Repository navigation

Add audit fix plan for `box new` clean-checkout failures - #4

Merged

bmdavis419 merged 28 commits into

mainfrom

audit/2026-06-30-box-new-fixes

Jul 1, 2026

Merged

Add audit fix plan for `box new` clean-checkout failures#4
bmdavis419 merged 28 commits into
mainfrom
audit/2026-06-30-box-new-fixes

Commits on Jun 30, 2026
- Add audit fix plan: box new is broken on a clean checkout
  
  Ben Davis
  and
  claude
  committed
  c56fad1
- fix(P0-1): re-pin Hermes installer SHA256 to current upstream
  
  Ben Davis
  and
  claude
  committed
  bf6c0fb
- fix(P1-5): decompression-bomb gate now bounds actual extracted bytes
  
  Ben Davis
  and
  claude
  committed
  762aead
- fix(P0-2): stop verify_required from silently killing provisioning
  
  Ben Davis
  and
  claude
  committed
  92cf51c
- fix(P1-1): lock hb's gateway check-then-spawn against double-spawn
  
  Ben Davis
  and
  claude
  committed
  85c0413
- fix(P0-3): preserve failure evidence before rollback destroys it
  
  Ben Davis
  and
  claude
  committed
  ecb1a53
- fix(P1-4): pin agent tooling versions instead of always installing latest
  
  Ben Davis
  and
  claude
  committed
  a557058
- fix(P1-2): supervise the hb-workload loop process
  
  Ben Davis
  and
  claude
  committed
  4f334c6
- fix(P1-3): gateway_is_disabled() now checks process state too
  
  Ben Davis
  and
  claude
  committed
  14b89ff
- fix(P2-1): make assets repair mode able to heal Hermes/Executor
  
  Ben Davis
  and
  claude
  committed
  32404eb
- test(P2-2): add coverage for box ls/rm/stop/start/enter and two gaps
  
  Ben Davis
  and
  claude
  committed
  a912ac2
- ci(P2-3): run make check on every push and PR to main
  
  Ben Davis
  and
  claude
  committed
  618b558
- refactor(P2-4): split tests/regressions.sh, extract shared tests/lib.sh
  
  Ben Davis
  and
  claude
  committed
  c482252
- fix(ci): pin shellcheck to v0.11.0 instead of apt's drifting version
  
  Ben Davis
  and
  claude
  committed
  01a38a5
- fix(test): give cli-surface.sh's empty-registry ls test the fixture PATH
  
  Ben Davis
  and
  claude
  committed
  9eacede
- fix(P3-1): drop personal path default from box.env
  
  Ben Davis
  and
  claude
  committed
  87210fb
- fix(P3-2): harden the three tx9 systemd units
  
  Ben Davis
  and
  claude
  committed
  658c7cb
- fix(P3-3): ship NAS automount template and backup retention
  
  Ben Davis
  and
  claude
  committed
  00b0a9e
- docs(P3-4): make README the single source of truth for duplicated content
  
  Ben Davis
  and
  claude
  committed
  5a10417
- fix(review): replace guest/hb's daemon lock with flock, fix real races
  
  Ben Davis
  and
  claude
  committed
  c436640
- fix(review): Makefile fail-fast loop + curl failure masking
  
  Ben Davis
  and
  claude
  committed
  2167b4b
- fix(review): don't rely on root home's default permissions for agent traversal
  
  Ben Davis
  and
  claude
  committed
  5391170
- fix(review): macOS portability, temp-dir leak, and minor nitpicks
  
  Ben Davis
  and
  claude
  committed
  65ad3b4
- fix(review): close cmd_load's failure-evidence gaps, harden transcript saves
  
  Ben Davis
  and
  claude
  committed
  df2b2c5
- fix(review): install_executor's idempotency guard now checks version
  
  Ben Davis
  and
  claude
  committed
  04cc316
- docs: note that P1-1's original mkdir-based lock was superseded
  
  Ben Davis
  and
  claude
  committed
  ee8e7d0
Commits on Jul 1, 2026
- refactor: dedupe MCP handshake between box and guest/hb, note deferred Go rewrite
  Ben Davis
  committed
  b5583a7
- fix(review): cmd_load reports which stage failed, matching cmd_new
  Ben Davis
  committed
  f564a22

Commits

Commits on Jun 30, 2026

Commits on Jul 1, 2026