[kixelated]

Plans the outcome of a /quest-plan audit of the kix job lifecycle's trust boundaries. It started from Codex Security's P1 findings on kixelated/quest#246 and kixelated/quest#243.

Quests

• New Read-only CI [M]:
  • Enrolled repositories keep pull-request CI read-only.
  • kix checks this at enrollment and warns.
  • cloudflare/GITHUB.md becomes a stage-by-stage trust model.
  • SETUP.md recommends the settings.
• New Head approval [M]: a maintainer approves an exact PR head, such as one kix pushed, for host runners.
• New Land review [M]: kix lands only heads that have a counting review on that exact head.
• Kix epic Plan: records the 2026-10-28 decision.

Decisions (maintainer, 2026-10-28)

Goal. Every stage of a kix job has a stated trust rule. No agent-written or contributor code reaches write credentials or host execution without a maintainer's signature or approval. Docs and quests match the code.

• ✅ Yes
• Narrower: CI only
• Broader

Enforcing read-only CI

• ✅ Check at enrollment and warn
• Refuse enrollment
• Document only

moq-dev/moq's repo-level write secrets

• ✅ Plan a moq quest (in a separate moq-dev/moq PR)
• Fix the settings now
• Later

Host trust (#243)

• ✅ Signatures now, approval later
• Both in Trust maintainer-signed PR heads #243
• Approval only

Upstream publication (#246)

• ✅ Keep it and decline the P1, since read-only CI covers it
• Add a review gate anyway

Landing

• ✅ Enforce a review on the exact head
• The maintainer's pick is enough

Runner claims (vm, marking the PR ready)

• ✅ Owner attestation, documented
• Verify vm and keep drafts

Placement

• Head approval: ✅ m0, after Trusted PR heads. Alternative: m1.
• Land review: ✅ m0, before the onboarding guide. Alternative: m1.

Also done in the same session:

• The guide gained the read-only CI rule (kixelated/quest#263).
• kixelated/quest's land environment is now limited to main.
• Trust maintainer-signed PR heads #243 and Publish job branches on the upstream #246 are being iterated against these decisions.

Checks

quest check passes (52 documents), and so does Prettier.

🤖 Generated with Claude Code

(written by Claude Opus 5.5)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T17:09:39.304121Z	d2c593e	New commits
🔒 Security Review	✅ Completed 2026-10-28T17:10:37.343333Z	d2c593e	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e542b698b1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: d2c593ed2c31247bb65d8fb0613539b3f2a4f040.

P2 — Audit effective CI permissions, not only the default (quest/m0/kix/ci-read-only.md:23–27). A repository with a read-only default token and no secrets can pass every listed check while a PR workflow/job explicitly grants contents: write and runs the submitted code. Same-repository PRs retain that grant, so upstream publication still exposes a write credential. Extend the planned warning/check to workflow/job permission overrides for CI executing unreviewed heads, or explicitly mark that part unverified and require a workflow audit; add a fixture with a read-only default but an explicit write grant. GitHub documents workflow/job permission overrides.

The separate exact-head host approval and landing gates are a sound direction without restoring forks or mandatory publication gates. The earlier stale-review delegation finding is addressed in this revision; no duplicate inline comment.

Verification: static review of the complete plan diff and relevant trust/contribution documentation; no tests executed or live repository settings audited.

[kixelated]

Merge summary:

• Codex's finding on land-review.md fit the recorded "review on the exact head" decision, so d2c593e fixes it: kix defers only to branch protection that requires approval of the most recent push or dismisses stale approvals, keeps its own exact-head check otherwise, and tests protection that keeps stale approvals. Codex 👍'd that head.
• a8d59ae is a conflict-free merge of main (kixelated/quest#262).
• quest check --base origin/main passes on the landed head (52 documents), and so does Prettier.
• No decisions changed.

(written by Claude Opus 5.5)