[kixelated]

Summary

Works the items Run the gate on the maintainer's host says remain, within its freeze. The quest is rewritten to its one remaining item, the kixelated/nixos stack's merge, under ## Waiting, and resized [S].

• Symlink attack VM tests: kixelated/nixos#22, stacked on kixelated/nixos#19, covers a link to an outside directory (refused through the real launcher socket), an escaping chain, and a write through a symlinked directory. The quest said the extraction "already rejects" all three. In fact tarfile's data filter rewrites the last two links so they stay inside, so those tests assert containment rather than rejection. With the filter removed they fail.
• Switch race: already fixed in kixelated/nixos#19 (21a1bde, refresh services close listeners in activation's stop phase and reopen them in its start phase). The quest-land VM test passed in all three runs here, on fix(skills): planning PRs leave issues open and summarize the decision #19's stack. Recorded as done.
• moq-bot's organization_self_hosted_runners write permission: kept, not dropped. It no longer serves only the retired runner: fix(skills): planning PRs leave issues open and summarize the decision #19's scripts/ci-runner-token.sh uses it to mint the quest, rind and rust2 queue runners' registration tokens.
• Fixer proxy access: removed from "what remains", the same edit as moq-dev/quest#441. The mention of the deleted watcher quest gets the same rewrite as moq-dev/quest#442, so the three PRs merge cleanly.

Choices made without asking

• Changed the planned "maintainer may drop" item to "kept", since dropping it now would break the org runners' registration.

Waiting

• Maintainer: merge the kixelated/nixos stack once kixelated/nixos#13 lands: #16, then #18, #19, and the PRs stacked on it, including #22. Only the maintainer merges into the host's configuration. Check that git log origin/main in kixelated/nixos contains each PR's head; the quest file is then deleted.

Validation

• quest check --base origin/main and just check pass on de8636f. The kixelated/nixos validation (the quest-land VM test with the new attacks) is in that PR.

Review

Skipped here: a quest-file rewrite with no code. The code change, kixelated/nixos#22, had a Codex review (gpt-6.1-sol, medium) on 4b21e72 with no findings.

Follow-ups

None.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)