Repository navigation
feat(launcher): mechanical engagement creation with the enforced machine RoE - #1058
Merged
Merged
Conversation
added 3 commits
October 22, 2026 14:21
…ine RoE The Go launcher generates the same machine-enforceable plan/roe.json the MCP bridge and CLI scan produce: multiple targets (URLs, hostnames, CIDRs, globs) plus an optional out-of-scope denylist, normalized by the core builder's contract pinned through shared golden test vectors. The .red-approved marker and the Red-approval ceremony (/mode red approve, the web plan-approval POST, provision_roe --approve-red) are retired — creating an engagement with a declared scope is the authorization, the middleware enforces it, and readiness on the picker, TUI Red gate and web dashboard is an enforced machine scope. Legacy dual-form RoE documents stay readable.
The creation flow now compiles the targets through the shared normalization contract and shows the generated scope — in-scope entries, the denylist, and dropped patterns — for an explicit Create confirmation before any workspace is written; createDirectEngagement takes the reviewed scopeLists instead of re-normalizing. The engagement picker carries each engagement's scope summary (in-scope/denied counts and first target) in its description and a counted title, replacing the generic ready/in-progress copy.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
added 5 commits
October 22, 2026 15:11
CodeQL flagged a js/file-system-race in assertRedApproved: the scope was lstat-checked and then read through a fresh path lookup, so a swap between the two could redirect the parsed content. Open the file once, verify the opened inode against the path (symlink refusal compares the path identity to the handle), and parse the same handle's bytes.
Post-unification (#1057) enforcement is unconditional and the runtime ignores the mode key, so the generated roe.json no longer writes "mode":"enforce" and the picker's readiness gate keys on the presence of a machine block with in-scope entries — matching the runtime for legacy documents too (a legacy audit-mode block is read as ready, since that is what the runtime does with it).
…hanical # Conflicts: # CHAGELOG.md # clients/launcher/internal/engagement/picker.go
2 of 3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Go launcher joins the RoE unification (
docs/design/2026-10-22-roe-unification.md— see the companion PR for phase 1): engagement creation generates the same machine-enforceableplan/roe.jsonthe MCP bridge and CLI scan produce, the creation flow reviews the generated scope before committing, and the.red-approvedapproval marker / Red-approval ceremony is retired everywhere. Creating an engagement with a declared scope is the authorization (the operator owns it); the control point is the always-enforced RoE middleware, not an approval ceremony.Changes
internal/engagement/scope_targets.go, new): the launcher compiles creation inputs through the core builder's normalization contract — multiple targets (URLs, hostnames, CIDRs,*.domainglobs), optional out-of-scope denylist, embedded-list split, userinfo/bracket/port stripping, lowercase + trailing dot, wildcard apex. Pinned to the Python builder by shared golden test vectors (packages/decepticon-core/tests/testdata/roe-target-vectors.json, consumed by both suites). IDNA diverges on purpose: Go rejects non-ASCII with an actionable punycode message, Python IDNA-encodes.promptNewEngagementshows the generated scope (in-scope entries, denylist, dropped patterns) via a huh Note + Confirm;createDirectEngagementtakes the reviewedscopeListsinstead of re-normalizing..red-approved; TUIprepareRedApproval//mode red approveremoved (assertRedApprovednow gates on an enforced machine block),/scope importno longer touches markers, the web plan-approval POST route is deleted and the terminal-server Red gate keys onscopeReady,provision_roe --approve-redremoved. Picker, TUI and web readiness all mean "an enforced machine scope exists".provision_roe --approve-redis gone; engagements whose documents carry nomachine_enforcementblock no longer enable Red. Recorded inCHAGELOG.md(Unreleased).Intent
docs/design/2026-10-22-roe-unification.md— companion launcher PR section (pulls parts of phases 2 and 4 forward per the maintainer's OSS responsibility-model decision).moderemoval or HITL scope expansion — phases 3 and 5 remain separate PRs.Blast radius
Diff budget
End-to-end verification
Ran on my machine (worktree
feat/launcher-roe-mechanical, Go 1.25.8, npm workspace):go build ./... && go vet ./... && go test ./...→ all packages pass, including 12 shared golden vector cases and the picker scope-summary tests.go build -o bin/decepticon . && ./bin/decepticon --help→ banner renders.npm install(install-scripts approved) →node-ptynative build succeeds; real PTY spawn smoke (pty.spawn('bash', …)) →PTY_OK.vitest run src/commands/→ 82 passed (12 files); web:tsc --noEmit -p .clean +node --import tsx --test "src/**/*.test.ts*"→ 62 passed (terminal-server tests transpile the source in a VM, so the gate change is covered without a live PTY).provision_roetests 9 passed (including rejection of the removed--approve-redflag); full fast lanepytest -n auto -q -m "not slow"→ 5933 passed, 43 skipped, 0 failed.Testing
go test ./...(launcher module) — all passvitest(clients/cli commands) — 82 passed; webnode --test— 62 passedpytest -n auto -q -m "not slow"— 5933 passedruffclean on changed Python;gofmtapplied; TUI/web typecheck cleanmake quality/make smoke— not run locally (CI covers)Quality Bar self-check
Related Issues
Companion to the RoE unification phase-1 PR (shared golden vectors reference). Retires the Red-approval marker pulled forward from phase 4.