@event4u/agent-config 9.4.0 → 9.6.0

package/dist/discovery/discovery-manifest.json.sha256

@@ -1 +1 @@
-a59f1fc1e9fccbdf2e6b8b99257e83439d96bb9b0c2ad694f2cfece80671657c  discovery-manifest.json
+225524bcfd872e6503022848fee38c77b6aa3553443fdb0656c447117cc476d1  discovery-manifest.json

package/dist/discovery/discovery-manifest.summary.md

@@ -1,6 +1,6 @@
 # Discovery Manifest — Summary
 
-- Generated: `2026-07-20T09:32:39Z`
+- Generated: `2026-07-20T21:31:59Z`
 - Scanner: `c24312e116f8`
 - Artefacts: **575**
 - Unassigned: **0**

package/dist/discovery/orphan-report.md

@@ -1,6 +1,6 @@
 # Discovery — Orphan Report
 
-- Generated: `2026-07-20T09:32:39Z`
+- Generated: `2026-07-20T21:31:59Z`
 - Orphan artefacts: **0**
 
 > An orphan is an artefact whose declared pack has no other members.

package/dist/discovery/packs.json

@@ -1,6 +1,6 @@
 {
-  "checksum": "sha256:16d037e41d10dcc83bb73c58b96e6aa3377ce5feb56a8d23aee0ef58e8a97c5c",
-  "generated_at": "2026-07-20T09:32:39Z",
+  "checksum": "sha256:5d153d76966c915aef5ae07b2d82aee0f7f456e65aef5528ebfe6e3355445769",
+  "generated_at": "2026-07-20T21:31:59Z",
   "packs": [
     {
       "always_on": false,

package/dist/discovery/trust-report.md

@@ -1,6 +1,6 @@
 # Discovery — Trust Report
 
-- Generated: `2026-07-20T09:32:39Z`
+- Generated: `2026-07-20T21:31:59Z`
 - Workspaces tracked: **10**
 - Human-review-required artefacts: **3**
 

package/dist/discovery/workspaces.json

@@ -1,6 +1,6 @@
 {
-  "checksum": "sha256:16d037e41d10dcc83bb73c58b96e6aa3377ce5feb56a8d23aee0ef58e8a97c5c",
-  "generated_at": "2026-07-20T09:32:39Z",
+  "checksum": "sha256:5d153d76966c915aef5ae07b2d82aee0f7f456e65aef5528ebfe6e3355445769",
+  "generated_at": "2026-07-20T21:31:59Z",
   "scanner_version": "c24312e116f8",
   "workspaces": [
     {

package/dist/mcp/registry-manifest.json

@@ -9,7 +9,7 @@
     "homepage": "https://event4u-app.github.io/agent-config",
     "name": "@event4u/agent-config",
     "repository": "https://github.com/event4u-app/agent-config",
-    "version": "9.4.0"
+    "version": "9.6.0"
   },
   "registries": [
     {

package/docs/CLAIMS.md

@@ -245,6 +245,13 @@ visible, not hidden.
 - status: backed
 - last_verified: 2026-07-12
 
+### claim: team-defect-finding-null
+- claim: On the pre-registered 12-fixture defect-finding corpus (three arms, deterministic file-level recall, codex reviewer gpt-5.5), the cross-model team-review arm produced NO recall lift over single-model self-review — all three arms recalled every planted defect (Δ = 0, H1 not met). Honest null, ceiling-limited (recall 1.00 everywhere: the seeded defects are too obvious to discriminate the arms on recall); the only non-null signal is a single self-review false positive on the controversial-but-correct control vs 0 for team/council. No cross-model quality/lift claim binds; team mode stays workflow-value-only. Re-open: a judge-survivable-subtlety corpus or a new model generation.
+- kind: quant
+- evidence: internal/bench/reports/defect-finding.json#honest_null
+- status: backed
+- last_verified: 2026-07-20
+
 ### claim: adversarial-council-finding-coverage
 - claim: On the residual defect pool (planted defects that survive a single strong cross-model judge), an adversarial panel of >=2 distinct-vendor skeptics finds materially more residual defects than that single judge — relative residual-recall lift >= +25% AND absolute >= +8 percentage points — at a false-positive rate on a controversial-but-correct control no worse than the single-judge baseline (within noise). Scope: finding coverage, NOT decision quality (the separate, unbacked council-vs-solo-baseline question). Pre-registered; honest-null (either threshold missed or FP worse) keeps the surface off by default permanently.
 - kind: quant

package/docs/benchmark.md

@@ -582,3 +582,43 @@ controversial-but-correct control.
   judge-survivable-subtlety corpus with a published distribution, then (2) a
   maintainer-gated paid cross-vendor run. Honest-null on that run keeps the
   surface default-off permanently, like recursive-verification.
+
+
+## Defect-finding: team vs self-review vs council (2026-07-20) — HONEST NULL (ceiling-limited) {#honest-null-defect}
+
+Pre-registered 12-fixture corpus (`internal/bench/corpora/defect-finding.yaml`:
+10 seeded-defect diffs across logic / off-by-one / race / missing-empty-state /
+security-smell, + 2 controls), three arms, deterministic file-level recall
+against ground truth (blind rubric judge deferred — the primary metric is
+deterministic). Codex reviewer pinned `gpt-5.5`. Total billable $0.083 (arm b
+codex = ChatGPT subscription, $0).
+
+| arm | recall | correctness | design | false-positives |
+|---|--:|--:|--:|--:|
+| self-review (single model) | 1.00 | 1.00 | 1.00 | 1 |
+| team (cross-model, codex) | 1.00 | 1.00 | 1.00 | 0 |
+| council (neutral breadth)  | 1.00 | 1.00 | 1.00 | 0 |
+
+**Verdict: HONEST NULL.** H1 (cross-model team > single-model self-review on
+correctness recall, Δ ≥ +0.20) is **not met** — Δ = 0: all three arms recalled
+every planted defect. H2 (council ≈ team on design, within 0.10) is met (Δ = 0).
+H3 (≤ 1 false positive/arm) is met.
+
+**Corpus-validity caveat (the honest bound):** recall 1.00 across every arm is a
+**ceiling effect** — these seeded defects are catchable by any strong model, so
+the corpus cannot discriminate the arms on recall. This is the same limitation
+the adversarial-verification-council section names: a corpus of obvious,
+model-differentiating defects measures parity, not the judge-survivable
+subtleties where a cross-model lens might actually differ. The one non-null
+signal is precision, not recall: single-model self-review produced 1 false
+positive on the controversial-but-correct control (`df-ctl-01`, a
+behaviour-preserving `clamp` refactor) where team and council produced 0 — a
+hint of a multi-arm precision edge, within the pre-registered H3 bound, too
+small to claim.
+
+**Disposition (Phase 5 Step 5): evidence-closed as NULL.** No cross-model
+defect-finding *quality/lift* claim binds; team mode stays documented as
+**workflow value only**. Re-open conditions: (a) a curated
+judge-survivable-subtlety corpus that breaks the recall ceiling, or (b) a new
+model generation. The worker-via-bundle delegate (roadmap Phase 3 Step 4) stays
+deferred — it re-opened only on a measured review lift, which did not occur.

package/docs/decisions/ADR-123-runtime-security-scope-and-spawn-hardening.md

@@ -0,0 +1,111 @@
+---
+adr: 123
+status: accepted
+date: 2026-07-20
+decision: runtime-security-scope-and-spawn-hardening
+supersedes: —
+superseded_by: —
+phase: road-to-runtime-security-hardening
+type: structural
+---
+
+# ADR-123 — Runtime-security scope: harden subprocess spawn-env, keep behavioural enforcement out of scope
+
+- **Status:** Accepted (2026-07-20)
+- **Closes:** `agents/roadmaps/archive/road-to-runtime-security-hardening.md`
+- **Related:** `docs/threat-model.md` row (d) (lethal-trifecta); `src/rules/tool-safety.md` (Least Agency); `src/rules/lethal-trifecta-guard.md`; `src/rules/untrusted-input-defense.md`.
+
+## Context
+
+A user-supplied source-level analysis compared agent-config's security stack
+against an external reference plugin (referred to only as **Source A** per
+`source-confidentiality`; © the third party, all-rights-reserved — concept
+adoption only, no code/regex/prompt port). It surfaced two distinct things that
+were repeatedly conflated:
+
+1. **A real shipped bug.** `src/scripts/ai_council/clients.ts::_runSubprocess`
+   built its `spawnSync` options with no `env:` key, so every spawned provider
+   CLI (`codex` / `claude` / `gemini`) — and any `git` those CLIs invoke
+   internally — inherited the full parent `process.env`. An attacker-influenced
+   `GIT_EXTERNAL_DIFF` / `core.pager` / `NODE_OPTIONS` / `LD_PRELOAD` /
+   `DYLD_INSERT_LIBRARIES` in the parent environment is remote code execution
+   (CWE-426 untrusted search path, CWE-88 argument injection). This is our own
+   transport violating the Least-Agency its `tool-safety` rule preaches.
+
+2. **A proposed scope reversal.** The analysis argued that because
+   `injection_scan_hook.ts` already scans **inbound** tool responses, the
+   threat-model's "runtime enforcement out of scope" decision (row (d)) is
+   already void, so we should also scan **outbound** — the content the agent
+   writes — with a pattern guard, a turn-diff baseline, and eventually an LLM
+   diff-review.
+
+A two-round council (2026-07-20, anthropic/claude-sonnet-4-5 + openai/gpt-4o)
+was decisive: round 1 leaned toward building the outbound guard; **round 2 both
+members pivoted skeptical** on the load-bearing distinction below.
+
+## Decision
+
+**1. Fix the spawn-env RCE (accepted, shipped in this roadmap).** A shared
+`src/scripts/_lib/spawn_env.ts::hardenedSpawnEnv(overrides?)` scrubs the
+code-execution-injection env families **by family, not by allowlist** — the
+provider CLIs legitimately need arbitrary env (API keys, config paths), so an
+allowlist would break them and rot; deny-by-family removes the known vectors
+(dynamic-loader `LD_*`/`DYLD_*`/`GCONV_PATH`, git `*_COMMAND`/`GIT_EXTERNAL_DIFF`/
+`GIT_SSH_COMMAND`/`PAGER`, runtime hooks `NODE_OPTIONS`/`BASH_ENV`/`ENV`/
+`PYTHON*`/`PERL5*`/`RUBYOPT`, and `IFS`) and preserves everything else. It is
+wired into the council transport and the two consumer-runtime hook spawn sites
+(`roadmap_progress_hook`, `hot_context_hook`), and guarded by a falsifiable
+regression test (proven RED without the fix — 8 vectors leaked into the child —
+GREEN with it).
+
+**2. Input sanitization ≠ runtime behavioural enforcement — row (d) stands.**
+The inbound `injection_scan_hook` is **self-defence**: it hardens AC's own
+handling of data it *receives* from external tools. It does **not** commit AC to
+*governing what the agent writes*. An outbound command guard requires
+interpreting intent from content (`rm -rf ./build` vs `rm -rf /`) — that is a
+runtime **enforcement** layer, a categorically different mechanism, and the one
+threat-model row (d) places out of scope. AC ships the *rules*
+(`lethal-trifecta-guard`, `untrusted-input-defense`, `tool-safety`); the
+consumer's tool-execution layer is the enforcement boundary. The inbound/outbound
+"asymmetry" is a defensible separation of concerns, not security theatre.
+
+**3. The outbound guard / turn-diff baseline / LLM diff-review are deferred, not
+rejected.** They remain `## Blockers` on the roadmap with a `revisit-if`: a real
+outbound-injection incident, a consumer demand signal, or utilization evidence —
+at which point they must also pass the six-question complexity budget
+(`artifact-drafting-protocol-mechanics` § Complexity budget), given PR #983 just
+consolidated surface and `surface-consolidation-restraint` freezes new modes
+pending the first external adopter. This ADR records the deferral so the
+decision is surfaced, not silently dropped (`decision-revisit-gate`).
+
+**4. Rejected:** a consumer-supplied-pattern ReDoS/trust-framing layer (Source A
+P5) — `security_lint.ts` has no consumer-pattern surface, so guarding it would
+build a defence for a feature that does not exist. Global env/pattern allowlists
+are also rejected: per-file pragma containment (`security_lint.ts`) only.
+
+## Consequences
+
+- The council transport and consumer-runtime hooks can no longer be turned into
+  an RCE vector by a poisoned parent environment; the fix is falsifiably tested.
+- `docs/threat-model.md` gains a row for the (now-mitigated)
+  subprocess-env-inheritance vector, and row (d)'s "no additional mitigation
+  planned" cell cites this ADR for the input-sanitization-vs-enforcement
+  distinction and the deferred-guard decision.
+- AC's security posture stays **authoring-time rules + input hygiene + our own
+  Least-Agency spawn discipline** — it does not become a runtime sandbox
+  supervising every agent tool call.
+- Maintainer-only CI/git-helper spawn sites (~15) are a deferred mechanical
+  sweep (`maintainer-ci-spawn-sweep` blocker): they run in trusted CI with lower
+  attacker-control of the environment.
+
+## Alternatives considered
+
+- **Complete the runtime layer (build the outbound guard now).** Council round 1
+  position. Rejected in round 2: conflates input sanitization with behavioural
+  enforcement; adds net-new enforcement surface with a false-positive burden,
+  right after a consolidation roadmap, with no demand signal.
+- **Delete `injection_scan_hook.ts` for symmetry.** Architecturally consistent
+  but operationally worse — inbound sanitization is legitimate self-defence and
+  costs nothing to keep.
+- **Env allowlist instead of deny-by-family.** Rejected — would strip env the
+  provider CLIs need and rot as new good vars appear.

package/docs/decisions/INDEX.md

@@ -126,6 +126,7 @@ _Auto-generated by `scripts/adr/regenerate_index.py`. Do not edit._
 | [ADR-120](ADR-120-council-chairman-mode.md) | Council Chairman Mode | accepted | 2026-07-12 | — |
 | [ADR-121](ADR-121-knowledge-sensitivity-classes.md) | Knowledge Sensitivity Classes | accepted | 2026-07-12 | — |
 | [ADR-122](ADR-122-adversarial-verification-council.md) | Adversarial Verification Council | accepted | 2026-07-14 | — |
+| [ADR-123](ADR-123-runtime-security-scope-and-spawn-hardening.md) | Runtime Security Scope And Spawn Hardening | accepted | 2026-07-20 | — |
 | [ADR-200](ADR-200-python-to-typescript-migration.md) | Python To Typescript Migration | accepted | 2026-06-11 | — |
 
 ## Unnumbered (legacy)

package/docs/guidelines/agent-infra/artifact-drafting-protocol-mechanics.md

@@ -70,6 +70,32 @@ those artifacts:
 - Batch mode never skips the Research pass itself — it relocates and
   batches it. `artifact_protocol: skip` does not exist.
 
+## Complexity budget — the six questions before a new artefact
+
+Folded here from the 9.4.0 review (Prio 5), which named the failure mode:
+"das Paket kann fast jede Kritik mit einem weiteren Mechanismus beantworten"
+(Problem → Regel → Lint → Hook → Report → Roadmap → Claim → Test = governance
+inflation). This REPLACES the ad-hoc "should this exist" prose — it is a
+checklist, not a new gate/rule (adding a gate to enforce "add less" would be
+the very inflation it guards against). Before drafting any new skill / rule /
+command / hook / gate, answer all six; a "no" on **replaces** or **removable**
+is a strong signal to fold into an existing artefact instead:
+
+1. **Replaces?** — what existing mechanism does this retire or subsume? (If
+   nothing, justify why the surface must grow.)
+2. **Overlaps?** — does it duplicate a trigger / responsibility another
+   artefact already owns?
+3. **Discoverable?** — will a user actually find it, or does it just raise the
+   catalog count?
+4. **Measurable?** — is there a signal that would show it earning its place
+   (or a null that would retire it)?
+5. **Removable?** — can it be demoted / de-eligibled / deleted later without a
+   migration?
+6. **Who debugs it?** — is the maintenance owner real, given bus-factor?
+
+The load-bearing question the review elevates: not "how do we prevent this
+error in future?" but **"which existing mechanism gets removed or replaced?"**
+
 ## See also
 
 - `artifact-drafting-protocol` (rule) — Iron Law, triggers, golden rules.

package/docs/proof.md

@@ -48,9 +48,10 @@ evidence pointer, or `task check-claims` fails the build.
 | Every artifact the package ships — source AND the condensed projection that reaches consumers — is machine-scanned in CI for hidden-Unicode, mixed-script-confusable, and instruction-smuggling payloads (the rules-file-backdoor class); a finding blocks the release before `npm publish`, not just the merge. | qual | `.github/workflows/publish-npm.yml#lint_agent_security` | ✅ |
 | 278 skills. | quant | `src/scripts/check_artefact_count_messaging.ts#Artefact-count messaging gate` | ✅ |
 | Removes only its own keys from a shared host config (matched by JSON-pointer + SHA-256), never a neighbour tool's entries. | qual | `docs/contracts/install-layout.md#JSON-pointer` | ✅ |
+| On the pre-registered 12-fixture defect-finding corpus (three arms, deterministic file-level recall, codex reviewer gpt-5.5), the cross-model team-review arm produced NO recall lift over single-model self-review — all three arms recalled every planted defect (Δ = 0, H1 not met). Honest null, ceiling-limited (recall 1.00 everywhere: the seeded defects are too obvious to discriminate the arms on recall); the only non-null signal is a single self-review false positive on the controversial-but-correct control vs 0 for team/council. No cross-model quality/lift claim binds; team mode stays workflow-value-only. Re-open: a judge-survivable-subtlety corpus or a new model generation. | quant | `internal/bench/reports/defect-finding.json#honest_null` | ✅ |
 | On the A3 orchestration eval (deterministic verify, measured token deltas), the production-validator subagent returned the correct verdict on both fixtures — NOT READY with the exact `file:line` citation on a planted hollow implementation, READY with zero spurious findings on the clean control — while consuming ~45k fewer tokens than the inline-host baseline on each task. Scope: two planted fixtures on a Claude Code host, not a broad hit-rate. | quant | `internal/bench/orchestration/pv-a3-results.md#token_delta_provenance: measured` | ✅ |
 
-**23 backed claim(s)** — all evidence pointers resolve in CI.
+**24 backed claim(s)** — all evidence pointers resolve in CI.
 
 Artefact counts in public prose (skills, commands, governed rules,
 guidelines, personas) are **generated from source and CI-drift-checked**:

package/docs/threat-model.md

@@ -13,9 +13,10 @@ and holds no user data. Threats are about **artifact integrity** and
 | a | **Malicious skill / rule via PR** — a contributed `.md` file smuggles prompt-injection or data-exfiltration payloads into the shipped artifact tree | Adversarial PR contributor embeds: (1) invisible Unicode (bidi / zero-width / Tag-block) to hide instructions, (2) role-takeover imperatives, (3) lethal-trifecta pattern in a new skill (private-data + untrusted-content + egress on one autonomous path) | `lint_hidden_unicode.py` — blocks Trojan-Source and invisible-char attacks; `lint_instruction_smuggling.py` — blocks disclosure-suppression and injection-tag prose; `lint_skill_frontmatter_safety.py` — blocks wildcard `allowed_tools`, `bypassPermissions`, unsafe `execution.type: automated`; PR review gate | No automated SARIF upload to GitHub Code Scanning; lethal-trifecta detection is architectural (rule) not linted structurally beyond the frontmatter check | Wire `lint_agent_security.py --sarif` output to GitHub Advanced Security on every PR (`lint_workflow_security.py` — P2); add structural trifecta check to frontmatter linter |
 | b | **Supply-chain compromise of AC's own deps** — a malicious version of an npm or Python dependency is pulled during CI / install and executes arbitrary code or modifies shipped artifacts | Dependency confusion / typosquatting attack on `package.json` or `requirements.txt` deps; compromised upstream package | `package-lock.json` + `requirements.txt` pin exact versions; CI installs from lockfile (`npm ci`) | No documented dep-audit policy; no Dependabot / Renovate automation; no integrity check (`npm audit` / `pip-audit`) in CI gate | Add `npm audit --audit-level=high` + `pip-audit` as a required CI step; document quarterly manual review cadence; pin Python deps in a lockfile (`pip-compile`) |
 | c | **Hostile consumer-repo environment** — AC's installer or hooks execute inside a repo whose `.git/hooks`, `.env`, or workspace files are attacker-controlled | Consumer repo pre-installs malicious Git hooks that intercept the AC installer or post-install hook; `.env` leaks tokens that AC hooks read; untrusted files are passed to AC linters | AC installer writes its own hooks under its namespace; AC hooks run as the user's shell — they do not read `.env` by design; `untrusted-input-defense` rule governs agent behaviour at runtime | No sandboxed execution for AC hooks; installer does not verify consumer hook integrity before writing | Document that AC hooks must not read repo-local env files; add installer pre-flight that warns if foreign hooks exist in `.git/hooks/`; scope AC hook writes to explicit namespaced filenames |
-| d | **Lethal-trifecta surface** — a skill combining private-data access + untrusted-content ingestion + external communication on one autonomous path enables confused-deputy / data-exfiltration attacks | Prompt-injected content inside a fetched doc instructs an agent to read a local secret and POST it to an attacker-controlled endpoint | `src/rules/lethal-trifecta-guard.md` (Iron Law: break one leg or gate egress behind human-in-the-loop); `src/rules/untrusted-input-defense.md` (untrusted content is data, never instructions; spotlighting); `lint_skill_frontmatter_safety.py` (flags over-broad tool grants) | These are authoring-time controls — no runtime enforcement layer exists | No additional mitigation planned (runtime layer out of scope for AC); `lethal-trifecta-guard.md` and `untrusted-input-defense.md` are the canonical reference — do not re-describe here |
+| d | **Lethal-trifecta surface** — a skill combining private-data access + untrusted-content ingestion + external communication on one autonomous path enables confused-deputy / data-exfiltration attacks | Prompt-injected content inside a fetched doc instructs an agent to read a local secret and POST it to an attacker-controlled endpoint | `src/rules/lethal-trifecta-guard.md` (Iron Law: break one leg or gate egress behind human-in-the-loop); `src/rules/untrusted-input-defense.md` (untrusted content is data, never instructions; spotlighting); `lint_skill_frontmatter_safety.py` (flags over-broad tool grants) | These are authoring-time controls — no runtime *behavioural-enforcement* layer exists (input sanitization ≠ enforcement — see ADR-123) | Runtime behavioural enforcement stays out of scope for AC (`ADR-123-runtime-security-scope-and-spawn-hardening`): AC ships the rules, the consumer's tool-execution layer enforces them; the outbound content-scan guard is deferred with a `revisit-if`, not silently dropped. `lethal-trifecta-guard.md` and `untrusted-input-defense.md` are the canonical reference — do not re-describe here |
 | e | **Malicious metadata / frontmatter injection** — a PR embeds hostile YAML in a skill's frontmatter (e.g. injecting a trigger keyword that causes a dangerous skill to fire in unintended contexts, or adding `permissionMode: bypassPermissions`) | PR contributor adds `permissionMode: bypassPermissions` or a wildcard `allowed_tools: ["*"]` entry to an existing skill's frontmatter; or crafts a trigger keyword to hijack routing | `lint_skill_frontmatter_safety.py` — HIGH-severity block on `bypassPermissions`, wildcard `allowed_tools`, unsafe `execution.type: automated` without safety floor; `lint_hidden_unicode.py` — catches invisible chars inside frontmatter YAML values; PR review gate; `scripts/validate_frontmatter.py` schema validation | Schema validation does not verify trigger-keyword semantic safety (a plausible keyword that causes over-broad firing is not caught) | Extend `validate_frontmatter.py` to flag trigger keywords that match security-sensitive path prefixes (e.g. a skill triggering on `"auth"` when it has `execution.type: automated`) |
 | f | **Skill self-update — safety-floor rewrite** — an agent is social-engineered (via chat or a PR) into weakening a kernel rule, safety floor, or MCP/tool allowlist | A PR removes the Iron Law block from `non-destructive-by-default.md`; or a chat prompt instructs the agent to edit `security-sensitive-stop.md` to narrow its self-modification clause; or a PR modifies `scope-control` to remove the Hard Floor | `src/rules/security-sensitive-stop.md` — "self-modification via chat" clause: requests to weaken safety floors / kernel rules / MCP allowlists must route through `scope-control` gates; `src/rules/scope-control.md` — kernel-rule edits require own PR + ≥ 24 h soak; `dist/agent-src/` is read-only (source-of-truth rule); `scripts/check_condensation.py` detects Iron-Law section deletion or downgrade | No automated per-rule diff check that fires specifically when a kernel rule's Iron Law section is removed; relies on PR reviewer recognising the file class | Add a CI check (`scripts/check_kernel_rule_integrity.py` — P3+) that asserts Iron Law fenced-code blocks survive unchanged in all files listed in `docs/contracts/kernel-membership.md` |
+| g | **Subprocess spawn-env inheritance** — AC's own transport spawns an external CLI (the AI-council provider CLIs; consumer-runtime hooks spawn `git`) with the full parent `process.env`, so an attacker-influenced env var in the parent becomes RCE when the child (or a `git` it invokes internally) runs | A poisoned `GIT_EXTERNAL_DIFF` / `core.pager` / `GIT_SSH_COMMAND`, a dynamic-loader `LD_PRELOAD` / `DYLD_INSERT_LIBRARIES` / `GCONV_PATH`, or a runtime hook `NODE_OPTIONS` / `BASH_ENV` / `PYTHONSTARTUP` present in the parent env executes attacker code inside the spawned process (CWE-426, CWE-88, CWE-427) | `src/scripts/_lib/spawn_env.ts::hardenedSpawnEnv()` scrubs the code-execution-injection env families (deny-by-family: loader `LD_*`/`DYLD_*`/`GCONV_PATH`, git `*_COMMAND`/`GIT_EXTERNAL_DIFF`/`GIT_SSH_COMMAND`/`GIT_PAGER`/`PAGER`, runtime hooks `NODE_OPTIONS`/`BASH_ENV`/`ENV`/`PYTHON*`/`PERL5*`/`RUBYOPT`, `IFS`) and preserves the rest; wired into `clients.ts::_runSubprocess`, `roadmap_progress_hook.ts`, `hot_context_hook.ts`; falsifiable regression test in `tests/scripts/ai_council/spawn_env.test.ts` (ADR-123) | Maintainer-only CI/git-helper spawn sites (~15) still inherit env — lower risk (trusted CI, low attacker-control) | Mechanical sweep applying `hardenedSpawnEnv` to the remaining CI/git-helper spawn sites (deferred — `maintainer-ci-spawn-sweep` blocker) |
 
 ## Review cadence
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@event4u/agent-config",
-    "version": "9.4.0",
+    "version": "9.6.0",
     "description": "Universal AI Agent OS — audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
     "license": "MIT",
     "private": false,

package/src/scripts/_lib/spawn_env.ts

@@ -0,0 +1,100 @@
+/**
+ * Hardened environment for spawned subprocesses
+ * (road-to-runtime-security-hardening Phase 1).
+ *
+ * agent-config shells out to external CLIs (the AI-council transport spawns
+ * `codex` / `claude` / `gemini`; hooks spawn `git`). By default `spawnSync`
+ * inherits the full parent `process.env`, so any attacker-influenced env var in
+ * the parent becomes a code-execution vector the moment the child (or a `git`
+ * it invokes internally) runs:
+ *
+ *   - dynamic-loader preload/search-path (CWE-426 untrusted search path):
+ *     LD_PRELOAD, LD_LIBRARY_PATH, DYLD_INSERT_LIBRARIES, DYLD_LIBRARY_PATH,
+ *     GCONV_PATH — load attacker code into any spawned ELF/Mach-O.
+ *   - git command-injection (CWE-88): GIT_EXTERNAL_DIFF, GIT_SSH,
+ *     GIT_SSH_COMMAND, GIT_PROXY_COMMAND, any GIT_*_COMMAND, GIT_PAGER, PAGER —
+ *     git runs these as shell commands (`core.pager` / external-diff RCE).
+ *   - runtime auto-exec hooks: NODE_OPTIONS (`--require attacker.js`),
+ *     BASH_ENV / ENV (sourced by non-interactive shells), PYTHONPATH /
+ *     PYTHONSTARTUP / PYTHONINSPECT, PERL5OPT / PERL5LIB, RUBYOPT.
+ *   - IFS — classic shell field-splitting hijack.
+ *
+ * This is the Least-Agency the `tool-safety` rule preaches, applied to our own
+ * transport. We scrub by *family* (prefix + exact name), NOT via an allowlist:
+ * the CLIs legitimately need arbitrary env (ANTHROPIC_API_KEY, XDG config
+ * paths, proxy settings), so an allowlist would break them and rot as new
+ * good vars appear. Deny-by-family removes the known execution vectors and
+ * preserves everything else. This is standard, publicly-documented OWASP/CWE
+ * knowledge — independently implemented here.
+ */
+
+/** Exact env-var names removed unconditionally. */
+const DENY_EXACT: ReadonlySet<string> = new Set([
+    // dynamic loader
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'LD_AUDIT',
+    'DYLD_INSERT_LIBRARIES',
+    'DYLD_LIBRARY_PATH',
+    'DYLD_FRAMEWORK_PATH',
+    'GCONV_PATH',
+    // git command-injection
+    'GIT_EXTERNAL_DIFF',
+    'GIT_SSH',
+    'GIT_SSH_COMMAND',
+    'GIT_PROXY_COMMAND',
+    'GIT_PAGER',
+    'PAGER',
+    // runtime auto-exec hooks
+    'NODE_OPTIONS',
+    'BASH_ENV',
+    'ENV',
+    'PYTHONPATH',
+    'PYTHONSTARTUP',
+    'PYTHONINSPECT',
+    'PERL5OPT',
+    'PERL5LIB',
+    'RUBYOPT',
+    // shell field-splitting
+    'IFS',
+]);
+
+/**
+ * Prefix families removed by pattern. `LD_` / `DYLD_` cover loader variants we
+ * did not enumerate; `GIT_*_COMMAND` covers every git config-command hook
+ * (e.g. GIT_ASKPASS is intentionally NOT here — it is a path, not a shell
+ * command, and legitimate credential helpers need it; the *_COMMAND family is
+ * the shell-executed one).
+ */
+function isDeniedByFamily(name: string): boolean {
+    if (name.startsWith('LD_') || name.startsWith('DYLD_')) return true;
+    if (name.startsWith('GIT_') && name.endsWith('_COMMAND')) return true;
+    return false;
+}
+
+/**
+ * Return a copy of the current environment with code-execution-injection
+ * vectors scrubbed, then `overrides` applied. Pass the result as
+ * `spawnSync`/`spawn`'s `env:` option.
+ *
+ * @param overrides values to set AFTER scrubbing (e.g. a scoped PATH or a
+ *   package-root marker). Overrides win over both the inherited env and the
+ *   deny-list, so a caller can deliberately re-supply a scrubbed var if it
+ *   genuinely needs one — that is an explicit, reviewable decision at the call
+ *   site, never an ambient inheritance.
+ */
+export function hardenedSpawnEnv(
+    overrides: Record<string, string> = {},
+): NodeJS.ProcessEnv {
+    const out: NodeJS.ProcessEnv = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        if (value === undefined) continue;
+        if (DENY_EXACT.has(key)) continue;
+        if (isDeniedByFamily(key)) continue;
+        out[key] = value;
+    }
+    for (const [key, value] of Object.entries(overrides)) {
+        out[key] = value;
+    }
+    return out;
+}

package/src/scripts/ai_council/clients.ts

@@ -44,6 +44,7 @@ import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
+import { hardenedSpawnEnv } from '../_lib/spawn_env.js';
 import * as user_global_paths from '../_lib/user_global_paths.js';
 import { appendEvent } from './events_log.js';
 
@@ -1101,6 +1102,11 @@ export abstract class CliClient extends ExternalAIClient {
         const spawnOpts: Parameters<typeof spawnSync>[2] = {
             encoding: 'utf-8',
             timeout: Math.round(this.timeout_seconds * 1000),
+            // Least-Agency: scrub code-execution-injection env vectors
+            // (loader preload, git *_COMMAND, NODE_OPTIONS, …) so an
+            // attacker-influenced parent env cannot RCE via the spawned CLI
+            // or a `git` it invokes internally.
+            env: hardenedSpawnEnv(),
         };
         if (stdinPayload !== null) {
             spawnOpts.input = stdinPayload;