[rdpollard]

The authorized Mint run stopped at SOURCE_OWNER: checkout directories were group-writable (0775), and the caller was 0664. This PR prevents shared-write creation through a fixed private runner launcher and adds a separately gated checkout-only diagnostic before any proposed media retry. The failed checkout is retained unchanged and the strict source-reader function is unchanged.

The launcher validates a fresh 0700 session and empty _work-private, rejects unsafe ancestry/default ACLs/registration drift, filters inherited startup hooks, and sets umask 0077 before the fixed listener exec. It performs no chmod/chown or recursive repair. Nonblocking settings validation and structured mask-restoration failure handling are covered by mocks.

The new manual-only mint-checkout-validation.yml uses the same pinned checkout configuration as media preparation, a ten-minute protected job, independent disabled MINT_CHECKOUT_* activation/SHA/six-file-bundle gates, main-only exact workflow binding, no inputs/reruns and the restricted runner group. The standalone observer reads bounded fixed source/metadata and /proc/self/status, verifies mask/modes/owners/ACLs/hash/context, and emits <=64 KiB sanitized evidence. It has no repository imports, media/native helper execution, KVM, subprocess, package or guest path. Permission success never claims authentication or cleanup proof.

Review corrections retain directory identity before an ACL-query failure and distinguish unchecked ACLs (null) from observed absence (false). Directory trust is checked before querying ACLs; malformed multiline Umask values are rejected. Added mocked coverage verifies ACL-query failure evidence, ancestry/inventory bounds and mid-read deadline closure without retry.

Validation: 121 mocked/static checks, focused actionlint and whitespace checks passed. The full eleven-file diff is within exact infrastructure scope; mixed app/key/unknown controls retain application CI. Automatic CI runs static/mocked checks only; existing media, inventory, native-fixture and installer/release gates are unchanged. Native inheritance/ACL/settings/log-retrieval/closeout remain proof gates after separate authorization.

Keep #78 and #73 draft/unmerged. Activation stays disabled; no host permissions, runner operations, dispatch, media downloads, guests, application builds/packages or releases were performed or are authorized. Future execution requires a new final main SHA, independent checkout bundle/launcher hashes, exact runner-group workflow restriction, environment approval and fresh one-job registration; old run/approval/hash cannot be reused.

[rdpollard]

Reviewed implementation bcaf9a4:

The setup correction prevents group-write creation before listener/worker/checkout startup through umask 0077 and a fixed fresh private session with empty _work-private. It does not chmod/chown or delete the failed checkout, accept shared writable source directories, or change the strict source-reader function. The latter was compared as an AST with main and is unchanged. Mocked regressions continue to reject the observed 0775 directory and 0664 file.

Launcher checks reject unsafe owner/mode/symlink/default-ACL states, reused workspace, wrong registration settings, oversized/changed/duplicate configuration and uncertain close. The ordinary umask inheritance model is tested at the mocked exec boundary; actual runner/worker/checkout and default-ACL/settings behavior remain native proof gates. New launcher identity is included in the five-file caller bundle. Old execution approval/hash is not reusable.

Local QA: 97 mocked/static checks and focused actionlint/whitespace checks passed. No real umask change, listener, signal, subprocess, spare-host permission modification, registration, dispatch, media/package/guest/build/release operation occurred.

Exact-head automatic CI: policy passed (39128813742); scope passed with checks/native/update-trust/release skipped (39128813658); workflow-checks passed with Windows/Mint fixtures skipped (39128813620). The eight-file diff stays within exact infrastructure paths; mixed app/key/unknown controls retain application CI. Existing activation/native/application workflow definitions are unchanged. PR #78 and #73 remain draft/open/unmerged.

[rdpollard]

Reviewed and fixed at 32ada58:

• Removed inherited shell/function/Node/loader startup hooks from the environment passed to the fixed runner script while retaining ordinary context and proxy/CA settings. Stored runner .env/native behavior remains a later proof gate; no malicious same-account/root defense is claimed.
• Opened .runner with nonblocking/no-ctty flags before bounded regular-file validation, preventing an unexpected special file from blocking that validation or acquiring terminal state.
• Attempted earlier-mask restoration before emitting structured failure; uncertainty reports UMASK_RESTORE_UNCERTAIN without retry or raw exception text. Unexpected exec return remains a failure.

102 local mocked/static checks passed (39 helper, 30 caller/workflow, 16 launcher/permission, 8 policy, 9 scope), focused actionlint and whitespace checks passed. Added regressions cover those fixes plus all excluded privileged groups/effective-UID mismatch. The original source-reader AST is unchanged; observed 0775/0664 inputs still fail. The full eight-file PR diff remains in the exact infrastructure exception, with mixed app/key changes retaining application CI.

Exact-head automatic CI: policy passed (39129115430), scope passed with application checks/native/update-trust/release skipped (39129115383), workflow-checks passed with Windows/Mint native fixtures skipped (39129115439).

No remaining blocking local finding identified within the declared trusted-account setup model. Native runner/worker/checkout mask inheritance, actual ACL/settings/runner-environment behavior, authentication and cleanup remain unvalidated and require separate authorization with new final SHA/file/bundle bindings. The existing failed checkout is untouched. No spare-host permissions, activation settings, runner operation, dispatch, downloads, guest/package/build/release action or merge occurred. #78 and #73 remain draft/open/unmerged.

[rdpollard]

Added checkout-only validation at 8babda5.

The fixed manual workflow has no inputs; it uses the same pinned checkout configuration as media preparation, independent disabled MINT_CHECKOUT_* flags and SHA/six-file-bundle approval, exact main workflow/source binding, attempt 1 only, protected mint-host-access, restricted runner group, shared non-cancelling concurrency and a 10-minute limit. No dispatch or activation setting was changed.

The standalone observer imports only standard-library modules and never loads repository/native helper code. It reads fixed bounded source/host/proc metadata, rejects unsafe/mismatched ownership, modes, default ACLs, identities, location, mask, release or hashes, and emits <=64 KiB sanitized evidence. Offending path metadata is retained when available. It contains no permission mutation, child process, network/media client, KVM/ioctl, package, guest or workspace-creation operation. All outcomes distinguish permission diagnostics from authentication (NotRun), cleanup (NotValidated), guest execution (false) and production readiness (false). Existing preparation source guard and native/activation/application workflow definitions are unchanged.

Local QA: 118 mocked/static tests, focused actionlint and whitespace checks passed. Tests include disabled/wrong/automatic context, reruns, mask/release/hash mismatch, source modes/symlinks/default ACLs, short/changed reads, close uncertainty, deadline and evidence bounds, CLI rejection and tamper sensitivity. Static tests check identical checkout, only observer command and no repository imports/native execution ports. Native filesystem/account/cancellation/inheritance/log/closeout behavior remains unvalidated.

Exact-head automatic CI:

• policy: success, run 39129770688.
• scope: success; application checks/native/update-trust/release skipped, run 39129770678.
• workflow-checks: success; Windows/Mint fixtures skipped, run 39129770632.

Full eleven-file PR remains within exact infrastructure scope; mixed app/key/unknown controls retain normal CI. #78 and #73 remain draft/open/unmerged. No spare-host changes, runner operations, dispatch, media downloads, guests, application builds/packages/releases or merge occurred. Any future diagnostic requires a new final main SHA, independent checkout bundle/launcher approval, sole selected-workflow restriction, protected deployment approval and fresh one-job runner authorization. The old failed checkout and failure remain preserved.

[rdpollard]

Reviewed the checkout-only observer, approval gates, resource limits and stop paths. Published acedfd3.

Corrections:

• Unchecked/default-ACL-query-failed locations report null rather than falsely reporting absence. Directory owner/mode/identity evidence is retained before ACL queries; unsafe directory types/owners/modes stop before those queries.
• Proc Umask parsing rejects a malformed value on a separate line.
• Added mocked coverage for ACL-query failure evidence, unchecked ACLs, ancestry changes, inventory limits and mid-read deadline closure without retry.

QA: 121 mocked/static checks passed; focused actionlint and git diff --check passed. Full PR diff remains exact infrastructure-only scope; mixed app/key controls require application CI. Automatic CI on acedfd3: policy, scope and workflow-checks passed. Windows/Mint native fixtures and application checks/native/update-trust/release jobs were skipped.

Reviewed controls remain unchanged: manual-only canonical main workflow; matching approved source/workflow SHA and independently approved six-file digest; first attempt only; separate disabled activation; mint-host-access approval; restricted runner-group selection. Labels do not authorize execution. Settings/group membership still need independent verification before a separately authorized run. No activation or settings were changed here.

Bounds remain six source files <=128 KiB each, root-owned host metadata <=8 KiB, proc status <=16 KiB, <=32 directory records, <=64 KiB JSON export, checked 30-second stage budget and independent 10-minute workflow timeout. Blocking OS calls are not claimed hard-real-time. Errors stop without permission repair, retry, fallback or native work; missing/cancelled export is not Pass.

The stopped media run remains a failure. Mocked diagnostic results establish neither native permission inheritance nor authentication safety, cleanup correctness or deregistration. No runner, dispatch, downloads, guests, application builds, packages or releases were executed. #78 and #73 remain draft and unmerged; activation and execution remain deferred.

[rdpollard]

Merged through the normal GitHub merge path (no administrator bypass), with an exact-head guard on reviewed acedfd3. GitHub accepted the squash merge as 881efd0.

Pre-merge scope, policy and workflow-checks passed; native fixtures and application/native/release jobs were skipped. Post-merge main checks:

• Build Skyview Dev Setup run 39130313736: scope passed; checks, native, update-trust and release all skipped.
• Mint preparation policy/mocked checks run 39130313782: policy passed.

PR #73 remains open and draft. No workflow was manually dispatched, no runner was registered/started, and no activation setting was changed. Environment readback still shows prevent_self_review=true and administrator bypass=false. Repository variable readback is unavailable to this integration (HTTP 403), so this is not a fresh independent attestation of stored activation values; the previously disabled settings were left untouched. No downloads, guest tests, packages, application builds or releases were performed.

Next step is preparation only: bind a new checkout-only authorization packet to the final main SHA and independently calculated observer bundle/launcher hashes, then verify runner-group and approval controls before requesting any execution authorization. Previous media-run authorization remains consumed and cannot be reused.