Investigate descriptor inheritance between concurrent spawns on macOS

[novelKR]

Status: investigation and proposal only.

• The owner authorized this issue on 2026-09-28 as an independent CodeSpace correctness and hygiene investigation.
• It is not part of CS-RG, which stays suspended, and not a backend rewrite.
• Nothing here approves an implementation, a pin change or a dependency. Any implementation needs its own approval.

Problem

On macOS, a child spawned by one CodeSpace execution can inherit another execution's transient descriptors while
they are being created in the same process. Two facts combine:

• Creation is not atomic. Rust std and Tokio (via mio) create pipes and sockets, and portable-pty creates PTYs,
  in two steps: the descriptor first, then close-on-exec. On macOS there is no atomic variant for these calls. In
  between, the descriptor is inheritable.
• Children exclude nothing. std and Tokio Command do not use POSIX_SPAWN_CLOEXEC_DEFAULT, so a child
  inherits every descriptor that is inheritable at the moment it is spawned.

So, in the Gateway process (InProcess) or a Runner worker (UDS), a concurrent spawn can capture another execution's
pipe end or PTY descriptor. Linux is different: std uses pipe2, SOCK_CLOEXEC and accept4 there, which are
atomic. Linux was not examined further.

Why it matters to CodeSpace

This is inference; none of it has been measured in CodeSpace's own processes.

• Delayed output EOF. A stray child holding another execution's stdout or stderr write end delays that
  execution's EOF until the stray child exits. Output completion can then wait on an unrelated process.
• Stdin EOF lost. A stray child holding another execution's stdin write end means closing stdin no longer gives
  that child EOF.
• PTYs kept open. A stray holder of a PTY slave keeps the terminal open after its child exits, so the master sees
  no EOF. A stray holder of a master keeps the terminal alive after CodeSpace drops it.
• Long-lived leaks. A long-lived child keeps whatever it inherited for its whole lifetime. An example is the UDS
  worker the Gateway spawns.

Evidence so far

• Source. Read at Rust 1.88.0, 1.95.0 and 1.98.1, mio 1.2.3, tokio 1.53.1 and Codex 72b8d8b: DevGuard handoff
  packet section 8.
  portable-pty 0.9.0, used by CodeSpace's pinned PTY path, calls openpty and then sets close-on-exec
  (src/unix.rs:36, :64-65).

• Test: BD-1. A scratch crate outside both repositories, Codex 72b8d8b, one host, one run. During concurrent
  Codex PTY launches, unrelated std and Tokio children received:

  • a transient PTY master in 104 of 2000 cases;
  • a PTY slave in 4 of 2000;
  • pipe ends in 39 of 2000.

  See packet section 11.

• Test: W3 experiment C1. A scratch harness, two runs, 400 children per cell.

  • std and Tokio children inherited pipes and sockets that another thread was creating at the same time.
  • Children spawned with Codex's local Command and DescriptorPolicy::Explicit, which uses
    POSIX_SPAWN_CLOEXEC_DEFAULT on macOS, held none in any cell of either run.
  • The full record will be in the W3 decision packet linked from Handoff: CS-RG managed-execution suspension (#75) and the DevGuard boundary revalidation (2026-09-27) #76.

• Not run:

  • CodeSpace's own processes;
  • representative workloads;
  • frequency of the effects above;
  • Linux.

Spawn sites on macOS (main at ab0341b)

Site	Spawner	Child-side exclusion
Pipe execution, crates/runner/src/process.rs:283	Tokio Command, piped stdio	none
Patch helper, crates/runner/src/patch_helper.rs:50	Tokio Command, piped stdio	none
UDS worker, crates/server/src/runtime.rs:33	Tokio Command	none
PTY execution through codespace-pty (crates/pty/src/lib.rs:66)	Codex portable path, then portable-pty	best-effort sweep in the child (close_random_fds, portable-pty src/unix.rs:152, :276)

The Linux sandbox helper is not probed or spawned on macOS (crates/runner/src/linux_sandbox.rs:60-69).

Candidate directions (none chosen)

1. Kernel close-by-default for CodeSpace's own local spawns.
   • Codex's Command with DescriptorPolicy::Explicit does this.
   • It does not exist at CodeSpace's pin (6b9826e). It is at stable rust-v0.157.1 as DescriptorPolicy::StdioOnly,
     and at the prerelease and Codex main as Explicit.
   • Using it needs a reviewed pin PR under the existing pin process.
2. A best-effort pre_exec sweep of inheritable descriptors in CodeSpace's own spawns, as portable-pty does. This
   moves std from posix_spawn to fork and exec.
3. One CodeSpace-internal lock around its own descriptor creation and spawns. It covers only code that takes the
   lock. Descriptors created inside Codex, Tokio or other libraries stay uncovered.

Every candidate must keep today's semantics:

• stdio wiring, kill_on_drop, reaping, exit status and signals, process group, working directory, PATH and arg0
  behaviour;
• error reporting;
• the governance-free off path.

Proposed next steps (each needs its own approval)

1. Inventory every descriptor-creating and spawning path in the Gateway and Runner processes on macOS, including
   library-internal ones.
2. A bounded diagnostic: measure whether the effects above occur with CodeSpace's own pipe and PTY paths under
   concurrency, for example one execution's EOF latency while unrelated children spawn.
3. Compare the candidates on preserved semantics and pin requirements, then choose, or decide no change is needed.

Out of scope

• DevGuard integration and CS-RG;
• pin changes;
• changes to off semantics;
• any implementation.

Trackers: #76 and novelKR/DevGuard#14.

[novelKR]

2026-09-28 11:41 UTC. Status at session close.

• The W3 session closed with this investigation unexecuted. The owner has not authorized its bounded diagnostic, and nothing has been run or implemented under this issue.
• The W3 evidence this issue refers to is recorded in novelKR/DevGuard#17 at head 70c814c93a96f383e3241b6817fe6d42aea9ea48, section 3.3. That record is non-normative and unmerged.
• The authoritative continuation state is in #76's latest comment and novelKR/DevGuard#14's latest comment.
• This stays a CodeSpace correctness and hygiene investigation. It is not a DevGuard integration issue.

[novelKR]

2026-09-30 15:42 UTC. Steps 1–2: the inventory and the frozen diagnostic protocol. One bounded run follows.

• Authorization. The owner authorized this on 2026-09-30 (W3 decision 7): steps 1–2 and one bounded run of the frozen protocol, in scratch, on the pinned baseline (main ab0341b, Codex gitlink 6b9826e, rust-v0.154.0). There is no CodeSpace code, pin or dependency change. This comment, written through the shared account, is not independent proof of the authorization.
• Justification: CodeSpace's own correctness only. The risks are delayed stdout/stderr EOF, lost stdin EOF, PTY lifetime extension, and long-lived inherited descriptors in the UDS worker.
• Baseline role. These measurements are the rust-v0.154.0 comparison baseline for CodeSpace's own later pin evaluation. The owner's staged pin direction is recorded on DevGuard #14. CodeSpace is not moved to 0.159.x for this diagnostic.

What the source inventory found. These are source findings; nothing has been run yet.

• Pipe executions (crates/runner/src/process.rs:283) get std pipes created in two steps, and a posix_spawn child that excludes nothing.
• PTY executions use portable-pty's openpty, also two steps, but the PTY child closes every descriptor above 2 (close_random_fds).
• Completion. A pipe execution completes only after stdout/stderr EOF: join_pump is unbounded, and live_count counts it until EOF, against the default limit of 8. PTY completion waits for master EOF.
• Stdin. No product operation closes a pipe execution's stdin at this revision.
• The UDS worker is spawned once, at startup, with stdout/stderr inherited.
• Coverage. The run measures only the Runner pipe and PTY paths. The worker, the patch helper and HTTP accept overlap are not_run, and are never treated as passing or negative evidence.

Frozen at 2026-09-30T15:41:38Z, before any build:

• protocol.md: SHA-256 bc8651b06c4f3e37d33803f2a45191398a0b839afb2dcaa65ff12be41cdf2a04
• inventory.md: SHA-256 fec8f46a618674a4042593b581031120173e3c87c70881f865cd8b91fdff48db

Both files are reproduced verbatim below, so the digests can be checked.

Step 1: inventory (inventory.md)

CodeSpace #79, step 1: descriptor-creating and spawning paths on macOS (read-only inventory, 2026-09-30)

Scope.

• Revision: CodeSpace main ab0341b5cf5eda8c82730487d4475f1ac922daf5 and its Codex gitlink
  6b9826e3aa83b1a5947db50f4332cb9c65f1b340 (rust-v0.154.0). Paths are repository-relative.
• Library versions: those locked in CodeSpace's Cargo.lock, whose last change was on 2026-09-21. Every crate archive
  read for this inventory matches its lock checksum: tokio 1.53.1, mio 1.2.3, portable-pty 0.9.0, libsqlite3-sys 0.30.1,
  notify 8.2.0 and fsevent-sys 4.1.0.
• Rust std: read at 1.95.0 (the build toolchain of the step 2 run, equal to codex-rs/rust-toolchain.toml at the pin)
  and at 1.98.1 (the stable toolchain of CodeSpace CI's last recorded run).
• Relation to earlier evidence: the std, mio and tokio citations reuse the verified source set behind DevGuard's
  W0–W2 packet §8 (S1–S14).

Justification: CodeSpace's own correctness only. The risks are:

• delayed stdout/stderr EOF;
• lost stdin EOF;
• PTY lifetime extension;
• long-lived inherited descriptors in the UDS worker.

Evidence levels: source, meaning read at the fixed revision; nothing in this document was run.

1. Processes

Process	Where	Descriptors it owns at run time
Gateway (codespace-server)	crates/server/src/main.rs:14-33: a Tokio multi-thread runtime (#[tokio::main]), with a stdio transport (stdio.rs:22-24, :35-37, rmcp on fds 0/1) or an HTTP transport (http.rs:105-114). Runner mode is InProcess (main.rs:48-51) or UDS (main.rs:52-68)	InProcess: every execution descriptor below. Both modes: transport, store and runtime descriptors
UDS worker (codespace-codex-runtime)	crates/codex-runtime/src/bin/codespace-codex-runtime.rs:14-39: pre_main_hardening (:16; on macOS it denies ptrace attach and zeroes the core size, and changes no descriptor), binds one socket (:30), accepts one connection (:34), then hosts an InProcess runner (:33, :38)	UDS mode: every execution descriptor below, plus fds 0–2 inherited from the Gateway

2. Creators and spawners in production code

"Atomic" means close-on-exec from creation (W0–W2 packet §8). "Child-side exclusion" means the child itself drops
unrelated descriptors.

#	Site	Creator or spawner	Atomic	Child-side exclusion	Owning process	Overlaps with
C1	Pipe execution, crates/runner/src/process.rs:283-295	Tokio Command (kill_on_drop), with Stdio::piped() for stdin, stdout and stderr. The pipes come from std (S1: pipe(), then FIOCLEX); the spawn is std posix_spawnp (S7; tokio 1.53.1 src/process/mod.rs:863-865) with no POSIX_SPAWN_CLOEXEC_DEFAULT	no (S1)	none: the child inherits every descriptor that is inheritable when it is spawned	Runner host: the Gateway (InProcess) or the worker (UDS)	every other C1, C2 or C3 in the same process; C7 in InProcess HTTP mode
C2	PTY execution, process.rs:393-421 → crates/pty/src/lib.rs:57-77 → Codex spawn_pty_process(..., &[]), which takes the portable path at the pin (codex-rs/utils/pty/src/pty.rs:145-150, :153-180)	portable-pty openpty (src/unix.rs:36), then close-on-exec on master and slave (:64-65). The master duplicate uses try_clone_to_owned, which is F_DUPFD_CLOEXEC (unix_io.rs:27). The spawn is std Command with a pre_exec, so fork/exec (src/unix.rs:228-286)	no (openpty window); the duplicate is atomic	yes, best effort: in the child, close_random_fds() closes every descriptor above 2 listed in /dev/fd (src/unix.rs:152-177, called at :276)	Runner host	the openpty window is visible to concurrent C1 and C3 spawns; the child holds nothing foreign
C3	Patch helper, crates/runner/src/patch_helper.rs:50-61	Tokio Command (kill_on_drop) with three piped stdio streams (S1, S7); collected by wait_with_output (:74), which reads both pipes to EOF	no (S1)	none	Runner host	as C1
C4	Worker spawn (UDS mode), crates/server/src/runtime.rs:33-37	Tokio Command: stdin null, stdout and stderr inherited, kill_on_drop; std posix_spawnp (S7)	n/a	none	Gateway	only Gateway startup, before any request (main.rs:18-19)
C5	Gateway-to-worker connect, runtime.rs:81 (connect_existing) and :127 (wait_for_socket); also crates/runner/src/uds.rs:74	Tokio UnixStream::connect: mio socket(), then FD_CLOEXEC (S8; mio 1.2.3 src/sys/unix/net.rs:37, :76)	no	n/a	Gateway	startup only
C6	Worker rendezvous, codespace-codex-runtime.rs:29-34	a std UnixStream::connect probe (crates/runner/src/socket.rs:58, S2); codex-uds bind (codex-rs/uds/src/lib.rs:149-150, Tokio UnixListener::bind, S8) and accept (:154; mio on Apple: accept(), then FD_CLOEXEC, src/sys/unix/uds/listener.rs:110-120)	no	n/a	worker	worker startup only, before any execution
C7	HTTP transport (HTTP mode), crates/server/src/http.rs:105 bind; :109 axum::serve accepts	Tokio TcpListener (S8 bind); each accept is mio TCP accept on Apple (accept(), then FD_CLOEXEC, src/sys/unix/tcp.rs:110-118)	no	n/a	Gateway	in InProcess HTTP mode, a concurrent C1 or C3 child can inherit an accepted client socket
C8	Tokio signal driver	a mio UnixStream::pair (S9; tokio 1.53.1 src/signal/unix.rs:71, created by the runtime signal driver at src/runtime/signal/mod.rs:67)	no	n/a	Gateway and worker	runtime start only; the HTTP-mode ctrl_c is at main.rs:27
C9	Store, rusqlite 0.32.1 / libsqlite3-sys 0.30.1 (bundled SQLite)	file opens with O_CLOEXEC (sqlite3/sqlite3.c:39081-39082); Store::memory() unless --operations-db (main.rs:82-88)	yes	n/a	Gateway	—
C10	File operations (crates/runner/src/files.rs; the codespace-fs adapter calling Codex exec-server's local file-system API)	std/tokio file opens (S5, O_CLOEXEC). The adapter source creates no process or socket; the Codex library internals were not audited further	yes (S5)	n/a	Runner host	—
C11	File watching, crates/runner/src/watch.rs:221-229	notify 8.2.0 RecommendedWatcher; the default feature macos_fsevent (Cargo.toml:69) uses FSEvents, whose backend code creates no file descriptor	n/a	n/a	Runner host	—
C12	Logging, crates/server/src/logging.rs:14-21	writes to stderr only; creates no descriptor	n/a	n/a	both	—

Not on macOS, or test-only:

• crates/runner/src/linux_sandbox.rs: the helper is probed and spawned only on Linux (:60-69; spawns at :74, :141).
  Its other spawns are in tests.
• files.rs:387 (mkfifo) is a test.
• patch_helper.rs:132-160 (ensure_helper_for_tests, cargo build) is test support.
• rmcp's child-process and reqwest transports are enabled in the workspace dependencies but are not used by production
  server or runner code.

3. What an inherited descriptor does in CodeSpace (source consequences)

1. Pipe output EOF gates completion, lease release and capacity.
   • Completion runs in order: reap, with a 20 ms try_wait poll (process.rs:676-698); then an unbounded join_pump
     on stdout and stderr (:700-705); only then eof, completed_at and the on_release callback (:343-353). In
     the Gateway, on_release is store.release_process (main.rs:41-47).
   • live_count counts every slot whose output has not reached EOF (:781-785) against max_processes, which
     defaults to 8 (:32, :54-60).
   • So a stray child that holds an execution's stdout or stderr write end delays that execution's completion and
     lease release until the stray closes it. It also keeps the execution counted as live after it has exited.
2. PTY completion waits for master EOF.
   • Completion is exit, then join_pump on the output channel (process.rs:470-481). That channel ends only when
     Codex's master reader ends, on EOF or any error (unix_io.rs:51-68), that is, once the slave side has been fully
     closed.
   • A stray holder of the slave can therefore delay completion, unless the kernel revokes the terminal when the
     session leader exits. That behaviour is not read in XNU here and is left to measurement.
   • A stray holder of the master keeps the terminal pair allocated after CodeSpace's own copies close: the PTY
     lifetime extension.
3. Lost stdin EOF cannot be reached through the product API at this revision.
   • RunnerWriteStdin carries data only (api.rs:102-105). write_host_stdin takes and puts back the ChildStdin
     (process.rs:506-541); it stays in the slot until eviction.
   • No product operation closes a pipe execution's stdin while it runs. A stray holder of a stdin write end would
     matter only if such an operation were added.
   • PTY stdin close (SendEof, unix_io.rs:75-88) happens only when CodeSpace drops the writer.
4. The patch helper. wait_with_output waits for EOF on both pipes, so a stray holder of the helper's stdout or
   stderr write end stalls a patch operation until HELPER_TIMEOUT returns a timeout error.
5. The UDS worker's long-lived descriptors.
   • The worker is spawned once, at Gateway startup, with stdout and stderr inherited explicitly. In stdio transport
     mode, fd 1 is the MCP stdout channel.
   • The worker keeps whatever it inherited for its whole lifetime, and pre_main_hardening does not close descriptors.
   • Creation-window overlap with executions cannot occur in the spawn mode, because the worker starts before any
     request. It can with --runner-socket only if an external launcher is involved; that is outside this inventory.

4. Coverage of the bounded run (step 2)

• Measured: the actual Runner pipe path (C1) and PTY path (C2) at ab0341b / 6b9826e, at the product's default of
  8 live processes and at a stress setting of 64 through the same CODESPACE_MAX_PROCESSES knob.

• not_run, never passing or negative evidence:

  • the UDS worker's inherited descriptors (C4, §3.5);
  • the patch helper (C3, §3.4);
  • HTTP accept overlap (C7);
  • Linux.

  Worker safety is not inferred from Runner results.

Step 2: frozen protocol (protocol.md)

CodeSpace #79, step 2: frozen diagnostic protocol (2026-09-30)

Status. Frozen before any build: the SHA-256 of this file is recorded, and posted on #79, before
the harness is built.

• A later change is a dated amendment, written before the runs it affects.
• A harness defect may be fixed and re-run only with a logged hypothesis. The failed attempt is kept.

Authorization. The owner's decision of 2026-09-30 (W3 decision 7): #79 steps 1–2 and one bounded run of this
frozen protocol, in scratch, on the pinned rust-v0.154.0 baseline. It includes no CodeSpace code, pin or dependency
change.

Justification: CodeSpace's own correctness only. The risks are:

• delayed stdout/stderr EOF;
• lost stdin EOF;
• PTY lifetime extension;
• long-lived inherited descriptors in the UDS worker.

DevGuard, D6 and CS-RG are not reasons for this run.

Baseline role. Following the owner's staged pin direction (§12.6 of the 2026-09-30 prompt, recorded on
novelKR/DevGuard#14), these measurements are the rust-v0.154.0 comparison baseline for CodeSpace's own later pin
evaluation. CodeSpace is not moved to 0.159.x for this diagnostic.

The source analysis is the step 1 inventory (inventory.md, SHA-256 in the #79 comment).

1. Frozen parameters

Parameter	Value
CodeSpace revision	ab0341b5cf5eda8c82730487d4475f1ac922daf5; its tree id is recorded
Codex revision	the gitlink 6b9826e3aa83b1a5947db50f4332cb9c65f1b340 (rust-v0.154.0); its tree id is recorded
Source acquisition	git archive of ab0341b from <CODESPACE_CHECKOUT>, and of 6b9826e from its submodule repository <CODESPACE_CHECKOUT>/.git/modules/third_party/codex. Both are extracted into <SCRATCH>/cs79/codespace (Codex into third_party/codex), and each archive's SHA-256 is recorded. No network is used for sources, and neither repository is changed
Toolchain	rustc 1.95.0 (59807616e 2026-04-14) / cargo 1.95.0, from <DEVGUARD_CHECKOUT>/.local/toolchains/1.95.0, used read-only. It equals codex-rs/rust-toolchain.toml at the pin and satisfies CodeSpace's rust-version 1.88. CodeSpace CI builds with floating stable (1.98.1 at its last recorded run); the difference is recorded. If 1.95.0 cannot build the locked graph, the run stops (not_run) and no toolchain is installed
Build	CARGO_BUILD_JOBS=1 and -j1, debug profile. CARGO_HOME and CARGO_TARGET_DIR are inside <SCRATCH>. The locked crates and the two locked git forks are downloaded only there
Lock	The harness workspace's Cargo.lock is seeded with a copy of CodeSpace's root Cargo.lock at ab0341b, and its [patch] entries are copied from CodeSpace's root Cargo.toml. After the build, the divergence from the seed is recorded. Any package present in both whose version or checksum changed stops the run (not_run: lock divergence)
Harness	A scratch crate cs79-harness with the binaries cs79 (driver) and fdprobe (probe). It depends by path on the extracted codespace-runner, codespace-policy and codespace-domain, and on tokio and libc at the locked versions
Product path	The driver creates RuntimeBackend::in_process(on_release), the constructor used by the Gateway's InProcess mode (crates/server/src/main.rs:48-51). It uses one Workspace::new(WorkspaceId("cs79"), <SCRATCH>/cs79/ws, Profile::WorkspaceWrite). Every execution goes through Runner::exec with RunnerExecRequest::for_host defaults, except argv and tty. The Tokio multi-thread runtime has the default worker count, like #[tokio::main]
Completion timestamp	on_release records CLOCK_REALTIME per process id. This is the Runner's completion and lease-release point (process.rs:343-353, :470-481)
Probe	BD-1's probe (DevGuard evidence upstream-adapter-2026-09-28/bd1/harness/src/probe.rs), extended as below
Probe snapshot	Taken first, before opening anything: proc_pidinfo(PROC_PIDLISTFDS). For each descriptor it records F_GETFD, fstat (type, dev, ino, rdev); for a pipe, proc_pidfdinfo(PROC_PIDFDPIPEINFO) (pipe_handle, pipe_peerhandle); for a character device, ttyname_r and ioctl(TIOCPTYGNAME) (a master's slave name). It also records pid, ppid, pgid, sid and snap_ns
Probe output	--out PATH writes the report atomically (temporary file, then rename) after recording exit_ns = CLOCK_REALTIME immediately before the write. --hold-ms N sleeps N ms after the report is written. The probe writes nothing to stdout or stderr
Roles	A target is fdprobe --out T and exits at once. A stray is fdprobe --out S --hold-ms 1500. All paths are absolute, under <SCRATCH>/cs79/ws/reports/
Invocations	The run is two driver invocations. D1 runs with CODESPACE_MAX_PROCESSES unset (the product default, 8). D2 runs with CODESPACE_MAX_PROCESSES=64 (the same product knob). No other environment knob is set
Admission	The driver admits at most L executions at once (8 in D1, 64 in D2), with a semaphore released by on_release. So WorkspaceBusy is never provoked

2. Hypotheses (from the inventory)

• H1. A pipe child (C1) can inherit another execution's transient descriptors: pipe ends (S1) and PTY master or slave
  (portable-pty openpty window), because it has no child-side exclusion.
• H2. A PTY child (C2) holds no foreign descriptor above 2, because of portable-pty's close_random_fds sweep.
• H3. When a stray holds a target pipe execution's stdout or stderr write end after the target exits, the
  target's completion and lease release, and its live-slot occupancy, last until the stray closes it. Completion is
  gated by an unbounded join_pump (process.rs:343-353, :700-705, :781-785).
• H4. (PTY; not source-derived: XNU revocation at session-leader exit was not read.) A holder of a target's PTY
  slave may delay PTY completion. A holder of the master extends the terminal's lifetime.
• H5. (Stdin) No product operation closes a pipe execution's stdin at this revision, so lost stdin EOF cannot be
  reached through the product API. This is a source finding. The run only counts holders of a target's stdin write end
  as an observation.

3. Cases (run once, in this order)

Throughout, "delay" is release_ns − exit_ns of a target, and a delay is "long" if it exceeds 500 ms.

Case	Driver	Procedure	Frozen expectation	Criterion
NC1	D1	The driver opens <SCRATCH>/cs79/nc1-inheritable with open() and without O_CLOEXEC. It runs 5 pipe targets, then 5 PTY targets, one at a time, then closes the file	pipe targets hold the file 5/5 (C1 excludes nothing); PTY targets 0/5 (sweep)	pipe half 5/5, otherwise the run is inconclusive (detection broken). The PTY half is recorded; a non-zero result is a finding
B0	D1	50 pipe targets, then 20 PTY targets, one at a time, with no strays	no target holds a foreign descriptor; every delay is at most 500 ms	a delay over 500 ms makes the delay threshold invalid, and the delay results inconclusive
PC1	D1	5 pipe targets, one at a time, each /bin/sh -c "<fdprobe> --out T; /bin/sleep 2 & exit 0"	the delay lies in [1900, 2600] ms for 5/5, because a same-execution descendant holds the write ends (H3 mechanism)	otherwise the delay metric is inconclusive
PC2	D1	5 PTY targets, one at a time, each /bin/sh -c 'trap "" HUP; <fdprobe> --out T; /bin/sleep 2 & exit 0'	none (H4 is not source-derived)	recorded as the observation that decides H4's slave half
P8	D1	100 pipe targets and 400 strays, submitted in the fixed repeating order [pipe stray, PTY stray, pipe stray, PTY stray, target]. Each submission waits for a semaphore permit (L = 8)	E-P1: every target with a valid write-end holder has a long delay. E-P2: every long delay has a valid write-end holder. E-P3: PTY strays hold 0 foreign descriptors	each is reported as k/N; a violation is a finding. The inheritance frequency is an observation with no expected value
T8	D1	50 PTY targets and 200 strays, in the same order and with the same admission	E-T1: PTY strays hold 0 foreign descriptors	slave and master holders, and their delays, are observations; H4 is read together with PC2
P64	D2	as P8, with L = 64	as P8	as P8
T64	D2	as T8, with L = 64	as T8	as T8

Totals: about 1,400 executions. Each case has a 300 s bound, and the whole run a 30-minute bound.

4. Matching and analysis (frozen rules)

• Pipe identity. A target's stdin read end, stdout write end and stderr write end are the pipe_handle of its fds
  0, 1 and 2. CodeSpace's parent-side ends are their pipe_peerhandle.
  • A stray holds a target's write end if one of its descriptors above 2 has a pipe_handle equal to the target's
    fd 1 or fd 2 handle.
  • It holds a parent end if the handle equals one of the peer handles. For the stdin write end, that is fd 0's
    peer.
• PTY identity. A target's slave is ttyname of its fd 0.
  • A stray holds the slave if one of its descriptors above 2 has that ttyname.
  • It holds the master if TIOCPTYGNAME on one of its descriptors returns that name.
• Validity window. A match counts only if the stray's snap_ns lies within the target's lifetime
  [submit_ns, release_ns]. Handles and terminal names can be reused after release. A match outside the window is
  reported separately as identity reuse and is excluded.
• Foreign descriptors. For every stray and target, any descriptor above 2 that is not the probe's own is counted by
  type (pipe, character device, socket, regular file, other). The stray's own fds 0–2 are excluded, and so is NC1's file
  after NC1.
• Reported per case:
  • targets completed, and execution errors;
  • the delay distribution (min, median, p95, max), for all targets and split into with and without holders;
  • k/N targets whose write end, parent end, slave or master was held;
  • k/M strays that held any foreign descriptor;
  • for master holders, the derived terminal-lifetime extension: holder end minus target release;
  • the wall time of the case.
• The analysis script (analyze.py) is written before the run and preserved. It reads only the probe reports and
  the driver's JSONL log.

5. Resources, stopping conditions and safety

• Before the build: at least 2 GiB reclaimable memory (free, inactive, speculative and purgeable pages), memory
  pressure below critical (kern.memorystatus_vm_pressure_level < 4), and at least 20 GiB free disk. Otherwise
  not_run: insufficient host resources.
• Stop, preserve and record if:
  • the build takes longer than 120 minutes or fails. A harness compile defect may be fixed under the logged-hypothesis
    rule; a CodeSpace or Codex compile failure is not fixed;
  • memory pressure reaches critical at a checkpoint (before each case);
  • a case exceeds 300 s;
  • a case has more than 5 execution errors;
  • anything is written outside <SCRATCH> except the evidence directory.
• Safety:
  • synthetic workloads only; no network at run time; no credentials or tokens;
  • neither the installed DevGuard nor any CodeSpace service is used. The DevGuard LaunchAgent's pid is recorded before
    and after;
  • no repository is changed, and nothing is pushed or submitted.
• Cleanup. After the evidence is sealed, <SCRATCH>/cs79 (sources, CARGO_HOME, target directory, workspace) is
  deleted.

6. Evidence

Kept in <DEVGUARD_CHECKOUT>/evidence/cs79-2026-09-30/ and sealed with MANIFEST.json:

• this protocol and its digest, and the inventory;
• the source archive digests and tree ids;
• the toolchain versions;
• the harness source, Cargo.toml, Cargo.lock and the lock divergence from the seed;
• the build logs;
• the resource checks;
• the driver JSONL logs and every probe report;
• analyze.py and its results;
• the LaunchAgent pid before and after;
• every failed or invalid attempt.

7. Coverage and limits

• Measured: CodeSpace's actual Runner pipe (C1) and PTY (C2) paths at ab0341b / 6b9826e, on one host (Apple M1,
  macOS 27), with synthetic probes, at L = 8 and L = 64.
• not_run: the UDS worker's inherited descriptors, the patch helper, HTTP accept overlap, and Linux. These are
  never counted as passing or negative evidence, and worker safety is not inferred.
• Frequencies are "k/N observed on this host": behavioural evidence for this configuration, not a rate for real
  workloads.
• No remedy is compared or proposed. That is Investigate descriptor inheritance between concurrent spawns on macOS #79 step 3, which needs its own decision.

Next: the single bounded run. Its results follow in a second dated comment. No CodeSpace change is proposed; comparing remedies (step 3) needs its own decision.

[novelKR]

2026-09-30 19:03 UTC. The single bounded run: results.

What ran.

• Protocol. The frozen protocol ran once, from 18:52:48 to 18:55:13 UTC (145 s). Its digest is protocol.md SHA-256 bc8651b06c4f3e37d33803f2a45191398a0b839afb2dcaa65ff12be41cdf2a04, frozen and posted in the previous comment.
• Revision and path. It ran on main ab0341b with Codex gitlink 6b9826e (rust-v0.154.0), through CodeSpace's own InProcess Runner (RuntimeBackend::in_process).
• Build. Rust 1.95.0, in scratch, debug profile, one job: 9 min 26 s, with no warnings. All 801 packages shared with CodeSpace's root lock kept their version and checksum.
• Invocations. D1 ran at the default live-process limit of 8, and D2 with CODESPACE_MAX_PROCESSES=64.
• Outcome. 1,590 executions, with 0 execution errors. There was no stop condition, no harness defect and no protocol amendment.
• Nothing else touched. No service was used; the DevGuard LaunchAgent had the same pid before and after. No CodeSpace code, pin or dependency changed.

The validity controls all pass.

• NC1 (detection): 5/5 pipe targets and 0/5 PTY targets held the deliberately inheritable file.
• B0 (the 500 ms threshold is valid): 50 pipe and 20 PTY targets, run without concurrency, held nothing foreign. The longest delay was 21.8 ms.
• PC1 (the delay metric is valid): all 5 delays were 2014–2017 ms, inside the frozen [1900, 2600] ms. Each came from a same-execution descendant holding the output for 2 s.

Results by hypothesis. Each figure is k/N observed on this host, not a rate for real workloads.

Hypothesis	Result
H1: pipe children inherit other executions' transient descriptors	Observed. Pipe strays holding foreign descriptors: P8 39/200, T8 33/100, P64 60/200, T64 39/100. Pipe targets: P8 21/100, P64 27/100. The strays' descriptors are almost all character devices (P8 84, T8 83, P64 292, T64 258). The rest are 2 pipe descriptors in P8, 2 in P64, and 40 unidentified descriptors in T64. The targets' descriptors are all character devices (P8 56, P64 133)
H2: PTY children hold nothing foreign	Held. None of the 730 PTY executions (targets and strays, all cases) held a foreign descriptor. E-P3 is 0/200 in P8 and 0/200 in P64; E-T1 is 0/100 in T8 and 0/100 in T64
H3: a held output write end delays completion	Mechanism confirmed by PC1. Through inheritance: not observed. No target's write end was held in P8 or P64 (0/100 each). No delay was long: the maximum was 22.6 ms at limit 8 and 99.9 ms at limit 64. E-P1 and E-P2 are 0/0
H4, slave half	Not observed. Slave holders did not delay completion. In T8, 12/50 targets' slaves were held, and the longest delay was 1.24 ms. In T64, 3/50 (a lower bound, see Limits), longest 20.6 ms. PC2's same-session descendant, with SIGHUP ignored, added only 1.4–3.2 ms
H4, master half	Observed. Pipe strays held 14/50 targets' masters in T8 and 14/50 in T64. The terminal outlived the target's release by the holder's remaining lifetime: a median of 1,495 ms in T8 and 1,776 ms in T64, up to 2,011 ms
H5: stdin	Targets' stdin write ends held: 0/100 in P8 and 0/100 in P64. The source finding stands: no product operation closes a pipe execution's stdin at this revision

Post-hoc characterisation. This was written after the run and is not a frozen metric. It applies the same identity rules and validity window to every execution, not only targets.

• Owners. Every identified inherited descriptor belongs to another execution that was live, between its submission and its release, at the holder's snapshot. This leaves aside T64's 40 unidentified descriptors and NC1's deliberate file. At limit 8, that snapshot came 3.8–18 ms after the owner's submission; at limit 64, up to 162 ms after.
• PTY descriptors. Most held terminals were complete master and slave pairs: 65 of 75 in P8, 40 of 43 in T8, 200 of 225 in P64, and 105 of 153 in T64, where unidentified descriptors hide some slaves.
  • This fits the span in portable-pty 0.9.0 from openpty (src/unix.rs:36) to the cloexec of master and slave (:64-65), during which both are inheritable. The span also calls tty_name(slave) (:49).
  • The run does not measure how long that span takes.
• Pipe descriptors. The 4 pipe descriptors are both ends of 2 pipe strays' stdin pipes, one pipe in each case: the pipe() → FIOCLEX window.
• Output write ends. No stdout or stderr write end of any pipe execution was held by another execution, so no completion was delayed by inheritance.
• What a master allows. While a holder has another execution's master, it can read that terminal's output and write to its input; that is what a master descriptor permits. The run did not exercise this.

Limits.

• Unidentified T64 descriptors. In T64, 21 pipe strays held 40 descriptors that were listed but whose fstat failed, so their identity is unknown. T64's slave count is therefore a lower bound. This is consistent with revoked terminals, but that is not shown.
• Scope of the run. One host (Apple M1, macOS 27), one workspace, synthetic probes, one run.
• not_run, never counted as passing or negative evidence: the UDS worker's inherited descriptors, the patch helper, HTTP accept overlap, and Linux. Worker safety is not inferred.
• Facts beyond the protocol text.
  • The seed lock pins a third git source besides the two forks the protocol names: microsoft/mxc, which provides Windows-only crates. It was fetched only into the scratch CARGO_HOME and is unchanged.
  • The probe writes BD-1's line format; only the driver log is JSONL.
  • Two instrument checks ran outside CodeSpace before the run: the probe's identity rules (12/12), and analyze.py on synthetic input.

Baseline role. These results are the rust-v0.154.0 comparison baseline for CodeSpace's own later pin evaluation, under the owner's staged pin direction (§12.6, recorded on DevGuard #14). CodeSpace stays at 6b9826e.

Evidence. DevGuard evidence/cs79-2026-09-30/ (local), 1,664 files, MANIFEST.json SHA-256 10beb5fd9319e66ac78a827617e8bfcec9bc8d6b385709458482c90207ef7cb7. It holds the protocol, inventory, harness, build log, lock divergence, checks, driver logs, every probe report, the output of analyze.py, and the post-hoc output.

Next. No CodeSpace change is proposed. Comparing remedies (step 3) needs its own decision.

[novelKR]

2026-10-01 07:05 UTC. The fix is #81, verified against the rust-v0.154.0 baseline. It is ready for review and not merged.

• What runner: keep only standard descriptors in spawned children (#79) #81 changes. It is at 8afb701.

  • Which spawns. Every spawn the runner host makes without child-side exclusion now marks every descriptor above 2 close-on-exec in the child, before exec. Those spawns are pipe executions, the patch helper, the Linux sandbox probe and prepare helper, and the Gateway's UDS worker.
  • How, per platform. On Linux it is one close_range call. On macOS the child lists its own descriptors with proc_pidinfo into a buffer allocated before the fork. A bounded walk is the fallback.
  • What is kept. Standard descriptors are kept. Descriptors that are already close-on-exec are left alone, so a failed exec is still reported as a spawn error.
  • What is unchanged. The PTY path already sweeps and is unchanged. No pin, dependency or execution structure changes.

• Tests. The new regression tests fail without the fix and pass with it: the product pipe path, the worker command, and the mechanism with an unguarded control. CI on 8afb701 is green, and the Linux integration leg ran these tests under bubblewrap.

• Comparative verification. The protocol (SHA-256 d1fe0bda…) was frozen before the build. The sealed Investigate descriptor inheritance between concurrent spawns on macOS #79 harness ran unchanged against the fix with Codex 6b9826e: 1,590 executions, 0 errors.

  Measure	Baseline	Fix
  Pipe strays holding a foreign descriptor (P8 / T8 / P64 / T64)	39/200, 33/100, 60/200, 39/100	0/200, 0/100, 0/200, 0/100
  Pipe targets holding one (P8 / P64)	21/100, 27/100	0/100, 0/100
  NC1's inheritable file reaching pipe children	5/5	0/5
  PTY targets whose master was held (T8 / T64)	14/50, 14/50	0/50, 0/50
  PTY targets whose slave was held (T8 / T64)	12/50, at least 3/50	0/50, 0/50
  Case wall times	—	within 1% of the baseline

• Not counted toward CS-RG. This is an independent product defect fix, and it does not count toward CS-RG or any DevGuard milestone.

• Evidence (DevGuard, local), MANIFEST.json SHA-256: cs79-fix-2026-10-01 57c724a6847de9b31618c9038cf93b350884dae8d4284ea8fdea7d70f9870dc4, and cs79-verify-2026-10-01 ea3e1e437de2fceeb40660d1a8e4da927a17c093a76d4365ca8139989f199f22.

• Next: the owner's review and exact-head merge approval of runner: keep only standard descriptors in spawned children (#79) #81.