@event4u/agent-config 9.5.0 → 9.7.0

package/docs/benchmark.md

@@ -559,7 +559,7 @@ replication on a per-token-billed key.
 - Runner: `src/scripts/bench_ab_v2_run.ts --host codex` (checkpoint-resumable).
 - Roadmap: `agents/roadmaps/archive/road-to-opt-measurement-unblock.md` Phase 2.
 
-## adversarial-verification-council finding coverage — UNBACKED (pending corpus + run)
+## adversarial-verification-council finding coverage — HONEST NULL (resolved 2026-07-21)
 
 Pre-registered claim `adversarial-council-finding-coverage` (docs/CLAIMS.md,
 ADR-122): on the RESIDUAL defect pool — defects that survive a single strong
@@ -574,14 +574,38 @@ controversial-but-correct control.
   **AND** absolute >= +8 pp, **AND** panel FP not worse than baseline within
   noise — encoded + tested in
   [`src/scripts/_lib/adversarial_council_gate.ts`](../src/scripts/_lib/adversarial_council_gate.ts).
-- **Status: UNBACKED.** The corpus-validity gate BLOCKS the registered run: the
-  existing `internal/bench/orchestration/corpus/` was built for cross-vendor
-  *parity* (obvious, model-differentiating defects), not judge-survivable
-  residual subtleties, so a run on it would be a measurement artifact (the
-  council's Round-1 critique). Resolving the claim needs (1) a curated
-  judge-survivable-subtlety corpus with a published distribution, then (2) a
-  maintainer-gated paid cross-vendor run. Honest-null on that run keeps the
-  surface default-off permanently, like recursive-verification.
+- **Status: HONEST NULL (resolved 2026-07-21).** A curated judge-survivable
+  corpus was built (`internal/bench/adversarial-council/`: 12 planted-defect
+  fixtures across 4 subtlety classes + 3 controversial-but-correct clean
+  controls; subtlety distribution published; passed an independent validity
+  audit after one fixture was repaired). The registered cross-vendor run
+  (anthropic `claude-sonnet-4-5` + openai `gpt-4o`, spend-authorized) resolved
+  the claim NEGATIVE:
+
+  | quantity | value |
+  |---|--:|
+  | judge-passed residual pool | 5–7 defects (missed by both neutral passes) |
+  | single-skeptic residual recall | 0.60 |
+  | 2-vendor panel residual recall | 0.60 (**zero lift**) |
+  | single-skeptic FP on clean controls | 1.00 |
+  | panel FP on clean controls | 1.00 |
+
+  The second vendor's residual catches were a **strict subset** of the first's,
+  so the panel added no marginal coverage; both recall thresholds (+25% rel,
+  +8 pp abs) missed → **honest-null**. Under the adversarial-skeptic posture
+  both the single skeptic and the panel false-flagged **all three**
+  controversial-but-correct controls (100% FP) — the posture over-flags correct
+  code. Stable across two runs. Per the locked gate, the Mode 9 surface stays
+  **default-off permanently** (like recursive-verification). Reproducible
+  artifact: `internal/bench/adversarial-council/runs/`.
+- **Transport lesson.** The first run attempted via `council_cli run` was
+  REJECTED as a measurement artifact: that transport runs multi-round
+  peer-review with cross-member visibility and returns prose ("Round 2 …
+  Reviewer A"), which both violates the independent-skeptic requirement and
+  defeats JSON scoring. The valid run uses direct, independent per-vendor
+  client calls (`bench_adversarial_council.ts`) with a strict-JSON system
+  prompt and a deterministic, pre-validated scorer
+  (`adversarial_bench_score.ts` + its synthetic red/green test).
 
 
 ## Defect-finding: team vs self-review vs council (2026-07-20) — HONEST NULL (ceiling-limited) {#honest-null-defect}

package/docs/decisions/ADR-122-adversarial-verification-council.md

@@ -134,3 +134,33 @@ Each settled decision this roadmap does NOT touch:
   ADR-120 (council chairman mode), ADR-109 (subagent-v1 contract).
 - `docs/CLAIMS.md#adversarial-council-finding-coverage` — the pre-registered claim.
 - `cross-vendor-parity` (backed) — the evidence the finding-coverage scope rests on.
+
+## Addendum (2026-07-21) — finding-coverage claim resolved HONEST-NULL
+
+The pre-registered `adversarial-council-finding-coverage` claim was executed and
+resolved **negative**. A curated judge-survivable corpus
+(`internal/bench/adversarial-council/`: 12 planted-defect fixtures across
+multi-file-interaction / logic-inversion / security-masked / complex-state + 3
+controversial-but-correct clean controls; subtlety distribution published;
+passed an independent validity audit after one fixture was repaired) was run
+cross-vendor (anthropic `claude-sonnet-4-5` + openai `gpt-4o`) under the
+maintainer spend authorization.
+
+**Result:** on the judge-passed residual, the 2-vendor skeptic panel matched the
+single skeptic exactly (residual recall 0.60 = 0.60, **zero lift** — the second
+vendor's catches were a strict subset of the first's), at a **100%** false-
+positive rate on the controversial-but-correct controls under the adversarial-
+skeptic posture. Both locked recall thresholds missed -> honest-null. **The
+Mode 9 `adversarial-verification-council` surface stays default-off permanently**
+(no settings change — it already ships off), recorded like recursive-verification
+(ADR-106). Detail + reproducible artifact:
+`docs/benchmark.md#adversarial-verification-council`,
+`internal/bench/adversarial-council/runs/`.
+
+**Transport lesson (durable):** `council_cli run`/`debate` is a *deliberation*
+transport — multi-round peer-review with cross-member visibility, prose output.
+It is the WRONG tool for an independent-skeptic, structured-output benchmark (it
+violated the independence requirement and defeated JSON scoring; the first run
+through it was rejected as an artifact). The valid measurement uses direct,
+independent per-vendor client calls with a strict-JSON contract and a
+deterministic, pre-validated scorer.

package/docs/decisions/ADR-123-runtime-security-scope-and-spawn-hardening.md

@@ -0,0 +1,142 @@
+---
+adr: 123
+status: accepted
+date: 2026-07-20
+decision: runtime-security-scope-and-spawn-hardening
+supersedes: —
+superseded_by: —
+phase: road-to-runtime-security-hardening
+type: structural
+---
+
+# ADR-123 — Runtime-security scope: harden subprocess spawn-env, keep behavioural enforcement out of scope
+
+- **Status:** Accepted (2026-07-20)
+- **Closes:** `agents/roadmaps/archive/road-to-runtime-security-hardening.md`
+- **Related:** `docs/threat-model.md` row (d) (lethal-trifecta); `src/rules/tool-safety.md` (Least Agency); `src/rules/lethal-trifecta-guard.md`; `src/rules/untrusted-input-defense.md`.
+
+## Context
+
+A user-supplied source-level analysis compared agent-config's security stack
+against an external reference plugin (referred to only as **Source A** per
+`source-confidentiality`; © the third party, all-rights-reserved — concept
+adoption only, no code/regex/prompt port). It surfaced two distinct things that
+were repeatedly conflated:
+
+1. **A real shipped bug.** `src/scripts/ai_council/clients.ts::_runSubprocess`
+   built its `spawnSync` options with no `env:` key, so every spawned provider
+   CLI (`codex` / `claude` / `gemini`) — and any `git` those CLIs invoke
+   internally — inherited the full parent `process.env`. An attacker-influenced
+   `GIT_EXTERNAL_DIFF` / `core.pager` / `NODE_OPTIONS` / `LD_PRELOAD` /
+   `DYLD_INSERT_LIBRARIES` in the parent environment is remote code execution
+   (CWE-426 untrusted search path, CWE-88 argument injection). This is our own
+   transport violating the Least-Agency its `tool-safety` rule preaches.
+
+2. **A proposed scope reversal.** The analysis argued that because
+   `injection_scan_hook.ts` already scans **inbound** tool responses, the
+   threat-model's "runtime enforcement out of scope" decision (row (d)) is
+   already void, so we should also scan **outbound** — the content the agent
+   writes — with a pattern guard, a turn-diff baseline, and eventually an LLM
+   diff-review.
+
+A two-round council (2026-07-20, anthropic/claude-sonnet-4-5 + openai/gpt-4o)
+was decisive: round 1 leaned toward building the outbound guard; **round 2 both
+members pivoted skeptical** on the load-bearing distinction below.
+
+## Decision
+
+**1. Fix the spawn-env RCE (accepted, shipped in this roadmap).** A shared
+`src/scripts/_lib/spawn_env.ts::hardenedSpawnEnv(overrides?)` scrubs the
+code-execution-injection env families **by family, not by allowlist** — the
+provider CLIs legitimately need arbitrary env (API keys, config paths), so an
+allowlist would break them and rot; deny-by-family removes the known vectors
+(dynamic-loader `LD_*`/`DYLD_*`/`GCONV_PATH`, git `*_COMMAND`/`GIT_EXTERNAL_DIFF`/
+`GIT_SSH_COMMAND`/`PAGER`, runtime hooks `NODE_OPTIONS`/`BASH_ENV`/`ENV`/
+`PYTHON*`/`PERL5*`/`RUBYOPT`, and `IFS`) and preserves everything else. It is
+wired into the council transport and the two consumer-runtime hook spawn sites
+(`roadmap_progress_hook`, `hot_context_hook`), and guarded by a falsifiable
+regression test (proven RED without the fix — 8 vectors leaked into the child —
+GREEN with it).
+
+**2. Input sanitization ≠ runtime behavioural enforcement — row (d) stands.**
+The inbound `injection_scan_hook` is **self-defence**: it hardens AC's own
+handling of data it *receives* from external tools. It does **not** commit AC to
+*governing what the agent writes*. An outbound command guard requires
+interpreting intent from content (`rm -rf ./build` vs `rm -rf /`) — that is a
+runtime **enforcement** layer, a categorically different mechanism, and the one
+threat-model row (d) places out of scope. AC ships the *rules*
+(`lethal-trifecta-guard`, `untrusted-input-defense`, `tool-safety`); the
+consumer's tool-execution layer is the enforcement boundary. The inbound/outbound
+"asymmetry" is a defensible separation of concerns, not security theatre.
+
+**3. The outbound guard / turn-diff baseline / LLM diff-review are deferred, not
+rejected.** They remain `## Blockers` on the roadmap with a `revisit-if`: a real
+outbound-injection incident, a consumer demand signal, or utilization evidence —
+at which point they must also pass the six-question complexity budget
+(`artifact-drafting-protocol-mechanics` § Complexity budget), given PR #983 just
+consolidated surface and `surface-consolidation-restraint` freezes new modes
+pending the first external adopter. This ADR records the deferral so the
+decision is surfaced, not silently dropped (`decision-revisit-gate`).
+
+**4. Rejected:** a consumer-supplied-pattern ReDoS/trust-framing layer (Source A
+P5) — `security_lint.ts` has no consumer-pattern surface, so guarding it would
+build a defence for a feature that does not exist. Global env/pattern allowlists
+are also rejected: per-file pragma containment (`security_lint.ts`) only.
+
+## Consequences
+
+- The council transport and consumer-runtime hooks can no longer be turned into
+  an RCE vector by a poisoned parent environment; the fix is falsifiably tested.
+- `docs/threat-model.md` gains a row for the (now-mitigated)
+  subprocess-env-inheritance vector, and row (d)'s "no additional mitigation
+  planned" cell cites this ADR for the input-sanitization-vs-enforcement
+  distinction and the deferred-guard decision.
+- AC's security posture stays **authoring-time rules + input hygiene + our own
+  Least-Agency spawn discipline** — it does not become a runtime sandbox
+  supervising every agent tool call.
+- Maintainer-only CI/git-helper spawn sites (~15) are a deferred mechanical
+  sweep (`maintainer-ci-spawn-sweep` blocker): they run in trusted CI with lower
+  attacker-control of the environment.
+
+## Alternatives considered
+
+- **Complete the runtime layer (build the outbound guard now).** Council round 1
+  position. Rejected in round 2: conflates input sanitization with behavioural
+  enforcement; adds net-new enforcement surface with a false-positive burden,
+  right after a consolidation roadmap, with no demand signal.
+- **Delete `injection_scan_hook.ts` for symmetry.** Architecturally consistent
+  but operationally worse — inbound sanitization is legitimate self-defence and
+  costs nothing to keep.
+- **Env allowlist instead of deny-by-family.** Rejected — would strip env the
+  provider CLIs need and rot as new good vars appear.
+
+## Follow-up (2026-07-21) — `road-to-spawn-env-completion`
+
+The 9.6.0 external review reproduced a working exploit against the fix this ADR
+shipped: `GIT_CONFIG_COUNT` / `GIT_CONFIG_KEY_<n>` / `GIT_CONFIG_VALUE_<n>` (and
+`GIT_CONFIG_GLOBAL` / `_SYSTEM`) survived the deny-by-family scrub — the
+`GIT_*_COMMAND` family missed them (no `_COMMAND` suffix) — letting an attacker
+set arbitrary git config (`core.fsmonitor` runs shell on every `git status`,
+which the consumer-runtime hooks trigger). `GIT_ALTERNATE_OBJECT_DIRECTORIES`
+and `HOSTALIASES` also leaked. **Confirmed empirically (all 5) and closed:**
+`hardenedSpawnEnv` now denies the whole `GIT_CONFIG`/`GIT_CONFIG_*` family by
+prefix plus the two exact vars, with falsifiable test vectors (red without the
+fix, green with it).
+
+**`maintainer-ci-spawn-sweep` blocker — resolved by classification, not mass
+migration.** Rather than migrate ~15 low-risk maintainer/CI sites, all spawn
+sites are now classified in `docs/spawn-site-policy.md` (Consumer Runtime /
+Maintainer CLI / trusted CI / install-time). The consumer-runtime dispatcher
+(`hooks/dispatch_hook.ts`) — missed in PR #984 — now routes through
+`hardenedSpawnEnv`; the maintainer/CI/install sites are documented exempt with
+rationale (env is maintainer- or workflow-controlled, not attacker-influenced).
+
+**Secure-spawn lint — rejected (council 2026-07-21, claude-sonnet-4-5 +
+gpt-4o).** A CI lint forbidding raw spawn in runtime paths was proposed (P0 in
+the review) but rejected: it is net-new governance surface (a CI gate +
+allowlist + exemption-adjudication + false-positive triage), which the folded
+complexity-budget lock (PR #983) forbids — the lock text explicitly lists
+"linter". The "retires ad-hoc review" justification failed the retirement test
+(no such review gate exists to retire). `docs/spawn-site-policy.md` is the
+self-enforcing substitute: its completeness claim is checked by git-diff
+visibility at review time, not a build gate.

package/docs/decisions/INDEX.md

@@ -126,6 +126,7 @@ _Auto-generated by `scripts/adr/regenerate_index.py`. Do not edit._
 | [ADR-120](ADR-120-council-chairman-mode.md) | Council Chairman Mode | accepted | 2026-07-12 | — |
 | [ADR-121](ADR-121-knowledge-sensitivity-classes.md) | Knowledge Sensitivity Classes | accepted | 2026-07-12 | — |
 | [ADR-122](ADR-122-adversarial-verification-council.md) | Adversarial Verification Council | accepted | 2026-07-14 | — |
+| [ADR-123](ADR-123-runtime-security-scope-and-spawn-hardening.md) | Runtime Security Scope And Spawn Hardening | accepted | 2026-07-20 | — |
 | [ADR-200](ADR-200-python-to-typescript-migration.md) | Python To Typescript Migration | accepted | 2026-06-11 | — |
 
 ## Unnumbered (legacy)

package/docs/guidelines/agent-infra/artifact-drafting-protocol-mechanics.md

@@ -70,6 +70,32 @@ those artifacts:
 - Batch mode never skips the Research pass itself — it relocates and
   batches it. `artifact_protocol: skip` does not exist.
 
+## Complexity budget — the six questions before a new artefact
+
+Folded here from the 9.4.0 review (Prio 5), which named the failure mode:
+"das Paket kann fast jede Kritik mit einem weiteren Mechanismus beantworten"
+(Problem → Regel → Lint → Hook → Report → Roadmap → Claim → Test = governance
+inflation). This REPLACES the ad-hoc "should this exist" prose — it is a
+checklist, not a new gate/rule (adding a gate to enforce "add less" would be
+the very inflation it guards against). Before drafting any new skill / rule /
+command / hook / gate, answer all six; a "no" on **replaces** or **removable**
+is a strong signal to fold into an existing artefact instead:
+
+1. **Replaces?** — what existing mechanism does this retire or subsume? (If
+   nothing, justify why the surface must grow.)
+2. **Overlaps?** — does it duplicate a trigger / responsibility another
+   artefact already owns?
+3. **Discoverable?** — will a user actually find it, or does it just raise the
+   catalog count?
+4. **Measurable?** — is there a signal that would show it earning its place
+   (or a null that would retire it)?
+5. **Removable?** — can it be demoted / de-eligibled / deleted later without a
+   migration?
+6. **Who debugs it?** — is the maintenance owner real, given bus-factor?
+
+The load-bearing question the review elevates: not "how do we prevent this
+error in future?" but **"which existing mechanism gets removed or replaced?"**
+
 ## See also
 
 - `artifact-drafting-protocol` (rule) — Iron Law, triggers, golden rules.

package/docs/spawn-site-policy.md

@@ -0,0 +1,72 @@
+# Spawn-Site Policy — subprocess env-hardening classification
+
+> Every place agent-config spawns a subprocess is classified into one of four
+> buckets. The bucket decides whether the spawn MUST route its environment
+> through `hardenedSpawnEnv()` (`src/scripts/_lib/spawn_env.ts`). This document
+> is the single authoritative inventory — a new spawn site is visible in a PR
+> diff as either an addition to a bucket below or an unclassified site that
+> contradicts this doc's completeness claim. That git-diff visibility is the
+> enforcement mechanism (a dedicated lint was considered and **rejected** — see
+> ADR-123 and the "No lint" note below).
+
+## The buckets
+
+| Bucket | Definition | Env rule |
+|---|---|---|
+| **Consumer Runtime** | Runs on the end-user's machine as part of the installed package — the hook dispatcher, dispatched hook concerns, and the AI-council CLI transport. The parent `process.env` is whatever the user's agent/shell exposes and is influenceable by repo content the agent just read. | **MUST** pass `env: hardenedSpawnEnv(overrides?)`. |
+| **Maintainer CLI / tooling** | Runs on a maintainer's dev machine, invoked explicitly (benchmarks, fixture replay, wizards, one-off scripts). The env is the maintainer's own. | SHOULD prefer the helper; MAY use raw env with a stated reason. Not attacker-controlled. |
+| **CI (trusted)** | Runs inside this repo's GitHub Actions on the repo's own refs (git/gh helpers reading `git log` / `gh pr view`). Env is set by the workflow file, not by PR content; fork PRs get no secrets. | Raw env permitted. Migrate only if a job begins consuming untrusted fork content into its env. |
+| **Install-time** | Runs during `npx`/install (the installer spawning package managers from a lockfile). | Raw env permitted; installs are lockfile-pinned. Revisit if an installer step ingests untrusted input. |
+
+## Consumer-Runtime inventory (the security-critical set)
+
+All Consumer-Runtime spawns route through `hardenedSpawnEnv()`:
+
+| Site | Spawns | Status |
+|---|---|---|
+| `src/scripts/ai_council/clients.ts::_runSubprocess` | provider CLIs (`codex`/`claude`/`gemini`) | ✅ hardened (ADR-123 / PR #984) |
+| `src/scripts/hot_context_hook.ts` | `git rev-parse` | ✅ hardened (PR #984) |
+| `src/scripts/roadmap_progress_hook.ts` | tsx regenerator (runs git) | ✅ hardened (PR #984) |
+| `src/scripts/hooks/dispatch_hook.ts` | every hook concern via tsx | ✅ hardened (this roadmap) |
+| `src/scripts/hooks/replay_hook.ts` | re-dispatches through the runtime | Maintainer/fixture tool; its downstream concern spawn is hardened by `dispatch_hook` above. Exempt at this layer. |
+
+Any NEW consumer-runtime spawn (a new hook that shells out, a new installed
+runtime path) MUST be added to this table and route through `hardenedSpawnEnv`.
+
+## Maintainer / CI / Install (exempt, with rationale)
+
+The remaining spawn sites (benchmarks `bench_*`, `consumer_matrix`, the
+installer `install.ts`, the fleet CLI, and the ~15 git/gh maintainer helpers
+such as `check_trunk_drift`, `evidence_report`, `print_required_checks`,
+`check_release_pr_shape`, `migration_status`, …) are Maintainer CLI, trusted CI,
+or install-time. Their environment is the maintainer's own or GitHub Actions'
+workflow-controlled env — not influenced by untrusted repo content the agent
+read at runtime. They are exempt from the MUST rule. A maintainer/CI site moves
+to the Consumer-Runtime bucket (and MUST harden) only if it starts running on an
+end-user machine or ingesting untrusted fork content into its spawn env.
+
+## What `hardenedSpawnEnv` scrubs
+
+Deny-by-family (not an allowlist — the CLIs legitimately need arbitrary env):
+dynamic loader (`LD_*`, `DYLD_*`, `GCONV_PATH`), git command hooks
+(`GIT_*_COMMAND`, `GIT_EXTERNAL_DIFF`, `GIT_SSH_COMMAND`, `GIT_PAGER`, `PAGER`),
+**git config-injection** (`GIT_CONFIG` and the whole `GIT_CONFIG_*` family —
+`GIT_CONFIG_COUNT`/`_KEY_<n>`/`_VALUE_<n>`/`_GLOBAL`/`_SYSTEM`, the
+`core.fsmonitor` RCE primitive), `GIT_ALTERNATE_OBJECT_DIRECTORIES`,
+`HOSTALIASES`, runtime auto-exec hooks (`NODE_OPTIONS`, `BASH_ENV`, `ENV`,
+`PYTHON*`, `PERL5*`, `RUBYOPT`), and `IFS`. Everything else is preserved.
+
+## No lint (deliberate)
+
+A CI lint forbidding raw spawn in runtime paths was proposed and **rejected**
+(council 2026-07-21; recorded in ADR-123): it is net-new governance surface (a
+CI gate + allowlist + exemption-adjudication + false-positive triage), which the
+complexity-budget lock forbids ("must not become a new rule/linter/gate"). This
+inventory doc is the self-enforcing substitute — its completeness claim is
+checked by git-diff visibility at review time, not by a build gate.
+
+## See also
+
+- `docs/decisions/ADR-123-runtime-security-scope-and-spawn-hardening.md` — the runtime-security scope decision + the rejected-lint record.
+- `docs/threat-model.md` row (g) — the subprocess-env-inheritance vector.
+- `src/scripts/_lib/spawn_env.ts` — the helper.

package/docs/threat-model.md

@@ -13,9 +13,10 @@ and holds no user data. Threats are about **artifact integrity** and
 | a | **Malicious skill / rule via PR** — a contributed `.md` file smuggles prompt-injection or data-exfiltration payloads into the shipped artifact tree | Adversarial PR contributor embeds: (1) invisible Unicode (bidi / zero-width / Tag-block) to hide instructions, (2) role-takeover imperatives, (3) lethal-trifecta pattern in a new skill (private-data + untrusted-content + egress on one autonomous path) | `lint_hidden_unicode.py` — blocks Trojan-Source and invisible-char attacks; `lint_instruction_smuggling.py` — blocks disclosure-suppression and injection-tag prose; `lint_skill_frontmatter_safety.py` — blocks wildcard `allowed_tools`, `bypassPermissions`, unsafe `execution.type: automated`; PR review gate | No automated SARIF upload to GitHub Code Scanning; lethal-trifecta detection is architectural (rule) not linted structurally beyond the frontmatter check | Wire `lint_agent_security.py --sarif` output to GitHub Advanced Security on every PR (`lint_workflow_security.py` — P2); add structural trifecta check to frontmatter linter |
 | b | **Supply-chain compromise of AC's own deps** — a malicious version of an npm or Python dependency is pulled during CI / install and executes arbitrary code or modifies shipped artifacts | Dependency confusion / typosquatting attack on `package.json` or `requirements.txt` deps; compromised upstream package | `package-lock.json` + `requirements.txt` pin exact versions; CI installs from lockfile (`npm ci`) | No documented dep-audit policy; no Dependabot / Renovate automation; no integrity check (`npm audit` / `pip-audit`) in CI gate | Add `npm audit --audit-level=high` + `pip-audit` as a required CI step; document quarterly manual review cadence; pin Python deps in a lockfile (`pip-compile`) |
 | c | **Hostile consumer-repo environment** — AC's installer or hooks execute inside a repo whose `.git/hooks`, `.env`, or workspace files are attacker-controlled | Consumer repo pre-installs malicious Git hooks that intercept the AC installer or post-install hook; `.env` leaks tokens that AC hooks read; untrusted files are passed to AC linters | AC installer writes its own hooks under its namespace; AC hooks run as the user's shell — they do not read `.env` by design; `untrusted-input-defense` rule governs agent behaviour at runtime | No sandboxed execution for AC hooks; installer does not verify consumer hook integrity before writing | Document that AC hooks must not read repo-local env files; add installer pre-flight that warns if foreign hooks exist in `.git/hooks/`; scope AC hook writes to explicit namespaced filenames |
-| d | **Lethal-trifecta surface** — a skill combining private-data access + untrusted-content ingestion + external communication on one autonomous path enables confused-deputy / data-exfiltration attacks | Prompt-injected content inside a fetched doc instructs an agent to read a local secret and POST it to an attacker-controlled endpoint | `src/rules/lethal-trifecta-guard.md` (Iron Law: break one leg or gate egress behind human-in-the-loop); `src/rules/untrusted-input-defense.md` (untrusted content is data, never instructions; spotlighting); `lint_skill_frontmatter_safety.py` (flags over-broad tool grants) | These are authoring-time controls — no runtime enforcement layer exists | No additional mitigation planned (runtime layer out of scope for AC); `lethal-trifecta-guard.md` and `untrusted-input-defense.md` are the canonical reference — do not re-describe here |
+| d | **Lethal-trifecta surface** — a skill combining private-data access + untrusted-content ingestion + external communication on one autonomous path enables confused-deputy / data-exfiltration attacks | Prompt-injected content inside a fetched doc instructs an agent to read a local secret and POST it to an attacker-controlled endpoint | `src/rules/lethal-trifecta-guard.md` (Iron Law: break one leg or gate egress behind human-in-the-loop); `src/rules/untrusted-input-defense.md` (untrusted content is data, never instructions; spotlighting); `lint_skill_frontmatter_safety.py` (flags over-broad tool grants) | These are authoring-time controls — no runtime *behavioural-enforcement* layer exists (input sanitization ≠ enforcement — see ADR-123) | Runtime behavioural enforcement stays out of scope for AC (`ADR-123-runtime-security-scope-and-spawn-hardening`): AC ships the rules, the consumer's tool-execution layer enforces them; the outbound content-scan guard is deferred with a `revisit-if`, not silently dropped. `lethal-trifecta-guard.md` and `untrusted-input-defense.md` are the canonical reference — do not re-describe here |
 | e | **Malicious metadata / frontmatter injection** — a PR embeds hostile YAML in a skill's frontmatter (e.g. injecting a trigger keyword that causes a dangerous skill to fire in unintended contexts, or adding `permissionMode: bypassPermissions`) | PR contributor adds `permissionMode: bypassPermissions` or a wildcard `allowed_tools: ["*"]` entry to an existing skill's frontmatter; or crafts a trigger keyword to hijack routing | `lint_skill_frontmatter_safety.py` — HIGH-severity block on `bypassPermissions`, wildcard `allowed_tools`, unsafe `execution.type: automated` without safety floor; `lint_hidden_unicode.py` — catches invisible chars inside frontmatter YAML values; PR review gate; `scripts/validate_frontmatter.py` schema validation | Schema validation does not verify trigger-keyword semantic safety (a plausible keyword that causes over-broad firing is not caught) | Extend `validate_frontmatter.py` to flag trigger keywords that match security-sensitive path prefixes (e.g. a skill triggering on `"auth"` when it has `execution.type: automated`) |
 | f | **Skill self-update — safety-floor rewrite** — an agent is social-engineered (via chat or a PR) into weakening a kernel rule, safety floor, or MCP/tool allowlist | A PR removes the Iron Law block from `non-destructive-by-default.md`; or a chat prompt instructs the agent to edit `security-sensitive-stop.md` to narrow its self-modification clause; or a PR modifies `scope-control` to remove the Hard Floor | `src/rules/security-sensitive-stop.md` — "self-modification via chat" clause: requests to weaken safety floors / kernel rules / MCP allowlists must route through `scope-control` gates; `src/rules/scope-control.md` — kernel-rule edits require own PR + ≥ 24 h soak; `dist/agent-src/` is read-only (source-of-truth rule); `scripts/check_condensation.py` detects Iron-Law section deletion or downgrade | No automated per-rule diff check that fires specifically when a kernel rule's Iron Law section is removed; relies on PR reviewer recognising the file class | Add a CI check (`scripts/check_kernel_rule_integrity.py` — P3+) that asserts Iron Law fenced-code blocks survive unchanged in all files listed in `docs/contracts/kernel-membership.md` |
+| g | **Subprocess spawn-env inheritance** — AC's own transport spawns an external CLI (the AI-council provider CLIs; consumer-runtime hooks spawn `git`) with the full parent `process.env`, so an attacker-influenced env var in the parent becomes RCE when the child (or a `git` it invokes internally) runs | A poisoned `GIT_EXTERNAL_DIFF` / `core.pager` / `GIT_SSH_COMMAND`, the `GIT_CONFIG_COUNT`/`_KEY_<n>`/`_VALUE_<n>` config-injection trio (sets `core.fsmonitor` → shell on every `git status`), a dynamic-loader `LD_PRELOAD` / `DYLD_INSERT_LIBRARIES` / `GCONV_PATH`, `GIT_ALTERNATE_OBJECT_DIRECTORIES` / `HOSTALIASES`, or a runtime hook `NODE_OPTIONS` / `BASH_ENV` / `PYTHONSTARTUP` present in the parent env executes attacker code inside the spawned process (CWE-426, CWE-88, CWE-427) | `src/scripts/_lib/spawn_env.ts::hardenedSpawnEnv()` scrubs the code-execution-injection env families (deny-by-family: loader `LD_*`/`DYLD_*`/`GCONV_PATH`, git `*_COMMAND` + the whole `GIT_CONFIG`/`GIT_CONFIG_*` family + `GIT_ALTERNATE_OBJECT_DIRECTORIES`/`HOSTALIASES`/`GIT_EXTERNAL_DIFF`/`GIT_SSH_COMMAND`/`GIT_PAGER`/`PAGER`, runtime hooks `NODE_OPTIONS`/`BASH_ENV`/`ENV`/`PYTHON*`/`PERL5*`/`RUBYOPT`, `IFS`) and preserves the rest; wired into ALL consumer-runtime spawns — `clients.ts::_runSubprocess`, `hooks/dispatch_hook.ts`, `roadmap_progress_hook.ts`, `hot_context_hook.ts`; falsifiable regression test in `tests/scripts/ai_council/spawn_env.test.ts` (ADR-123 + 2026-07-21 follow-up) | — (consumer-runtime surface fully hardened; maintainer/CI/install sites are env-controlled, not attacker-influenced) | Spawn sites classified in `docs/spawn-site-policy.md` (Consumer Runtime MUST harden / Maintainer / CI / install exempt with rationale); the deferred lint was rejected — the policy doc is the self-enforcing substitute |
 
 ## Review cadence
 

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
-    "version": "9.5.0",
-    "description": "Universal AI Agent OS — audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
+    "version": "9.7.0",
+    "description": "Universal AI Agent OS — audited skills, governance rules, commands and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
     "license": "MIT",
     "private": false,
     "type": "module",

package/src/agent-src/README.md

@@ -1,8 +1,8 @@
 # Agent Infrastructure
 
 > **⚠️ DO NOT edit files in `dist/agent-src/` or `.augment/` directly.**
-> The source of truth is `.agent-src.uncondensed/`. Edit there, then run `task sync`.
-> See `.agent-src.uncondensed/commands/condense.md` for the full workflow.
+> The source of truth is `src/` (`src/skills/`, `src/rules/`, `src/agent-src/`). Edit there, then run `task sync`.
+> See the `source-of-truth` rule and the `/condense` command for the full workflow.
 
 This directory contains the shared agent infrastructure: skills, commands, rules, guidelines,
 templates, and contexts that power the AI coding assistant across all projects.

package/src/scripts/_lib/adversarial_bench_score.ts

@@ -0,0 +1,106 @@
+/**
+ * Deterministic scorer for the adversarial-council residual-detection benchmark
+ * (road-to-adversarial-council-benchmark Phase 1).
+ *
+ * Pure + countable — never LLM-computed (the anti-lesson from ADR-122). Given a
+ * corpus item's ground truth and a reviewer's structured findings, decide
+ * whether the reviewer CAUGHT the planted defect (for a defect fixture) or
+ * raised a FALSE POSITIVE (for a clean control). The two-stage recalls and FP
+ * rates this produces feed `evaluateCouncilBench` (adversarial_council_gate.ts).
+ *
+ * Matching rule (deliberately NOT exact file:line — the scorer bug from the
+ * earlier defect-finding benchmark required an exact line token and mis-scored
+ * genuine catches that cited a nearby line): a finding CATCHES a planted defect
+ * iff it names one of the defect's file(s) by basename AND its category falls in
+ * the same normalized family as the planted defect. Line numbers are advisory,
+ * never required. This credits a real catch that localizes the right file +
+ * defect class, and denies credit for a scattershot "something's wrong here"
+ * with the wrong class.
+ */
+
+/** Normalize a free-form category string to a coarse family. */
+export function categoryFamily(raw: string): string {
+    const c = raw.toLowerCase().replace(/[^a-z]/g, '');
+    if (/(accesscontrol|authz|authorization|idor|bola|ownership|privilege|rbac)/.test(c)) return 'access-control';
+    if (/(auth|authentication|session|credential|login)/.test(c)) return 'auth';
+    if (/(ssrf|serverside)/.test(c)) return 'ssrf';
+    if (/(pathtraversal|traversal|directorytraversal|lfi)/.test(c)) return 'path-traversal';
+    // NB: no bare "rce" token — it substring-matches inside "resou[rce]leak".
+    if (/(injection|sqli|xss|commandinjection|deserial|remotecodeexec)/.test(c)) return 'injection';
+    if (/(crypto|cryptographic|timing|constanttime|hash|signature)/.test(c)) return 'crypto';
+    if (/(concurrency|race|atomic|deadlock|idempoten)/.test(c)) return 'concurrency';
+    if (/(resourceleak|leak|memory|handle|unsubscrib|cleanup)/.test(c)) return 'resource-leak';
+    if (/(dataintegrity|integrity|corrupt|consistency|stale)/.test(c)) return 'data-integrity';
+    if (/(correctness|logic|offbyone|boundary|edgecase|bug)/.test(c)) return 'correctness';
+    return 'other';
+}
+
+export interface Finding {
+    /** File the finding points at (any path form; matched by basename). */
+    file: string;
+    /** Reviewer-supplied category (free text; normalized via categoryFamily). */
+    category: string;
+    /** Reviewer confidence, if given. Low-confidence findings can be excluded from FP counting. */
+    confidence?: 'high' | 'medium' | 'low';
+}
+
+export interface GroundTruth {
+    id: string;
+    /** true = clean control (no defect); a finding here is a false positive. */
+    is_clean: boolean;
+    /** Basenames of the file(s) the planted defect lives in (empty for clean). */
+    defect_files: string[];
+    /** Planted defect category family (via categoryFamily); empty for clean. */
+    defect_category: string;
+}
+
+function basename(p: string): string {
+    return p.split(/[\\/]/).pop() ?? p;
+}
+
+/**
+ * Did the reviewer CATCH the planted defect? file-basename match on any defect
+ * file AND category-family match. Clean controls always return false (they have
+ * no defect to catch — use `isFalsePositive` for them).
+ */
+export function caughtDefect(truth: GroundTruth, findings: Finding[]): boolean {
+    if (truth.is_clean) return false;
+    const wantFiles = new Set(truth.defect_files.map(basename));
+    const wantFamily = truth.defect_category;
+    return findings.some(
+        (f) => wantFiles.has(basename(f.file)) && categoryFamily(f.category) === wantFamily,
+    );
+}
+
+/**
+ * Did the reviewer raise a FALSE POSITIVE on a clean control? Any finding that
+ * points at the control file counts (a claimed defect where none exists).
+ * Low-confidence findings are excluded — a hedged "might check X" is not a FP
+ * claim. Non-clean fixtures always return false.
+ */
+export function isFalsePositive(truth: GroundTruth, findings: Finding[]): boolean {
+    if (!truth.is_clean) return false;
+    return findings.some((f) => (f.confidence ?? 'high') !== 'low');
+}
+
+export interface StageResult {
+    /** Per-defect-fixture: id → caught?. Excludes clean controls. */
+    caught: Record<string, boolean>;
+    /** Per-clean-control: id → false-positive?. */
+    fp: Record<string, boolean>;
+}
+
+/** Recall over a set of defect ids, given per-id caught flags. */
+export function recall(caught: Record<string, boolean>): number {
+    const ids = Object.keys(caught);
+    if (ids.length === 0) return 0;
+    const hits = ids.filter((id) => caught[id]).length;
+    return hits / ids.length;
+}
+
+/** FP rate over clean controls. */
+export function fpRate(fp: Record<string, boolean>): number {
+    const ids = Object.keys(fp);
+    if (ids.length === 0) return 0;
+    return ids.filter((id) => fp[id]).length / ids.length;
+}

package/src/scripts/_lib/spawn_env.ts

@@ -0,0 +1,120 @@
+/**
+ * Hardened environment for spawned subprocesses
+ * (road-to-runtime-security-hardening Phase 1).
+ *
+ * agent-config shells out to external CLIs (the AI-council transport spawns
+ * `codex` / `claude` / `gemini`; hooks spawn `git`). By default `spawnSync`
+ * inherits the full parent `process.env`, so any attacker-influenced env var in
+ * the parent becomes a code-execution vector the moment the child (or a `git`
+ * it invokes internally) runs:
+ *
+ *   - dynamic-loader preload/search-path (CWE-426 untrusted search path):
+ *     LD_PRELOAD, LD_LIBRARY_PATH, DYLD_INSERT_LIBRARIES, DYLD_LIBRARY_PATH,
+ *     GCONV_PATH — load attacker code into any spawned ELF/Mach-O.
+ *   - git command-injection (CWE-88): GIT_EXTERNAL_DIFF, GIT_SSH,
+ *     GIT_SSH_COMMAND, GIT_PROXY_COMMAND, any GIT_*_COMMAND, GIT_PAGER, PAGER —
+ *     git runs these as shell commands (`core.pager` / external-diff RCE).
+ *   - git config-injection (CWE-88): the GIT_CONFIG* family (GIT_CONFIG,
+ *     GIT_CONFIG_GLOBAL/_SYSTEM, and inline GIT_CONFIG_COUNT / GIT_CONFIG_KEY_<n>
+ *     / GIT_CONFIG_VALUE_<n>) sets ANY git config — `core.fsmonitor` runs shell
+ *     on every `git status`; GIT_ALTERNATE_OBJECT_DIRECTORIES / HOSTALIASES
+ *     redirect object stores / hostname resolution.
+ *   - runtime auto-exec hooks: NODE_OPTIONS (`--require attacker.js`),
+ *     BASH_ENV / ENV (sourced by non-interactive shells), PYTHONPATH /
+ *     PYTHONSTARTUP / PYTHONINSPECT, PERL5OPT / PERL5LIB, RUBYOPT.
+ *   - IFS — classic shell field-splitting hijack.
+ *
+ * This is the Least-Agency the `tool-safety` rule preaches, applied to our own
+ * transport. We scrub by *family* (prefix + exact name), NOT via an allowlist:
+ * the CLIs legitimately need arbitrary env (ANTHROPIC_API_KEY, XDG config
+ * paths, proxy settings), so an allowlist would break them and rot as new
+ * good vars appear. Deny-by-family removes the known execution vectors and
+ * preserves everything else. This is standard, publicly-documented OWASP/CWE
+ * knowledge — independently implemented here.
+ */
+
+/** Exact env-var names removed unconditionally. */
+const DENY_EXACT: ReadonlySet<string> = new Set([
+    // dynamic loader
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'LD_AUDIT',
+    'DYLD_INSERT_LIBRARIES',
+    'DYLD_LIBRARY_PATH',
+    'DYLD_FRAMEWORK_PATH',
+    'GCONV_PATH',
+    // git command-injection
+    'GIT_EXTERNAL_DIFF',
+    'GIT_SSH',
+    'GIT_SSH_COMMAND',
+    'GIT_PROXY_COMMAND',
+    'GIT_PAGER',
+    'PAGER',
+    // git config-injection: GIT_ALTERNATE_OBJECT_DIRECTORIES can point git at
+    // attacker-controlled object stores; the GIT_CONFIG* family is handled by
+    // prefix below (it is a general arbitrary-config-injection primitive).
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+    // resolver hijack: HOSTALIASES remaps hostnames via an attacker file,
+    // redirecting any network fetch the child performs (CWE-427-adjacent).
+    'HOSTALIASES',
+    // runtime auto-exec hooks
+    'NODE_OPTIONS',
+    'BASH_ENV',
+    'ENV',
+    'PYTHONPATH',
+    'PYTHONSTARTUP',
+    'PYTHONINSPECT',
+    'PERL5OPT',
+    'PERL5LIB',
+    'RUBYOPT',
+    // shell field-splitting
+    'IFS',
+]);
+
+/**
+ * Prefix families removed by pattern. `LD_` / `DYLD_` cover loader variants we
+ * did not enumerate; `GIT_*_COMMAND` covers every git config-command hook; the
+ * `GIT_CONFIG` family (GIT_CONFIG, GIT_CONFIG_GLOBAL, GIT_CONFIG_SYSTEM, and the
+ * inline GIT_CONFIG_COUNT / GIT_CONFIG_KEY_<n> / GIT_CONFIG_VALUE_<n> trio) is a
+ * general arbitrary-config-injection primitive — an attacker can set ANY git
+ * config key, e.g. `core.fsmonitor` / `core.pager` / `core.sshCommand` /
+ * `core.hooksPath` / `alias.*`, all of which git executes as shell on ordinary
+ * operations (`git status` alone runs `core.fsmonitor`). The plain `GIT_*_COMMAND`
+ * check missed it (no `_COMMAND` suffix), so it is denied by its own prefix.
+ * (GIT_ASKPASS is intentionally NOT denied — it is a path, not a shell command,
+ * and legitimate credential helpers need it; the *_COMMAND family is the
+ * shell-executed one.)
+ */
+function isDeniedByFamily(name: string): boolean {
+    if (name.startsWith('LD_') || name.startsWith('DYLD_')) return true;
+    if (name.startsWith('GIT_') && name.endsWith('_COMMAND')) return true;
+    if (name === 'GIT_CONFIG' || name.startsWith('GIT_CONFIG_')) return true;
+    return false;
+}
+
+/**
+ * Return a copy of the current environment with code-execution-injection
+ * vectors scrubbed, then `overrides` applied. Pass the result as
+ * `spawnSync`/`spawn`'s `env:` option.
+ *
+ * @param overrides values to set AFTER scrubbing (e.g. a scoped PATH or a
+ *   package-root marker). Overrides win over both the inherited env and the
+ *   deny-list, so a caller can deliberately re-supply a scrubbed var if it
+ *   genuinely needs one — that is an explicit, reviewable decision at the call
+ *   site, never an ambient inheritance.
+ */
+export function hardenedSpawnEnv(
+    overrides: Record<string, string> = {},
+): NodeJS.ProcessEnv {
+    const out: NodeJS.ProcessEnv = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        if (value === undefined) continue;
+        if (DENY_EXACT.has(key)) continue;
+        if (isDeniedByFamily(key)) continue;
+        out[key] = value;
+    }
+    for (const [key, value] of Object.entries(overrides)) {
+        out[key] = value;
+    }
+    return out;
+}