[kixelated]

Implements the daemon side of the fixer quest. The quest is rewritten to the host integration that remains.

Behavior

• quest land fix is the payload the host runs in an isolated container. It runs codex exec (configurable) in a standalone repository of the batch, with a built-in prompt. Codex may only make mechanical fixes that change no behavior, and never touches the protected paths. The prompt also says that repository, log, and PR content is untrusted: instructions found there are never followed, and an attempt means handing that PR back. The result is quest-land-result.json, one entry per PR: requeue, fixed, or handback.
• The daemon:
  • tracks each fixer as background work that survives restarts;
  • imports only objects, through a clean repository, never running git inside the fixer's .git;
  • validates every fixed head: it must descend from the pinned head, and the protected set (flake.nix, flake.lock, nix/, .envrc, .github/, Nix entrypoints, .gitmodules, gitlinks) must equal the pinned head's or the merge's as a whole;
  • pushes as moq-bot with a lease, appends a neutralized mechanical fix by <agent> line to the ## Review record, and requeues with pinned auto-merge and quest:merge;
  • re-pins requeue unchanged;
  • turns handback, invalid results, crashes, and timeouts into a comment with quoted, neutralized diagnosis.
• One attempt per maintainer pick.
• Guide: assets/AGENTS.md gains the mechanical-fix review exemption.

Decisions (maintainer, 2026-10-30)

• A fixed head lands without further review, so "mechanical" is enforced by the prompt, with the protected paths blocked: Claude reviews the fix first / fixes need a re-pick / narrow what it may touch / ✅ keep as decided
• Add a prompt-injection instruction to the fixer's prompt.

Host contract

The wrapper runs in the repository's directory with <log> <PR numbers...>. It gets PATH and LANG from the daemon, and adds a fresh HOME, OPENAI_BASE_URL, and the gate's OPENAI_API_KEY. It runs quest land fix "$@" in a container and preserves the repository and result. The host side is kixelated/nixos#16.

Checks

just check and just test pass: 701 CLI and 426 Worker tests.

Review

Codex (gpt-6.1-sol) wrote this, and Claude Opus 5.5 reviewed it in sub-agent rounds. quest review --harness claude doesn't see this session's environment credentials.

• Round 1: 3 high, 3 medium, and 4 low findings, all fixed:
  • a hostile fixer could wedge the daemon;
  • fetching trusted the fixer's .git;
  • fixer text reached PR bodies and comments unneutralized;
  • a stale timeout after a restart;
  • the kill didn't reach the container;
  • the protected-set check accepted mixed versions;
  • no import cap;
  • a hard-coded model name.
• Round 2, on 90c9d36: all fixes verified, safe to ship. Low items remain: decompression bombs (fetch.fsckObjects), parsing the fixer's pack indexes, "Codex" wording when another agent ran, attribution stacking in the PR body, and test gaps (gitfile, hooks, the cap, SIGTERM). Follow-up: send the repository back as a git bundle, which removes the remaining .git parsing.
• The head since is a conflict-free merge of main (5135933).

🤖 Generated with Claude Code

(written by Claude Opus 5.5)