Enforce repository I/O security boundary

.github/workflows/validate.yml

@@ -44,9 +44,22 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
+      - name: Harden ephemeral Linux runner home chain
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          mapfile -d '' -t account_home_chain < <(python -I -S -B -c 'import os, pathlib, pwd; home = pathlib.Path(pwd.getpwuid(os.geteuid()).pw_dir); current = pathlib.Path(home.anchor); chain = [current]; [(chain.append(current := current / component)) for component in home.parts[1:]]; print(*(str(path) for path in chain), sep="\0", end="\0")')
+          sudo setfacl --remove-all --remove-default -- "${account_home_chain[@]}"
+          sudo chmod go-w -- "${account_home_chain[@]}"
+          account_home="${account_home_chain[${#account_home_chain[@]}-1]}"
+          private_tmp="$account_home/codexqb-ci-tmp"
+          install -d -m 0700 -- "$private_tmp"
+          printf 'TMPDIR=%s\n' "$private_tmp" >> "$GITHUB_ENV"
       - name: Run the short dependency-free gate
         run: make check-fast
       - name: Run dependency-free unit contracts
@@ -72,9 +85,22 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
+      - name: Harden ephemeral Linux runner home chain
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          mapfile -d '' -t account_home_chain < <(python -I -S -B -c 'import os, pathlib, pwd; home = pathlib.Path(pwd.getpwuid(os.geteuid()).pw_dir); current = pathlib.Path(home.anchor); chain = [current]; [(chain.append(current := current / component)) for component in home.parts[1:]]; print(*(str(path) for path in chain), sep="\0", end="\0")')
+          sudo setfacl --remove-all --remove-default -- "${account_home_chain[@]}"
+          sudo chmod go-w -- "${account_home_chain[@]}"
+          account_home="${account_home_chain[${#account_home_chain[@]}-1]}"
+          private_tmp="$account_home/codexqb-ci-tmp"
+          install -d -m 0700 -- "$private_tmp"
+          printf 'TMPDIR=%s\n' "$private_tmp" >> "$GITHUB_ENV"
       - name: Run Goal and Apply behavior gates
         run: make check-behavior
 
@@ -85,9 +111,22 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"
+      - name: Harden ephemeral Linux runner home chain
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          mapfile -d '' -t account_home_chain < <(python -I -S -B -c 'import os, pathlib, pwd; home = pathlib.Path(pwd.getpwuid(os.geteuid()).pw_dir); current = pathlib.Path(home.anchor); chain = [current]; [(chain.append(current := current / component)) for component in home.parts[1:]]; print(*(str(path) for path in chain), sep="\0", end="\0")')
+          sudo setfacl --remove-all --remove-default -- "${account_home_chain[@]}"
+          sudo chmod go-w -- "${account_home_chain[@]}"
+          account_home="${account_home_chain[${#account_home_chain[@]}-1]}"
+          private_tmp="$account_home/codexqb-ci-tmp"
+          install -d -m 0700 -- "$private_tmp"
+          printf 'TMPDIR=%s\n' "$private_tmp" >> "$GITHUB_ENV"
       - name: Run package contract and extraction gates
         run: make check-package
       - name: Run public release privacy validation
@@ -129,10 +168,13 @@ jobs:
           test -f "$tmpdir/plugin/.codex-plugin/plugin.json"
           test ! -e "$tmpdir/plugin/tests"
           test ! -e "$tmpdir/source/CodexQB/.git"
-          cd "$tmpdir/source/CodexQB"
-          CODEXQB_VALIDATE_SKIP_UNITTESTS=1 \
-            CODEXQB_VALIDATE_SKIP_BEHAVIOR_SMOKE=1 \
-            bash scripts/validate.sh
+          python3 -I -S -B scripts/run_extracted_validation.py \
+            --expected-head "$GITHUB_SHA" \
+            --zip "$tmpdir/CodexQB-source-worktree.zip" \
+            --root "$tmpdir/source/CodexQB" \
+            --profile static \
+            --skip-unit-tests \
+            --skip-behavior-smoke
 
   required:
     name: required / CodexQB
@@ -161,9 +203,22 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"
+      - name: Harden ephemeral Linux runner home chain
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          mapfile -d '' -t account_home_chain < <(python -I -S -B -c 'import os, pathlib, pwd; home = pathlib.Path(pwd.getpwuid(os.geteuid()).pw_dir); current = pathlib.Path(home.anchor); chain = [current]; [(chain.append(current := current / component)) for component in home.parts[1:]]; print(*(str(path) for path in chain), sep="\0", end="\0")')
+          sudo setfacl --remove-all --remove-default -- "${account_home_chain[@]}"
+          sudo chmod go-w -- "${account_home_chain[@]}"
+          account_home="${account_home_chain[${#account_home_chain[@]}-1]}"
+          private_tmp="$account_home/codexqb-ci-tmp"
+          install -d -m 0700 -- "$private_tmp"
+          printf 'TMPDIR=%s\n' "$private_tmp" >> "$GITHUB_ENV"
       - name: Install release validation dependencies
         run: python -m pip install --requirement requirements-ci.txt
       - name: Run strict release validation

Makefile

@@ -2,6 +2,8 @@ SHELL := /bin/bash
 PYTHON ?= python3
 NO_BYTECODE = PYTHONDONTWRITEBYTECODE=1
 PLATFORM_POLICY ?= auto
+CODEXQB_SKILL_ROOT := $(abspath plugins/codexqb/skills/codexqb)
+CODEXQB_LAUNCHER := $(CODEXQB_SKILL_ROOT)/scripts/skill_launcher.py
 
 .PHONY: check check-fast check-static check-unit check-platform check-schema check-behavior check-package check-public-privacy check-release test export-plugin export-source export-plugin-worktree export-source-worktree export-source-package export-sanitized export-sanitized-worktree export-sanitized-source-package
 
@@ -27,8 +29,8 @@ check-platform:
 	@set -euo pipefail; \
 	tmpdir="$$(mktemp -d)"; \
 	trap 'rm -rf "$$tmpdir"' EXIT; \
-	$(NO_BYTECODE) $(PYTHON) plugins/codexqb/skills/codexqb/scripts/doctor.py --json > "$$tmpdir/doctor.json"; \
-	$(NO_BYTECODE) $(PYTHON) plugins/codexqb/skills/codexqb/scripts/doctor.py; \
+	$(NO_BYTECODE) $(PYTHON) -I -S -B "$(CODEXQB_LAUNCHER)" --active-skill-md "$(CODEXQB_SKILL_ROOT)/SKILL.md" --controller doctor -- --json > "$$tmpdir/doctor.json"; \
+	$(NO_BYTECODE) $(PYTHON) -I -S -B "$(CODEXQB_LAUNCHER)" --active-skill-md "$(CODEXQB_SKILL_ROOT)/SKILL.md" --controller doctor --; \
 	probe_output="$$( $(NO_BYTECODE) $(PYTHON) tests/platform/run_mount_identity_probe.py )"; \
 	echo "$$probe_output"; \
 	if [[ "$(PLATFORM_POLICY)" == "required" && "$$probe_output" != *"status=ready "* ]]; then \
@@ -71,7 +73,7 @@ check-release:
 	$(NO_BYTECODE) $(PYTHON) scripts/verify_package_manifest.py --root "$$tmpdir/plugin" --strict-artifact --expected-artifact-type plugin; \
 	test -f "$$tmpdir/plugin/.codex-plugin/plugin.json"; \
 	$(NO_BYTECODE) $(PYTHON) scripts/verify_package_manifest.py --root "$$tmpdir/source/CodexQB" --strict-artifact --expected-artifact-type source; \
-	cd "$$tmpdir/source/CodexQB" && CODEXQB_VALIDATE_SKIP_UNITTESTS=1 CODEXQB_VALIDATE_SKIP_BEHAVIOR_SMOKE=1 bash scripts/validate.sh
+	$(NO_BYTECODE) $(PYTHON) -I -S -B scripts/run_extracted_validation.py --expected-head "$$(git rev-parse --verify HEAD)" --zip "$$tmpdir/CodexQB-source-release.zip" --root "$$tmpdir/source/CodexQB" --profile static --skip-unit-tests --skip-behavior-smoke
 
 # Legacy full discovery remains available for maintainers. Gate-aware CI uses
 # the explicit targets above so schema/package/platform behavior cannot drift.