Daily harness signal

Make the checkout prove its pin

July 30, 2026 · JST One fresh finding Git plugins · supply chain
Codex 0.146.0 turns an obscure Git ref ambiguity into a concrete plugin-supply-chain rule: a declared commit pin is not real until the materialized checkout independently attests the same object ID.
01 · Fresh · source date 2026-07-29

Verify the checkout, not the checkout command

Use when: an agent marketplace, plugin manager, skill installer, or deployment manifest accepts a Git commit hash and then loads prompts, hooks, scripts, tools, or executable configuration from that checkout.

Action: make commit pinning a postcondition, not an argument. Require a full object ID for commit mode; keep tags and branches in a separately labeled mutable-ref mode. Materialize into a fresh staging directory, run checkout with prompts disabled, then resolve HEAD with git rev-parse HEAD . Compare the complete normalized IDs. If they differ, emit both requested_sha and resolved_sha, discard or quarantine staging, and expose zero plugin capabilities. Key any reusable cache by canonical repository URL plus verified object ID; repeat attestation before activation, not only on first download.

Acceptance check: create commit A with a benign marker, then commit B with a hostile marker. Rename the remote default branch to A’s 40-hex ID while leaving it at B. Ask the installer for A. Pass only if installation fails closed, logs A as requested and B as resolved, and no skill, hook, MCP server, or script becomes visible. As a control, fetch A through an unambiguous object reference and require HEAD equals A before the benign plugin loads.

Evidence: OpenAI’s merged Codex PR #34644 adds exactly this post-check in loader.rs and a regression fixture reproducing the SHA-shaped hostile default branch. The implementation compares rev-parse HEAD case-insensitively with the requested SHA and rejects mismatch. It shipped in stable Codex 0.146.0; Git’s own checkout and revision documentation confirms that checkout guesses among branch and commit meanings.

Caveat: equality proves which Git object loaded, not that its contents are safe. Tags and branches remain movable. Submodules, Git LFS objects, generated downloads, package-manager installs, and runtime network fetches add separate mutable inputs; pin and attest them independently or disable them. A local cache also needs ownership, symlink, and replacement protections after verification.

Compact source notes

  1. OpenAI Codex 0.146.0 (published 2026-07-29 01:42 UTC). Stable official release containing the Git plugin checkout repair.
  2. Codex PR #34644 and merged commit 690995b (2026-07-22). Primary rationale, two-file implementation, and regression-test claim.
  3. Versioned loader and hostile-default-branch test (2026-07-22). Inspectable code resolves HEAD, compares it with the requested SHA, and rejects the adversarial fixture.
  4. Git checkout and revision syntax documentation (retrieved 2026-07-30). Independent primary documentation for branch/commit guessing and ref disambiguation.
  5. Method: anchor lens—merged code, versioned test, and stable release; unity lens—every claimed immutable source becomes an attested postcondition. The SHA-shaped-branch fixture is the falsification test.