Gemini repository review can expand to user-home root and fail permission check

[sumitake]

Summary

A direct, read-only Gemini plan review can fail before returning a verdict because agy attempts to read the user-home root instead of remaining inside the supplied project working directory.

Observed environment

• installed public plugin: agent-collab 6.2.3
• carrier: agy 1.1.19
• working directory: a clean agent-collab-workspace worktree
• invocation class: agy --mode plan --sandbox --effort high --print ...
• requested authority: read-only plan review; no edits and no external services

Result

The process exited nonzero before a verdict:

permission check failed for read_file "/Users/josumi": user denied permission for read_file(/Users/josumi)

No provider verdict was consumed, and the invocation was not replayed.

Expected

The review should stay inside the explicit current project, or return a typed missing-criterion response identifying the path it actually needs. A parent/home-root read should not be invented for a repository-local plan review.

Follow-up scope

Audit the Gemini/direct-CLI workspace-root derivation and ensure repository-local review prompts cannot expand to the user-home root. Preserve fail-closed permission behavior; correct the requested path rather than broadly granting home access.

[sumitake]

Additional current-release evidence from the v7.0.0 exact-head governance gate (2026-08-28 UTC):

• Installed plugin: agent-collab 6.3.0; canonical response reports wire digest 774067d0a2a640b2eac27cace99f6cf812649169e03aab2ec8fcf77a2c3fe2a9 and manifest digest 688ae21fa5fd60412def402fd30c1a56a6807435114bd92537f60c89c05138ca.
• Carrier: Agy 1.1.22 through the installed sealed coordinator, logical agent gemini, action governance.repository.
• Source: a freshly cloned, tracked-clean repository pinned to 2e2b9145241125465ac37ae36b0cd51de9641eb1.
• Request ID: agent-collab-v7-gemini-governance-2e2b914.
• Result: typed source_containment_failed / adapter code outside_source, detail absolute_outside_roots.
• Trace: 92 successful repository tool outcomes, one failed repository read outside the allowed source, provider_processes: 1, model-call/turn counts unavailable, and cleanup_confirmed: true.

The request was not replayed or failed over. Response evidence SHA-256: c759fa62dc7b0a2530344399b3b75647392170933af0ab25c77d3c0d746e35ef.

This confirms that fail-closed containment is working, but the current installed route can still invent an out-of-source read after substantial repository-local inspection. Keep this issue open until the released v7 bytes are positively verified without provider invocation; any later semantic recheck must be a separately authorized new request, not a replay of this attempt.

[sumitake]

v7.0.0 closeout update: JOHN-MBP now has agent-collab 7.0.0 installed/enabled, all 170 published members match the immutable release archive, the signed/notarized verifier passes, and the sole provider-free readiness artifact reports Gemini ready through the active Agy 1.1.22 executable while proving zero model calls.

This does not resolve the latest consumed semantic evidence already recorded above: the exact-head Agy 1.1.22 governance attempt still requested an absolute path outside the sealed source after substantial in-root work and failed closed as source_containment_failed/outside_source. Keep this issue open for a separately authorized bounded semantic qualification or upstream/runtime correction. The consumed attempt was not replayed, and no new provider canary was run.

[sumitake]

Additive v7.0.0 exact-head evidence from workspace PR #3105 on 2026-08-28 UTC:

• Installed plugin: 7.0.0; provider runtime 5.0.0
• Manifest SHA-256: 2bf858764510fddfa86f491f677ad1a80d05b854a33d77a9a3230d0cb399fddf
• Wire-contract SHA-256: 9ec0c1d0c943a9ba9025dbb554847abea45d5c2dcac893a69ac09539d265a85f
• Request: governance.repository, frontier / maximum, target_agent=gemini, timeout_ms=600000
• Exact source head: 42c339815682412500a342ec116ff8232ab35714
• Source: clean standalone clone produced and positively verified by the workspace sealed_review_root.py helper
• A separately named review.repository request against the same sealed root and head completed successfully immediately beforehand with a Google-family repository-read receipt and no findings

The governance attempt completed 41 successful repository tool outcomes, then failed closed with source_containment_failed, adapter code outside_source, containment detail absolute_outside_roots, one provider process, no artifact/verdict/receipt, and cleanup_confirmed=true. The request was not replayed or represented as governance approval.

The governance prompt mentioned that the public companion PR had already merged. That may have encouraged an external verification attempt, but the terminal trace does not reveal the requested path, so this remains a hypothesis rather than a proven cause. A separately named corrected request will constrain adjudication to the admitted workspace source and treat the already-verified public merge as a supplied prerequisite. No prompt, repository contents, credentials, usernames, raw provider output, or local paths are included here.

[sumitake]

Additive staged-release evidence from the paired v7.0.1 qualification work on 2026-08-30 UTC:

• Package state: pre-release staged plugin 7.0.1; manifest digest c9c5b5c01b2531b9e2883fac2bb5ec29f3e3687955c9821748b66f76587ac4b1; wire digest 8932ebcbaea11c4e24e4829256660f5d0f9861f08953a042605146ca82f76130.
• Request ID: packaged-host-identity-plan; documents-based reasoning request, target logical agent Gemini, standard / maximum, one bounded document.
• Terminal result: capability_error / source_containment_failed, outside_source_observed=true, one provider process, cleanup confirmed, and no artifact.
• Failure-trace envelope SHA-256: 50543c4482223ac3ee4bda7cd627cd4f97fcde338cf8b8538c42387507962259.

The provider-started request was consumed and was not replayed. No prompt, document content, raw provider output, credential, username, or local path is included here.

[sumitake]

Additive exact-head evidence from public plugin PR #188 on 2026-08-30 PDT:

• Candidate: agent-collab 7.0.1, exact signed/GitHub-verified head cb04cdbce23a92f2b93520ac36d9f75049c70c5a.
• Candidate manifest digest: 51a7fcc8f0ef96f32bfb7b21b1293b07c2678396c3646a7acdd4f271a4e08917; wire digest: 86137024f7e16c67bbeb9f29eaee03d8031e645ce1b5b2c46154aeae7528bcd9.
• Request ID: plugin-7-0-1-governance-cb04cdb; logical action governance.repository; target logical agent Gemini; frontier / maximum; descriptor-owned admitted-progress inactivity mode.
• Terminal result: capability_error / source_containment_failed; adapter code outside_source; containment detail absolute_outside_roots; outside_source_observed=true.
• Attempt telemetry: one provider process, three metadata processes, 43 successful tool outcomes, zero failed/incomplete/unknown tool outcomes in the retained public trace, and cleanup_confirmed=true.
• Native envelope SHA-256: bf2a77d8f0fd45b54e8b528052ddb8bd3ce0da753938a6a3bc617d2b48eea417.

The provider-started attempt is consumed and was not replayed or failed over. No raw provider output, prompt body, private path, credential, or model pin is included here. PR CI is independently green; the terminal containment failure left no governance artifact or receipt and therefore cannot satisfy the required independent review.

[sumitake]

Canonical pre-implementation design checkpoint for the next runtime release:

• Workspace design head: af440d707f17e0187a7926fc818dd566f39dbed9 (GPG-signed commit; local design branch, not yet a merged implementation).
• First parent: 3788b0c2b8b98dabf2f782a1e3483b8dbcdb7180.
• Tree: e5f1cd11858d006647249e54ef03004f1d390c41.
• Design document SHA-256: 9b1fb001492f058f5c23b0153991ce8471b754c7c82c364bf842557a1a5788a4.
• Focused architecture-registry validation: 3/3 passed; diff checks passed.

The design replaces the binary outside root = failure rule with typed authorization and provenance:

• Exact-head repository reads remain authoritative evidence for repository findings.
• Public remote context and provider-native internet research remain available as supporting, non-evidentiary context.
• Explicitly admitted runtime/operator local support roots may be used with closed provenance classes and never become repository evidence.
• A correlated content-free denied local attempt is non-terminal and does not poison a later clean in-root result.
• Successful unauthorized private-local access or ambiguous local authority remains fail-closed.
• Missing passive remote metadata is not a veto. The runtime does not infer semantic influence from prose, formatting, usage, tool-name fingerprints, models, or CLI versions.
• The change may not disable or narrow native reasoning, tools, network access, web research, or provider-internal delegation.

Load-bearing questions that must be closed by exact-head distinct-family design review before implementation:

1. The PR runtime: ship provider runtime 5.0.3 in agent-collab 7.0.1 #188 recurrence retained 43 successful outcomes and zero failed outcomes. A sanitized exact producer-shape fixture must prove whether the location event can be correlated as a content-free denial; otherwise it remains ambiguous and fail-closed.
2. Removing the Agy permission-bypass argument must be proven noninteractive in headless operation while retaining the full tool surface and internet access.
3. The permanent public wire surface must remain minimal. Remote-support observability is non-gating, and speculative provenance vocabulary must not ship without a present sealed-input requirement.
4. The in-root . listing/result-contract mismatch tracked on runtime: ordinary governance reviews fail closed across adapters #144 belongs in the same runtime generation only if a provider-free end-to-end regression proves that exact causal seam.

The prior Grok architecture.repository review of superseded head e95438ff9142532125b6a327b0aaae4905193fe8 provider-started and ended in a total-deadline timeout with zero managed tool outcomes, cleanup confirmed, and no artifact, verdict, or receipt. It was consumed once and not replayed or failed over. The operator was concurrently using the same CLI successfully, so the occurrence is managed-route delivery/progress ambiguity rather than evidence of provider unavailability. Details: #144 comment 5474149590 and #187 comment 5474149594.

Release disposition:

• Public PR runtime: ship provider runtime 5.0.3 in agent-collab 7.0.1 #188 and runtime 5.0.2 remain held and must not merge, tag, publish, install, activate, or restart.
• After design convergence, implementation requires a separately governed workspace PR, currently planned as provider runtime 5.0.3 / wire schema 10.
• Only after that workspace merge may both architectures be rebuilt, signed, notarized, re-imported into the public candidate, and qualified with provider-free coverage plus one installed immutable semantic canary for affected Gemini and Grok behavior.
• Issue Gemini repository review can expand to user-home root and fail permission check #165 remains open until those installed bytes prove the authorization/provenance behavior.

No raw provider output, prompt/source content, private path, credential, or provider result is included here.

[sumitake]

Additive provider-free audit of the current authorization/provenance design checkpoint at af440d707f17e0187a7926fc818dd566f39dbed9:

• This was read-only: no edits, provider calls, network/provider activity, release action, or recursive delegation.
• The current Gemini failed-event fixture is pathless. Existing tests add an outside location synthetically and assert the old binary outside_source result.
• The current Gemini event projector retains lifecycle identity/state/status, explicit success, and locations, but drops any carrier permission-decision fact.
• The current normalizer and aggregator track only success, failure, incomplete, and unknown outcomes. Consequently, an outside permission denial omitted from the failed-outcome stream can coexist with the externally observed 43 successes / 0 failures and is indistinguishable from no attempted outside access.
• No exact local producer/event record for the PR runtime: ship provider runtime 5.0.3 in agent-collab 7.0.1 #188 request or its 43/0 stream was available. The immutable public trace remains the evidence anchor; this audit does not claim a locally reproduced producer shape.

Blocking design implication:

The implementation must first identify and closed-validate the carrier's real typed permission field and stable lifecycle correlation. A provisional sanitized permission.decision=denied fixture may describe the required shape, but must not be represented as current Agy producer truth. Unknown, free-form, prose-derived, duplicate, malformed, missing, conflicting, or identity-mismatched permission information is ambiguous and remains fail-closed.

Minimum red-first provider-free proof:

1. Pre- and post-projection tests preserve only an admitted closed permission decision; content, prose, tool name, model, CLI version, URL, and passive metadata cannot authorize.
2. An aggregate stream with 43 successful in-root reads plus one correlated typed denied outside attempt reports success=43, failed=0, and denied_local_attempts=1; the denial is a separate fact and does not poison a later grounded result.
3. The same stream without a valid typed permission correlation is ambiguous/fail-closed; an outside success is unauthorized; canonical sibling/home/symlink escapes and lifecycle mismatches fail closed.
4. Headless operation proves no permission bypass, no carrier sandbox, one EOF-delivered managed process, long pre-tool progress/event flushing, full native tools, continued in-root reads, and path-free public remote support after a denial.
5. No interaction prompt, tool/version fingerprint, replay, failover, or prose-level semantic inference is introduced.

This is a blocking acceptance input to the already-authorized exact-head distinct-family design review, not a new implementation workstream. The canonical design/release checkpoint remains #165 (comment). PR #188 and all release/install/activation actions remain frozen.

[sumitake]

Additive final read-only design audit of the docs-only working revision based on af440d707f17e0187a7926fc818dd566f39dbed9 identified four blocking contradictions. The auditor made no edits, provider calls, network/provider requests, GitHub writes, or recursive delegations.

1. Admission-table contradiction. The carrier-specific section correctly states that current Agy has no proven closed per-call permission decision and that a visible untyped outside lifecycle must remain ambiguous/fail-closed. The generic admission table still says a denied outside attempt is accepted and recorded without conditioning that outcome on a carrier-proven typed decision. The table must state that this row is available only to carriers with a real closed decision correlated to the exact failed lifecycle. Agy wire 10 cannot take that row or increment denied_local_attempts until such a signal is proven.

2. Unproven repository-root . seam. The design includes the root-listing result-contract mismatch in the same runtime generation, but no exact provider-free root-list regression currently proves it. Existing nested-directory listing coverage is not causal proof. Add the red root-list fixture before retaining this seam, or remove it from this generation.

3. Tool/web preservation is not executable proof. The design requires no permission bypass, no carrier sandbox, full native tools, internet/web support, no interaction prompt, and capability-neutral authorization. Current Agy evidence projection still relies on exact tool names, while the design rejects tool-name fingerprints. The design needs an executable capability-neutral projection/test contract that compares the carrier-reported capability surface before and after denial, proves no prompt, carries a path-free remote-support event through the final grounded result, and never uses a decorated tool name as authority.

4. Unproven invocation expansion. The design proposes restoring --new-project and --mode plan, but the current builder omits both, current tests assert their absence, and historical-option coverage rejects --mode. Remove this expansion as YAGNI or add a checked-in carrier-shaped capability proof showing each flag is supported and necessary for the authorization fix.

These are blocking design findings, not implementation requests. They must be resolved in one corrected design revision before the exact-head distinct-family review can converge. Any head-changing correction invalidates review evidence for the predecessor head. PR #188 and all build/release/install/activation actions remain frozen. Canonical prior checkpoint: #165 (comment). Provider-shape audit: #165 (comment).

[sumitake]

Design-audit re-check of the current working diff:

Resolved since the prior blocker comment:

1. The generic denied-attempt admission row is now explicitly conditional on a real closed typed permission decision correlated to the exact lifecycle, and it explicitly excludes current Agy.
2. An exact provider-free repository-root listing regression now exists. The new Grok test test_completed_repository_root_list_is_canonical_evidence was run and is red with actual inspected_paths=[] versus expected ["."], proving the previously inferred . seam before implementation.
3. The unsupported Agy --new-project / --mode plan expansion has been removed. The design now preserves the established argv and prohibits those speculative flags.

One blocking gap remains:

The design specifies a matched pair of carrier-shaped Agy process fixtures intended to prove unchanged carrier-reported tools, no interactive reply, public remote-support continuation, clean canonical in-root evidence, and invariance under renamed/decorated tool labels. No such Agy fixture or test exists in the current diff, and the production Gemini evidence path still gates on exact tool names.

Before design review can converge, add the smallest fixture/test using only already observed closed Agy producer fields and define a capability-neutral projection contract. It must:

• prove the reported capability set is unchanged;
• require no interactive prompt/reply;
• retain path-free public remote support as non-evidentiary context;
• preserve canonical in-root repository evidence;
• remain invariant when presentation/tool labels change; and
• avoid inventing a typed permission signal that current Agy does not emit.

If real producer fields cannot support that proof, the design must state the limitation and use a causal prevention path rather than claim preservation or guess from prose/free-form metadata.

This remains one design-review blocker, not a new workstream. The release freeze remains unchanged. Prior blocker inventory: #165 (comment).