Skip to content

Universal Code cumulative baseline and B12 sandbox budget / Drydock corrections - #235

Merged
Qiyuanqiii merged 85 commits into
mainfrom
codex/uc-b12-review-699f26c0
Oct 4, 2026
Merged

Qiyuanqiii merged 85 commits into
mainfrom
codex/uc-b12-review-699f26c0

Conversation

@NanaseInori

Copy link
Copy Markdown
Contributor

Live Sandbox candidates can reject legitimate Supervisor wait accounting, and repeated Drydock Git inspections can exceed the existing foreground timeout. B12 rechecks current budgets under the exact active Run lease and reduces duplicate inspections while retaining fresh full binding validation. The SQL trigger correction is still pending, so this is an incomplete checkpoint for dot's review.

Scope and immutable review anchors:

  • Base main: 1c9775dc88055cc4638ff9a846013b7cf5b6180a.
  • Frozen head: 699f26c0329805658806f060d155c4f8e9486795; tree: 335101a903c736356ea4c388076a142ac667eec4.
  • The main-to-head PR contains the cumulative A/B/C Universal Code baseline: 85 commits and 375 changed files. These are not all B12 changes.
  • B12 itself is the 12-file diff from reviewed cumulative baseline 34a61426822690456e103ee342d414c3ff61998b to the frozen head (+623/-46).
  • Local v182 work is excluded. No raw logs or evidence archives are part of this publication.

Targeted Windows race-test results at this checkpoint:

  • Application: 27 PASS / 5 FAIL / 0 SKIP.
  • Store: 38 PASS / 3 FAIL / 0 SKIP.
  • Repository: 4 PASS / 0 FAIL / 0 SKIP.
  • Foreground Sandbox execution passes in all three approval modes with the original 20-second timeout unchanged. Recovery rejection and no-host-fallback cases also pass.
  • Three concurrent Supervisor-wait cases and five candidate/lifecycle/preflight/evidence cases still fail against the frozen-usage SQL triggers. v182 is being implemented and tested separately to address this remaining boundary.

The affected Git, SQLite and native authority paths were exercised with a controlled transport fixture. No real paid provider or Docker daemon was used; this is not full platform, OS isolation or complete-suite acceptance. Credential-pattern matches in the reachable Git objects were reviewed as synthetic test fixtures; pattern scanning is not an exhaustive guarantee.

Draft only. Dot's final review and acceptance remain pending. This branch is frozen at the stated head; do not mark ready or merge.

Exercise the production Docker adapter through existing controlled transports, real Drydock and SQLite. Cover stale owned workspace refusal and enabled-host fallback controls in all three modes. Preserve the failing positive cases exposing the native Docker workspace_access-only gate; production wiring remains owned by C.
Exercise the production Docker adapter through existing controlled transports, real Drydock and SQLite. Cover stale owned workspace refusal and enabled-host fallback controls in all three modes. Preserve the failing positive cases exposing the native Docker workspace_access-only gate; production wiring remains owned by C.

(cherry picked from commit ff5225e)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants