Whole-codebase audit remediation, hardened to mission-critical grade for the live
transcript write path + guard daemon. Closes every P1 from the 2026-06-15 adversarial
audit, folds in three @ynaamane contributor PRs, and survived 16 rounds of
assume-the-fix-is-wrong adversarial re-gating plus an independent @ynaamane peer review
(all 12 findings fixed). Final gate: 0 catastrophic (P0/P1) issues reachable through
an automatic path; full test suite 1487 green.
🔒 Data integrity (silent-data-loss fixes)
- Equal-size in-place rewrite is re-hashed before prune-save (no silent clobber).
- Read-once snapshots close two TOCTOU windows (append-dup, mid-read merge).
- Unicode line separators (U+2028/U+2029/U+0085) no longer tear a JSON line.
- Non-UTF-8 bytes round-trip losslessly (surrogateescape + byte-exact serialization),
so a stray binary byte neither corrupts the transcript nor freezes the guard. - A reserved-key collision (
_raw/_parse_error) can no longer let transcript content
overwrite a real line. tool-result-ageonly collapses inside real diff hunks; doctor repairs append-merge.
🛡️ Daemon resilience
- The whole "untrusted field used as a set/dict key" crash class is closed (loader
wraps non-str DAG ids; a shared coercion guards every block-field site) — a poisoned
transcript can no longer crash the prune or respawn-storm the guard. - Per-strategy isolation; bounded escalation; malformed
usagecan't crash the daemon. - Reactive overflow recovery fails closed (defers, never SIGKILLs a live agent team
on a gate error). - Guard-loop watchdog hardened (K/M-suffix parsing, identity gate, error-storm
discriminator).
🪟 Windows
- PowerShell-native auto-resume (session-scoped); the
--protect-patternReDoS budget
fails closed on the no-SIGALRM path (a catastrophic pattern is refused, not run).
🧹 Security & correctness
- Untrusted team/digest text is sanitized before it reaches Claude's memory.
- Overflow recovery adds a token-axis post-prune preflight.
doctor --fixreports "fixed" only when a re-check confirms it.
📦 Merged contributor PRs (@ynaamane)
- #130
enforce_floorno longer forks the DAG on a compacted session - #129 sidechain turns excluded from learned corrections
- #128 guard-identity verification before a
--fixSIGTERM
Confidence ledger
- Full confidence (offline-verified + regression-tested) for everything except:
the Windows fixes are emulation-verified (no Windows CI), and the overflow-marker
widening is strictly broader but awaits a captured real overflowed-CC JSONL fixture. - Known non-blocking follow-up: the report-only guard-watchdog error-storm detector has
documented edge cases — tracked in #140 (rate-based redesign).