Harden TQQQ trusted snapshot verification

[Pigbibi]

Summary

• verify TQQQ R1 snapshot members through a stable directory descriptor while preserving caller path metadata
• add an authenticated trusted snapshot package with strict JSON/error normalization and single-owner descriptor lifecycle
• cover the prior deterministic CI fingerprint and all four known P1/P2 findings with platform-independent regressions

Validation

• focused: 39 passed
• full: 584 passed, 3 skipped
• Ruff: pass
• compileall: pass
• diff-check / exact four-file scope: pass

Boundaries

• offline/provider-free; no capture, replay, plugin, broker, capital, deploy, or live action
• no dependency, public API/schema, workflow, ruleset, or settings change
• size=0

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f9819c81c4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Enforce the JSON payload size bound

When read_strict_json is called directly with untrusted bytes larger than MAX_EVIDENCE_BYTES, it decodes and parses the entire payload without any length check, allowing a large flat array or object to consume unbounded additional memory despite the function's promise to decode bounded JSON. The package loader happens to pre-bound file inputs through _read_regular, but this newly public helper is also exercised directly and should reject oversized payloads before decode().

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Reject trailing-slash symlink snapshot roots

When snapshot_dir is supplied as a string ending in / or /. and its final directory component is a symlink, POSIX resolves that symlink before applying O_NOFOLLOW, so this open succeeds and the loader accepts a root that verify_tqqq_r1_snapshot rejects after Path normalization. This bypasses the intended non-symlink trusted-input boundary and leaves TrustedSnapshotPackage.snapshot_dir referring to a mutable symlink; normalize and reject such paths or open the final component relative to its parent descriptor.

Useful? React with 👍 / 👎.

[Pigbibi]

Fail-closed settlement for immutable head f9819c81c40d58341035aad823764654d3fdb216:

• required test run 30459310995: SUCCESS
• unique GitHub Codex App exact-head review PRR_kwDOR_7pX88AAAABHqdDqA: terminal
• current unresolved P2 threads: PRRT_kwDOR_7pX86UyWjm, PRRT_kwDOR_7pX86UyWju
• evidence fingerprint: 471f727d87f5b7e78f99504e775dfb80609051c4054456003bd193047215ce46

The high-risk single-review immutable-head contract forbids post-review patching or re-review. Closing unmerged; no review-thread mutation, rerun, or merge. P3 remains unauthorized and size=0.