D3 F1 follow-up — bind computed network keys by symbol by LogicDuke · Pull Request #66 · LogicDuke/agentbridge

LogicDuke · 2026-08-29T21:16:59Z

Stack

Protected feature parent:

PR Cockpit D3 — Read-only dashboard host (Stage A) #55 — cockpit/d3-readonly-dashboard-host
protected HEAD: 5ae2b786ad6dc4653286d4c2b50e1fd705daa974

Network-purity parent:

PR D3 network-egress purity — lexical binding enforcement #64 — repair/d3-network-egress-purity
HEAD: b5b07a38be7c809cd01a059a638c1917e4e972cf
remains Draft

Affected F1 parent:

PR D3 F1 — close computed global network member gap #65 — repair/pr64-f1-computed-network-members
exact affected/base HEAD:
8e32c7fbb1eb15121cc35c48d6b778998f03516b
remains Draft

This PR is a quarantined stacked follow-up repair.

Finding

CURRENT / P2 — computed global-network const substitution used identifier text without proving binder identity.

A same-named const in another lexical scope could be substituted for an unrelated identifier reference, producing a false-positive network capability.

Verified example:

function f() {
  const Infinity = 'fetch';
}
void (globalThis as any)[Infinity];

The outer Infinity does not resolve to the inner const, but the prior NET static-string path could synthesize "fetch" from identifier text.

Bounded repair

The NET-specific computed-global-member path now requires TypeScript binder identity before substituting an Identifier-backed collected const.

The repair preserves:

genuine same-symbol computed fetch / WebSocket rejection
literal and concatenated static-member resolution
fail-closed handling of indeterminate global keys
RC/HA existing conservative text-only policy
F2 reflective-socket finding
F3 label finding
EventSource deferral
node:http/export policy
socket Rule A/A2/B

No handwritten scope engine, taint analysis, alias propagation, type-resolution expansion, whole-program analysis, module graph analysis, fixpoint, or runtime sandbox was introduced.

Exact identity

Head commit:

0a1a94fc16e345376f572363757a0fe4c0bcc42b

Changed file exactly:

tests/cockpit-host/purity.test.ts

Validated patch:

SHA256: 57583FBE7C854F21FD29F28C4FF9207963D4F343F46749BCAA213EF3243BA52C
Bytes: 12350

Independent validation:

PASS_PR65_P2_CONST_BINDING_IDENTITY_INDEPENDENT_VALIDATION

Full suite:

2368 passed
8 skipped
0 failed

Typecheck, lint, build, and git diff --check: PASS

Authority

This PR is DRAFT.

It is evidence/proposal only.

It is NOT authorized for Ready or merge yet.

Human merge authority is preserved.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6vGgvRSKBesMRt15DqZhn

coderabbitai · 2026-08-29T21:17:09Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 17f2e9b7-43cd-4f1d-b300-a54442257d5d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0a1a94fc16

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-29T21:25:58Z

+    const value = constMap.get(n.text);
+    if (value === undefined) return null;
+    return bindsToCollectedConst(n, checker) ? value : null;


Bind identifiers inside collected constant initializers

The binder gate validates only the final element-access identifier, while its value has already been recursively computed by the text-only collectStringConsts. For example, function f(){ const Infinity = 'fetch'; } const key = Infinity; void globalThis[key]; makes key resolve to its own const and pass this check, but the initializer's out-of-scope Infinity is incorrectly folded from the inner const, so this benign access is still reported as outbound networking. The collected representation must retain and validate binding identity throughout initializer resolution, not only at the outer key reference.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-08-29T21:26:01Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T08:08:32.390386Z	`f2da06a`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6vGgvRSKBesMRt15DqZhn

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e7b4fa6b73

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-29T22:39:10Z

+    new Set<ts.Declaration>(),
+    new Map<ts.Declaration, string | null>(),
+    budget,


Share the declaration memo across member resolutions

When a source uses the same N-declaration const chain in M computed accesses, constructing a fresh memo here makes every access traverse the chain again, producing Θ(M×N) binder work; the visitor also invokes this for element accesses on unrelated receivers. The previous collectStringConsts path resolved each declaration once per source, so generated or growing host code with repeated computed keys can now make the purity test disproportionately slow, while the per-resolution visit cap does not limit the cumulative work. Keep the declaration-result cache for the whole usesOutboundNetwork traversal rather than recreating it for each member.

Useful? React with 👍 / 👎.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6vGgvRSKBesMRt15DqZhn

LogicDuke · 2026-08-30T08:06:16Z

@codex review

chatgpt-codex-connector · 2026-08-30T08:08:31Z

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: f2da06abe3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

test(cockpit): bind computed network keys by symbol

0a1a94f

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6vGgvRSKBesMRt15DqZhn

LogicDuke marked this pull request as ready for review August 29, 2026 21:24

chatgpt-codex-connector Bot reviewed Aug 29, 2026

View reviewed changes

LogicDuke marked this pull request as draft August 29, 2026 21:29

test(cockpit): memoize binder-safe network keys

e7b4fa6

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6vGgvRSKBesMRt15DqZhn

LogicDuke marked this pull request as ready for review August 29, 2026 22:35

chatgpt-codex-connector Bot reviewed Aug 29, 2026

View reviewed changes

LogicDuke marked this pull request as draft August 30, 2026 06:35

test(cockpit): share binder-safe network memo

f2da06a

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N6vGgvRSKBesMRt15DqZhn

LogicDuke marked this pull request as ready for review August 30, 2026 08:01

LogicDuke merged commit df55f27 into repair/pr64-f1-computed-network-members Aug 30, 2026
2 checks passed

LogicDuke mentioned this pull request Aug 30, 2026

D3 F1 — close computed global network member gap #65

Merged

Navigation Menu

D3 F1 follow-up — bind computed network keys by symbol - #66

D3 F1 follow-up — bind computed network keys by symbol#66
LogicDuke merged 3 commits into
repair/pr64-f1-computed-network-membersfrom
repair/pr65-p2-const-binding-identity

LogicDuke commented Aug 29, 2026

Uh oh!

coderabbitai Bot commented Aug 29, 2026 •

edited

Loading

Review skipped

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Aug 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Aug 29, 2026

Uh oh!

LogicDuke commented Aug 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

LogicDuke commented Aug 29, 2026

Stack

Finding

Bounded repair

Exact identity

Authority

Uh oh!

coderabbitai Bot commented Aug 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 29, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 29, 2026

Choose a reason for hiding this comment

Uh oh!

LogicDuke commented Aug 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Aug 29, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Aug 29, 2026 •

edited

Loading