SECURITY REVIEW - STRUCTURED FINITE-PLAN STUDY
Scope: trusted Codex operator code review and actual benign software tests; no independent human audit, penetration-test certificate, or formal verification.

Evaluated output is data. The only admitted object has exactly plan, verify and claim. The finite manifest bounds plan IDs; at most 16 entries, 16 KiB of JSON and depth 5; flags/types and duplicate JSON keys are checked. The interpreter has no model-dispatched host file, process, import, command or URL operation. Synthetic recovery actions do not touch a filesystem. The trusted Python code itself was AI-assisted and is executed; claims that no generated code executes refer specifically to outputs from the evaluated models.

Trusted model transport fixes localhost at 127.0.0.1:11437 and a short endpoint allowlist. Proxying/redirects are disabled, responses bounded, raw prompts and options retained. Model identity/version/manifests/executable hashes are checked. No agent chooses credentials, model download URLs, shell commands or host paths. Public prompts contain complete synthetic inputs but no gold result, private semantic grade, master-stop path or SSH key path. Post-freeze audit verifies these properties against retained returned turns.

Owned native model processes start suspended, enter a Windows Job, then resume. The job has kill-on-close, a 3 GiB commit cap, an 8-process limit and a 40% CPU cap. A separate trusted supervisor checks master/private stops, a heartbeat timeout of 5 seconds, resource floors, a 16 MiB log limit and a lifetime limit of 590 seconds. Runtime floors: 1 GiB available RAM, 2 GiB commit reserve, 2 GiB free on C and 5 GiB free on D. After repeated resource incidents, the operator also requires 3 GiB available RAM at prelaunch across 3 samples spaced 5 seconds apart. Thresholds were not lowered. Unknown listeners are never adopted or terminated. Observed cleanup is attested per chunk.

Emergency controls: v2-study/security/RED-BUTTON.cmd and STOP-NOW.cmd. The persistent master stop prevents new work and is polled by active supervisors. This is a software control on a trusted functioning host, not a guarantee against OS/driver hangs. Its private path is excluded from model prompts. Security relies on limited capabilities, not on keeping the existence of a stop button secret.

Important limits: the native server runs with current-user filesystem rights; Windows Job Objects limit lifetime/resources and are not an AppContainer or hostile-native-code sandbox. Windows Job limits do not impose a separate GPU-memory quota. Cloud inference is disabled, but OS-wide network isolation and zero network egress were not independently established. A compromised Ollama/CUDA/tokenizer/native parser, malicious co-resident process, kernel or driver remains outside the tested threat model. Verified TLS/digests are not an independent offline binary signature. Only trusted acquired model assets are admitted.

No arbitrary agent-authored code, service attack, real medical/application data or hidden user files are used. The broader catalogue is not security-certified. The original arbitrary-code study remains blocked. Live website, Git repository and QAAI remain outside this study. Files/models/temp/cache are directed to D; installed system tools are read from C. OS paging/GPU/app writes on C cannot be guaranteed absent.

Resource stops are retained, never reset automatically or converted into successful outcomes. Trusted reviews authorize only never-attempted assignments under unchanged scientific inputs. Completed/partial logs are audited separately; a lost in-flight response stays unknown. The evidence package excludes runtime homes and generated private keys. Hashes/chains prove internal consistency under a trusted operator, not external timestamping or adversarial tamper resistance.

A retained pre-task heartbeat interruption occurred before any model request. Cleanup was confirmed, and subsequent concurrent heartbeat checks passed; the precise cause was not established. The original watchdog and incident STOP remain unchanged. This lifecycle incident is distinct from interrupted task outcomes.

After a second heartbeat loss, a separately pinned host-only diagnostic wrapper was added. It preserves the original read/parser/type/identity/age checks, immediate stop, timeout and resource limits; no retry or grace is introduced. Equivalence controls were checked before use. Failure metadata are written after owned cleanup. This post-freeze instrumentation and unknown interrupted outcomes are disclosed.

Qualification refinement: diagnostic observer captured a private read PermissionError. The native share-delete candidate failed its held-reader replacement control and was rejected without inference use; failure is retained. A tested Windows mutex serializes the private reader and writer, with100ms maximum acquisition. Timeout/abandonment/error stops; validity/identity/types/five-second age and all resource floors remain. This bounded I/O synchronization changes host monitoring timing and is separately disclosed/pinned. It does not confer new model capabilities.
