Adversarial review and fix (run c6c486)

[ravidsrk]

Summary

Full-app adversarial review + remediation for autonomous-fleet (mission adversarial-review-and-fix, run c6c486).

Phase 0

• Code-grounded review → docs/adversarial-review-fresh.md
• Schema-verified findings: 21 confirmed, 0 unverified, 1 DO_NOT_FIX (SEC-006)
• Skeptic freeze + CLOSE-INDEX in .fleet/docs/arch-build-progress.md

Phase 1 — Lane A closed (15 findings)

Merged into this BASE via merge-commits (fix PRs #135–#147):

ID	Fix
SEC-001 / SEC-008	Remove eval from install-community.sh; pin skills@1.5.12
SEC-002	Validate reviewer --run-id before sandbox mounts
SEC-003	Linux bwrap reviewer --unshare-net
SEC-007	Sync SECURITY.md classifier examples to DENY/ASK
ARCH-001	fleet-verify gains sha-pin + reviewer-sandbox layers
ARCH-002 / BUG-002	Campaign archived-mission exec gate; remove || true on blocked parse
BUG-001	Enforce created_utc ≤ file mtimes; stamp at run start
BUG-003	Pin namespace._RUN_ID_RE to fleet_run.RUN_ID_PATTERN
BUG-004	increment_resume_count updates markdown table rows
ARCH-003	mission_promotion honors FLEET_LEDGER_DIR
OPS-001	Fatal real-run archive emit failure
OPS-002	Adapter auth-check subprocess timeout
SEC-011	Cap findings JSON load size

Lane B (HUMAN_GATED)

SEC-004, SEC-005, SEC-009, ARCH-004, ARCH-005, SEC-010 — draft-both variants in .fleet/docs/DECISIONS.md.

CI fix

Substrate sync drifted autonomous-fleet-core content under version 1.3.0. Bumped to 1.3.1, refreshed skills-lock.json computedHash, and synced substrate-manifest.json core_version.

Test plan

• python3 scripts/registry_lint.py . passes
• skill lock version sync OK
• sync_substrate_assets.py --check OK
• Targeted pytest for changed modules green
• CI validate job green on this PR

  

Greptile Summary

This PR applies the adversarial-review fix set across the fleet scripts, substrate assets, docs, and tests. The main changes are:

• Hardened community skill installation by removing eval, validating hosts, rejecting shell metacharacters, and pinning the skills CLI.
• Tightened reviewer sandbox behavior with run-id validation, path containment, and bwrap network isolation.
• Added archive and verification checks for created_utc, SHA pins, reviewer sandbox manifests, findings size caps, and run identity.
• Updated campaign, headless, promotion, recovery, namespace, and adapter preflight flows for the documented Lane A fixes.
• Synced the autonomous-fleet-core substrate assets and expanded targeted tests for the changed surfaces.

Confidence Score: 5/5

This PR appears safe to merge from the reviewed changed-code paths.

The executable changes match the documented fix intent and have targeted tests for the affected flows. No new actionable bugs were identified in the reviewed changes.

No new files require special attention beyond the already-discussed historical fleet_verify SHA-pin behavior.

T-Rex Logs

What T-Rex did

• T-Rex started a targeted pytest run under a multibash wrapper; the wrapper timed out before returning, but the foreground pytest process finished and produced a complete, successful run.
• The proof log trex-artifacts/targeted-pytest.log was captured, and it includes the command, working directory, version and environment lines, full verbose test output, a Pytest summary, and EXIT_CODE: 0.
• A log artifact was uploaded to provide access to the targeted-pytest.log for review.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
scripts/install-community.sh	Replaces shell-string eval execution with allowlisted argv-based installer flows and pins the skills CLI.
scripts/run-sandboxed.sh	Validates reviewer run IDs before mounts and drops network access in the bwrap reviewer sandbox.
scripts/lib/fleet_verify.py	Adds sha-pin and reviewer-sandbox verification layers; prior reviewed SHA-pin merge-marker concern remains excluded from repeat comments.
scripts/lib/fleet_run.py	Stamps run archives at allocation time and validates created_utc against artifact mtimes.
scripts/run-campaign.sh	Blocks archived campaign missions unless explicitly allowed and fails on readiness parse errors.
scripts/run-mission-headless.sh	Makes real-run archive emission failures fatal while preserving dry-run cleanup behavior.
scripts/lib/adapter_preflight.py	Adds configurable timeout handling around adapter auth preflight commands.
scripts/lib/recovery_scan.py	Extends resume-count rewriting to markdown table ledger rows.
skills/autonomous-fleet-core/assets/substrate/substrate-manifest.json	Updates substrate manifest metadata and hashes for synced assets.
tests/test_fleet_verify.py	Covers fleet-verify layer composition including sha-pin and reviewer-sandbox checks.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant Operator
participant Installer as install-community.sh
participant Sandbox as run-sandboxed.sh
participant Headless as run-mission-headless.sh / run-campaign.sh
participant Archive as fleet_run.py
participant Verify as fleet_verify.py

Operator->>Installer: choose community bundle
Installer->>Installer: validate host + reject shell metacharacters
Installer-->>Operator: dry-run display or argv-based execution

Operator->>Sandbox: reviewer role with run_id
Sandbox->>Sandbox: validate RUN_ID_PATTERN + contain path under .fleet/runs
Sandbox->>Sandbox: create read-only reviewer sandbox
Sandbox-->>Operator: reviewer output under run dir

Operator->>Headless: run mission/campaign
Headless->>Archive: emit trace/archive for real run
Archive->>Archive: stamp created_utc at run start and validate mtimes
Headless->>Verify: validate run artifacts
Verify->>Verify: run archive, findings, outcome, trace, identity, sha-pin, reviewer-sandbox layers
Verify-->>Operator: PASS/FAIL layer report

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant Operator
participant Installer as install-community.sh
participant Sandbox as run-sandboxed.sh
participant Headless as run-mission-headless.sh / run-campaign.sh
participant Archive as fleet_run.py
participant Verify as fleet_verify.py

Operator->>Installer: choose community bundle
Installer->>Installer: validate host + reject shell metacharacters
Installer-->>Operator: dry-run display or argv-based execution

Operator->>Sandbox: reviewer role with run_id
Sandbox->>Sandbox: validate RUN_ID_PATTERN + contain path under .fleet/runs
Sandbox->>Sandbox: create read-only reviewer sandbox
Sandbox-->>Operator: reviewer output under run dir

Operator->>Headless: run mission/campaign
Headless->>Archive: emit trace/archive for real run
Archive->>Archive: stamp created_utc at run start and validate mtimes
Headless->>Verify: validate run artifacts
Verify->>Verify: run archive, findings, outcome, trace, identity, sha-pin, reviewer-sandbox layers
Verify-->>Operator: PASS/FAIL layer report

Loading

_{Reviews (4): Last reviewed commit: "fix(ci): sync substrate-manifest core_ve..." | Re-trigger Greptile}