07 05:16:54 -07:00

vm_placement.rs

fix(placement): a composed graph needs every backend its nodes name

2026-08-09 15:36:40 -07:00

vm_stop_gate.rs

feat(missions): a pre-execution gate on mission tool calls

2026-08-19 14:50:01 -07:00

vm_tool_gate.rs

feat(gate): untrusted-target in shadow — stage 2 of argument provenance

2026-09-22 18:45:08 -05:00

vm_tool_tap.rs

feat(taint): stage 1 of argument provenance — the tap records hosts fetched content named

2026-09-22 18:27:07 -05:00

workflow_registry.rs

feat(teams): staff research phases with a research team

2026-08-21 09:35:33 -07:00