Stabilize GitHub peer authorization reads #2

Merged

hermes-os merged 2 commits from fix/stable-agent-authorization-read into main

2026-08-05 13:53:17 +00:00

hermes-os commented

2026-08-02 01:34:48 +00:00

(Migrated from github.com)

Summary\n- bind the canonical GitHub peer authorization file to one no-follow, nonblocking descriptor\n- reject inode or metadata replacement across the full read and cap input at 256 KiB\n- cover root-pinned identity, atomic replacement, FIFO replacement, and oversized inputs\n\n## Verification\n- 24 focused handoff tests passed\n- ./validate.sh passed\n- agent-repo-check --strict passed\n- exact-candidate independent review passed with no findings

## Summary\n- bind the canonical GitHub peer authorization file to one no-follow, nonblocking descriptor\n- reject inode or metadata replacement across the full read and cap input at 256 KiB\n- cover root-pinned identity, atomic replacement, FIFO replacement, and oversized inputs\n\n## Verification\n- 24 focused handoff tests passed\n- ./validate.sh passed\n- agent-repo-check --strict passed\n- exact-candidate independent review passed with no findings

👍 1