PR 029 P3: Bypass mutable Error Symbol.hasInstance

[LogicDuke]

Purpose

Stacked validation PR for:

AUDIT-PR029-HASINSTANCE-ON-ERROR-DEFEATS-CLASSIFICATION

This PR is intentionally narrow and quarantined.

It targets protected parent PR #29:

repair/pr025-normalization-release-order

It does NOT target main.

It does NOT directly target protected PR #10.

It does NOT target PR #25 directly.

Finding

Classification:

CURRENT P3

At exact parent HEAD:

879d2c475ed6199aa11fa0250f772ec177ad4495

the hardening-failure classifier used:

error instanceof NativeError

Capturing NativeError protects against reassignment of the global Error binding, but does not protect the constructor object itself.

A hostile pre-classification path can install an own:

Error[Symbol.hasInstance]

that lies and returns true for a plain non-Error value.

That causes the raw hostile object to be treated as the caller-visible Error, violating the stable hardening-failure and cause-retention contract.

Release, settlement, and child containment still occur, so this is bounded P3.

Repair

The bounded repair:

• captures Function.prototype[Symbol.hasInstance] at module evaluation;
• invokes that captured ordinary @@hasInstance operation through the existing captured reflectApply;
• bypasses a mutable own Error[Symbol.hasInstance];
• preserves ordinary genuine Error identity;
• preserves stable fallback Error construction;
• preserves exact original cause identity;
• keeps hostile operand prototype-chain faults inside the existing catch;
• preserves classification-before-release ordering;
• preserves unconditional release;
• does not redesign process transport;
• does not broaden brand checks;
• does not introduce string tags, .constructor, .message, .stack, or .name inspection.

Changed files exactly:

• src/adapters/process-transport.ts
• tests/adapters/process-transport.test.ts

Exact quarantine identity

Protected parent PR #29 HEAD:

879d2c475ed6199aa11fa0250f772ec177ad4495

Repair commit:

e5cdf4cf1f5bdd6df830c648736cbb2ef4b1a36d

Validated patch SHA-256:

A5B5ECCB9DAB677514A6A0F1A9EA086BDD834F0ED3E45C476C63A39CA233F22B

Patch bytes:

16094

Changed files exactly:

• src/adapters/process-transport.ts
• tests/adapters/process-transport.test.ts

The committed patch was mechanically verified byte-for-byte identical to the candidate that passed fresh independent validation.

Independent validation

Fresh independent validation:

PASS

The validator independently:

• reproduced the original defect against exact pristine parent HEAD;
• confirmed the hostile own Symbol.hasInstance path is reachable;
• confirmed the old classifier invokes the hostile hook;
• confirmed the old classifier returns the raw non-Error hostile value;
• confirmed release still occurs;
• confirmed the child is not abandoned;
• confirmed settlement still occurs;
• confirmed no unhandled rejection;
• verified the candidate bypasses the hostile own hook;
• verified caller-visible rejection is a real stable Error;
• verified exact cause identity;
• verified ordinary Error identity;
• verified hostile getPrototypeOf containment;
• verified revoked Proxy fallback;
• verified global Error binding poisoning remains defeated;
• verified unchanged cross-realm behavior;
• executed load-bearing counterfactuals;
• reverified six prior findings as FIXED;
• found zero new CURRENT P0/P1/P2/P3 defects;
• audited the complete diff;
• verified final fingerprint unchanged.

Validation evidence

Focused regression:

1 passed

Complete process transport:

146 passed, 9 skipped

Full suite:

1181 passed, 9 skipped

Typecheck:

PASS

Lint:

PASS

Build:

PASS

git diff --check:

PASS

The validation host was Windows.

The 9 skipped tests are POSIX-gated tests and are not claimed as passes.

Protected invariants

This repair preserves:

• caller settlement;
• mandatory bounded child release;
• ordinary Error identity;
• stable fallback Error behavior;
• exact cause retention;
• no SPAWN_FAILED laundering;
• no AgentExchange laundering;
• no discarded rejected Promise;
• existing termination semantics;
• cancellation/deadline semantics;
• raw output behavior;
• environment isolation;
• no shell execution;
• no PID/PGID authority expansion;
• dormant/unwired process transport;
• frozen AgentBridge architecture;
• AgentBridge V1 managed-repository READ-ONLY authority.

Quarantine rule

This DRAFT PR is evidence/proposal only.

Do not merge it because implementation, validator, CI, CodeRabbit, or Codex reports success.

Required before upward integration into PR #29:

• exact-head CI;
• independent GitHub review evidence;
• classification of every new finding against exact CURRENT HEAD;
• policy/evidence gate PASS;
• Ready transition only after those gates;
• POST-READY observation;
• human merge authority;
• CREATE A MERGE COMMIT upward into PR PR 025 P2: Release child before hardening error normalization #29;
• establish PR PR 025 P2: Release child before hardening error normalization #29 NEW HEAD;
• fresh exact-head PR PR 025 P2: Release child before hardening error normalization #29 audit.

Summary by CodeRabbit

• Bug Fixes

  • Improved process failure handling when error classification behavior has been modified.
  • Ensured hardening failures are consistently normalized while preserving the original error details.
  • Improved cleanup and child-process termination after hostile or unexpected failures.

• Tests

  • Added coverage for manipulated error classification scenarios.
  • Verified stable rejection behavior, cleanup, and prevention of unhandled errors.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fe92bd24-08de-4b52-8247-3c286e7de819

📥 Commits

Reviewing files that changed from the base of the PR and between 879d2c4 and e5cdf4c.

📒 Files selected for processing (2)

• src/adapters/process-transport.ts
• tests/adapters/process-transport.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The process transport now bypasses mutable Error[Symbol.hasInstance] hooks during hardening-failure classification. New adversarial tests verify normalization, cause preservation, cleanup, hook restoration, and rejection behavior.

Changes

Error classification hardening

Layer / File(s)	Summary
Intrinsic error classification src/adapters/process-transport.ts	The transport captures the ordinary hasInstance operation and uses it for guarded NativeError classification. Non-errors and classification failures retain normalized hardening errors with the original value as cause.
Hostile hook validation tests/adapters/process-transport.test.ts	Tests add a hostile probe mode and a lying Error[Symbol.hasInstance] hook. Assertions verify normalized rejection, cause preservation, hook bypass and restoration, child cleanup, and absence of unhandled rejections.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to e5cdf

This is a localized Error-classification hardening change with reported passing validation and no actionable merge-blocking risk in the supplied evidence; proceed after the stated normal repository gates and owner review.

Possibly related PRs

• LogicDuke/agentbridge#24: Both changes modify the post-spawn hardening-failure path and cleanup behavior.
• LogicDuke/agentbridge#30: Both changes modify hardening-failure classification and adversarial tests for hostile Error behavior.

Poem

A rabbit found a hook that lied,
But guarded checks stood firm inside.
The cause stayed safe, the child was cleared,
The false Error was not revered.
Hop, hop—clean rejection appears!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: bypassing the mutable Error Symbol.hasInstance hook.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch repair/pr029-hasinstance-classification

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[LogicDuke]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[LogicDuke]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: e5cdf4cf1f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".