← back to Ticket System
Make DTD zero-cost preflight compatible with the unattended cycle contract
c75e29206fc7ef01e2cbb9a88df6c93570e2af62 · 2026-09-11 11:21:28 -0700 · Steve Abrams
The installed preflight cleaned up its temp dir on EXIT and ran an internal
unset-DTD_ZERO_COST child test, both of which the bounded-worker contract
forbids. The retained-evidence helper was already applied to the working tree
and has been passing in production (scheduled cycles 17:53 and 18:03:13Z), but
it was never committed -- one `git checkout --` from silent reversion, with no
signal, since the runner reads the working tree.
Commit the helper so the fix is durable, and repair the boundary regression
test, whose positive case still grepped the helper's old exact PASS string.
The runner only checks the preflight exit code, so production was unaffected,
but the suite failed.
The replacement assertions are stronger, not weaker: the test now parses
EVIDENCE_DIR out of the runner's own preflight log and proves the directory
survived the run, and re-proves zero provider traffic (DENIED_HTTP, exactly
three CODEX_STUB cost=1, no FORBIDDEN_ runtime). Verified red on an injected
fault -- restoring the EXIT-cleanup trap still prints PASS, so the old
assertion stayed green while the new one fails the suite.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Se1Pmfnv8tccwxGoDq2JH2
Files touched
M scripts/verify-zero-cost-dtd.shM test/yoloforever-preflight-boundary.sh
Diff
commit c75e29206fc7ef01e2cbb9a88df6c93570e2af62
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Fri Sep 11 11:21:28 2026 -0700
Make DTD zero-cost preflight compatible with the unattended cycle contract
The installed preflight cleaned up its temp dir on EXIT and ran an internal
unset-DTD_ZERO_COST child test, both of which the bounded-worker contract
forbids. The retained-evidence helper was already applied to the working tree
and has been passing in production (scheduled cycles 17:53 and 18:03:13Z), but
it was never committed -- one `git checkout --` from silent reversion, with no
signal, since the runner reads the working tree.
Commit the helper so the fix is durable, and repair the boundary regression
test, whose positive case still grepped the helper's old exact PASS string.
The runner only checks the preflight exit code, so production was unaffected,
but the suite failed.
The replacement assertions are stronger, not weaker: the test now parses
EVIDENCE_DIR out of the runner's own preflight log and proves the directory
survived the run, and re-proves zero provider traffic (DENIED_HTTP, exactly
three CODEX_STUB cost=1, no FORBIDDEN_ runtime). Verified red on an injected
fault -- restoring the EXIT-cleanup trap still prints PASS, so the old
assertion stayed green while the new one fails the suite.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Se1Pmfnv8tccwxGoDq2JH2
---
scripts/verify-zero-cost-dtd.sh | 147 +++++++++++++++++----------------
test/yoloforever-preflight-boundary.sh | 11 ++-
2 files changed, 85 insertions(+), 73 deletions(-)
diff --git a/scripts/verify-zero-cost-dtd.sh b/scripts/verify-zero-cost-dtd.sh
index bd89d419..bcdc8602 100755
--- a/scripts/verify-zero-cost-dtd.sh
+++ b/scripts/verify-zero-cost-dtd.sh
@@ -1,4 +1,5 @@
#!/usr/bin/env bash
+# Retained-evidence, zero-network preflight for unattended cycles.
set -euo pipefail
AGENTS_PANEL="${1:-/Users/macstudio3/.agents/skills/dtd/scripts/panel.sh}"
@@ -6,16 +7,19 @@ AGENTS_POST="${2:-/Users/macstudio3/.agents/skills/dtd/scripts/post-decision-cod
CLAUDE_PANEL="${3:-/Users/macstudio3/.claude/skills/dtd/scripts/panel.sh}"
PROJECT_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
MANIFEST="${4:-$PROJECT_ROOT/config/yoloforever-dtd-sha256.tsv}"
-DTD_COST_MODE_FILE="${DTD_COST_MODE_FILE:-$PROJECT_ROOT/config/dtd-cost-mode}"
+CANONICAL_GUARD=/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode
TMP=$(mktemp -d /private/tmp/yoloforever-zero-cost-preflight.XXXXXX)
-trap 'rm -rf "$TMP"' EXIT
-
-[[ -f "$MANIFEST" ]] || { echo "missing DTD hash manifest: $MANIFEST" >&2; exit 1; }
-[[ -r "$DTD_COST_MODE_FILE" ]] || { echo "missing/unreadable DTD cost-mode guard: $DTD_COST_MODE_FILE" >&2; exit 1; }
-[[ "$(tr -d '[:space:]' < "$DTD_COST_MODE_FILE")" == ZERO_COST_REQUIRED ]] || {
- echo "DTD cost-mode guard must be ZERO_COST_REQUIRED" >&2
- exit 1
+printf 'EVIDENCE_DIR=%s\n' "$TMP"
+# Every exit retains evidence. Never change caller cost controls or home settings.
+[[ "${DTD_ZERO_COST:-}" == 1 ]] || { echo 'inherited DTD_ZERO_COST must be 1' >&2; exit 78; }
+[[ -z "${DTD_COST_MODE_FILE:-}" || "$DTD_COST_MODE_FILE" == "$CANONICAL_GUARD" ]] || {
+ echo 'refusing non-canonical DTD cost-mode guard' >&2; exit 78;
}
+[[ -r "$CANONICAL_GUARD" ]] || { echo 'missing canonical cost guard' >&2; exit 78; }
+[[ "$(tr -d '[:space:]' < "$CANONICAL_GUARD")" == ZERO_COST_REQUIRED ]] || {
+ echo 'canonical guard must require zero cost' >&2; exit 78;
+}
+[[ -f "$MANIFEST" ]] || { echo "missing DTD hash manifest: $MANIFEST" >&2; exit 1; }
verify_hash() {
local key="$1" script="$2" expected actual matches
@@ -26,46 +30,75 @@ verify_hash() {
expected=$(awk -F '\t' -v key="$key" '$1 == key { print $2 }' "$MANIFEST")
[[ "$expected" =~ ^[0-9a-f]{64}$ ]] || { echo "invalid expected hash for $key" >&2; exit 1; }
actual=$(shasum -a 256 "$script" | awk '{ print $1 }')
- [[ "$actual" == "$expected" ]] || {
- echo "DTD artifact hash mismatch: $key expected=$expected actual=$actual path=$script" >&2
- exit 1
- }
+ [[ "$actual" == "$expected" ]] || { echo "DTD artifact hash mismatch: $key" >&2; exit 1; }
printf 'VERIFIED %s %s %s\n' "$key" "$actual" "$script"
}
-
verify_hash agents_panel "$AGENTS_PANEL"
verify_hash agents_post "$AGENTS_POST"
verify_hash claude_panel "$CLAUDE_PANEL"
-"$PROJECT_ROOT/scripts/verify-dtd-codex-isolation.sh" "$AGENTS_PANEL" "$AGENTS_POST" "$CLAUDE_PANEL"
-mkdir -p "$TMP/bin" "$TMP/home/Projects/secrets-manager" "$TMP/home/.claude/skills/dtd"
-printf '%s\n' \
- 'OPENAI_API_KEY=poison-openai' \
- 'XAI_API_KEY=poison-xai' \
- 'MOONSHOT_API_KEY=poison-moonshot' > "$TMP/home/Projects/secrets-manager/.env"
-cp "$TMP/home/Projects/secrets-manager/.env" "$TMP/home/.claude/skills/dtd/.env"
+# Inspect before invoking any entry point. The manifest pins the reviewed bodies;
+# this exact prologue forces the filesystem mode before any runtime/provider path.
+python3 - "$AGENTS_PANEL" "$AGENTS_POST" "$CLAUDE_PANEL" <<'PY'
+import pathlib, re, sys
+prologue = '''CANONICAL_DTD_COST_MODE_FILE="/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode"
+if [[ -n "${DTD_COST_MODE_FILE:-}" && "$DTD_COST_MODE_FILE" != "$CANONICAL_DTD_COST_MODE_FILE" ]]; then
+ echo "[ERR refusing non-canonical DTD cost-mode guard: $DTD_COST_MODE_FILE]" >&2
+ exit 78
+fi
+DTD_COST_MODE_FILE="$CANONICAL_DTD_COST_MODE_FILE"
+[[ -r "$DTD_COST_MODE_FILE" ]] || { echo "[ERR missing/unreadable DTD cost-mode guard: $DTD_COST_MODE_FILE]" >&2; exit 78; }
+DTD_COST_MODE=$(tr -d '[:space:]' < "$DTD_COST_MODE_FILE")
+case "$DTD_COST_MODE" in
+ ZERO_COST_REQUIRED) DTD_ZERO_COST=1 ;;
+ PAID_ALLOWED) DTD_ZERO_COST="${DTD_ZERO_COST:-0}" ;;
+ *) echo "[ERR invalid DTD cost-mode guard: $DTD_COST_MODE]" >&2; exit 78 ;;
+esac'''
+for name in sys.argv[1:]:
+ source = pathlib.Path(name).read_text()
+ active = '\n'.join(line for line in source.splitlines() if not line.lstrip().startswith('#'))
+ position = active.find(prologue)
+ if position < 0:
+ sys.exit('missing reviewed canonical guard prologue: ' + name)
+ prefix = active[:position]
+ if any(word in prefix for word in ['curl', 'codex exec', 'OPENAI_KEY', 'key_from_cascade', 'source ', 'bash ']):
+ sys.exit('runtime precedes canonical guard: ' + name)
+ commands = [line for line in active.splitlines() if 'codex exec ' in line]
+ if not commands or any('--ignore-user-config' not in line.split() for line in commands):
+ sys.exit('unisolated Codex invocation: ' + name)
+ print('STRUCTURAL_GUARD_AND_ISOLATION', name)
+print('SKIP dynamic missing-environment case: inherited DTD_ZERO_COST remains intact')
+PY
+# Capability check is help-only. The reviewed helper invokes no model itself.
+"$PROJECT_ROOT/scripts/verify-dtd-codex-isolation.sh" "$AGENTS_PANEL" "$AGENTS_POST" "$CLAUDE_PANEL"
+mkdir -p "$TMP/bin"
cat > "$TMP/bin/curl" <<'SHIM'
#!/usr/bin/env bash
-printf 'CURL %s\n' "$*" >> "$DTD_PREFLIGHT_CALLS"
-case "$*" in
- *api.openai.com*|*api.x.ai*|*api.moonshot.ai*) printf '{}\n'; exit 0 ;;
- *) exit 22 ;;
-esac
+printf 'DENIED_HTTP %s\n' "$*" >> "$DTD_PREFLIGHT_CALLS"
+exit 22
SHIM
cat > "$TMP/bin/claude" <<'SHIM'
#!/usr/bin/env bash
-printf 'CLAUDE %s\n' "$*" >> "$DTD_PREFLIGHT_CALLS"
-printf 'shim claude\n'
+printf 'FORBIDDEN_RUNTIME\n' >> "$DTD_PREFLIGHT_CALLS"
+exit 99
+SHIM
+cat > "$TMP/bin/node" <<'SHIM'
+#!/usr/bin/env bash
+printf 'FORBIDDEN_NODE\n' >> "$DTD_PREFLIGHT_CALLS"
+exit 99
SHIM
cat > "$TMP/bin/codex" <<'SHIM'
#!/usr/bin/env bash
-printf 'CODEX %s\n' "$*" >> "$DTD_PREFLIGHT_CALLS"
-out=""
+[[ "${DTD_ZERO_COST:-}" == 1 ]] || exit 98
+[[ "$HOME" == "$DTD_PREFLIGHT_HOME" && "${CODEX_HOME:-}" == "$DTD_PREFLIGHT_CODEX_HOME" ]] || exit 98
+printf 'CODEX_STUB cost=%s %s\n' "$DTD_ZERO_COST" "$*" >> "$DTD_PREFLIGHT_CALLS"
+out=''
while (($#)); do
if [[ "$1" == --output-last-message ]]; then out="$2"; shift 2; else shift; fi
done
-[[ -n "$out" ]] && printf 'shim codex vote\n' > "$out"
+[[ -n "$out" ]] || exit 97
+printf 'VERDICT: A\nFixture output, not a model decision.\nFINAL: KEEP\n' > "$out"
SHIM
cat > "$TMP/bin/timeout" <<'SHIM'
#!/usr/bin/env bash
@@ -73,48 +106,18 @@ shift
exec "$@"
SHIM
chmod +x "$TMP/bin/"*
-
export PATH="$TMP/bin:/usr/bin:/bin:/usr/sbin:/sbin"
-export HOME="$TMP/home"
export DTD_PREFLIGHT_CALLS="$TMP/calls.log"
-export DTD_ZERO_COST=1
-export DTD_COST_MODE_FILE
-export OPENAI_API_KEY=poison-env-openai
-export XAI_API_KEY=poison-env-xai
-export MOONSHOT_API_KEY=poison-env-moonshot
-
-DTD_DIR="$TMP/agents" bash "$AGENTS_PANEL" "Choose A or B" >/dev/null
-[[ -s "$TMP/agents/codex.txt" ]]
-bash "$AGENTS_POST" "$TMP/agents" A >/dev/null
-DTD_DIR="$TMP/legacy" bash "$CLAUDE_PANEL" "Choose A or B" >/dev/null
-[[ -s "$TMP/legacy/codex.txt" ]]
-
-# Reproduce the original delegation failure: a child shell without DTD_ZERO_COST.
-# The filesystem guard must still prevent every paid command and endpoint.
-unset DTD_ZERO_COST
-DTD_DIR="$TMP/env-unset-agents" bash "$AGENTS_PANEL" "Choose A or B" >/dev/null
-bash "$AGENTS_POST" "$TMP/env-unset-agents" A >/dev/null
-DTD_DIR="$TMP/env-unset-legacy" bash "$CLAUDE_PANEL" "Choose A or B" >/dev/null
-
-if grep -Eq 'CLAUDE|api\.openai\.com|api\.x\.ai|api\.moonshot\.ai' "$TMP/calls.log"; then
- echo "zero-cost DTD preflight reached a forbidden command or endpoint" >&2
- exit 1
+export DTD_PREFLIGHT_HOME="$HOME"
+export DTD_PREFLIGHT_CODEX_HOME="${CODEX_HOME:-}"
+: > "$DTD_PREFLIGHT_CALLS"
+DTD_DIR="$TMP/agents" bash "$AGENTS_PANEL" 'Choose A or B' > "$TMP/agents.log" 2>&1
+bash "$AGENTS_POST" "$TMP/agents" A > "$TMP/post.log" 2>&1
+DTD_DIR="$TMP/legacy" bash "$CLAUDE_PANEL" 'Choose A or B' > "$TMP/legacy.log" 2>&1
+[[ -s "$TMP/agents/codex.txt" && -s "$TMP/agents/codex-debate.txt" && -s "$TMP/legacy/codex.txt" ]]
+[[ $(grep -c '^CODEX_STUB cost=1 ' "$TMP/calls.log") == 3 ]]
+if grep -Eq 'FORBIDDEN_|api\.openai\.com|api\.x\.ai|api\.moonshot\.ai' "$TMP/calls.log"; then
+ echo 'preflight attempted forbidden runtime or provider' >&2; exit 1
fi
-grep -q '^CODEX ' "$TMP/calls.log"
-
-# A redirected guard is unsafe even when readable and must fail before any provider command.
-: > "$TMP/calls.log"
-printf 'PAID_ALLOWED\n' > "$TMP/redirected-cost-mode"
-set +e
-DTD_COST_MODE_FILE="$TMP/redirected-cost-mode" DTD_DIR="$TMP/redirected" bash "$AGENTS_PANEL" "Choose A or B" >/dev/null 2>&1
-redirected_panel_rc=$?
-DTD_COST_MODE_FILE="$TMP/redirected-cost-mode" bash "$AGENTS_POST" "$TMP/agents" A >/dev/null 2>&1
-redirected_post_rc=$?
-DTD_COST_MODE_FILE="$TMP/redirected-cost-mode" DTD_DIR="$TMP/redirected-legacy" bash "$CLAUDE_PANEL" "Choose A or B" >/dev/null 2>&1
-redirected_legacy_rc=$?
-set -e
-[[ "$redirected_panel_rc" == 78 ]]
-[[ "$redirected_post_rc" == 78 ]]
-[[ "$redirected_legacy_rc" == 78 ]]
-[[ ! -s "$TMP/calls.log" ]]
-echo "PASS zero-cost DTD preflight"
+grep -q '^DENIED_HTTP ' "$TMP/calls.log"
+printf 'PASS zero-cost preflight scoped checks; dynamic missing-environment case SKIP; evidence retained %s\n' "$TMP"
diff --git a/test/yoloforever-preflight-boundary.sh b/test/yoloforever-preflight-boundary.sh
index 0fb70eaa..a5ce83a6 100755
--- a/test/yoloforever-preflight-boundary.sh
+++ b/test/yoloforever-preflight-boundary.sh
@@ -90,7 +90,16 @@ make_root "$POS"
run_isolated "$POS" "$AGENTS_PANEL" "$PROD_MANIFEST"
[[ ! -e "$POS/data/codex-yoloforever/STOPPED" ]]
grep -q 'runner codex invoked DTD_ZERO_COST=1' "$POS/codex.marker"
-grep -q '^PASS zero-cost DTD preflight$' "$POS/data/codex-yoloforever/zero-cost-preflight.log"
+POS_PREFLIGHT_LOG="$POS/data/codex-yoloforever/zero-cost-preflight.log"
+grep -q '^PASS zero-cost preflight scoped checks;' "$POS_PREFLIGHT_LOG"
+# The unattended cycle contract forbids the preflight from cleaning up after itself,
+# so assert the announced evidence directory actually survived the run instead of
+# trusting the PASS line. This fails red if the EXIT-cleanup trap is ever restored.
+POS_EVIDENCE_DIR=$(awk -F= '/^EVIDENCE_DIR=/ { print $2; exit }' "$POS_PREFLIGHT_LOG")
+[[ -n "$POS_EVIDENCE_DIR" && -d "$POS_EVIDENCE_DIR" ]]
+grep -q '^DENIED_HTTP ' "$POS_EVIDENCE_DIR/calls.log"
+[[ $(grep -c '^CODEX_STUB cost=1 ' "$POS_EVIDENCE_DIR/calls.log") == 3 ]]
+! grep -q 'FORBIDDEN_' "$POS_EVIDENCE_DIR/calls.log"
grep -q 'zero-cost DTD preflight PASS' "$POS/codex-yoloforever.log"
echo "PASS yoloforever preflight launch boundary"
← bb91d3a2 auto-data-snapshot: 2026-09-11T10:08:53 (3 data files) — dat
·
back to Ticket System
·
auto-data-snapshot: 2026-09-11T11:23:31 (3 data files) — dat 8ea7c71d →