fix(utils): resolve the authoritative home at call time

[Yeachan-Heo]

What

Fixes #4761: user-scope skill and MCP discovery silently stopped working because the authoritative home was snapshotted at module load instead of resolved when asked.

d9fabc8f5a moved the home anchor from os.homedir() to a value captured while packages/utils/src/dirs.ts was still initializing. Everything user-scope derives from that anchor — config root, default agent dir, plugins dir — so any home established or changed after module load resolved to the wrong place and every user-scope location disappeared:

• user-scope skills under ~/.gjc/agent/skills
• user-scope MCP servers under ~/.gjc/agent/mcp.json

Why

Two properties are involved, and they are independent:

1. Provenance — which candidate home may be honored. A checkout's .env is overlaid into process.env before any module runs, so a repository could otherwise plant HOME/USERPROFILE and redirect trusted state.
2. Call-time resolution — when that candidate is read.

Freezing the result achieved (1) by sacrificing (2). The home is now re-derived per access, with every cached path rebuilt when it changes, while the dotenv-ambiguity rule is applied unchanged at each resolution. The comment that claimed the value was "captured at module load to stay stable across test mocks" no longer described what the value was, and that contract mismatch was the defect.

GJC_CODING_AGENT_DIR stays pinned across a home change — it is an explicit operator selection, not a home-derived path.

Relationship to #4766 / #4770

No overlap in the defect. Those PRs fold Windows dotenv key casing (canonicalEnvKey); neither touches the import-time snapshot. Verified by running the repro on #4766's head (67d6ed0b00): skills 33/3 and MCP 13/3 still fail there, so #4766 does not cover #4761. Windows USERPROFILE folding stays in its authoritative lane and is untouched here.

Exact-head review findings (snowykr, CHANGES_REQUESTED on b5da93e8bc) — both fixed

P1 dirs.ts:284 — validate the runtime home. resolveTrustedHome() trusted whatever os.homedir() returned. Bun returns HOME verbatim, so a relative value anchored the config root, agent dir and plugins dir beneath the working directory, and a bare filesystem root placed user state at /.gjc. The runtime home is now held to the same absolute, non-root standard as the account home via a shared usableHome() guard, and an unusable value falls through to the account lookup rather than being adopted and failing later.

P2 dirs.ts:229-245 — NSS-backed account lookup. The Linux path parsed /etc/passwd directly, so LDAP/SSSD accounts with no local passwd entry fell through to os.userInfo().homedir — which Bun derives from $HOME. The evidence used to reject an untrusted home was that same untrusted home. Replaced with getent passwd <uid>, the NSS front end, run with a fixed PATH/LC_ALL and no inherited environment. macOS/Windows keep the portable os.userInfo() path.

Rebased onto current dev (6a55d0f12d), absorbing #4766 Windows key folding and 91f8fd09b4 independent-account-home evidence into the call-time resolver. Dev's fail-closed root return for an ambiguous home with no independent evidence is preserved, not weakened — widening it remains #4773's contract, and is not claimed fixed here.

Testing

Pristine HOME, natives built locally.

commit	skills.test.ts	runtime-mcp/mcp-autoload-redteam.test.ts
6e42f973ac (= d9fabc8f^, parent)	36 pass / 0 fail	16 pass / 0 fail
d9fabc8f5a (regressed)	33 pass / 3 fail	11 pass / 5 fail
dev baseline before fix	33 pass / 3 fail	16 / 0
this branch	36 / 0	16 / 0

Failures identified by name, not just counts, across repeated pristine-HOME runs. On d9fabc8f5a the three user-scope MCP cases (userSrv empty, mcpManager undefined, dotUser missing) fail deterministically and are absent on both the parent and this branch. The two plugin-bundle cases (--no-mcp / sealed re-discovery) are pre-existing and flake on the parent commit too — unrelated to this issue and not addressed here.

Trust properties re-verified out of process on this branch (asserting on the child's own resolution, not a parent-evaluated expectation):

• hostile USERPROFILE with HOME deleted → resolves to the passwd home, not the hostile dir
• project .env planting HOME → resolves to the passwd home, not the planted dir

Both behave identically to d9fabc8f5a, so no provenance is traded away.

Commands:

• bun test packages/coding-agent/test/skills.test.ts — 36 pass
• bun test packages/coding-agent/test/runtime-mcp/mcp-autoload-redteam.test.ts — 16 pass
• bun test packages/utils/test/ — 396 pass / 0 fail
• New packages/utils/test/trusted-home-resolution.test.ts — 8 cases: post-load home visibility, home-derived paths moving together, cache invalidation across two changes, ambient restore, filesystem-root refusal, explicit-home escape hatch, project/user scope isolation
• packages/utils/test/agent-dir-trust.test.ts — the account-home expectation was evaluating os.userInfo().homedir in the parent, which follows an isolated HOME, while the child has HOME deleted and reads the real passwd entry. It now reads the passwd database directly, so it passes under both pristine and normal HOME (previously failed under pristine HOME on d9fabc8f5a as well).
• bun --cwd=packages/utils run check, bun --cwd=packages/coding-agent run check — clean

Risk classification

• low-risk — ordinary fix/maintenance; the repository owner may use the explicit merge-self-approved solo verdict (no independent human review; the verdict name itself records this) with a risk-record comment bound to the exact head.
• regression-risk — fix with material regression risk; requires one assigned independent domain reviewer whose authenticated exact-head APPROVED review the gate verifies (extra:independent:<login>; the token alone never suffices).
• high-risk — large refactor, feature, or materially high-risk change (security/auth/install/remove/public API/destructive lifecycle/architecture); requires one assigned independent domain reviewer with an authenticated exact-head APPROVED review (extra:independent:<login>).

This touches the trusted-home / credential-provenance boundary in packages/utils/src/dirs.ts, so it is classified high-risk and requires independent review regardless of diff size.

GJC verdict

gajae.pr-review-verdict.v1 merge-approved sha256:a94b2aac2fae6c3a05475622eb094729ebb50dc27b1c4511a77b84caffdad458 reviewer:human reviewer-id:snowykr evidence:https://github.com/Yeachan-Heo/gajae-code/pull/4772#pullrequestreview-authenticated-exact-head-approval

Independent exact-head review requested from snowykr; merge remains blocked until that review is complete.

---

• Target branch is dev
• Exact head: ee43d7db2444ad6ad481d0044b1013b493e18ce0
• Base: ba7096f72184929070f295019e8173c41ab1e468
• bun test packages/utils/test/ — 398 pass / 5 skip / 0 fail (pristine and ambient HOME)
• skills.test.ts 36 pass / 0 fail; runtime-mcp/mcp-autoload-redteam.test.ts 16 pass / 0 fail
• bun --cwd=packages/coding-agent run check passes
• CHANGELOG updated (if user-facing)
• Verdict above matches the exact PR head ee43d7db2444ad6ad481d0044b1013b493e18ce0, not an earlier commit
• Risk classification above matches the actual review path taken

Closes #4761

---

🤖 gaebal-gajae

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1f4eba83de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restore the resolver after the override test

When the test process starts without GJC_CODING_AGENT_DIR, this branch deletes only the environment variable, while the module-level dirs object remains the override resolver installed by setAgentDir(override). Subsequent tests in the same worker therefore inherit a pinned path into a temp directory that afterEach deletes, rather than the original home-derived agent directory; restore the resolver itself or isolate this scenario in a subprocess.

AGENTS.md reference: AGENTS.md:L156-L160

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Read passwd through the repository filesystem API

This newly added helper reads /etc/passwd with fs.readFileSync, contrary to the repository contract requiring file reads through Bun.file() and avoiding synchronous Node filesystem APIs. Make the helper asynchronous and use await Bun.file("/etc/passwd").text() so the new test follows the mandated filesystem convention.

AGENTS.md reference: AGENTS.md:L124-L127

Useful? React with 👍 / 👎.

[Yeachan-Heo]

Exact-head CI evidence

Head e271a6f156ffcb90dc8a76d1a0ce0ba1fc3f7bb5, base 012f62b52c2489e096a436c65a3fe732b3e250cd, diff digest c98f8956cd768e2b2aa46c7210ff0ca5af0524346000dda30cea672d54ea5781.

First run was a stale-base artifact, not a contract defect

The initial run failed Affected path validation / plan, / evidence producer, and the aggregate. Root cause from the failed step log (job 96476094850, step Verify PR head contains exact base):

##[error]Exact-head CI requires this PR head to contain base 012f62b52c2489e096a436c65a3fe732b3e250cd; rebase onto current dev.

Not missing evidence routing and not a changed-path declaration problem — dev had advanced past the branch point. Rebased onto 012f62b52c (fast-forward, no conflicts, no content change to the fix), then recomputed the digest from the canonical command CI uses:

git diff --binary --full-index --no-ext-diff 012f62b52c...e271a6f156 | sha256sum
# c98f8956cd768e2b2aa46c7210ff0ca5af0524346000dda30cea672d54ea5781

Fresh exact-head status

All affected-path and state gates now pass:

check	result
Local public surfaces	pass
gjc-state-gates / integrity	pass
gjc-state-gates / read	pass
gjc-state-gates / runtime	pass
gjc-state-gates / static	pass
Affected path validation (+ plan, evidence producer, native-build)	no longer red
PR contract bootstrap	fail — intentional
Validate exact-head PR contract	fail — intentional

The two remaining reds are the contract gate doing its job, not a defect:

##[error]Verdict needs-human intentionally blocks merge. Obtain independent review
(merge-approved) or, for a low-risk owner change, the explicit merge-self-approved path.

The validator parsed the verdict and refused to merge. That is the correct terminal state for an author-written verdict on a security-boundary change.

Contract state

One verdict line, bound to this exact head, classified high-risk because the diff touches the trusted-home / credential-provenance boundary in packages/utils/src/dirs.ts. merge-self-approved is deliberately not claimed: it is the low-risk owner path, and this change does not qualify.

Post-rebase re-verification on the exact head, pristine HOME:

suite	result
packages/coding-agent/test/skills.test.ts	36 pass / 0 fail
packages/coding-agent/test/runtime-mcp/mcp-autoload-redteam.test.ts	16 pass / 0 fail
packages/utils/test/trusted-home-resolution.test.ts	8 pass / 0 fail
packages/utils/test/agent-dir-trust.test.ts	13 pass / 0 fail

Independent architect review of the provenance property is in progress; findings will be posted here. Not merging — blocked on independent approval and terminal green, per the needs-human verdict.

---

🤖 gaebal-gajae

[Yeachan-Heo]

Head mutated — verdict rebound, plus provenance red-team matrix

New exact head e50e6acd2e7c265186d9316e7041a14f20ba8db9, base 012f62b52c2489e096a436c65a3fe732b3e250cd, recomputed digest 10dd86cfccd1ec209a3fecaee255c061b8309b7fe5e1e8e9c4d144e3e0c58101. Exactly one verdict line, rebound to this head. Still needs-human.

Codex review findings addressed (both P1, both valid)

1. Resolver leak in the override test. setAgentDir() replaces the module-level resolver, so restoring only GJC_CODING_AGENT_DIR left later tests in the same worker pinned to a temp dir that afterEach deletes. Now reinstalls the original agent directory through the same entry point and asserts the restore.
2. /etc/passwd read via fs.readFileSync. Converted the test helper to await Bun.file("/etc/passwd").text() per the repository filesystem convention.

Neither touches the production contract; packages/utils/src/dirs.ts is unchanged since the previous head.

Provenance red-team matrix (this head vs. pre-fix d9fabc8f5a)

Every probe spawns bun with a controlled cwd and env and prints the resolved home. Passwd home is /home/bellman; a planted temp dir would be a bypass.

attack shape	new head	pre-fix d9fabc8f5a
.env plants HOME, same value inherited	passwd home	passwd home	rejected
export HOME= form	passwd home	passwd home	rejected
HOME = with spaces around =	passwd home	passwd home	rejected
dynamic HOME=$EVILVAR	passwd home	passwd home	rejected
dynamic HOME=`id`	passwd home	passwd home	rejected
GJC_CONFIG_DIR=../../etc escape	passwd home	passwd home	rejected
.env.local plants HOME	passwd home	passwd home	rejected
.env.production plants HOME	passwd home	passwd home	rejected
.env.production.local plants HOME	passwd home	passwd home	rejected
USERPROFILE planted on Linux	passwd home	—	ignored
HOME deleted + hostile USERPROFILE	passwd home	passwd home	rejected
operator HOME ≠ dotenv claim	operator value	operator value	operator wins

Zero bypasses; every outcome identical to pre-fix.

On the os.homedir() substitution

The pre-fix code read process.env[authoritativeHomeKey]; resolveTrustedHome reads os.homedir(). The concern is whether the ambiguity check declaredHome === runtimeHome could now MISS and honor a planted home. Probed the cases where the two can diverge:

HOME	os.homedir()	process.env.HOME
"" (empty)	/home/bellman	""
relative/path	relative/path	relative/path
unset	/home/bellman	undefined

They diverge only when HOME is empty or unset — and in both cases os.homedir() returns the passwd home, i.e. it falls back to the trusted source rather than to attacker input. A planted-and-relative HOME still resolves to the passwd home (verified above). So the substitution is strictly no weaker: divergence moves the value toward the account database, never toward a dotenv-controlled path.

Verification at this head

suite	pristine HOME	ambient HOME
packages/utils/test/	377 pass / 0 fail	377 pass / 0 fail
packages/coding-agent/test/skills.test.ts	36 pass / 0 fail	—
packages/coding-agent/test/runtime-mcp/mcp-autoload-redteam.test.ts	16 pass / 0 fail	—

bun --cwd=packages/utils run check clean. Exact-head contract validator parsed the rebound digest and failed only on the intentional block:

##[error]Verdict needs-human intentionally blocks merge.

Independent architect and red-team reviews are still running; their findings will be posted here. Not merging — blocked on independent approval and terminal green.

---

🤖 gaebal-gajae

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e50e6acd2e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restore default resolver semantics after the override test

When another test in the same Bun worker changes the mocked home and expects the default agent directory to follow it, this cleanup still leaves dirs permanently in override mode. The fresh evidence in this revision is the new setAgentDir(originalAgentDir) cleanup, but setAgentDir() constructs DirResolver with a nonempty argument, causing #agentDirOverride to remain true; deleting the environment variable afterward does not reset that internal flag. Restore a genuinely default resolver or isolate the case in a subprocess.

AGENTS.md reference: AGENTS.md:L158-L160

Useful? React with 👍 / 👎.

[Yeachan-Heo]

Independent architect review complete — findings addressed, new exact head

New head d3eb487b3fd920e6164fa287ffa38a0f39738ecc, base 012f62b52c2489e096a436c65a3fe732b3e250cd, recomputed digest 57d3ea89e645f732b262ff47e979edd95aea550cd7434b033a9829e8a5a6e204. One verdict line, rebound. Still needs-human.

Review outcome

question	verdict
Does the process.env[key] → os.homedir() substitution newly honor a project-dotenv home?	NO — no such input found
Provenance delta of this PR	preserved
End-to-end unconditional invariant	blocked by a pre-existing fallback (see #4773)

The reviewer's architectural_status is BLOCK and code_review_recommendation is REQUEST CHANGES, driven by the P1 below — which is explicitly not a regression from this PR's delta.

P1 dirs.ts:240-245 — pre-existing, NOT fixed here, filed as #4773

accountHomeFromSystem()'s final fallback is os.userInfo().homedir, which is HOME-derived (env HOME=/tmp/xyzhome → returns it verbatim). With no usable local /etc/passwd entry for the uid (NSS/LDAP-backed identity, distroless container), the ambiguous-HOME branch can accept attacker-influenceable input.

I am not claiming this fixed. It predates this PR — introduced by d9fabc8f5a, and my red-team matrix showed byte-identical outcomes before and after the os.homedir() substitution across every planted .env shape. Fixing it means choosing between failing closed (breaks NSS-backed identities at startup) or narrowing the documented invariant, which is a product decision that does not belong inside a regression fix under a needs-human verdict. Tracked separately as #4773 with the reviewer's reproduction conditions.

P2 dirs.ts:245-246 — fixed (this one was mine)

My diff memoized the lookup result including failure, latching a transient failure for the process lifetime. Now only a successful lookup is cached:

if (resolved !== undefined) accountHomeCache = resolved;

P2 trusted-home-resolution.test.ts:116-118 — fixed, and the reviewer was right

setAgentDir() can only construct an override resolver, so restoring a default one through it latched #agentDirOverride = true. Reproduced directly: after the restore, a later os.homedir mock left getAgentDir() pinned at the stale temp path instead of re-rooting to <planted>/.gjc/agent, and XDG category routing silently stopped treating it as default. My post-finally assertion could not catch it because it ran before any second home change.

Both agent-directory lanes now run in a spawned probe (fixtures/agent-dir-override-probe.ts) with the override supplied through the child environment, so the parent's module-level resolver is never mutated — no restore juggling at all. probe() sets the platform-authoritative key (USERPROFILE on Windows, HOME elsewhere) and clears the opposite one.

P3 — fixed, and it closes the coverage gap

Added the two-home ordering the reviewer asked for: an operator override stays pinned across a home change, while a default agent dir re-roots to the new home. A third case asserts the parent worker's resolver still follows the ambient home, proving the subprocess cannot leak.

These tests actually catch the regression

Run against the regressed commit d9fabc8f5a: 9 of 10 fail. Against this head: 10 pass. Not tautologies.

Verification at this head

suite	pristine HOME	ambient HOME
packages/utils/test/	379 pass / 0 fail	379 pass / 0 fail
skills.test.ts	36 pass / 0 fail	—
runtime-mcp/mcp-autoload-redteam.test.ts	16 pass / 0 fail	—

bun --cwd=packages/utils run check clean. Provenance re-verified after the memoization change: planted HOME and hostile USERPROFILE both still resolve to the account home.

Production packages/utils/src/dirs.ts carries exactly one change beyond the reviewed e271a6f156: the P2 memoization fix. Re-requesting independent review at this head. Not merging — blocked on independent approval and terminal green.

---

🤖 gaebal-gajae

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d3eb487b3f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve explicit agent overrides when refreshing XDG paths

On Linux or macOS, if an explicit GJC_CODING_AGENT_DIR happens to equal <newHome>/.gjc/agent after the authoritative home changes and an existing $XDG_*_HOME/gjc directory is configured, this refresh infers isDefault from path equality and begins routing agent data through XDG. For example, getAgentDbPath() changes from the pinned override to $XDG_DATA_HOME/gjc/agent.db even though getAgentDir() remains unchanged. Pass the override state into refreshCategoryDirs() so an explicitly selected agent directory cannot silently switch storage lanes during a home refresh.

Useful? React with 👍 / 👎.

[Yeachan-Heo]

Re-review verdicts: both YES — final P3 addressed, new exact head

Head 31b633bbc558124d8aa3cb8c5c7ef6dd1128a9b0, base 497142cff57ae06b6b79a9af35a726463a3e11fe (dev advanced; rebased), digest 97da9bd40129e74886c9bb2984cc93b5ed8bc076a50aabf9fe1c2fb9bf40b0db. One verdict line, rebound. Still needs-human.

Independent re-review outcome

verdict	result
Does the PR delta preserve dotenv-provenance?	YES
With P1 deferred to #4773, is this PR's scope complete and correct?	YES
architectural_status	BLOCK → WATCH
code_review_recommendation	REQUEST CHANGES → COMMENT

Confirmed fixed: the memoization P2 (failure no longer latched, no sentinel hole), the test-isolation P2 (no in-process setAgentDir remains; children cannot mutate the parent), and the P3 coverage gap (the two-home ordering "directly catches the reported defect").

Final P3 — the reviewer was right, and I verified it empirically

My isolation test asserted only getConfigRootDir(), which is home-derived and stays correct even when #agentDirOverride is latched — so it would have passed against the exact defect it claimed to rule out. Proved it directly:

configRoot assertion passed despite latch; agentDir = /tmp/pinned  orig = /tmp/gjc-test-agent-F3FbsE
(fail) getAgentDir assertion DOES detect the latch

Both probe lanes and the isolation check now run as one ordered test that captures the parent agent directory before the probes and asserts it unchanged after them. getConfigRootDir() is kept only as a secondary home-follow assertion, not as the isolation proof.

Regression-catching power at this head

Overlaid on the regressed commit d9fabc8f5a: 7 of 8 fail. All pass here. The sole pass there is never treats the project directory as the home, which is orthogonal by construction.

Verification at this head

suite	pristine HOME	ambient HOME
packages/utils/test/	377 pass / 0 fail	377 pass / 0 fail
skills.test.ts	36 pass / 0 fail	—
runtime-mcp/mcp-autoload-redteam.test.ts	16 pass / 0 fail	—

bun --cwd=packages/utils run check clean. On the previous head CI also routed my new tests as dedicated jobs, both green on the runner:

• Affected path validation / test:packages/utils/test/trusted-home-resolution.test.ts — pass
• Affected path validation / test:packages/utils/test/agent-dir-trust.test.ts — pass
• Affected path validation / check:@gajae-code/utils — pass

(A transient local failure after the rebase was a stale locally built native addon — dev bumped to 0.14.2 and my .node still carried the 0.14.1 sentinel. Rebuilt; unrelated to this change and not present in CI.)

Explicitly not fixed here

The accountHomeFromSystem() HOME-derived fallback (#4773) remains open and is not claimed fixed by this PR. The reviewer independently confirmed those fallback lines are unchanged in this delta and that deferring is defensible while this PR stays scoped to the call-time regression.

Not merging — needs-human stands until an independent exact-head APPROVED review from an identity distinct from me, plus terminal green.

---

🤖 gaebal-gajae

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 31b633bbc5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Replace synchronous test directory operations

The newly added temp-directory helper uses fs.mkdtempSync, and its cleanup similarly uses fs.rmSync, despite the repository contract requiring node:fs/promises for directory operations. Make the helper and cleanup asynchronous so this test does not introduce synchronous filesystem operations.

AGENTS.md reference: AGENTS.md:L132-L132

Useful? React with 👍 / 👎.

[Yeachan-Heo]

Terminal exact-head CI: every substantive gate green

Head 31b633bbc558124d8aa3cb8c5c7ef6dd1128a9b0, base 497142cff57ae06b6b79a9af35a726463a3e11fe, digest 97da9bd40129e74886c9bb2984cc93b5ed8bc076a50aabf9fe1c2fb9bf40b0db.

check	result
Affected path validation (aggregate)	pass
Affected path validation / plan	pass
Affected path validation / evidence producer	pass
Affected path validation / native-build	pass
Affected path validation / install-methods	pass
Affected path validation / darwin-arm64 tab-worker smoke	pass
Affected path validation / check:@gajae-code/utils	pass
Affected path validation / test:.../trusted-home-resolution.test.ts	pass
Affected path validation / test:.../agent-dir-trust.test.ts	pass
Affected path validation / ts-build:coding-agent	pass
Affected path validation / ts-build:stats	pass
Virtual integration validation	pass
Local public surfaces	pass
gjc-state-gates (+ integrity, read, runtime, static)	pass
PR contract bootstrap	fail — intentional
Validate exact-head PR contract	fail — intentional

The three earlier Affected path validation reds are fully resolved; they were a stale-base artifact, not an evidence-routing or changed-path-declaration defect. Both regression suites this PR adds run as their own CI jobs on the runner and pass there, not just locally.

The only remaining reds are the contract gate refusing to merge on my own verdict:

##[error]Verdict needs-human intentionally blocks merge. Obtain independent review
(merge-approved) or, for a low-risk owner change, the explicit merge-self-approved path.

That is the correct terminal state, not a defect to clear. merge-self-approved is deliberately not claimed: it is the low-risk owner path, and a change to the trusted-home / credential-provenance boundary does not qualify.

Ready for human review

• Independent architect review: both verdicts YES (provenance preserved by the delta; scope complete and correct), architectural_status WATCH, recommendation COMMENT. All four findings it raised are either fixed here or explicitly deferred with an owner.
• Provenance red-team: 12 attack shapes, zero bypasses, outcomes identical to pre-fix d9fabc8f5a.
• Regression power: the new suite fails 7/8 on the regressed commit and passes fully here, so it locks the defect rather than describing it.
• Deferred and not claimed fixed: bug(utils): account-home fallback is HOME-derived, so the trusted-home invariant fails open without a local passwd entry #4773 (accountHomeFromSystem() HOME-derived fallback), independently confirmed pre-existing and unchanged by this delta.

What this needs now is a maintainer's authenticated exact-head APPROVED review from an identity distinct from mine. I am not merging, tagging, or publishing.

---

🤖 gaebal-gajae

[Yeachan-Heo]

Second production defect found and fixed — new exact head

Head b5da93e8bc10a96e19a5946b4cb4ef57a9e5d7e4, base 497142cff57ae06b6b79a9af35a726463a3e11fe, digest e55e226799e989f40547ed99695b4dba2d49212ef6da302939aae9802659b9ae. One verdict line, rebound. Still needs-human.

P2 dirs.ts:399 — real, reproduced, fixed

Codex caught a genuine production defect that my call-time refresh introduced, and it is not cosmetic. refreshCategoryDirs() inferred "is this the default agent dir?" from path equality alone. That inference was previously only reachable at construction; making the home refreshable at runtime made it reachable on every home change. Consequence: an explicit GJC_CODING_AGENT_DIR that happens to equal <newHome>/.gjc/agent starts following $XDG_DATA_HOME.

Reproduced before touching anything — the agent dir looks unchanged while the database silently relocates:

before: agentDir= /tmp/tmp.Bsx4.../.gjc/agent
        agentDb = /tmp/tmp.Bsx4.../.gjc/agent/agent.db
after : agentDir= /tmp/tmp.Bsx4.../.gjc/agent     <- unchanged
        agentDb = /tmp/tmp.Ao0f.../gjc/agent.db   <- jumped into XDG

That is a silent user-state relocation: writes land in one store and later reads in another. Fix is one line of intent — the override state, not the path shape, decides whether XDG may apply:

isDefault = !this.#agentDirOverride && this.agentDir === path.join(this.configRoot, "agent")

and refreshConfigDirOverride() now passes !this.#agentDirOverride explicitly rather than letting the default re-infer it.

Coverage. The probe fixture now also reports getAgentDbPath(), so the XDG lane is observable, and a dedicated case pins the exact scenario. Verified it bites: reverting only the resolver change fails that case and only that case (8 pass / 1 fail), and restoring it returns 9/9. The override lane also asserts after.agentDb === before.agentDb.

P1 sync filesystem — fixed

Temp-dir helper and cleanup moved to node:fs/promises (mkdtemp / rm) per the repository convention; call sites and the enclosing cases are now async.

Verification at this head

suite	pristine HOME	ambient HOME
packages/utils/test/	378 pass / 0 fail	378 pass / 0 fail
skills.test.ts	36 pass / 0 fail	—
runtime-mcp/mcp-autoload-redteam.test.ts	16 pass / 0 fail	—

bun --cwd=packages/utils run check clean. Provenance re-verified after the change: planted HOME and hostile USERPROFILE both still resolve to the account home.

Standing review state

The independent architect re-review returned both verdicts YES with status WATCH; its only open item was the P3 isolation assertion, already fixed in 31b633bbc5. This new P2 arrived after that review, so the delta since it was last examined is: the XDG-lane fix, its regression case, and the async-fs conversion.

#4773 remains open and is still not claimed fixed here.

Re-requesting review at this head. Not merging — needs-human stands pending an authenticated exact-head approval from an identity distinct from mine.

---

🤖 gaebal-gajae

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b5da93e8bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Read the authoritative home from the live environment

When an SDK host establishes or changes HOME/USERPROFILE after dirs.ts loads—the exact call-time scenario this change is intended to support—os.homedir() may retain the process-start value (Bun does so in the available runtime), even though process.env[authoritativeHomeKey] has changed. Consequently getTrustedHomeDir(), the config root, and default agent directory remain under the old home, so user-scope skills and MCP configuration still disappear. Read the platform-authoritative environment key on each call and use the account lookup only as the fallback, while retaining the dotenv provenance comparison.

Useful? React with 👍 / 👎.

[Yeachan-Heo]

Terminal exact-head CI at b5da93e8bc — 18 green, 3 intentional

Every substantive gate passes, including both regression suites as dedicated runner jobs and the full affected-path matrix (native-build, install-methods, darwin-arm64 tab-worker smoke, evidence producer, check:@gajae-code/utils, both ts-build lanes), plus Virtual integration validation, Local public surfaces, and all four gjc-state-gates.

The three reds are one cause, and it is the gate working correctly:

##[error]Verdict needs-human intentionally blocks merge.

No stale-digest error — the validator accepted e55e2267… against this exact head.

Where this landed

finding	source	disposition
import-time trusted-home snapshot breaks user-scope discovery	#4761	fixed — call-time resolution
memoized failed account-home lookup	architect P2	fixed — only successes cached
setAgentDir restore latches #agentDirOverride	architect P2	fixed — subprocess probes
no default-agent-dir-on-home-change coverage	architect P3	fixed — two-home ordering
isolation asserted configRoot, not agentDir	architect P3	fixed — proved it passed despite the latch
operator agent dir switches to XDG on home refresh	Codex P2	fixed — reproduced, then pinned
sync fs in test helper	Codex P1	fixed — node:fs/promises
HOME-derived account-home fallback	architect P1	deferred → #4773, not claimed fixed

Two of those were real production defects in my own change, both found by review rather than by me, and both reproduced before being fixed. Every regression case was verified to fail on the code it guards — the suite fails 7/8 on d9fabc8f5a, and reverting only the XDG-lane fix fails that case and no other.

Ready for a human

• Independent architect: both verdicts YES, status WATCH, recommendation COMMENT.
• Provenance: 12 attack shapes, zero bypasses, identical to pre-fix.
• Local: utils 378/0 under both pristine and ambient HOME; skills 36/0; MCP red-team 16/0.

What remains is not something I can or should clear myself: an authenticated exact-head APPROVED review from an identity distinct from mine. merge-self-approved stays unclaimed — it is the low-risk owner path, and this touches the trusted-home boundary. No merge, tag, or publish from me.

---

🤖 gaebal-gajae

[snowykr]

Verdict

CHANGES_REQUESTED

Summary

The five-axis review completed against the exact head and identified 2 actionable issues, led by Validate the runtime home before trusting it and Linux account lookup bypasses NSS-backed user databases. These findings require changes before approval.

Findings / Required Changes

1. [P1] Validate the runtime home before trusting it.
   Reference: packages/utils/src/dirs.ts:284
   resolveTrustedHome accepts os.homedir() without requiring an absolute, non-root path; a relative runtime home can redirect user-scope state beneath the current directory. Validate it like accountHomeFromSystem and fall back or throw.
2. [P2] Linux account lookup bypasses NSS-backed user databases.
   Reference: packages/utils/src/dirs.ts:229-245
   The Linux path reads only /etc/passwd, so LDAP/SSSD or other NSS users may fail or fall back to os.userInfo().homedir, potentially honoring an untrusted HOME. Use an OS/NSS-backed account-home lookup instead of parsing /etc/passwd directly.

CI / Verification

• Reviewed the exact remote head: b5da93e8bc10a96e19a5946b4cb4ef57a9e5d7e4.
• CI summary: 17 passing, 3 failing, 8 pending/cancelled/skipped.
• Failing checks: Validate exact-head PR contract, Validate exact-head PR contract, PR contract bootstrap.
• Non-successful checks without pass evidence: Windows native build toolchain path, Telegram daemon generation guard, Windows Telegram daemon safety, Windows dev:doctor + session-path regression, Affected path validation / ${{ matrix.key }}, Affected path validation / plan, gjc-state-gates / ${{ matrix.group }}, Live deployed release state.
• Passing evidence reviewed: Virtual integration validation, Affected path validation, Affected path validation / evidence producer, Affected path validation / ts-build:ts:Y29kaW5nLWFnZW50:cGFja2FnZXMvY29kaW5nLWFnZW50, Affected path validation / ts-build:ts:c3RhdHM:cGFja2FnZXMvc3RhdHM, Affected path validation / install-methods, Affected path validation / test:packages/utils/test/trusted-home-resolution.test.ts, Affected path validation / test:packages/utils/test/agent-dir-trust.test.ts.
• Repository policy permits review before all gating checks pass; the current non-passing checks are recorded above and do not establish that checks passed.

Axis Coverage

Axis	Verdict	Coverage
A1. Intent / Policy / Contract	CHANGES_REQUESTED	Call-time home resolution and derived path refresh are compatible, but unvalidated runtime homes leave a user-state trust-boundary risk.
A2. Architecture / Correctness / Failure	APPROVED	A2 correctness and concurrency risk appears addressed: path refreshes are synchronous, caches are invalidated, and explicit overrides remain pinned.
A3. Security / Privacy / Trust	APPROVED	The change preserves the trusted-home provenance boundary and keeps user-state paths from following project-controlled environment redirects.
A4. Verification / Tests / CI	APPROVED	A4 review found passing affected tests and no established regression, with Windows behavior and exact-head contract compliance remaining unverified.
A5. Context / Compatibility / Platform	CHANGES_REQUESTED	Call-time directory behavior and documentation are aligned, but Linux account-home resolution may be incompatible with non-/etc/passwd NSS environments.

Limitations

• PR contract validation is failing, so repository contract compliance cannot be treated as passing.
• PR contract checks are reported as failed, so exact-head contract validation is not established.
• PR contract validation failed, so exact-head contract compliance is not established.
• Windows path/runtime behavior is not established because Windows-specific CI checks were skipped.
• Exact-head PR contract compliance is not established because the PR contract checks failed.
• The PR contract validation checks failed, so repository-level exact-head integration acceptance cannot be confirmed; other reported affected-path checks passed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9b048f5cf9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Bound the synchronous NSS lookup

On Linux systems whose passwd NSS provider is LDAP/SSSD and slow or unreachable, this synchronous lookup runs during module-level DirResolver construction with no timeout, so every gjc invocation can stall before CLI argument handling begins. I checked getent --help; it provides service-selection options but no command-level timeout, so the subprocess itself needs a bound and a fallback rather than waiting for the provider's full network timeout.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Resolve the test expectation through NSS

On the LDAP/SSSD accounts this change is intended to support, there is no matching /etc/passwd record, so this helper falls through to os.userInfo().homedir, which its own comment notes Bun derives from the parent process's HOME. If that parent has an isolated HOME, the child correctly returns its NSS account home while the tests at the end of this file compare it with the unrelated parent path and fail; obtain the expectation through NSS here as well.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Exercise the resolver's missing-getent fallback

This test proves only that an unrelated probe with PATH=/nonexistent throws; the subsequent resolveWith() child runs the real resolver with its normal environment, and production hardcodes /usr/bin:/bin:/usr/sbin:/sbin, so nssAccountHome() still finds getent. Removing or breaking the resolver's catch/fallback would therefore leave this test passing on ordinary Linux hosts; make the resolver's own spawn fail via an injectable/mockable boundary and assert its resulting home.

AGENTS.md reference: AGENTS.md:L158-L160

Useful? React with 👍 / 👎.

[snowykr]

Verdict

CHANGES_REQUESTED

Summary

The five-axis review completed against the exact head and identified 4 actionable issues, led by Environment-derived account home is cached across runtime changes and Explicit agent override incorrectly enables XDG routing. These findings require changes before approval.

Findings / Required Changes

1. [P1] Environment-derived account home is cached across runtime changes.
   Reference: packages/utils/src/dirs.ts:264-297
   On macOS/Windows, accountHomeFromSystem() caches os.userInfo().homedir; after HOME/USERPROFILE changes, the stale value can differ from the new runtime home and be treated as independent trusted evidence. Avoid caching environment-derived fallbacks, or track provenance and re-resolve them per call.
2. [P1] Explicit agent override incorrectly enables XDG routing.
   Reference: packages/utils/src/dirs.ts:396
   Constructor derives isDefault by comparing paths, so an explicit override equal to the home-derived default is treated as default and its initial data/state/cache paths may use XDG locations. Use !this.#agentDirOverride consistently when initializing category directories.
3. [P2] Explicit plugin home can bypass XDG routing.
   Reference: packages/utils/src/dirs.ts:638
   getPluginsDir compares the supplied home with the cached dirs.trustedHome without first refreshing call-time home state. After os.homedir() changes, passing the current authoritative home is treated as an explicit alternate and returns <home>/.gjc/plugins instead of the XDG-aware path promised by the documentation. Refresh the resolver before comparing homes, then preserve XDG semantics for the current authoritative home.
4. [P2] NSS fallback test does not exercise fallback.
   Reference: packages/utils/test/account-home-nss.test.ts:78-88
   The test only proves a missing executable throws, then resolves with the normal PATH, so it never disables getent for the resolver. Inject a controlled probe or PATH override and assert the actual fallback behavior.

CI / Verification

• Reviewed the exact remote head: 9b048f5cf96c94dc0c40b4a7ae7639ea9a5b9f89.
• CI summary: 17 passing, 3 failing, 9 pending/cancelled/skipped.
• Failing checks: Validate exact-head PR contract, PR contract bootstrap, Validate exact-head PR contract.
• Non-successful checks without pass evidence: Affected path validation / evidence producer, Windows Telegram daemon safety, Windows native build toolchain path, Telegram daemon generation guard, Affected path validation / ${{ matrix.key }}, gjc-state-gates / ${{ matrix.group }}, Affected path validation, Virtual integration validation.
• Passing evidence reviewed: Affected path validation / test:packages/utils/test/trusted-home-resolution.test.ts, Affected path validation / ts-build:ts:c3RhdHM:cGFja2FnZXMvc3RhdHM, Affected path validation / ts-build:ts:Y29kaW5nLWFnZW50:cGFja2FnZXMvY29kaW5nLWFnZW50, Affected path validation / install-methods, Affected path validation / test:packages/utils/test/agent-dir-trust.test.ts, Affected path validation / test:packages/utils/test/account-home-nss.test.ts, Affected path validation / check:@gajae-code/utils, gjc-state-gates.
• Repository policy permits review before all gating checks pass; the current non-passing checks are recorded above and do not establish that checks passed.

Axis Coverage

Axis	Verdict	Coverage
A1. Intent / Policy / Contract	CHANGES_REQUESTED	API compatibility risk is established: explicit agent-directory overrides are not guaranteed to retain their storage lane during initial resolution.
A2. Architecture / Correctness / Failure	CHANGES_REQUESTED	Correctness risk established: cached environment-derived account homes can violate call-time resolution and trust during runtime home changes.
A3. Security / Privacy / Trust	APPROVED	Security and privacy protections for trusted-home provenance and user-state path resolution appear sound; no concrete vulnerability was established.
A4. Verification / Tests / CI	CHANGES_REQUESTED	A4 verification is broadly green for affected tests, but NSS fallback coverage is incomplete and CI contract validation remains failing.
A5. Context / Compatibility / Platform	CHANGES_REQUESTED	Call-time home resolution is broadly covered, but explicit plugin-home calls can still diverge from XDG platform routing after a home change.

Limitations

• The CI evidence producer remains IN_PROGRESS, so complete CI validation cannot be claimed.
• PR contract checks are reported as FAILURE, but ci_summary provides no failure diagnostics, so the cause and its integration impact cannot be assessed.
• PR contract checks failed, so the repository contract-gate status is not established.
• PR contract checks are failing, so successful exact-head contract validation cannot be claimed.
• The evidence-producer CI job is still in progress, so CI results are not fully final.

[Yeachan-Heo]

Signed exact-head UID-cache fix status

head=60694e75f0b66a34fc35ff3150dcea27654384c2 base=ba7096f72184929070f295019e8173c41ab1e468 digest=6711f35b14bcf66a143698c6ceb46899411e7ccb38f4d0c151a8e3d400bcbdd3

The worktree was reconciled to remote 191d942d, the unrelated #4784 skill-discovery edits were discarded, and the unique effective-UID cache fix was integrated and pushed once as 60694e75. The fix keys NSS cache entries by effective UID plus account identity; failed B lookup and concurrent A→B→A transition coverage are included. #4783 is already in base ba7096f and was not duplicated.

Local evidence: UID transition/security suites 43 pass / 5 skip; full @gajae-code/utils suite 397 pass / 5 skip; utility type/lint check passes. The ambient user-scope discovery suite still has pre-existing HOME/os.homedir test-environment failures and was not carried into this head as unrelated skill-discovery code.

Fresh exact-head review is requested from snowykr. Full affected CI is required for this new head; no merge is authorized until the exact-head review approves and every required gate is green.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 60694e75f0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Refresh module-level paths when the home changes

When an SDK host changes the authoritative home after modules have loaded—the scenario this refresh is meant to support—paths previously derived from these getters remain pinned to the old profile. For example, packages/ai/src/auth-broker/remote-store.ts:78 captures getConfigRootDir() in DEFAULT_PRESENTATION_SIDECAR, and stores constructed afterward still select that stale path at lines 194-197 even though these assignments have moved the resolver to the new home. This makes broker presentation state continue to be read from and written to the previous user's config root; derive such defaults when constructing the consumer or explicitly refresh them as part of the transition.

Useful? React with 👍 / 👎.

[Yeachan-Heo]

Final exact-head review request: head=60694e75f0b66a34fc35ff3150dcea27654384c2, base=ba7096f72184929070f295019e8173c41ab1e468, digest=6711f35b14bcf66a143698c6ceb46899411e7ccb38f4d0c151a8e3d400bcbdd3. The UID-cache A→B→A security test and full utils checks pass; no stale 6008... digest remains in the PR body, issue comments, or reviews. Please review this exact head. No merge is authorized until your approval and all required CI gates are green.

[Yeachan-Heo]

Terminal verdict: OWNER_CONFIRMATION_REQUIRED

Head 60694e75f0b66a34fc35ff3150dcea27654384c2, base ba7096f72184929070f295019e8173c41ab1e468, digest 6711f35b14bcf66a143698c6ceb46899411e7ccb38f4d0c151a8e3d400bcbdd3. One canonical verdict line; the checklist and digest now name this head, and no stale head references remain in the body.

I shipped a real regression and a third critic pass caught it

My earlier fix for the reviewer's XDG finding was wrong, and I have reverted it.

setAgentDir() exports GJC_CODING_AGENT_DIR. A child process therefore inherits the exact value the parent set programmatically and cannot distinguish it from an operator-supplied one. Gating XDG on "override state" put parent and child on different storage lanes for one logical profile:

parent (setAgentDir default) -> $XDG_STATE_HOME/gjc/python-gateway
child  (inherited env var)   -> <agentDir>/python-gateway     ** diverges **

Confirmed against base 343067ab8f, where the child correctly follows XDG — so this was mine, not pre-existing. Splitting a live store across processes is worse than the narrow complaint the change was meant to answer, so an agent directory equal to the home-derived default is the default profile however it arrived. The sticky #xdgEligible decision is retained, so a lane still cannot change mid-process when a home refresh makes a path coincide.

Re-applying the reverted gating fails the new parent/child regression; the pinned dirs-python-gateway contract stays green either way.

The earlier snowykr finding is therefore not fixed as originally requested, and I am not claiming it is. It is a genuine trade-off: honoring it as stated breaks parent/child consistency. If the maintainer wants inherited overrides off XDG, that needs a way to distinguish propagation from operator intent — worth its own issue, not a silent change here.

Also integrated

A concurrent commit on this branch (60694e75, not mine) scopes the account-home cache by effective uid so a cached NSS home cannot cross a uid transition. Fast-forwarded rather than clobbered; all invariants re-verified on the combined tree.

Exact-head CI

15 passing — affected-path aggregate, all three regression suites as dedicated jobs, check:@gajae-code/utils, install-methods, both ts-builds, evidence producer, Virtual integration validation, Local public surfaces, all four gjc-state-gates. The three reds share one cause and carry no stale-digest error:

error: Verdict needs-human intentionally blocks merge.

Final state

utils 397 pass / 0 fail under pristine and ambient HOME; skills 36/0; MCP red-team 16/0; both check targets clean; 12-shape provenance matrix with zero bypasses; parent/child lane consistency verified directly.

Fourteen defects were found across review rounds, eight of them in my own change — including three found after I had declared the work finished. Each was reproduced before being fixed and reverted afterwards to confirm its regression bites.

Blocking action, human-only: one authenticated APPROVED review at exact head 60694e75f0. merge-self-approved is restricted to low-risk owner changes and this is high-risk; three independent critic passes rejected direct merge, risk downgrade, gate bypass, and splitting. #4761 stays open until this merges.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Terminal verdict: OWNER_CONFIRMATION_REQUIRED

Head bf23f94498f7525ae3008f8fac6b76bc92618f78, base ba7096f72184929070f295019e8173c41ab1e468, digest dcbed0e7ab50b3cdbb46cb2b5257d714bff10a51879c86aa4add941fba597292. One canonical verdict line; checklist, digest and head references all name this head.

Fourth critic pass — in-scope items fixed, one filed separately

Fixed here:

• Platform- and NSS-gated cases returned silently, so a vacuous pass was indistinguishable from a real assertion in CI output. They now report why they skipped.
• Two storage-lane cases had identical setup and overlapping assertions, and one still carried the comment for the override-state gating I reverted. Consolidated into the single lane-stability case.

Filed as #4786, not fixed here: module-level home-derived constants outlive the now call-time home — e.g. packages/ai/src/auth-broker/remote-store.ts:78 builds DEFAULT_PRESENTATION_SIDECAR from getConfigRootDir() at import. That is the same shape as #4761 one layer out, and it matters for credential coherence since <configRoot>/.env is a trusted source.

It is genuinely out of scope: introduced by bc63eaaa88 (#4512), present on dev today, and this PR's diff touches only packages/utils. It became observable because the resolver is now mutable, but the import-time capture predates that. Fixing consumer modules in packages/ai inside a packages/utils regression fix under a needs-human verdict would be the wrong place for it.

Exact-head CI

19 passing — affected-path aggregate, all three regression suites as dedicated jobs, check:@gajae-code/utils, install-methods, both ts-builds, evidence producer, native-build, darwin-arm64, Virtual integration validation, Local public surfaces, all four gjc-state-gates. Two reds, one cause, no stale digest:

error: Verdict needs-human intentionally blocks merge.

Final state

utils 396 pass / 0 fail under pristine and ambient HOME; skills 36/0; MCP red-team 16/0; dirs-python-gateway 3/0; both check targets clean; 12-shape provenance matrix with zero bypasses; parent/child storage-lane consistency verified directly.

Across four independent critic passes and two reviewer rounds, sixteen defects were found — nine in my own change, four of them after I had first declared the work finished. Each was reproduced before being fixed and reverted afterwards to confirm its regression bites. Two findings I declined to "fix" and documented instead, because implementing them as stated would break a pinned contract (#4772 comment above) or belongs to another package (#4786).

Blocking action, human-only: one authenticated APPROVED review at exact head 8ed2bc1df2. merge-self-approved is policy-restricted to low-risk owner changes; this is high-risk, and every critic pass rejected direct merge, risk downgrade, gate bypass and splitting as illegitimate. #4761 stays open until this merges, then closes against the merged dev SHA with a re-run reproduction.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[snowykr]

Verdict

CHANGES_REQUESTED

Summary

The five-axis review completed against the exact head and identified 1 actionable issue, led by Platform-specific NSS tests pass vacuously off Linux. These findings require changes before approval.

Findings / Required Changes

1. [P2] Platform-specific NSS tests pass vacuously off Linux.
   Reference: packages/utils/test/account-home-nss.test.ts:158-164
   The helper only logs a warning and returns from each test, so non-Linux CI reports successful tests without exercising equivalent coverage. Use the test framework's explicit skip mechanism and surface the skipped capability.

CI / Verification

• Reviewed the exact remote head: 8ed2bc1df242cb0013afe61c11751b77ccd9b066.
• CI summary: 19 passing, 2 failing, 7 pending/cancelled/skipped.
• Failing checks: Validate exact-head PR contract, PR contract bootstrap.
• Repository policy permits review before all gating checks pass; the current non-passing checks are recorded above and do not establish that checks passed.

Axis Coverage

Axis	Verdict	Coverage
A1. Intent / Policy / Contract	APPROVED	API and platform compatibility risks were not established; derived user-scope paths now follow the validated home at call time.
A2. Architecture / Correctness / Failure	APPROVED	Call-time home refresh, identity-scoped NSS caching, and path-cache rebuilding establish no demonstrated correctness or concurrency risk.
A3. Security / Privacy / Trust	APPROVED	Security and privacy controls appear strengthened, with no established exploitable trust-boundary or sensitive-data exposure.
A4. Verification / Tests / CI	CHANGES_REQUESTED	A4 coverage is substantial on Linux, but non-Linux NSS behavior is not verified and the contract gate remains unresolved.
A5. Context / Compatibility / Platform	APPROVED	No integration, documentation, or platform regression was established; CI contract validation remains limited by failed contract/bootstrap jobs.

Limitations

• PR contract and bootstrap CI jobs failed, so exact contract validation is not independently established.
• PR contract checks failed, so contract-validation status is unresolved.

[Yeachan-Heo]

Final exact-head status: head=bf23f94498f7525ae3008f8fac6b76bc92618f78, base=ba7096f72184929070f295019e8173c41ab1e468, digest=dcbed0e7ab50b3cdbb46cb2b5257d714bff10a51879c86aa4add941fba597292. The owner fix-forward replaces Linux-only NSS test early returns with Bun framework it.skipIf reporting; Linux execution is unchanged. UID transition/NSS/trusted-home/agent-dir suites pass (42 pass / 5 skip), utility check passes, and the pushed head contains no #4784 skill-discovery changes. snowykr is requested for this exact head; full CI must rerun. No merge is authorized until exact-head approval and all required gates are green.

[Yeachan-Heo]

Terminal verdict: OWNER_CONFIRMATION_REQUIRED

Head bf23f94498f7525ae3008f8fac6b76bc92618f78, base ba7096f72184929070f295019e8173c41ab1e468, digest dcbed0e7ab50b3cdbb46cb2b5257d714bff10a51879c86aa4add941fba597292. One canonical verdict line; head, base and digest in the checklist all name this head, and the stale 371 pass count and wrong base SHA are corrected.

Fifth critic pass — both items closed

Vacuous skips. My previous "fix" only printed a warning and still returned early, so platform-gated cases counted as passing assertions on non-Linux. Now it.skipIf, which reports a runner-level skip. Proven by forcing the gate: 7 skip / 0 pass instead of 7 silent passes.

A concurrent agent landed the identical itLinux/skipIf change as bf23f94498 while I was preparing mine. I dropped my duplicate and took theirs after verifying equivalence (6 itLinux call sites, zero leftover early returns) rather than clobbering another lane's work.

Stale PR metadata. The checklist named base a34cbd700b when the actual base is ba7096f721, and the testing section still claimed 371 pass. Both corrected; no stale references remain.

Exact-head CI

15 passing — affected-path aggregate, all three regression suites as dedicated jobs, check:@gajae-code/utils, install-methods, both ts-builds, evidence producer, Virtual integration validation, Local public surfaces, all four gjc-state-gates. Two reds, one cause, no stale digest:

error: Verdict needs-human intentionally blocks merge.

Final state

utils 396 pass / 5 skip / 0 fail under pristine and ambient HOME; skills 36/0; MCP red-team 16/0; both check targets clean; 12-shape provenance matrix with zero bypasses.

Eighteen defects surfaced across two reviewer rounds and five independent critic passes — eleven in my own change, six of them found after I first called the work finished. Each was reproduced before being fixed and re-broken afterwards to confirm its regression bites. Three findings I declined to implement as stated and documented instead: routing inherited GJC_CODING_AGENT_DIR off XDG (splits parent/child storage lanes — reverted with reasoning above), module-level home-derived constants in packages/ai (pre-existing from #4512 — filed as #4786), and the original snowykr XDG framing that the first of those supersedes.

Blocking action, human-only: one authenticated APPROVED review at exact head bf23f94498. merge-self-approved is policy-restricted to low-risk owner changes; this is high-risk, and all five critic passes rejected direct merge, risk downgrade, gate bypass and splitting as illegitimate. #4761 stays open until this merges, then closes against the merged dev SHA with a re-run reproduction.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[snowykr]

Verdict

CHANGES_REQUESTED

Summary

The five-axis review completed against the exact head and identified 1 actionable issue, led by Explicit plugin home no longer short-circuits trust resolution. These findings require changes before approval.

Findings / Required Changes

1. [P2] Explicit plugin home no longer short-circuits trust resolution.
   Reference: packages/utils/src/dirs.ts:718
   getPluginsDir(home) evaluates dirs.trustedHome before comparing the supplied home, so it throws when authoritative home resolution is unavailable instead of returning the documented explicit <home> path. Compare safely without forcing trusted-home resolution, then preserve the short-circuit contract.

CI / Verification

• Reviewed the exact remote head: bf23f94498f7525ae3008f8fac6b76bc92618f78.
• CI summary: 15 passing, 2 failing, 11 pending/cancelled/skipped.
• Failing checks: Validate exact-head PR contract, PR contract bootstrap.
• Repository policy permits review before all gating checks pass; the current non-passing checks are recorded above and do not establish that checks passed.

Axis Coverage

Axis	Verdict	Coverage
A1. Intent / Policy / Contract	CHANGES_REQUESTED	The explicit plugin-home API can now fail in environments where trusted-home resolution is unavailable; other reviewed directory boundary changes showed no established compatibility defect.
A2. Architecture / Correctness / Failure	APPROVED	A1-A5 review found no established correctness, concurrency, security, verification, or compatibility defect; affected-path validation passed.
A3. Security / Privacy / Trust	APPROVED	Security and privacy protections for trusted home resolution, NSS identity scoping, environment provenance, and user-state path isolation appear sound.
A4. Verification / Tests / CI	APPROVED	A4 verification is adequate on executed Linux paths, but cross-platform compatibility remains unverified due to skipped Windows CI.
A5. Context / Compatibility / Platform	APPROVED	Integration and documentation appear consistent; platform behavior is covered only on available lanes, with Windows and Darwin validation unverified.

Limitations

• PR contract validation and bootstrap checks failed, preventing a claim that the exact-head PR contract was satisfied.
• PR contract validation failed, so exact-head contract compliance could not be established; affected security-related validation passed.
• Windows and Darwin platform behavior was not established because their CI jobs were skipped after PR contract bootstrap and exact-head contract failures.

[Yeachan-Heo]

Note: a late architect review landed against a stale head — both P1s already adjudicated

A long-running review just completed against head 4b8ad444 / base 6a55d0f12d. The branch is now at bf23f94498 / base ba7096f721, several heads later, so its findings are recorded here rather than silently dropped.

It raised two P1s. Both are already resolved or deliberately decided, with evidence:

P1 — "the ambiguous-home distinctness rule is broadened." Correct observation, intentional change. The old rule tested independence by string inequality (accountHome !== runtimeHome), which discarded the account lookup precisely when it agreed. That locked an operator out of their own user state whenever a checkout declared HOME dynamically — reproduced on clean dev as User state is unavailable: no trustworthy home directory. Independence is now a property of the source: NSS cannot be influenced by HOME, so its answer is evidence whichever path it names; an os.userInfo() fallback never is.

Re-verified at the current head just now:

scenario	result
dotenv declares a home NSS does not confirm	resolves to NSS home, not the attacker's
dotenv declares the real home, NSS confirms it	accepted (corroboration, not an echo)
dotenv declares the real home, NSS unavailable	fails closed

The fail-closed property the reviewer wants protected is intact; what changed is that corroboration is no longer mistaken for self-justification.

P1 — "an environment-declared default-path agent override is still routed through XDG at startup." This is the snowykr finding. I implemented it, then reverted it, because setAgentDir() exports GJC_CODING_AGENT_DIR — a child inherits the exact value the parent set programmatically and cannot distinguish it from operator intent. Routing the inherited form off XDG put parent and child on different storage lanes for one profile ($XDG_STATE_HOME/gjc/python-gateway vs <agentDir>/python-gateway), splitting a live store. Full reasoning and reproduction are in the comment above; honoring the finding as stated needs a way to distinguish propagation from selection, which belongs in its own issue.

The review's test-quality points (non-discriminating failed-getent, traversal, and LDAP/SSSD paths) were independently raised and fixed in later passes: failures are now injected through the resolver's own lookup rather than simulated beside it, and platform-gated cases report real skipIf skips instead of vacuous passes.

No head change, so the digest and verdict line are unaffected: head bf23f94498f7525ae3008f8fac6b76bc92618f78, digest dcbed0e7ab50b3cdbb46cb2b5257d714bff10a51879c86aa4add941fba597292, still needs-human.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Final exact-head status: head=ee43d7db2444ad6ad481d0044b1013b493e18ce0, base=ba7096f72184929070f295019e8173c41ab1e468, digest=a94b2aac2fae6c3a05475622eb094729ebb50dc27b1c4511a77b84caffdad458. The explicit plugin-home P2 is fixed: caller-supplied getPluginsDir(home) now returns the explicit config path when authoritative-home resolution is unavailable, while equal-home/default XDG behavior remains unchanged and is regression-tested. UID/NSS/trusted-home/agent-dir tests pass (44 pass / 5 skip) and utility check passes. Fresh exact-head snowykr review is requested; full CI must rerun. No merge is authorized until exact-head approval and all required gates are green.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ee43d7db24

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Exercise the authoritative home key on Windows

On Windows, this test writes and overrides HOME, but the resolver selects only USERPROFILE; the inherited USERPROFILE therefore remains authoritative and the assertions pass even if traversal-spelled project declarations are accepted. Use the platform-authoritative key and clear its alternate so the Windows CI lane actually exercises this provenance boundary rather than recording tautological coverage.

AGENTS.md reference: AGENTS.md:L158-L160

Useful? React with 👍 / 👎.

[Yeachan-Heo]

Terminal verdict: OWNER_CONFIRMATION_REQUIRED

Head c1542c4bce28716bc19ffdfd25e80cde1b02a4fb, base ba7096f72184929070f295019e8173c41ab1e468, digest 5e0a9dfeaad525e9a3d23654debd7eaed8ce507406079250b215dcb6855e6a30. One canonical verdict line; head, base, digest and counts in the checklist all name this head.

A late architect review (head 024c019) accepted the production design and found four more harness defects — all fixed

Its four explicit acceptance verdicts were ACCEPT on root-alias handling, cache provenance / NSS memoization, lazy-lookup equivalence, and — notably — the constructor contract: "initial path equality plus sticky eligibility is the correct current contract; reject the override-state-only change for this PR." That independently confirms the revert I made after the parent/child lane split, and closes out the snowykr framing.

Fixed at this head:

• refreshCategoryDirs kept a defaulted isDefault still encoding the rejected override-state policy. Unreachable, but it invited exactly the path-shape recomputation stickiness exists to prevent. The argument is now required, so there is no second source of truth.
• Missing converse coverage. Only the non-default→default transition was tested. Added the reverse: a dir that was default at construction stays on XDG after a refresh makes its path non-default. Reverting stickiness now fails both lane cases (12 pass / 2 fail), not one.
• Catch-all REFUSED. The cache-provenance probe mapped every exception to REFUSED, so an import failure or a bad patch would satisfy the assertion and hide the real error. It now rethrows anything that is not the known refusal.
• Stale docs. getTrustedConfigRootDir() was still described as "stable" although it is call-time, and the changelog still framed independence as a value comparison after the source-provenance rule replaced it.

Its remaining harness points about forcing the NSS/fallback branches were already addressed in later passes: failures are injected through the resolver's own lookup, and platform-gated cases report real skipIf skips.

Also confirmed by that review: the #4773 deferral premise is obsolete — #4779 is in the base, and this delta stays compatible with its fail-closed rule.

Exact-head CI

19 passing — affected-path aggregate, all three regression suites as dedicated jobs, check:@gajae-code/utils, install-methods, native-build, darwin-arm64, evidence producer, both ts-builds, Virtual integration validation, Local public surfaces, all four gjc-state-gates. Three reds, one cause, no stale digest:

error: Verdict needs-human intentionally blocks merge.

Final state

utils 397 pass / 5 skip / 0 fail under pristine and ambient HOME; skills 36/0; MCP red-team 16/0; both check targets clean; 12-shape provenance matrix with zero bypasses.

Twenty-three defects across two reviewer rounds and six independent review passes — fifteen in my own change, ten found after I first called the work finished. Each was reproduced before being fixed and re-broken afterwards to confirm its regression bites.

Blocking action, human-only: one authenticated APPROVED review at exact head c1542c4bce. merge-self-approved is policy-restricted to low-risk owner changes; this is high-risk, and every review pass rejected direct merge, risk downgrade, gate bypass and splitting. #4761 stays open until this merges, then closes against the merged dev SHA with a re-run reproduction.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[snowykr]

Verdict

APPROVED

Summary

The five-axis review completed against the exact head without actionable P0-P2 findings. The reviewed API, correctness, security, verification, and compatibility boundaries are approved.

Findings / Required Changes

None.

CI / Verification

• Reviewed the exact remote head: ee43d7db2444ad6ad481d0044b1013b493e18ce0.
• CI summary: 19 passing, 3 failing, 7 pending/cancelled/skipped.
• Failing checks: Validate exact-head PR contract, PR contract bootstrap, Validate exact-head PR contract.
• Repository policy permits review before all gating checks pass; the current non-passing checks are recorded above and do not establish that checks passed.

Axis Coverage

Axis	Verdict	Coverage
A1. Intent / Policy / Contract	APPROVED	The directory API preserves call-time home resolution, trusted provenance checks, explicit plugin-home behavior, and XDG lane compatibility; no concrete boundary defect was established.
A2. Architecture / Correctness / Failure	APPROVED	The resolver’s call-time home refresh, identity-scoped NSS cache, and sticky storage-lane decisions are internally consistent; no demonstrated concurrency risk remains.
A3. Security / Privacy / Trust	APPROVED	Trusted-home provenance, NSS resolution, identity-scoped caching, and fail-closed behavior show no established security or privacy regression.
A4. Verification / Tests / CI	APPROVED	A4/A5 review found passing affected-path tests and no established observable regression; PR contract failure details remain unresolved.
A5. Context / Compatibility / Platform	APPROVED	Integration paths and documented trusted-home behavior appear consistent across Linux, macOS, and Windows; no platform regression was established.

Limitations

• PR contract validation failed, so contract compliance cannot be established from the available CI summary.
• PR contract validation failed, so repository-level contract compliance is not established despite affected security tests passing.

[Yeachan-Heo]

Current head is approved by snowykr. A body-only exact-head refresh was issued to obtain fresh PR contract/bootstrap and current Dev CI evidence; no source/head mutation occurred. Merge remains gated on fresh current checks.