John Smith 8ee3efd9bc Wave 8: remediate all AUDIT_REPORT_FINDINGS (P0 guards/taint/symlink, P1 roles/SSRF/rollback/retry, P2/P3 deps/CI/receipts) ...

- OH-6.2: explicit evaluatePermission in every harness execute (index + host adapter)
- OH-6.5: canonicalized shell classifier (sudo/env/-u/-g, basenames, git globals, refspec force, .. fail-closed, write over unwrapped)
- OH-6.6: MCP server_tool taint ids, fork inheritance, broadened denylist
- OH-6.3: realpath containment on all writers (hashline, ast, rename, tx, checkpoints)
- OH-6.1: NFKC role normalization + unknown-role least privilege
- OH-7.4: SSRF default-deny + allowlist + redirect guard; OH-7.3 scoped-test containment
- OH-2.1: zod v4 native toJSONSchema, bridge removed; TS 7.0.2; @types/bun 1.4.3
- OH-3.4/4.6: sabotage-catching rollback + retry tests; OH-4.8 created-file receipts
- OH-1.4/1.5/4.3/8.1: run.sh, SHA-pinned CI + upstream verify, hunk error, optional browser peers
- 62 new tests (267 green), scripts/accept/wave-8.sh + docs/reports/wave-8.md

2026-10-17 02:32:00 -04:00

..

accept

Wave 8: remediate all AUDIT_REPORT_FINDINGS (P0 guards/taint/symlink, P1 roles/SSRF/rollback/retry, P2/P3 deps/CI/receipts)

2026-10-17 02:32:00 -04:00

host-test

Wave 8: remediate all AUDIT_REPORT_FINDINGS (P0 guards/taint/symlink, P1 roles/SSRF/rollback/retry, P2/P3 deps/CI/receipts)

2026-10-17 02:32:00 -04:00

upstream

chore(upstream): vendor opencode-2 core fixes script (reference-only, not applied)

2026-10-16 02:05:08 -04:00