PR 029 P2: Capture stable Error intrinsic

[LogicDuke]

Purpose

Stacked validation repair for the exact-current PR #29-owned finding:

PR029-CODEX-HOSTILE-GLOBAL-ERROR-CONSTRUCTOR-SKIPS-RELEASE

This PR is intentionally narrow and quarantined.

It targets protected parent PR #29 branch:

repair/pr025-normalization-release-order

It does NOT target main.

It does NOT directly target PR #25.

It does NOT directly target protected PR #10.

It does NOT modify sibling PR #22.

Finding

Classification:

CURRENT P2

Exact affected parent HEAD:

f5fe331108b4b215ac02fb50626d60b3a773f583

A hostile thrown value can execute code during instanceof classification and replace the mutable global Error binding.

The hardening-failure path then performs fallback construction through a fresh Error lookup.

A hostile replacement constructor can throw in the first fallback and again in the guarding catch.

The second throw escapes before releaseUnprotectedChild(...) begins.

Because the child has already been created, this can skip the required bounded release attempt and leave the child alive.

The defect was independently reproduced on the exact affected parent HEAD with a real abandoned child.

Repair

The bounded repair captures the trusted Error intrinsic at module evaluation alongside the module's existing captured intrinsics.

The hardening-failure classification block uses that stable captured binding for:

• ordinary Error classification;
• primary fallback construction;
• guarded fallback construction.

This prevents hostile mid-exchange mutation of globalThis.Error from changing classification or routing fallback construction through attacker-controlled code.

The repair preserves classification before release so release-time hostile child accessors cannot mutate the Error chosen for caller-facing rejection.

Changed files exactly:

• src/adapters/process-transport.ts
• tests/adapters/process-transport.test.ts

Protected invariants

The repair preserves:

• ordinary Error object identity;
• stable fallback message;
• exact exceptional-value cause retention;
• total guarded classification for the scoped hostile-JavaScript threat model;
• mandatory bounded release attempt;
• rejection only after release settles;
• no SPAWN_FAILED laundering;
• no AgentExchange laundering;
• no discarded rejected Promise;
• exactly-once caller settlement;
• existing Windows/POSIX-qualified termination semantics;
• no additional PID/PGID authority;
• raw output behavior;
• environment isolation;
• dormant/unwired process transport;
• frozen AgentBridge architecture;
• AgentBridge V1 managed-repository read-only authority.

Exact quarantine identity

Protected parent PR #29 HEAD:

f5fe331108b4b215ac02fb50626d60b3a773f583

Repair commit:

19a8d56df0a42886d73affb595ee893cbe2dd541

Validated patch SHA-256:

8CB59F61A33521677E607A84749283AD9E1B07BBE71F70665FC48DD8B1AA2A72

Patch bytes:

10701

Changed files exactly:

• src/adapters/process-transport.ts
• tests/adapters/process-transport.test.ts

The committed patch was mechanically verified byte-for-byte identical to the candidate that passed fresh independent validation.

Independent validation

Fresh independent validation result:

PASS

The validator independently:

• reproduced the original P2 on pristine exact parent HEAD;
• verified a real child was abandoned by the defective path;
• verified hostile global Error mutation is reachable;
• verified the candidate prevents fallback construction through the poisoned global;
• verified instanceof NativeError is load-bearing because pre-catch poisoning can otherwise destroy ordinary Error identity;
• verified ordinary Error identity remains preserved;
• verified fallback cause identity;
• verified classification remains before release;
• verified child release is not skipped;
• verified no SPAWN_FAILED laundering;
• verified no AgentExchange laundering;
• verified no discarded/unhandled rejection;
• ran six bounded counterfactual checks;
• audited the complete diff;
• ran focused adversarial regressions;
• ran the complete process-transport test file;
• ran the full suite;
• ran typecheck;
• ran lint;
• ran build;
• ran git diff --check;
• re-fingerprinted the exact candidate with no drift.

Validation evidence

Complete tests/adapters/process-transport.test.ts:

145 passed, 9 skipped

Full suite:

1180 passed, 9 skipped

Typecheck:

PASS

Lint:

PASS

Build:

PASS

git diff --check:

PASS

Validation host:

Windows

The 9 skipped tests are platform-conditional/POSIX-gated tests.

No Windows result is claimed as proof of POSIX runtime execution.

Previously tracked PR #29 findings

The independently validated candidate preserves:

PR029-CODEX-ERROR-IDENTITY-MUTATED-BEFORE-CLASSIFICATION
→ FIXED

PR029-CODERABBIT-CAUSE-RETENTION-ASSERTION
→ FIXED

AUDIT-PR025-HOSTILE-THROW-NORMALIZATION-SKIPS-RELEASE
→ FIXED

Out-of-scope inherited findings

The following remain separate and are NOT repaired here:

AUDIT-PR025-ABSORBER-LOST-ON-PARTIAL-LISTENER-CLEAR

AUDIT-PR026-TEMPDIR-SILENT-LEAK

They must be reverified separately against their eventual exact parent HEAD.

Quarantine rule

This DRAFT stacked child PR is evidence/proposal only.

Do not merge it because the repair agent, validator, CI, Codex, or CodeRabbit reports success.

Required before upward integration into protected PR #29:

• exact-head CI;
• fresh independent GitHub review evidence against the exact child HEAD;
• classification of every new finding;
• policy/evidence gate PASS;
• Ready transition only after those gates;
• POST-READY review/check observation;
• human merge authority;
• CREATE A MERGE COMMIT upward into PR PR 025 P2: Release child before hardening error normalization #29;
• establish PR PR 025 P2: Release child before hardening error normalization #29 NEW HEAD;
• fresh PR PR 025 P2: Release child before hardening error normalization #29 audit.

Summary by CodeRabbit

• Bug Fixes
  • Improved error handling when hostile or unexpected values are thrown.
  • Ensured failures consistently produce usable error details without being disrupted by a modified global error constructor.
  • Preserved the original thrown value as the underlying cause for easier diagnosis.
  • Improved cleanup and process handling after adversarial failures.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3de85766-afe0-4831-a511-9419ecc892cd

📥 Commits

Reviewing files that changed from the base of the PR and between f5fe331 and 19a8d56.

📒 Files selected for processing (2)

• src/adapters/process-transport.ts
• tests/adapters/process-transport.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The process transport now captures the native Error constructor for hardening-failure handling. Adversarial tests replace globalThis.Error during classification and verify fallback construction, cause identity, child cleanup, settlement, and unhandled-rejection behavior.

Changes

Process transport hardening

Layer / File(s)	Summary
Capture and use the native Error constructor src/adapters/process-transport.ts	The transport captures the native Error constructor at module load and uses it for hardening-failure classification and fallback construction.
Validate hostile Error global handling tests/adapters/process-transport.test.ts	The adversarial probe poisons globalThis.Error during classification and verifies standard failure settlement, fallback construction, cause preservation, child cleanup, and rejection handling.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 19a8d

The change is narrowly scoped to stabilizing Error handling and adds focused regression coverage; no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• LogicDuke/agentbridge#12: Both changes modify process-transport hardening tests, but this PR covers global Error poisoning while the other covers EventEmitter.emit poisoning.
• LogicDuke/agentbridge#24: Both changes modify the process-transport hardening-failure path and cleanup behavior.

Poem

A rabbit guards the error trail,
While poisoned globals fail.
Native Error holds the line,
Cause and cleanup stay in time.
No lost child, no broken hue—
The transport settles true.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: capturing a stable native Error intrinsic to prevent hostile global Error mutation.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch repair/pr029-stable-error-constructor

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[LogicDuke]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[LogicDuke]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 19a8d56df0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".