From 174425b621d37db094aafed7630a728edbccd88f Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Mon, 2 Nov 2026 20:51:11 -0800 Subject: [PATCH 1/2] chore(quest): claim quest/m0/host-land/fixer.md Quest-Claim: 7c24839254a5e4be From fd56c19d273ab0b86a5f8ce06cf046890a9c0ad7 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Mon, 2 Nov 2026 20:51:30 -0800 Subject: [PATCH 2/2] quest: delete the fixer proxy quest, verified on the live host The watcher re-enqueued moq-dev/moq#7388 with the fixer's mechanical fix, which merged at that head, and re-enqueued moq-dev/quest#324 unchanged. Co-Authored-By: Claude Opus 5.5 --- quest/m0/host-land/README.md | 1 - quest/m0/host-land/fixer.md | 40 ------------------------------------ quest/m0/host-land/host.md | 2 -- 3 files changed, 43 deletions(-) delete mode 100644 quest/m0/host-land/fixer.md diff --git a/quest/m0/host-land/README.md b/quest/m0/host-land/README.md index 1687a5ac..7b9b031b 100644 --- a/quest/m0/host-land/README.md +++ b/quest/m0/host-land/README.md @@ -109,5 +109,4 @@ can hand off instead. ## Required - [Gate host](/quest/m0/host-land/host.md) - kixelated/nixos runs the daemon as its own user, checks in nspawn containers, and retires the Actions runner -- [Fixer proxy access](/quest/m0/host-land/fixer.md) - connect the nixos fixer container to CLIProxyAPI with the gate client key and maintainer login - [Fixer TLS](/quest/m0/host-land/fixer-tls.md) - the fixer's container trusts public certificates, so workerd and the Worker tests run there diff --git a/quest/m0/host-land/fixer.md b/quest/m0/host-land/fixer.md deleted file mode 100644 index 02081866..00000000 --- a/quest/m0/host-land/fixer.md +++ /dev/null @@ -1,40 +0,0 @@ -# [S] Connect the host fixer to CLIProxyAPI - -## Goal - -The nixos fixer container reaches CLIProxyAPI with the gate's client key, while -Codex login and Git/GitHub credentials stay outside the container. Verify a real -mechanical fix and unchanged requeue through the -[queue watcher](/quest/m0/queue-watcher/README.md) or the host daemon. - -## Plan - -Maintainer decision, 2026-10-30: a `fixed` head lands without further review. -"Mechanical" stays prompt-enforced, protected paths are blocked, and the residual -prompt-injection risk is accepted. Protected paths stay blocked: on 2026-11-01 the -maintainer briefly let the fixer edit them (moq-dev/quest#357), then reverted that -after an audit, routing fixer-written protected edits through a ready commit -instead ([Protected edits as ready commits](/quest/m0/land-fixer/protected-commit.md)). The built-in prompt treats contributor content -as untrusted and ignores instructions in the PRs' diffs, without handing the PR -back for them. - -- Claude reviews the fix first -- Fixes need a re-pick -- Narrow what it may touch -- ✅ Keep as decided - -The quest CLI implements `quest land fix`, durable collection, validation, -lease-pushes, Review records, and the stop rules that end a pick's fixer -rounds (`stopRule` in `src/cli/land-fixer.ts`). Host work -remains in kixelated/nixos: the ephemeral fixer container (`qland-fix`) reaches -CLIProxyAPI and, like the check containers, the public internet without private -ranges (`modules/ci-egress.nix`), so its builds fetch dependencies; -`assets/land-fix.md` limits the fixer to those fetches. Provide `OPENAI_BASE_URL` and the gate's `OPENAI_API_KEY`, -and log the maintainer's Codex account into CLIProxyAPI. The wrapper runs with -the supplied repository as cwd, receives ` `, exposes the -log read-only, waits for `quest land fix`, preserves its exit status, and returns -`quest-land-result.json` in the repository. See the README's landing contract. - -## Related - -- [Gate host](/quest/m0/host-land/host.md) - container provisioning and daemon rollout diff --git a/quest/m0/host-land/host.md b/quest/m0/host-land/host.md index c5343c18..aab78151 100644 --- a/quest/m0/host-land/host.md +++ b/quest/m0/host-land/host.md @@ -95,8 +95,6 @@ What remains: - Merge #16 once [kixelated/nixos#13](https://github.com/kixelated/nixos/pull/13) lands. -- The fixer's container access to CLIProxyAPI and the Codex login, which the - [fixer](/quest/m0/host-land/fixer.md) needs. - VM tests for three more symlink attacks (an escaping chain, a link to a directory, a write through a symlinked directory), which the extraction already rejects.