audit: independent Claude review pass over the full codebase (second opinion, post-#100)

[thehoff]

Why

Issue #100 ran a full-codebase audit via Codex peer review — 8 groups, ~11 CRITICAL / ~47 IMPORTANT / ~13 NICE remediated across PRs #101-#109 (+ #110, a clippy blocker found on the merged tip).

This issue tracks an independent second pass by Claude over the same codebase. Multi-model peer review: a different reviewer lens on freshly-remediated code. Two goals:

1. Verify the audit: full-codebase security + correctness review (Codex, multi-pass) #100 remediations actually hold in the current develop tip.
2. Find what Codex's lens missed — independent eyes, adversarial stance.

Result

All 8 groups reviewed. 4 CRITICAL, 15 IMPORTANT, 24 NICE-TO-HAVE. The #100 remediations all verified holding — no regression. Findings are gaps the Codex pass did not reach.

Three of the four CRITICALs share one root pattern: the env-injection surface was hardened comprehensively, but the command-line forbidden-flag surface was applied piecemeal (git checker not wired to subcommands, grep missing its -- boundary, Go missing a checker entirely).

Per-group findings in the comments. No auto-fix this round — findings filed for review.

Groups

• G1 — Security core — 1 IMPORTANT, 5 NICE
• G2 — Hook system + dispatch — 1 IMPORTANT, 4 NICE
• G3 — Filter engine + tracking — 2 IMPORTANT, 2 NICE
• G4 — Command filters: git + cloud — 1 CRITICAL, 1 IMPORTANT, 2 NICE
• G5 — Command filters: system + rust + js — 1 CRITICAL, 2 IMPORTANT, 3 NICE
• G6 — Command filters: python + ruby + go + jvm + dotnet — 1 CRITICAL, 3 IMPORTANT, 2 NICE
• G7 — Discover + analytics + learn + parser — 1 CRITICAL, 3 IMPORTANT, 3 NICE
• G8 — TOML filter configs + test harness — 2 IMPORTANT, 3 NICE

[thehoff]

G1 — Security core — Claude review

Verdict: substantially clean. 6 findings — 1 IMPORTANT, 5 NICE-TO-HAVE. The #100 remediations hold: universal env-strip wired into every secure_*_command via apply_universal_env_strip, meta-dispatch regression test guards tool routing, integrity fails closed on NoBaseline, baseline symlink/world-writable checks present, compound-allow fix (rtk-ai#1213) correct, trust TOCTOU-safe via check_trust_bytes.

IMPORTANT

1. Supply-chain gate auto-allows unnameable installs. supply_chain_gate.rs:248-260,294,320 — detect_installs only flags packages it can name. npm install (lockfile install) or pip install -r req.txt yields empty pkgs → out.push skipped → whole command returns Verdict::Skip (auto-allow). A lockfile / requirements.txt install pulls arbitrary unvetted packages the gate never sees; -r is explicitly skipped at :320. Fix: when an install verb is detected but no package is resolvable (lockfile / -r / -c), emit an UnvettableSource finding rather than dropping it.

NICE-TO-HAVE

2. tirith_gate.rs fails OPEN by default. should_downgrade only downgrades Unavailable when require_tirith() is set (:133). A missing/crashed/timed-out tirith silently allows. Documented + intentional (:352), but a defence-in-depth gate is safer failing closed-to-Ask; at minimum the dashboard should warn louder than [--] not required.

3. secure_git_command strips GIT_CONFIG_KEY_0..63 but GIT_CONFIG_COUNT can exceed 64. utils.rs:529,555 — loop bound 64; a tainted GIT_CONFIG_COUNT=200 leaves indices 64-199. COUNT itself is stripped (:519) so no trigger today, but a std::env::vars() dynamic sweep (the pattern already used for PIP_*/NPM_CONFIG_*/CARGO_TARGET_*) would close it uniformly.

4. Cargo --config <file.toml> path form not denied. utils.rs:1247-1283,1299 — cargo's --config accepts KEY=VALUE or a TOML file path. The scanner only inspects K=V pairs; a value with no = is waved through. cargo build --config /tmp/evil.toml setting target.*.runner bypasses the deny-list. Fix: treat a --config value lacking = as a file reference — reject, or refuse unless it resolves inside CWD.

5. osv_severity default-High (supply_chain_gate.rs:592) — fail-secure direction, but can over-block on non-standard OSV severity encodings. Acceptable.

6. Trust store / supply-chain config files have no ownership/world-writable check. integrity.rs rigorously validates the .rtk-hook.sha256 baseline (symlink + uid + mode), but trust.rs::read_store (:54) and supply_chain_gate.rs::read_config_from_disk (:195) read their JSON/TOML with no equivalent guard. A world-writable trusted_filters.json lets an attacker pre-trust a malicious filter; a writable supply-chain.toml lets [overrides.always_allow] neuter the gate. Low practical risk (~/.local/share / ~/.config), but the asymmetry with the integrity baseline is worth a matching guard.

Branding: clean — user-facing strings say contextcrawler. Only rtk residue is internal on-disk paths / env var names (.rtk-hook.sha256, RTK_DATA_DIR) — a migration concern, not a finding.

Correctness: no unwrap()/panic on a hot path; fallbacks fail-secure.

[thehoff]

G2 — Hook system + dispatch — Claude review

Verdict: sound — Codex remediations hold. 1 IMPORTANT inconsistency, 4 NICE-TO-HAVE. No CRITICAL. The #100 CRITICALs (deny-rule → PayloadAction::Deny, path-traversal rejection at proxy + meta call sites) and IMPORTANTs (basename-normalise membership, Broken hook status, audit-log symlink-escape + size caps) all verified present and correct. The Claude hook path could not be broken open.

IMPORTANT

1. Gemini hook fails OPEN on malformed JSON — inconsistent with the Claude hook's fail-closed contract. hook_cmd.rs:195 — run_gemini parses with serde_json::from_str(&input).context(...)?. The ? bubbles Err up through run(), which exits non-zero with no decision JSON. The agent harness treats a non-zero hook exit with no decision as allow — so a crafted/garbled payload to the Gemini hook silently lets the command through. The Claude path (run_claude, :574-582) was hardened in #100 to emit_claude_deny on parse failure; Gemini was not. Gemini owns the allow/deny verdict, so this is real exposure. Fix: on parse failure emit {"decision":"deny",...} instead of ?-bailing, matching run_claude.

NICE-TO-HAVE

2. proxy path spawns the lossy String, not OsString — comment overstates the guarantee. main.rs:3705 — resolved_command(&cmd_name_display) where cmd_name_display is to_string_lossy().into_owned(). The comment (:3700-3704) claims argv[0] stays OsString; it doesn't. Not exploitable (separator check + PATH resolution already constrain argv[0] to a bare resolvable name), but drop the misleading comment + dead let _ = &cmd_name.

3. Cursor hook silently fails open on malformed JSON. hook_cmd.rs:655-661 — run_cursor emits {} (no decision) on parse error. Lower severity than Gemini (Cursor {} defers to Cursor's own permission engine; only the rewrite is lost). Acceptable — but add a comment noting the deliberate fail-open rationale.

4. No end-to-end test for the GateDecision::Ask + un-rewritable → Deny path. hook_cmd.rs:482-494 — gate_no_rewrite_deny_log has a wording test, but no test drives a real payload through with gate_ask true to assert PayloadAction::Deny { audit_tag: "deny:gate_no_rewrite" }. A fault-injecting test would close it.

5. Audit log + data dir still use legacy rtk on disk — hook_cmd.rs:274 (~/.local/share/rtk), RTK_AUDIT_DIR/RTK_HOOK_AUDIT. Branding inconsistency; flag for a deliberate migrate-or-keep decision.

[thehoff]

G3 — Filter engine + tracking — Claude review

Verdict: Codex remediations hold. Filter engine is sound — no output-corruption or deadlock bug. 2 IMPORTANT, 2 NICE. No CRITICAL.

Codex remediations verified intact

• match_output/unless evaluates against the pre-replace snapshot (toml_filter.rs:503,527) — a replace rule cannot mask error markers.
• max_lines = 0 rejected at compile (:370); head/tail use saturating_add (:558).
• telemetry.rs:31 — maybe_ping() hard-returns before any network code; ureq calls statically unreachable. No network path confirmed.
• stream.rs thread topology correct: bounded rx (4096) + bounded sink (8192) with try_send drop-on-overflow; all three threads joined; sink_tx dropped before join. No deadlock, no unbounded growth, drops accounted + surfaced.
• SQL fully parameterised (params![...], GLOB-not-LIKE at tracking.rs:179); scrub_secrets at the INSERT boundary; DB + WAL/SHM forced 0600.

IMPORTANT

1. RTK_DB_PATH bypasses the $HOME confinement applied to tracking.database_path. get_db_path() (tracking.rs:1380) returns the env value verbatim as Priority 1, while a config-file path goes through confine_db_path_to_home() (Priority 2). Codex hardened the config path but left the env path open. Anyone who can set process env (hostile project .envrc/direnv, poisoned hook) can redirect the SQLite DB — 90 days of command history — anywhere writable. The tee dir handles this consistently: RTK_TEE_DIR is confined (tee.rs:80). Fix: route RTK_DB_PATH through confine_db_path_to_home() too, or document the asymmetry as intentional test opt-in.

2. no_bloat compares byte length, not token count, while tracking records token estimates. runner.rs:36 picks the smaller of baseline/filtered by .len() (bytes); TimedExecution::track then estimates tokens (tracking.rs:1582). A filtered output fewer in bytes but more in whitespace-delimited tokens makes the emitted text and the recorded savings disagree on direction — the exact consistency the no_bloat doc-comment (#95) promises. Low blast radius, but the guard should measure the unit it defends. Fix: compare estimate_tokens(), or document bytes as a deliberate proxy.

NICE-TO-HAVE

3. apply_filter does a full owned-String-per-line copy (toml_filter.rs:489) and replace re-clones every line per rule (:507) — ~6 transient copies of a 10 MiB blob. Bounded by RAW_CAP upstream so no OOM; a &str-slice line filter would cut latency. Pre-existing rtk design, not a fork regression.

4. Cosmetic: toml_filter.rs env vars still RTK_NO_TOML/RTK_TOML_DEBUG; the lookup-priority doc-comment (:5-13) references rtk init and ~/.config/rtk/. Env var names are intentionally kept for compatibility; the stale prose isn't.

filter.rs, tee.rs (O_NOFOLLOW + 0600 + UTF-8-boundary truncation), config.rs, display_helpers.rs — clean.

[thehoff]

G5 — system + rust + js filters — Claude review

Verdict: Codex remediations hold, but TWO real bugs survived — 1 CRITICAL, 2 IMPORTANT, 3 NICE. Verified intact: env value-aware masking + entropy gate, ls/tree -- boundaries, rg --pre/-z rejection, secure_rg/cargo/node_command env-strip, cargo/node forbidden-arg checks.

CRITICAL

1. grep_cmd.rs:53 — no -- argument boundary; a --leading pattern/path is parsed as an rg flag, past the forbidden-arg check.
rg_cmd.args(["-n", "--no-heading", "--no-ignore-vcs", &rg_pattern, path]); — pattern and path go straight into argv with no -- separator. Codex added the -- boundary to ls.rs:60 and tree.rs:58 for exactly this class (commented "#100, G5#1/#2") but grep was missed. extra_args are also appended after path (:59-65) with no boundary, and check_forbidden_rg_args only scans extra_args — not pattern/path. So a pattern of --pre=<cmd> form reaches rg unscanned: --pre runs an arbitrary preprocessor command (RCE). The grep fallback at :75 (grep_cmd.args(["-rn", pattern, path])) has the same defect. Fix: emit the fixed flags, then forbidden-checked extra_args, then "--", then &rg_pattern, then path. (Note: this is the same grep -r surface that opened this whole work stream — the arg-boundary half was never closed.)

IMPORTANT

2. tree.rs:40 — -o listed as a value-consuming flag. VALUE_FLAGS includes "-o". When a user runs tree -o somedir intending somedir as a path, expect_value=true swallows it onto the flag side of the -- boundary and the path operand is silently dropped. Not security; verify against the tree man page for the target platform — if -o is kept, document why.

3. find_cmd.rs:267 — strip_prefix fallback can emit absolute display paths. entry_path.strip_prefix(path).unwrap_or(entry_path) — when path has a trailing slash or differs in normalisation, strip_prefix fails and the full absolute path is pushed, breaking the "relative to search root" contract and bloating output. Not a leak. Normalise path first.

NICE-TO-HAVE

4. env_cmd.rs:46-51,64 — value_looks_sensitive work is wasted on uncategorised vars (they're dropped from output anyway by the categorisation gate). Cosmetic.

5. looks_like_high_entropy_secret — a pure-lowercase base32 secret fails class_count>=2 and leaks; documented accepted residual, key-name check is the backstop. Acceptable.

6. No unwrap() on hot paths outside tests/lazy_static!; branding clean; grep exit codes propagate.

Priority: fix #1 before next release — both a correctness and an arg-injection-surface regression that Codex's ---boundary sweep should have caught but didn't.

[thehoff]

G8 — TOML filter configs + test harness — Claude review

Verdict: good shape. No CRITICAL data-loss bug. 2 IMPORTANT, 3 NICE. Every match_output (12 filters) short-circuits only on a success sentinel AND carries a sound unless guard covering error/warning/failure vocabulary, each with a "not swallowed despite success line" regression test — the danger class is closed.

IMPORTANT

1. max_lines head-truncation can silently drop the error tail — oxlint.toml:8 (max_lines = 50), gcc.toml, basedpyright.toml, biome.toml, markdownlint.toml, yamllint.toml, shellcheck.toml. These linter filters cap at max_lines from the head. On a run with >50 diagnostics the summary line ("Found N errors") sits at the bottom and is truncated away — the agent sees 50 warnings and no count, or the trailing error: lines vanish. Build filters mitigate with keep_lines_matching/tail_lines; the linter filters don't. No test exercises the overflow path. Fix: reserve tail_lines for the summary or pin error:/summary lines with keep_lines_matching, + an overflow test per filter.

2. xcodebuild.toml / gradle.toml on_empty masks a crash as success. on_empty = "xcodebuild: ok" / "gradle: ok" fires when the tool crashes producing no stdout (JVM OOM, segfault) — the agent is told "ok" on a hard failure. Both honestly document this in a NOTE (#100/G8) comment, but documenting a footgun isn't closing it. Safe default is on_empty = "" (pass empty through) — "ok" is an active false claim. Linter/strip filters with on_empty (oxlint, biome, basedpyright, skopeo, gcc) share this.

NICE-TO-HAVE

3. Weak tests assert too little — runtime_hardening.rs:339 (pytest_p_legitimate_module_names_still_allowed) only asserts the deny message is absent, so it'd still pass if the deny logic were deleted. pytest_p_glued_form_is_rejected:321 asserts exit 2 but doesn't pin the #49 ref like its sibling. Tighten + pin refs consistently.

4. No filter-level test covers max_lines/truncate_lines_at truncation — all [[tests.*]] inputs sit under the cap; the truncation path in ~30 filters is untested at the TOML layer. One overflow fixture per cap-bearing filter would catch finding #1.

5. No secret-masking coverage in G8's scope — nothing feeds a token-shaped string through a filter and asserts output doesn't leak it. If masking is owned by another group, fine — flagging so it isn't assumed covered here.

Clean

• Branding: no rtk in user-facing TOML strings (the two brew-install.toml:24,26 hits are inside a realistic Homebrew test fixture — correct).
• No real secrets in tests/fixtures/ (AKIA/ghp_/JWT/PEM scan empty).
• Strip patterns appropriately narrow — helm, oxlint, iptables, ssh all carry deliberate-narrowing comments; no over-broad strip found.
• The security harness (cargo_hardening.rs, runtime_hardening.rs, gh_glab_gt_hardening.rs, hook_claude_deny.rs) is genuinely strong — empirical marker-file PoCs, exit-2 assertions, issue-ref pinning, positive controls. Not volume-padding.

[thehoff]

G6 — python + ruby + go + jvm + dotnet filters — Claude review

Verdict: env-injection half of the threat model is solid; the command-line-flag half is inconsistent. 1 CRITICAL, 3 IMPORTANT, 2 NICE. Codex's #100 lens was env-var-centric and missed a class of CLI forbidden-arg bypasses.

CRITICAL

1. Go has NO forbidden-arg checker — -toolexec/-exec/-gcflags RCE wide open. go/go_cmd.rs:48-60 (run_test), :85-90 (run_build), golangci_cmd.rs:141 all forward user args verbatim into secure_go_command. No check_forbidden_go_args exists anywhere. go build -toolexec=/tmp/evil, go test -exec /tmp/evil, -gcflags=-toolexec=... all run an arbitrary binary during the build. The comment at go_cmd.rs:5-7 names -toolexec=/tmp/evil as the threat and falsely claims secure_go_command defends it — -toolexec is a CLI flag, not an env var; env-strip does nothing. Same vector class Codex closed for git (--exec-path), pip (--index-url), gradle (--init-script) — Go was skipped. Fix: add check_forbidden_go_args rejecting -toolexec, -exec, -gcflags/-ldflags/-asmflags containing -toolexec; call it in every go_cmd.rs/golangci_cmd.rs run_*.

IMPORTANT

2. pytest -c/--config bypasses the -p plugin block. utils.rs:2909 — check_forbidden_pytest_args blocks --rootdir and -p <path> but not -c FILE. An attacker-controlled pytest.ini/tox.ini via -c can set addopts = -p /tmp/evil_plugin.py — the plugin-path block is one config-file indirection away from defeated. Fix: reject -c/--config like mypy's --config-file.

3. gradle -I glued form not caught. utils.rs:3054-3071 — matches a == "-I" and --init-script= but not the glued -I/path/init.gradle (arbitrary Groovy). Also unguarded: -c/--settings-file, -b/--build-file. Fix: add a.starts_with("-I") + reject those.

4. golangci-lint -c/--config unchecked. golangci_cmd.rs:141 — golangci-lint loads custom Go-plugin .so linters declared in its config; -c <attacker.yml> can point at one. Needs a planted .so (lower severity), same family. Fix: reject -c/--config or restrict to in-cwd.

NICE-TO-HAVE

5. rake has no forbidden-arg checker — rake_cmd.rs:49; rake accepts -r/--require and -f/--rakefile. rspec/rubocop got checkers, rake was skipped. Lower priority (rake tasks are arbitrary Ruby by design) but -r injects into a benign rake test.

6. mypy -c PROGRAM_TEXT not blocked — utils.rs:3008; marginal, -c type-checks an inline string, not RCE. Noted for completeness.

Verified clean

Env-strip builders (secure_python/ruby/jvm/dotnet/go_command) cover the documented dangerous vars; spawn-level child-env tests genuinely confirm strip. pytest -p glued-form + bare-relative-path fixes verified. binlog gzip-bomb cap (.take(MAX_ARTIFACT_BYTES+1)) correct. binlog/dotnet exit-code authority correct. Branding clean; no hot-path unwrap().

[thehoff]

G7 — discover + analytics + learn + parser — Claude review

Verdict: Codex's #100 security remediations hold; the branding sweep was incomplete and left correctness bugs. 1 CRITICAL, 3 IMPORTANT, 3 NICE. Verified intact: RTK_DISABLED exact-key parsing, strip_absolute_path starts_with('/'), per-file symlink rejection — all correct and tested. No security regression.

CRITICAL

1. extract_json_object panics / corrupts on non-ASCII JSON — parser/mod.rs:174-191. Line 174 collects chars() into a Vec, then :190 computes end_pos = start_pos + i + 1 using the char index i as a byte offset. Any multibyte char before the closing brace (a non-ASCII test name in vitest JSON) makes end_pos wrong: &input[start_pos..end_pos] either panics (byte index is not a char boundary) or returns corrupt JSON. Tests only exercise ASCII. Same bug class as the gain truncation Codex fixed — missed here. Fix: track byte offsets via char_indices() or operate on as_bytes(). Related: :157-163 reconstruct a byte offset as l.len()+1 per line, assuming single-byte \n — drifts on \r\n.

IMPORTANT

2. Session adoption metric undercounts every hook-rewritten command — analytics/session_cmd.rs:42. count_rtk_commands tests part.starts_with("rtk ") but not "contextcrawler ". The current hook emits contextcrawler <cmd>; those route to Classification::Ignored so they count as NOT adopted. The "Adoption" % is silently understated for every user on the current binary. Fix: add || part.starts_with("contextcrawler ").

3. compute_totals reports an unweighted mean of savings percentages — cc_economics.rs:369-370. pct_sum / pct_count averages each period's % equally regardless of volume — 1 cmd at 90% + 1000 at 10% reports 50%. set_rtk_from_month correctly derives a token-weighted pct, then compute_totals discards it. Fix: weight by saved_tokens / total, consistent with the monthly derivation.

4. Branding: user-facing output still says "RTK" — session_cmd.rs:150 "RTK Session Overview", :155 column header; learn/report.rs:18 "RTK Learn", :63-64 writes auto-generated by rtk learn / rtk learn --write-rules into the generated rules file. Visible output, same lens as discover/gain branding — missed.

NICE-TO-HAVE

5. RTK_DISABLED via absolute-path env not detected — discover/registry.rs:444-446; /usr/bin/env RTK_DISABLED=1 git status isn't recognised as a deliberate bypass — an accounting inaccuracy in rtk_disabled_count, not a security hole.

6. command_similarity arg extraction breaks on env-prefixed commands — learn/detector.rs:157-167; two distinct RUST_BACKTRACE=1 cargo test --foo/--bar compare as identical. Minor accuracy loss.

7. gain.rs byte-slices date/timestamp strings — :475, :741-744; DB-controlled ASCII today so safe, but inconsistent with the char-safe truncate used elsewhere — latent panic if the schema carries non-ASCII.

[thehoff]

G4 — git + cloud filters — Claude review

Verdict: 1 CRITICAL git deny-list gap; curl/wget checkers are genuinely solid. 1 CRITICAL, 1 IMPORTANT, 2 NICE.

CRITICAL

1. Git transport-flag denylist not enforced on subcommand args — RCE. main.rs:2731 is the only call to check_forbidden_git_args, and it runs against a synthesised ["-c", cfg] pair from the --config-override global. The per-subcommand args for fetch/push/pull and the catch-all passthrough go straight to git unvalidated — git.rs:1270-1274 (run_push), :1302-1306 (run_pull), run_fetch, :1997-1999 (run_passthrough). FORBIDDEN_GIT_FLAGS_EXACT/_PREFIX (--upload-pack, --receive-pack, --exec-path, --config-env) therefore never fire for:

• contextcrawler git fetch --upload-pack=/tmp/evil origin
• contextcrawler git push --receive-pack=/tmp/evil origin
• contextcrawler git clone --upload-pack=/tmp/evil git@host:repo (clone routes to run_passthrough)

All confirmed RCE shapes per #35; env-strip in secure_git_command does not cover argv flags. git_hardening.rs tests only the -c global path + env-strip. The function and its unit tests already exist — it just isn't wired in. Fix: call check_forbidden_git_args(args) at the head of git::run and inside run_passthrough; add an integration test driving git fetch --upload-pack=….

IMPORTANT

2. Catch-all passthrough is a blanket denylist bypass. Same root cause as #1: GitCommands::Other → run_passthrough takes OsString args verbatim. Any unmodelled subcommand (clone, submodule, config, apply, am) flows here unguarded. The #1 fix (validate in run_passthrough) closes it.

NICE-TO-HAVE

3. to_string_lossy() deny-check vs original-OsString spawn — container.rs:549,646,706. kubectl/docker checkers compare a lossy copy while spawn uses the original OsString. Not exploitable (every denied token is ASCII), but add a comment noting the checks are safe only because the denied set is ASCII — a future non-ASCII deny entry would be bypassable.

4. curl -O (remote-name file write) not denied — utils.rs:3839 explicitly excludes -O from the -o target check. -O writes a URL-derived filename in CWD (weaker than -o ~/.bashrc; URL controls the name). Asymmetry with wget (-O is denied there). Document the deliberate choice or close it.

Verified holding: curl/wget checkers thorough — long_key_matches_forbidden (getopt prefix), short_token_has_forbidden (bundling/attached) cover short/long/--flag=val/-Kfile/-sK/--conf; VALUE_FLAGS prevents the curl --data -K false positive; -- separator handled. minify_json genuinely lossless (textual strip, float precision preserved). kubectl/docker/aws/psql env-strip complete + spawn-verified. Branding clean; no hot-path unwrap().

---

Consolidated summary — Claude independent review (#111)

All 8 groups reviewed against the current develop tip (post #101-#110).

Tally: 4 CRITICAL, 15 IMPORTANT, 24 NICE-TO-HAVE.

Group	CRITICAL	IMPORTANT	NICE
G1 Security core	0	1	5
G2 Hook system	0	1	4
G3 Filter engine	0	2	2
G4 git + cloud	1	1	2
G5 system+rust+js	1	2	3
G6 py+rb+go+jvm+dotnet	1	3	2
G7 discover+analytics	1	3	3
G8 TOML + tests	0	2	3

The 4 CRITICALs — and the pattern

• G4 — git transport-flag denylist (--upload-pack/--receive-pack/--exec-path) not wired to subcommand args → RCE.
• G5 — grep_cmd has no -- argument boundary; a --pre=<cmd>-shaped pattern reaches rg unscanned → preprocessor RCE.
• G6 — Go has no forbidden-arg checker at all; -toolexec/-exec → RCE (the code comment falsely claims env-strip defends it).
• G7 — extract_json_object uses a char index as a byte offset → panic / corrupt JSON on any non-ASCII input.

Three of the four CRITICALs are the same root pattern: the #100 audit hardened the environment-injection surface comprehensively and consistently, but the command-line forbidden-flag surface was applied piecemeal — git's checker exists but isn't called on subcommands, grep never got the -- boundary its siblings got, Go got no checker at all. The env-var half of the threat model is solid; the argv-flag half has holes. A single consolidated "every tool that spawns a subprocess has a forbidden-arg checker wired into every run path, with an integration test" sweep would close the class.

The #100 remediations themselves all verified holding — no regression found in any group. These are gaps the Codex pass did not reach, surfaced by an independent reviewer lens — which is the point of the second pass.

Findings filed for review; no auto-fix this round.