alexandre-daubois · Oct 29, 2026 · Oct 28, 2026 · Oct 28, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -41,7 +41,6 @@ jobs:
           - { package: ./internal/report, name: FuzzText }
           - { package: ./internal/report, name: FuzzClues }
           - { package: ./internal/repo, name: FuzzReadFileStaysInTrackedFiles }
-          - { package: ./internal/modelproxy, name: FuzzProviderRequest }
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

diff --git a/docker/agent/Dockerfile b/docker/agent/Dockerfile
@@ -9,7 +9,7 @@ ARG CLAUDE_AMD64_LOCK=v2.1.306@sha256:9dc640d16d8228eff9620bde9e0f70d38385a2124f
 ARG CLAUDE_ARM64_LOCK=v2.1.306@sha256:871fd7f46210c13a95a38506e03ac90abfc5125fc25a1d4f840fbab551b5cd2e
 ARG CODEX_AMD64_LOCK=rust-v0.163.0@sha256:582646c6bf0561eb0de540f7fc85b9121b0091a826bc6e96830b7f1722122182
 ARG CODEX_ARM64_LOCK=rust-v0.163.0@sha256:9d8ecf2d19d3e184877983902d6c85de48b3888dcb72c382a8a0c975845927fb
-ARG HARNESS_VERSION=v0.1.16
+ARG HARNESS_VERSION=v0.1.18
 
 FROM golang:1.27.3-trixie@sha256:1896654cfc5c2b5ad74c07f29cb36f5d2d1cbed42e3054070fbfe444e521e83c AS proxy
 ARG HARNESS_VERSION

diff --git a/docs/development.md b/docs/development.md
@@ -9,20 +9,21 @@ go build ./cmd/tamis
 go test -race ./...
 ```
 
-Four fuzz targets cover the comment escaper, the duplicate-search clues, file reading and the provider protocol filter:
+Three fuzz targets cover the comment escaper, the duplicate-search clues and file reading:
 
 | Target | Package |
 |---|---|
 | `FuzzText` | `./internal/report` |
 | `FuzzClues` | `./internal/report` |
 | `FuzzReadFileStaysInTrackedFiles` | `./internal/repo` |
-| `FuzzProviderRequest` | `./internal/modelproxy` |
 
 ```bash
 go test ./internal/report -run '^$' -fuzz '^FuzzText$' -fuzztime 60s
 ```
 
-On each push, CI checks formatting and `go mod tidy`, then runs `go vet`, the tests, the four fuzz targets and the Docker isolation tests of both agent images. Make both isolation jobs required release checks.
+The provider protocol filter is fuzzed in harness, with its model proxy.
+
+On each push, CI checks formatting and `go mod tidy`, then runs `go vet`, the tests, the three fuzz targets and the Docker isolation tests of both agent images. Make both isolation jobs required release checks.
 
 ## Isolation tests
 
@@ -79,8 +80,7 @@ tamis posts the comment for real. It skips an advisory that already has a comple
 |---|---|
 | `cmd/tamis` | Configuration and entry point |
 | `internal/triage` | Advisory selection and the triage pipeline |
-| `internal/sandbox` | The agent container, through harness |
-| `internal/modelproxy` | The proxy that keeps the model key on the host |
+| `internal/sandbox` | The agent container and the model proxy that keeps the key on the host, through harness |
 | `internal/budget` | Request and byte budgets shared by every agent and comparator of a run |
 | `internal/usage` | Requests and tokens spent per advisory, for the log |
 | `internal/engine` | The in-process model loop of the exact duplicate confirmation |

diff --git a/docs/security.md b/docs/security.md
@@ -37,7 +37,7 @@ The agent runs through [harness](https://github.com/alpha-omega-security/harness
 - a throwaway container per advisory, with a read-only root filesystem, all capabilities dropped and no new privileges,
 - one single-branch clone of the analysed branch per execution, mounted read-only into each agent run, with no untracked files and an empty `.git/config`, while only tamis reads the other branches, checked out as worktrees,
 - an internal bridge network with both gateway modes set to `isolated` and IPv6 disabled, whose only peer is an authenticated egress proxy that allows the model proxy and `api.github.com`,
-- a read-only workspace except for `report.json`, with memory, CPU, process, file-size, output-capture and Docker log limits,
+- a read-only workspace except for `report.json`, with memory, CPU, process and file-size limits,
 - an image with only the agent CLI, git, curl, ripgrep and `harness-proxy`, each download checked against a pinned checksum,
 - that image pinned by digest in each release, and checked by the action against its build attestation before use, like the tamis binary of a release.
 
@@ -68,6 +68,7 @@ tamis turns off the Codex ChatGPT features that call other routes: plugins, apps
 - Request and byte limits bound one run, not the cost of an endless series of runs. Enforce a provider spending ceiling and a workflow timeout as the [setup guide](setup.md#2-create-a-private-repository) describes.
 - tamis sends the report to the model provider. Check its data retention terms against your disclosure policy.
 - An internal network without a host gateway needs Docker Engine 28 or newer.
+- The agent CLI state is a writable host directory, removed after each advisory. A run can rewrite its own configuration for the correction round and fill the runner disk, though not leave the network or the model proxy.
 - The advisory comments API is in public preview and may change.
 
 CI builds both agent images and runs the Docker isolation tests on `ubuntu-latest`. They test the model path, direct and proxied host access, DNS, and IPv4 and IPv6 egress, without real provider credentials. Treat both `isolation` jobs as required checks before releasing or updating the deployment SHA.

diff --git a/go.mod b/go.mod
@@ -3,7 +3,7 @@ module github.com/php/tamis
 go 1.27.3
 
 require (
-	github.com/alpha-omega-security/harness v0.1.16
+	github.com/alpha-omega-security/harness v0.1.18
 	github.com/anthropics/anthropic-sdk-go v1.84.0
 	github.com/git-pkgs/cwe v0.1.1
 	github.com/openai/openai-go/v3 v3.85.1
@@ -20,6 +20,7 @@ require (
 	github.com/dnephin/pflag v1.0.7 // indirect
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/fsnotify/fsnotify v1.10.1 // indirect
+	github.com/git-pkgs/skills v0.2.0 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect

diff --git a/go.sum b/go.sum
@@ -8,8 +8,8 @@ github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.2 h1:utpeoEeZjd+A8J41zvoLsOOr
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.2/go.mod h1:iptorS+VYKFL2N6PnebpS91dubG35eAOEERnT4PJbQU=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0/go.mod h1:7dCRMLwisfRH3dBupKeNCioWYUZ4SS09Z14H+7i8ZoY=
-github.com/alpha-omega-security/harness v0.1.16 h1:FxYZO4aBRUOJT4tBBDeflbTUB3atu5ucmniy+c2R9t4=
-github.com/alpha-omega-security/harness v0.1.16/go.mod h1:wpUi6g2ebGi0OMSHaDTGhj/zMV1Lse1P8GrAp4J3LMI=
+github.com/alpha-omega-security/harness v0.1.18 h1:99coqkQjuQ13jAX0ivZo7mu5xQyJW6n/QWj19USGMCI=
+github.com/alpha-omega-security/harness v0.1.18/go.mod h1:4JI0CxVRwiWQ9zAtSTnM5p8l0A79bwREtps9BA9oLXY=
 github.com/anthropics/anthropic-sdk-go v1.84.0 h1:mnAhggc5H5A98JYmhQELT+j4J89PYBFKnnSvUTNwNd8=
 github.com/anthropics/anthropic-sdk-go v1.84.0/go.mod h1:GThfYqPJoaQ/6pmibCI98Cr4y5su2FXMUHn3NrSSnIc=
 github.com/aws/aws-sdk-go-v2 v1.47.1 h1:uOIZnp4PK3ZhKI0dNrJrhTEsLxbpXHTAJlwoS1pvAtw=
@@ -64,6 +64,8 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5
 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/git-pkgs/cwe v0.1.1 h1:FTdif2t/pQCd8IFxJUt3fy4khoQ93djiw2sukqE8KiQ=
 github.com/git-pkgs/cwe v0.1.1/go.mod h1:6yUxEoA+3rI4W3ftqb7PZP1Z7zZFmV4/wfr7P46HtHU=
+github.com/git-pkgs/skills v0.2.0 h1:WcYbOukbrQLhjrg0qocknf16MrLVF5bKdwOeNHF6we0=
+github.com/git-pkgs/skills v0.2.0/go.mod h1:fnhLBuE0+QEhLh6bb3x2IDljwu5lhJlrU+FE2LfHAk4=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
 github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

diff --git a/internal/modelproxy/live_test.go b/internal/modelproxy/live_test.go