v0.107.2

the adversarial pass

published 2026-08-02 · 8 assets · the catalog this site serves

An adversary was set on 0.107.1’s six boundaries with one instruction, break it. Three of six claims fell, and hunting what the first repairs still let through found four more · every fix proven on the binary before the code was touched, each carrying the mutation that makes it fail. Two doors were open: a permit could name a system root by shouting it (/ROOT/x* passed where /root/./x* refused: macOS folds case, so the comparison does now, and the Linux side can only ever refuse a path that does not exist), and a secret redacted in the trace was printed on stdout (outputs: rides RunOutcome past the event lane · the map is scrubbed at any depth now). Three guards judged less than they claimed: the dangerous-environment floor is proven entry by entry (forty names, both halves pinned), a tainted nika:notify target is judged whatever channel carries it, and the run guard speaks only about runs (an unreadable payload no longer blocks ls). And one law had two implementations: the MCP spawn now composes its child environment through the same function as the exec runner · the copy was equivalent, and equivalence was exactly what nothing guaranteed.

vendored from the public release record · re-vendored at the train cadence