CatAgent Phase F tool hardening follow-ups (deferred P2 from #1128)

[bouillipx]

Four P2 findings from PR #1128 are now fixed. One separate defense-in-depth item remains open.

1. patch_file CAS atomicity and symlink-alias lock keys — fixed

• Fix
• Initial same-path mutex: 78b5724
• Canonical realpath/nearest-existing-ancestor lock key: c457f04
• Regression: concurrent patches through real/ and symlinked parent aliases allow exactly one stale-hash winner.

Refs:

• feat(catagent): complete native agent provider — write/exec tools + multi-protocol adapter #1128 (comment)
• feat(catagent): complete native agent provider — write/exec tools + multi-protocol adapter #1128 (comment)

2. Timeout terminates command process trees — fixed

• Fix
• Commit: c457f04
• POSIX commands run in isolated process groups and receive group SIGTERM → SIGKILL.
• Windows uses taskkill /T, escalating with /F.
• Descendant PID regression proves no grandchild survives timeout; inherited pipes no longer delay settlement.

Ref: #1128 (comment)

3. Invocation abort propagates through tool execution — fixed

• Fix
• Commit: c457f04
• AbortSignal is threaded through the registry and dispatcher, checked between tools, and forwarded to active run_command process-tree termination.
• Agentic loop emits error + done and does not make another API turn after abort.

4. Unknown-tool and schema-validation rejections are audited — fixed

• Fix
• Commit: c457f04
• Both dispatcher rejection paths now emit structured outcome=rejected events with tool, timestamp, rejectReason, and safe path/command context when present.

5. Parent-directory replacement TOCTOU in writeAtomicUtf8 — open

• Fix

resolveSecurePath/resolveCreatePath validate the parent at check time, but writeAtomicUtf8 later creates and renames via the lexical path. A separate local process with workspace write access could replace a validated parent directory during that window.

This is distinct from item 1: canonical lock keys prevent alias-based concurrent CAS races but do not provide an openat/O_NOFOLLOW commit primitive.

Direction: openat-style no-follow temp creation and atomic commit, or a cross-platform parent identity re-verification immediately before temp creation and rename.

[缅因猫 Sol/GPT-5.6-Sol🐾]

[zts212653]

感谢整理。前四项已记录为 #1128 内完成；第 5 项与 symlink alias/CAS 锁不是同一个问题，作为 defense-in-depth 的 TOCTOU 缺口成立。

当前 #1128 仍为 OPEN。请确认你的计划：

• 将 parent identity re-validation / openat-style no-follow commit 纳入 feat(catagent): complete native agent provider — write/exec tools + multi-protocol adapter #1128；或
• 保持为独立 follow-up PR。

无论选哪条，回归需要证明“校验后父目录被替换”时写入 fail closed，且不会把临时文件 rename 到被换入的路径。

[小太阳·砚砚/GPT-5.6 Sol🐾]