[kixelated]

Finishes quest/m0/land-fixer/network.md, part of the land fixer epic.

Summary

The host never blocked the fixer's network: kixelated/nixos modules/ci-egress.nix gives qland-fix the check containers' public egress, and Codex runs with --dangerously-bypass-approvals-and-sandbox. The fixer chose cargo --offline because assets/land-fix.md said "Never push or contact GitHub", and fetching a git dependency such as moq's uniffi from github.com counted as contact. In 17 of moq's last 40 fix jobs, cargo failed with "failed to get uniffi".

• assets/land-fix.md: two new paragraphs.
  • Build tools may fetch the dependencies named in manifests and lockfiles, from package registries and from github.com/codeload.github.com for git dependencies. The fixer must not build --offline to avoid them. GitHub's API (gh, api.github.com), pushing, and every other host stay forbidden.
  • Before reporting fixed or requeue, the fixer builds and tests the packages the PR and its fix touch, including whatever the failure log shows failing, and names the commands in the reason. If it can't get a PR passing mechanically, or can't run its build or tests, it hands the PR back and quotes the command and the output line that shows why.
• README.md: the fixer wrapper contract said the wrapper "must restrict network access to the model proxy". It now says the network must reach the model proxy, the package registries, and github.com/codeload.github.com, and that the prompt allows only dependency fetches.
• quest/m0/host-land/fixer.md: the "network access only to CLIProxyAPI" line now describes the host as built.
• quest/m0/land-fixer/README.md: removes the quest from Required, points the audit table row at this PR, and keeps the decision record that lived in the deleted quest file.
• test/land.test.ts: a new test pins the network and verification wording, next to the existing prompt-injection test.

To avoid conflicts with moq-dev/quest#357, which rewrites the protected-path sentences, the new rules are separate paragraphs placed after the protected-path paragraph. That paragraph is unchanged, so its "Never push or contact GitHub" stays. The new paragraph carves the exception out of it: "These fetches are the only GitHub contact allowed".

Choices made without asking

• An unverified requeue also hands back, not just an unverified fix. The quest's Goal says the fixer builds and tests "before the fixer reports fixed or requeue". So a PR whose build or tests the fixer cannot run is handed back rather than requeued untested. If the container lacks a repository's toolchain, more handbacks result.
• Git dependencies on hosts other than GitHub stay unreachable, since the Plan names only registries and github.com/codeload.github.com. A PR that needs one cannot be built, so it is handed back.
• "Never call GitHub's API yourself" is worded so that a build tool's own requests are allowed. Cargo's GitHub fast path queries api.github.com during a git fetch; the fixer must not call the API directly.

Follow-ups

• PR code the fixer builds can read the gate's proxy key. The fixer now builds and tests PR code more often, for example build.rs, test code, and npm lifecycle scripts. That code runs as the same user as Codex in a container with public egress, so it can read OPENAI_API_KEY from /proc/<codex pid>/environ and send it anywhere. This risk existed before this PR, since the egress was already public and offline builds still ran build.rs, but this change makes it more likely. Options:
  • Run the agent's commands as a different user from the one holding the key.
  • Narrow qland-fix egress to a registry allowlist or proxy, as Gate host's Goal states.
  • Rely on the gate's separately revocable client key and add a spend cap on CLIProxyAPI.
• quest/m0/host-land/host.md's Goal is out of date. It still says the containers' network "reaches only the package registries and the host's CLIProxyAPI", while its own Plan records that egress follows the CI public-IPv4 policy. Either correct the Goal or narrow the egress to match it.

Review

Codex (quest review --deep), gpt-6-astra at medium effort, round 1 of session 01a19747-c865-7ac0-aded-0ef7a72f0194, reviewed head 0b842d48559baaa44adb835c670d514ced8b4c2a against origin/main (4bc19cc): no findings.

Local checks on this head: just check, quest check --base origin/main, and test/land.test.ts (131 tests) passed.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 36 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ca4c62e3-bad3-4dfc-9182-85be1a840156

Commits

Reviewing files that changed from the base of the PR and between 4bc19cc and 0b842d4.

Files selected for processing: 6

• README.md
• assets/land-fix.md
• quest/m0/host-land/fixer.md
• quest/m0/land-fixer/README.md
• quest/m0/land-fixer/network.md
• test/land.test.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn