Harden subagent safety boundaries: symlink rejection, bounded reads, worker loop hardening (continuation of PR #1)#2

Draft

bgoertzel-sing wants to merge 148 commits into

hlgreenblatt:mainfrom

bgoertzel-sing:agent/threadkeeper-hardening-next

Commits on Jun 17, 2026

feat(threadkeeper): configurable hybrid OmegaClaw mesh for budget-aware orchestration

hlgreenblatt
and
claude
committed

Commits on Jun 26, 2026

feat(demo): live 4-engine mesh dashboard, bulk-worker demo, DR docs

hlgreenblatt
and
claude
committed

Commits on Jun 27, 2026

docs: add RSI demonstration + transcript; fix upstream-sync wording

hlgreenblatt
and
claude
committed
demo: add escalation-demo.md — honest smart-routing demo (easy->local $0, hard->GLM+DeepSeek). Shows 'escalate only when needed' with all tiers, fractions of a cent.

hlgreenblatt
and
claude
committed
docs: add pitch-artifacts-slide.md — verified artifact list for the 3-min pitch

hlgreenblatt
and
claude
committed

Commits on Jun 28, 2026

dashboard: chat-first UX + honest, persistent counters

hlgreenblatt
and
claude
committed
dashboard: dynamic Primary tile + current-config local engines + full-history ledger

hlgreenblatt
and
claude
committed
Lift the escalation policy from Python into MeTTa (Atomspace rules)

hlgreenblatt
and
claude
committed
Wire should_escalate into the live delegate path (cloud-gating)

hlgreenblatt
and
claude
committed
README: honest scope note on what the dashboard numbers mean

hlgreenblatt
and
claude
committed

Commits on Jun 30, 2026

Harden subagent safety boundaries
Ben Goertzel
committed
Harden subagent calls and file writes
Ben goertzel
committed

Commits on Jul 1, 2026

Persist structured subagent run records
Ben goertzel
committed
Add subagent quotas and escalation integrity
Ben goertzel
committed
Add subagent task contracts
Ben goertzel
committed
Make subagent append writes atomic
Ben goertzel
committed
Require explicit subagent provider metadata
Ben goertzel
committed
Pin subagent persona integrity
Ben goertzel
committed
Harden subagent persona examples
Ben goertzel
committed
Add subagent LLM rate limit guard
Ben goertzel
committed
Add subagent LLM concurrency guard
Ben goertzel
committed
Lock subagent file writes
Ben goertzel
committed
Harden subagent emit protocol
Ben goertzel
committed
Validate subagent task contracts
Ben goertzel
committed

Commits on Jul 2, 2026

Tighten subagent task contract validation
Ben goertzel
committed
Record subagent setup failures
Ben goertzel
committed
Structure no-tool subagent setup errors
Ben goertzel
committed
Sandbox subagent persona prompts
Ben goertzel
committed
Skip Docker cleanup when unavailable in mock pytest gate
Ben goertzel
committed
Add subagent transcript checksums
Ben goertzel
committed
Allow task contracts to narrow subagent tool quotas
Ben goertzel
committed
Index subagent run records
Ben goertzel
committed
Fail closed on missing subagent cloud client
Ben goertzel
committed
Harden subagent numeric env parsing
Ben goertzel
committed
Run subagent shell commands in workspace
Ben goertzel
committed
Restrict subagent shell executable paths
Ben goertzel
committed
Sanitize subagent shell PATH
Ben goertzel
committed

Commits on Jul 3, 2026

Scrub subagent shell environment
Ben goertzel
committed
Cap subagent tool calls per turn
Ben goertzel
committed
Bound subagent read-file output
Ben goertzel
committed
Add dispatch wall-clock timeout and worker token accounting
Ben goertzel
committed
Hash-chain subagent run index
Ben goertzel
committed
Add subagent patch proposal mode
Ben goertzel
committed
Add queue-only subagent dispatch mode
Ben goertzel
committed
Add optional adjudicator gate for high-stakes subagent outputs
Ben goertzel
committed
Document requires_adjudication task contract in subagent reference
Ben goertzel
committed
Add queued subagent worker primitive
Ben goertzel
committed
Add bounded queued dispatch drain helper
Ben goertzel
committed
Retain failed queued subagent claims
Ben goertzel
committed
Ignore queue result sidecars when draining
Ben goertzel
committed
Add subagent candidate review helper
Ben goertzel
committed

Commits on Jul 4, 2026

Add subagent run index verifier
Ben goertzel
committed
Reject queue result sidecars as worker tasks
Ben goertzel
committed
Preserve queued subagent task contracts
Ben goertzel
committed
Verify queued subagent task checksums
Ben goertzel
committed
Bound optional subagent shell argv
Ben goertzel
committed
Bound subagent shell output controls
Ben goertzel
committed
Validate queued subagent task schema
Ben goertzel
committed
Tighten queued task contract schema
Ben goertzel
committed
Reject coerced queued task integers
Ben goertzel
committed
Preserve queued subagent cancellation token
Ben goertzel
committed
Add bounded queued worker loop
Ben goertzel
committed
Add queued worker loop lock metadata
Ben goertzel
committed
Add bounded subagent worker loop runner
Ben goertzel
committed
Add worker loop runtime-cap and error-continuation tests
Ben goertzel
committed

Commits on Jul 5, 2026

Validate worker loop stop file config
Ben goertzel
committed
Validate worker loop explicit bounds
Ben goertzel
committed
Add artifact-local worker loop smoke
Ben goertzel
committed
Load env files in worker loop runner
Ben goertzel
committed
Reject unsafe worker env-file keys
Ben goertzel
committed
Bound worker env file parsing
Ben goertzel
committed
Add max_consecutive_errors to worker loop
Ben goertzel
committed
Bound worker loop results and add live lock metadata
Ben goertzel
committed
Bound transcript turn records and add retry backoff jitter
Ben goertzel
committed
Reject expired queued tasks before worker LLM calls
Ben goertzel
committed

Commits on Jul 6, 2026

Add dispatch-level token budget cap
Ben goertzel
committed
Add graceful SIGTERM/SIGINT handling to worker loop
Ben goertzel
committed
Sanitize absolute paths from tool error messages
Ben goertzel
committed
Detect stale worker lock from crashed previous worker
Ben goertzel
committed
Add current-task tracking to worker loop lock metadata
Ben goertzel
committed
Add completion fields and queue depth to worker loop lock metadata
Ben goertzel
committed
Add per-task duration and total runtime to worker loop results
Ben goertzel
committed
Bound transcript summary field and reject empty shell commands
Ben goertzel
committed
Add run index entry bounding with rotation
Ben goertzel
committed
Reject empty search/tavily-search/technical-analysis queries
Ben goertzel
committed
Add output size cap for search/tavily-search/technical-analysis tools
Ben goertzel
committed

Commits on Jul 7, 2026

Add workspace file size cap for write-file and append-file
Ben goertzel
committed
Make JSON audit read cap configurable
Ben goertzel
committed
Bound final subagent emit size
Ben goertzel
committed
Reject non-finite numeric env knobs
Ben goertzel
committed
Bound raw subagent worker responses
Ben goertzel
committed
Bound subagent run index audits
Ben goertzel
committed
Bound native worker HTTP responses
Ben goertzel
committed
Bound transcript hash audit reads
Ben goertzel
committed
Bound run index append tail reads
Ben goertzel
committed
Require string subagent tool arguments
Ben goertzel
committed
Require string final emits
Ben goertzel
committed
Confine worker control token paths
Ben goertzel
committed

Commits on Jul 8, 2026

Bound patch proposal transcript content
Ben goertzel
committed
Bound shell output memory capture
Ben goertzel
committed
Bound checksum sidecar reads
Ben goertzel
committed
Bound candidate review sidecar reads
Ben goertzel
committed
Bound escalation policy integrity reads
Ben goertzel
committed
Bound persona setup reads
Ben goertzel
committed
Bound worker LLM state reads
Ben goertzel
committed
Stream transcript audit hashing
Ben goertzel
committed
Bound worker lock metadata reads
Ben goertzel
committed
Reject symlink async worker locks
Ben goertzel
committed
Reject symlink queued task records
Ben goertzel
committed
Stop async worker at consecutive error cap
Ben goertzel
committed

Commits on Jul 9, 2026

Clear async worker signal state after run
Ben goertzel
committed
Tighten inline task contract list validation
Ben goertzel
committed
Reject symlink run index files
Ben goertzel
committed
Reject symlink integrity sidecars
Ben goertzel
committed
Reject symlink workspace file locks
Ben goertzel
committed
Harden run index tail and rotation writes
Ben goertzel
committed
Reject symlink LLM guard state
Ben goertzel
committed
Reject symlink transcript audit records
Ben goertzel
committed
Harden worker usage accounting writes
Ben goertzel
committed
Reject symlink escalation policies
Ben goertzel
committed
Reject symlink audit write targets
Ben goertzel
committed
Use nofollow opens for audit reads
Ben goertzel
committed
Reject symlink persona setup files
Ben goertzel
committed

Commits on Jul 10, 2026

Harden budget audit log files
Ben goertzel
committed
Harden budget config reads
Ben goertzel
committed
Durably fsync ThreadKeeper audit writes
Ben goertzel
committed
Harden workspace file tool reads with O_NOFOLLOW
Ben goertzel
committed
Reject symlink audit parent directories
Ben goertzel
committed
Reject symlink workspace file parents
Ben goertzel
committed
Reject trailing payloads after quoted emits
Ben goertzel
committed
Harden worker usage log parent
Ben goertzel
committed
Use nofollow fd for append size checks
Ben goertzel
committed
Reject symlink audit ancestor directories
Ben goertzel
committed
Reject symlink queued dispatch directories
Ben goertzel
committed
Reject symlink LLM guard state parents
Ben goertzel
committed
Reject non-relative file tool paths
Ben goertzel
committed

Commits on Jul 11, 2026

Use open fds for setup size checks
Ben goertzel
committed
Harden task contract path validation
Ben goertzel
committed
Bound run-index audit reads
Ben goertzel
committed
Harden budget audit log parents
Ben goertzel
committed
Avoid path getsize in transcript audits
Ben goertzel
committed
Bound budget accounting reads after open
Ben goertzel
committed
Validate persona config scalar fields
Ben goertzel
committed
Reject unquoted emit trailing payloads
Ben goertzel
committed
Reject symlink subagent workspaces
Ben goertzel
committed
Reject control chars in subagent command args
Ben goertzel
committed
Bound queued dispatch path arguments
Ben goertzel
committed
Reject control chars in run control paths
Ben goertzel
committed