[bbishdotdev]

Overlap review is incomplete. This PR remains a draft.

What changes and why

A contributor can put instructions in a PR that try to make a review model read the reviewer's machine or leak data in its posted review. Read-only model flags do not confine reads. This change makes untrusted review fail closed until an isolated worker is configured, and adds checks around what the runner contacts, spends, and publishes.

Before and after

Before	After
Any valid HTTPS PR host could be contacted. Models ran with the reviewer's host access.	The PR must match the project origin or an explicit target. Untrusted source requires an isolated worker; --trusted-pr is an explicit escape hatch.
Model prose and same-account public receipts could influence publication and reuse.	Model-written links and HTML are rejected. Another checkout must run its own models.

How it works and why

The runner checks the target and limits the diff before model calls. The worker boundary strips inherited credentials and probes policy-file access, outside files, GitHub auth, and local-network access. The canary resolves policy files in both source and installed layouts. Trusted host access is pinned to the PR code and discussion that were explicitly approved. The parent runner alone holds GitHub publication authority. Publication renders model-written prose as plain text and adds its own evidence links; the local budget caps repeated model calls.

Diagram fallback

flowchart LR
  PR[Untrusted PR] --> Parent[Parent runner: target, commits, GitHub auth]
  Parent --> Worker[Isolated model worker: pinned snapshot]
  Worker --> Parent
  Parent --> Review[Validated review]

Loading

Verification

87 GitHub workflow tests, 40 shared-workflow tests, 29 package tests, and package integrity checks passed. New cases cover a hostile review output, a foreign target, an unsafe forwarding worker, replayed model calls, and cross-checkout receipts. A real isolated worker was not available in this environment, so its provider and network policy still need a live deployment check.

Reviewer attention

Scan coverage (2 gaps)

• Target: patch unavailable for bstack/release/skills-sh/install-bstack/assets/bstack.zip (binary or omitted)
• PR chore(bstack): land PR 16 changes on main #17: patch unavailable for bstack/release/skills-sh/install-bstack/assets/bstack.zip (binary or omitted)

• Merge chore(bstack): land PR 16 changes on main #17 first; this PR is based on that recovery branch.
• Check the fail-closed setup path: an untrusted PR now needs a worker; --trusted-pr deliberately restores host access for trusted source.
• Before unattended use, run the real worker's live doctor and verify its mounts and provider-only network route.

_{🤖 BStack PR · Prepared with gpt-6-sol}

[bbishdotdev]

✅ Looks good. GitHub won't let me formally approve my own PR.

✅ Fixed: Installed BStack always fails the worker policy canary; Trusted-PR host access carries over to commits pushed later.

Checked the follow-up and the behavior it affects.

_{🤖 BStack review · Independent: claude-opus-5-5 + gpt-6-astra · Final check: claude-opus-5-5}