harden(pitot): fail-closed boundaries, bounded state, adapter guards + public README - #260
Merged
Conversation
…+ public README Feature-preserving hardening across the Pitot adapter surface, guided by a full Locus analysis (trace-refinement per adapter, supervisory-rw by host class, nonblockingness of the router, root-cause of the two silent degradations, ranked frontier). No adapter, transport, or observe-only mode was removed. Runtime / boundary: - transport: an event-delivery fault now returns 409, not a 204 that read as allow (fail-open closed). - runtime: additive strict mode — require_controller config key and `pitot run --strict` flag — faults instead of silently allowing when a declared kind has no controller; default behavior unchanged, with a once-per-kind observation-only notice otherwise. - hook: one-line stderr notice when no runtime is selected (still exit 0); allow path now requires the response ActionID to match. - sensor/adapters: decode-time tool-name guards per host; ActionKind no longer silently defaults to "shell" for unknown boundary events. - bridge: the router's resolved-action set is now bounded (4096-entry window). - devinacp: one-shot diagnostic when a tool_call update lacks the cognition.ai/inferenceToolName meta (stays fail-closed). - doctor: PITOT_RUNTIME-unset note and a binary-hash drift check for non-repo-wired hosts. Tests: - new Go guards (adapters, sensor, bridge window, runtime strict + transport fault, devinacp meta, hook notice). - new Python coverage: devin control-proxy HTTP behavior, validate_receipts negative branches, the two E2E apparatus binaries, and npm/kimi/cursor installers. Fixed a real devin-proxy save() race surfaced by the burst test. Public README: Devin added to the supported-hosts table with a platforms column, host admission criteria (deny-continuation) section, a threat model that names Kimi's fail-open host semantics plainly, and a contributing guide covering both adapter transport classes. Disclosure-Reviewed: reviewed — public-safe only, private facet kept out of this commit
bigboateng
force-pushed
the
codex/pitot-hardening
branch
from
July 31, 2026 14:25
bc5d813 to
1eb1450
Compare
Required by the Generated distribution gate: any labs/15-pitot change ships a release note under pitot-distribution/release-notes. Disclosure-Reviewed: reviewed — public-safe only, private facet kept out of this commit
Pitot coding-agent E2EIntelligence Flow is the verification source; Pitot's public README carries the latest
Runtime capabilities
Source commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Feature-preserving hardening of the Pitot adapter surface, guided by a full Locus analysis, landing on top of the merged Devin ACP adapter (#259). No adapter, transport, or observe-only mode was removed.
What changed
Runtime / boundary (fail-closed):
transport: an event-delivery fault now returns 409, not a 204 that a host reads as allow.runtime: additive strict mode —require_controller: trueconfig key andpitot run --strictflag — faults instead of silently allowing when a declared action kind has no controller. Default behavior unchanged; otherwise a once-per-kind observation-only notice is emitted.hook: one-line stderr notice when no runtime is selected (still exit 0); allow path now requires the responseActionIDto match the request.sensor/adapters: decode-time tool-name guards per host;ActionKindno longer silently defaults to"shell"for unknown boundary events.bridge: the router's resolved-action set is now bounded (4096-entry window).devinacp: one-shot diagnostic when atool_callupdate lackscognition.ai/inferenceToolName(stays fail-closed).doctor:PITOT_RUNTIME-unset note and a binary-hash drift check for non-repo-wired hosts.Tests: new Go guards (adapters, sensor, bridge window, runtime strict + transport fault, devinacp meta, hook notice); new Python coverage for the devin control-proxy HTTP behavior,
validate_receiptsnegative branches, the two E2E apparatus binaries, and npm/kimi/cursor installers. Fixed a real devin-proxysave()race surfaced by the 64-connection burst test (shared tmp filename → collision → killed connection; the plausible origin of the intermittent WindowsConnectionFailed).Public README: Devin added to the supported-hosts table with a platforms column; new Host admission criteria (deny-continuation) section; a Threat model section that names Kimi's fail-open host semantics plainly; a contributing guide covering both adapter transport classes.
Locus analysis (all verdicts advisory / model-scoped; evidence-root = worktree)
16 models fidelity-certified against
labs/15-pitotsources.verification.trace-refinement): 9/10 adaptersrefines=true. kimirefines=FALSE, witness verbatim:intercept → host_hook_crash → execute.control.supervisory-rw): repo-wired and ACP classes controllable; user-level fail-open class not controllable, violation verbatim:uncontrollable event "host_fail_open_execute" fires from reachable state "PENDING" into forbidden state "EXECUTED_UNSUPERVISED".control.nonblockingness):nonblocking=true— exactly one terminal resolution per action.practice.root-cause, both transforms accepted): failure class = silent-mode-degradation; instances (a) hook withoutPITOT_RUNTIME, (b) devinacp missing vendor_metakey. Class-eliminating change: every guarantee downgrade must announce itself + additive strict opt-in.safety-reachability, feature-vs-defect): wp1/wp2/wp3/wp6/wp8 all under-assumption — keep the feature, harden the assumption (none refuted).drv-910d01f7,drv-a358fc34,drv-6d39be01,drv-6e4cec53,drv-5fedcc4a.forbidden-unreachable):strict-config-v1andstrict-flag-v1both satisfy;strict-none-v1rejected via[declared_kind_without_controller, silent_allow]—drv-7b62b16c.Undischarged obligations: refinement verdicts discharge against the 30-cell E2E matrix (real CLI behavior = modeled lifecycle); the kimi fail-open and copilot/qwen crash behaviors are host-semantics facts only vendors can change.
Gates
go test ./...,go vet, gofmt (clean except pre-existingsdk/runner.go),python3 -m unittest discover(99 tests), supervisorcheck,check_import_boundary.sh, and manifest regen (build_pitot.py --write) all green locally.