[Elodie Mirza (elodiejmirza)]

BLUF

• Repairs new WAV and received-frame output permissions; tracks central #179, without closing it. Owner accepted the private-filesystem boundary and authorized normal merge on green. This does not override open findings or failed checks.
• Final lifecycle correction is signed/DCO commit 5e4550b; all final-head and integrated native/CodeQL gates passed. Previous heads remain historical evidence.
• POSIX new files are created and validated inside an owner-private staging directory, then published by exclusive hard link. macOS receives noninheriting ACLs atomically at directory/file creation. Failure cleanup never unlinks the requested destination; a concurrent destination survives. Existing explicitly selected regular WAV overwrite preserves access settings.
• Windows new files receive a protected current-user DACL at creation; non-ACL volumes fail before creation. Alternate stream aliases are rejected before access, including ::$DATA; ordinary drive-letter paths remain supported.
• No integrated scanner fix or issue closure is claimed until current-master analysis confirms it. Other Direwolf findings and protection issue Support APRS Directed Station Queries wb2osz/direwolf#112 remain separate.

Verification and security review evidence

• Full native Debug build and 41/41 CTest passed after staged-publication implementation; final focused test passed after enabling the same fault-injection tests for Linux. Strict compiler and ASan/UBSan focused tests passed.
• Negative control: the new lifecycle test fails against previous head 3956274 because rejected permissive creation leaves the final destination. The correction passes absence-after-failure, private retry and concurrent KEEP preservation.
• Tests retain permissive umask, inherited Mac ACL, bytes, overwrite, collisions, symlink/FIFO/directory rejection, invalid enums and noninheritance. New Windows tests reject stream aliases and retain an actual absolute drive-letter path. Fresh hosted Windows execution passed40/40, including these checks.
• Earlier actual synthetic WAV generation was byte-identical (SHA256 e1d38421e75ba0bb44547d731d737040cbed08d6e18b4f7f26b70922fb81e5c1), private0600; loopback KISS receive produced a private complete synthetic frame. These observations are historical, not substitutes for final-head validation.
• Reviewed helper/header, both call sites, CMake and test files for permission inheritance, object races, cleanup, truncation ordering, platform bytes, bounds and OWASP-relevant file handling. Focused independent architecture review found no actionable remaining finding; root independently inspected diff and tests. Staged Gitleaks and diff checks passed.
• GitHub review identified ADS aliases, failed-creation lifecycle and late Mac ACL exposure. All three have source corrections; all three threads are resolved with final-head execution evidence.
• No credentials, global umask mutation, scanner suppression, registry/configuration-policy change, or new runtime dependency. Windows identity lookup is TOKEN_QUERY. XP-compatible API baseline retained; actual XP execution is not claimed.

Compatibility and residual limits

• Parent directories must be trusted. New POSIX files require private-permission and exclusive hard-link support; new Windows files require persistent ACL support. User accepted this fail-closed filesystem boundary. Existing selected regular WAV permissions and hard-link overwrite semantics remain supported.
• Crash/cleanup failure can retain an empty/private task-owned staging namespace; cleanup never recursively removes unrelated paths. No general path sandbox or repair of unrelated input/output aliases is claimed.
• Source integration, current-master scanner confirmation, operational acceptance and governance protection remain distinct. No upstream notification or public assessment publication.

Lessons Learned

• Central register and active RCA context reviewed. LL-0002: failed approaches and architecture change recorded on Feature Request: control beacon transmission using an external command wb2osz/direwolf#179 before further correction. LL-0004/0011: require live exact-head native, review and analysis proof. LL-0007: preserve historical findings/failed observations and task-owned evidence. LL-0010: verify signatures through GitHub and use normal signed/DCO integration.
• LL-0001/0003/0008/0009: no factory producer/catalogue contract change. LL-0005/0006/0012: no workflow, Codespace or identity-scope change.
• Complexity removed or justified: one shared output helper and explicit new-versus-existing lifecycle replace repeated public-path permission cleanup. Private staging is required to prevent failed-validation retry bypass.
• Tracking: Feature Request: control beacon transmission using an external command wb2osz/direwolf#179 / Add GPIO LED support when PTT is asserted wb2osz/direwolf#61 Project9, GPIO PTT wb2osz/direwolf#60 Project10. PR item remains In Progress / In review, Security / P1 High / Security / Ad hoc. No issue-closing directive.

Integrated verification

• Normal owner-authorized Direwolf #15 merged at signed c1aee849c05ebb8a751581bdde8a6e7f5c8a3138, containing all three verified signed/DCO commits. All review findings are fixed/replied/resolved; no bypass or settings change.
• Integrated native run41841321444 passed Windows, Mac, Ubuntu latest Debug and Ubuntu22.04. Windows actually passed private-output/40CTest. Integrated CodeQL41841321369 passed all3 languages; C++2094846569 has only the two separate existing DSP/config results; Actions2094839542/Python2094840642 zero, empty errors/warnings.
• Alerts#19/Misc fixes for upstream wb2osz/direwolf#20 retain historical dismissed states but both now have scanner-confirmed fixed_at=2026-11-04T13:49:02Z. Current-source C++ results reduced four→two. DSP#1/config-path#15 remain needs_review; Feature Request: control beacon transmission using an external command wb2osz/direwolf#179 stays open. Governance#112 separately owns missing live master protection.
• Project9 PR#15 is read-back Done / Verified (Security/P1 High/Security/Ad hoc). Owning issue/central delivery remain open; Project10 BAU#60 receives the evidence follow-up. No parent-goal completion inferred.
• Lessons LL0002/0004/0007/0010/0011 applied at start/end: architecture recurrence recorded, failed observations preserved, exact native/scanner/identity proof correlated. Clean task master synced. Diagnostic worktrees preserved for Feature Request: control beacon transmission using an external command wb2osz/direwolf#179; no Docker used, no Docker cleanup applicable.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T13:48:10.567785Z	5e4550b	Draft marked ready
🔒 Security Review	✅ Completed 2026-11-04T13:49:14.089912Z	5e4550b	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟡 Changes recommended

Critical privacy gaps in output creation can expose data through inherited macOS ACLs, NTFS alternate streams, and retries that reuse permissive files left behind after failed setup.

3 open issues

• Reject NTFS alternate streams for private output · New
• Remove newly created files when privacy setup fails · New
• Secure macOS ACL before publishing the new file · New

What changed in this PR

This PR introduces a shared output helper to restrict permissions on new WAV and received-frame files while preserving existing WAV permissions and platform-specific byte handling.

Changes:

• Adds platform-specific permission enforcement and file-object validation before truncation.
• Routes WAV and received-frame output through the helper, with exclusive frame-file creation and write-error reporting.
• Adds focused regression tests and Windows library linkage.

File	Description
test/​private_output_test.c	Tests permissions, byte handling, collisions, and invalid file objects.
test/​CMakeLists.txt	Registers the private-output test and Windows linkage.
src/​private_output.h	Defines output modes, creation policies, and the helper contract.
src/​private_output.c	Implements platform-specific private output creation and validation.
src/​kissutil.c	Uses exclusive frame-file creation and reports write failures.
src/​gen_packets.c	Uses the helper for binary WAV output.
src/​CMakeLists.txt	Builds the helper into both utilities and links Windows security APIs.

_{Review effort: Balanced}