[joshavant]

What Problem This Solves

Security-worker installation selects older Go, uv, and AIG CA data that can trust chains involving the compromised eMudhra intermediates.

User Impact

Fresh worker installations consume released trust fixes: Go 1.27.3, uv 0.13.4 and certifi 2026.10.19. Existing workers require normal rebuild/reinstallation. This does not clear independently selected Node/Codex or SkillSpector dependencies.

Why This Change Was Made

Update the existing installer selections and only certifi's universal-wheel hash in the reviewed AIG environment. All scanner source commits, Responses patches, other Python pins and locked SkillSpector installation remain unchanged. SkillSpector's maintained lock still needs an upstream fix; updating its source ref alone would not repair it.

Evidence

• Owning uv resolution succeeds for the existing Ubuntu CPython 3.12 dependency set; only certifi is selected differently.
• Exact PyPI wheel SHA256 verified. Exclusive CA-file tests reject all twelve disclosed chains with the new data; both old selected certifi bundles accept six. Ordinary GitHub HTTPS passes before and after. These are trust-data tests, separate from product runtime proof.
• Installer shell syntax and git diff --check pass.
• Independent Codex review of the full diff reports no actionable P0–P3 findings.
• Secretless Linux arm64 guest: bun run ci:static and all seven focused installer tests pass. The actual reviewed-source installer builds/runs ClawScan with Go 1.27.3. Static audit emits existing unrelated KaTeX/launch-editor advisory warnings. Full AIG installation targets Ubuntu amd64/macOS arm64 wheels; this Linux arm64 guest is outside its reviewed native-wheel hash set.
• Actual uv 0.13.4 rejects all twelve live chains with default roots, but accepts their TLS handshakes when explicitly supplied an older affected OS CA file. This update repairs default CA data only; that custom-store exposure remains recorded for a suitable upstream fix. Operator CA settings are preserved.
• Image publication and deployment remain separate.

Landing scope

Landing is explicitly authorized with the existing automatic main-merge effects: permanent Test deployment, configured Vercel frontend automation and subsequent ordinary worker runs. No manual production Convex, npm or GitHub release workflow is dispatched.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Oct 21, 2026 7:48am UTC

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates worker installations to Go 1.27.3, uv 0.13.4, and certifi 2026.10.19 while preserving scanner source pins and installation safeguards.

Example: A fresh security worker installs the scanner resolver.

• Before: The installer selects uv 0.12.5, whose bundled roots include the affected emSign root.
• After: The installer selects uv 0.13.4, whose bundled roots remove that root; custom certificate stores remain operator-controlled.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	A focused, source-supported security update with no blocking findings; runtime confidence is limited to reported verification rather than inspectable execution evidence.
Proof confidence	🦐 gold shrimp (3/6)	The supplied maintainer-authored classification places this PR outside the ordinary contributor-proof gate. The body reports a real Go installer run and live uv TLS checks, but no linked output supports independently assessing those runs or a complete AIG installation.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Security workers installed with affected trust data can accept HTTPS chains involving compromised intermediates.
Reason: Replacing affected dependency selections has clear security value and stays within the maintainer-authorized scope; the PR explicitly disclaims broader remediation.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: current main still selects affected trust dependencies, and this focused update has clear security value. No introduced blocking defects were found.

Priority: P1
Reviewed head: 02328dfcd0832f4d690c3a3b2a17da13070282dc

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: Inspectable output does not establish a complete updated AIG installation and affected-chain rejection through its installed transport; existing installer tests primarily exercise mocked commands.

Agent review details

How this fits together

GitHub security workflows invoke shared installers that build the pinned ClawScan CLI and install its matching Python scanners; those tools produce evidence for publication and security review.

flowchart TD
  A[Security workflows] --> B[Shared installers]
  B --> C[ClawScan Go binary]
  B --> D[Python scanner environments]
  C --> E[Security worker]
  D --> E
  E --> F[Scan evidence and verdicts]

Loading

Technical review

Best possible solution:

Update the existing installer pins while retaining scanner locks, source verification, operator CA settings, and separate ownership of deployment and remaining dependency repairs.

Do we have a high-confidence way to reproduce the issue?

Current-main pins and upstream advisories establish the affected default trust configuration without running target code; no exploit or worker runtime reproduction was performed during this review.

Is this the best way to solve the issue?

Best-fix verdict: best for the stated installer scope. Updating the existing dependency selections preserves reviewed source and lock contracts; changing scanner source revisions alone would not repair their separately locked dependencies.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 1c5fc5b72ef0.

Provenance checked

• Source-built ClawScan and matched scanner installation keeps the original intent (21841f0: feat: adopt reviewed Sol security consumer policy #3998 established exact reviewed source builds and matching Responses adapters for the approved security consumer policy.)
• Hash-locked AIG dependency environment keeps the original intent (ba5eb72: feat(security): surface A.I.G scanner findings #3522 established a complete hash-locked dependency environment for required skill scanning.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Pinned change and current-main comparison: The introduced diff changes only three dependency selections, certifi's wheel hash, and two matching spec references. Main retains Go 1.27.2, uv 0.12.5, and certifi 2026.7.22. (scripts/security/install-clawscan.sh:19, 02328dfcd083)
• Shared production installation boundary: Security scanning, prepublication checks, and canary publication workflows invoke these installers. Exact source verification, patch checks, hash-required AIG installation, locked SkillSpector installation, adapter tests, and dependency checks remain intact. (scripts/security/install-clawscan-scanners.sh:37, 02328dfcd083)
• Upstream confirms affected and repaired resolver versions: The uv advisory identifies versions below 0.13.4 as affected and explains that 0.13.4 removes the compromised-chain root from bundled certificates; system and custom stores require independent evaluation. GHSA-hq85-5cpj-mr62. (7456b60bc6bc)
• Upstream trust-data repair: The advisory describes removal of affected emSign roots in 2026.10.18; the selected 2026.10.19 tag includes the follow-up restoring unaffected roots. GHSA-6q48-6c7w-9gw2. (662df63d7906)
• Authoritative dependency contract and policy: ClawHub builds this exact dependency revision and consumes its Dockerfile scanner pins, Responses patches, and adapter tests, establishing an affirmative dependency-policy signal. Its complete root AGENTS.md and runtime Dockerfile were read; this PR preserves those contracts. (docker/clawscan-runtime/Dockerfile:3, 5be7f8e97fa4)
• Discussion, ownership, and verification limits: The full live PR body, comments, reviews, and timeline were read. The author reports installer execution and live uv rejection checks but supplies no inspectable logs or media. PyPI access was blocked, preventing independent wheel-hash verification; local historical-content reads also encountered missing objects. Neither infrastructure limit establishes a patch defect. (02328dfcd083)

Likely related people:

• boyhack: Raw commit 50726e9 adds scripts/security/aig-worker-requirements.txt:5 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 50726e9bec5d; files: scripts/security/aig-worker-requirements.txt)

Review metrics

Metric	Value	Why it matters
Patch size	Installer and dependency configuration +4/-4; specs +2/-2	The security update uses existing installation owners and adds no production machinery or test scaffolding.

Labels

Label changes:

• add P1: Current worker installation selects dependencies covered by upstream certificate-compromise advisories, warranting prompt security maintenance.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P1: Current worker installation selects dependencies covered by upstream certificate-compromise advisories, warranting prompt security maintenance.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach redacted installation and TLS-rejection output from a supported updated worker environment.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 21, 2026, 3:59 AM ET / 07:59 UTC.