commitwork.mjs is the CLI itself (see the root README for commands, options and manifest trust rules). Everything else here is a scanner, generator or gate it orchestrates — each file's header comment is the authoritative doc; this is the map.

bin/lib/sandbox.mjs is the one place isolation is expressed. It holds two kinds of posture:

• Container postures (POSTURES, buildSandbox) for the docker lanes — deps-osv, supply-chain-guarddog, deps-reachability, deps-updates. A docker lane is declared three ways (its requires names docker, monitor/perf-profiles.json says container: true, and its command or script runs docker run), and bin/test/manifest-egress.test.mjs fails if the three disagree. The runner never wraps these on the host: the docker client needs the daemon socket, which the host profile denies as network, and the container posture is already the confinement. Their rows carry the posture's isolation (fs-only for lookup/fetch, full when every named posture severs the network) and an isolationReason that says so.
• The host posture (hostSandboxArgv) for every other lane. The runner spawns each manifest command as sandbox-exec -p <profile> /bin/sh -c <cmd> on macOS and bwrap --ro-bind / / --dev-bind <dev> <dev>… --tmpfs /tmp --tmpfs /run [--tmpfs /var/run] [--tmpfs <home> --ro-bind <read path under home> …] --bind <reportDir> <reportDir> [--bind <TMPDIR>] [--bind-try <declared write>…] [<credential mask>…] [--remount-ro <home>] --unshare-net --die-with-parent -- sh -c <cmd> on Linux (the five data devices are re-bound with device access; the home is an empty tmpfs at its resolved path, with the macOS read set under it bound back read-only and the home remounted read-only at the end unless a writable bind covers it; TMPDIR is bound only when it lies outside /tmp; the tmpfs mounts come before the report-dir bind so a report dir under /tmp stays writable; a declared write absent on the host is skipped; each credential mask is --tmpfs <dir> or --ro-bind /dev/null <file>, is placed only where something bound back or written reaches the store, and comes after every bind, because bwrap's later mount wins). A Linux lane whose egress is not none is prefixed node bin/lib/sandbox-net.mjs [--loopback <ports>] -- and adds --ro-bind-data 5 <resolv.conf> --info-fd 3 --block-fd 4, so the command waits until pasta has connected its network namespace. There is no host sandbox on Windows. The macOS profile is generated from inputs only; the Linux argv also stats the credential stores it masks, /run and the resolver config, through an injectable fs. So bin/test/sandbox-host.test.mjs asserts the text for every class on both platforms, holds the Linux masks against the paths parsed out of the macOS profile, and then, where sandbox-exec exists, runs it and measures the effects with a control for each.

Egress classes. Every check declares egress — none, registry, verifiers, github or target — and the vocabulary is EGRESS_CLASSES, closed and mirrored into the manifest schema. none runs with the network denied and the row reads isolation: full; the other four run with the filesystem confined and the internet reachable but not this host: loopback, the host's own addresses and local sockets are denied (on Linux the lane has its own network namespace, joined to the internet through pasta, and no pasta refuses the lane), and a target lane reaches loopback only on its target URLs' ports. Their rows read isolation: fs-only, because what they reach is the point of the lane (a package registry or advisory database, the credential-issuing services TruffleHog verifies against, the GitHub API, the live URL under test). A lane the manifest leaves undeclared is not wrapped under a guessed class: it runs unconfined with isolationReason: check declares no egress class on its row (one that executes repository code, or any lane under CW_SANDBOX=require, is refused as noscan instead), and the manifest test fails on any bundled check that omits the key. Under none an OSV-style lane would otherwise exit 0 over an empty result, which is why a guess in either direction is refused.

The filesystem rule is the same for every class, and the two platforms enforce different halves of it. On macOS the profile denies by default and reads only the scanned tree, the report dir, commitwork's own root, the system prefixes (/usr, /bin, /sbin, /opt/homebrew, /System, /Library, /private/etc, /private/var/db, /private/tmp, /dev), the node prefix, TMPDIR, the Xcode developer directory (/usr/bin/git is a shim that dlopens it; for an Xcode.app, the bundle's whole Contents), a linked worktree's git dirs, the lane's JAVA_HOME, for a networked lane the scoped DOCKER_CONFIG and the resolver config, ~/.gitconfig and ~/.config/git (git treats a permission error on its global config as fatal where a missing file is fine), the install prefix of every binary the check's requires.tools names — resolved at run time through command -v and realpath, never / and never the home directory itself — the targets of symlinks in the tree that point outside it (a target in a forbidden mount, or one that lies inside a credential store or contains one, such as the home directory or ~/.config, is refused and named), and every ancestor directory of those paths as a bare literal (Java's toRealPath walks them). It writes only $CW_REPORT_DIR, TMPDIR, /tmp (tools hardcode it, and it is world-writable already) and /dev/null. Credential directories (~/.ssh, ~/.aws, ~/.gnupg, ~/.docker, ~/.kube, ~/.netrc, the keychains) are denied after every allow, so a declared extra read of ~/ still cannot reach them — the live test proves it. Seatbelt matches resolved paths, so every /tmp, /var and /etc path is emitted in its /private form as well. On Linux, bwrap binds the whole root read-only and then masks every credential store that exists on the host. The paths macOS denies (~/.ssh, ~/.aws, ~/.gnupg, ~/.docker, ~/.kube, ~/Keychains, ~/.netrc, ~/Library/Keychains, /Library/Keychains) are masked whatever the lane declares. ~/.config/gh, ~/.config/gcloud, ~/.azure, ~/.git-credentials, ~/.npmrc, ~/.pypirc and ~/.cargo/credentials{,.toml} (DECLARABLE_CREDENTIALS) are masked unless the lane's readable set reaches them, the condition under which the macOS allowlist lets them through: posture-scorecard's declared ~/.config/gh, or ~/.cargo/credentials.toml for a lane whose cargo lives in ~/.cargo. A declaration inside one of these unmasks the whole store, where macOS would open only the declared path; no bundled lane declares one. A directory gets an empty tmpfs (writes land there and are discarded) and a file gets /dev/null, whose open fails with EACCES. A store is masked at its resolved path, because bwrap refuses to mount on a symlink; an absent store is skipped, because bwrap cannot create a mount point on the read-only root; a stat error other than ENOENT or ENOTDIR refuses the lane. As of 2026-09-27, under bubblewrap 0.12.0 as root and as uid 1000, every masked store read fails while the tree, the report dir and a declared ~/.config/gh stay readable. Everything else stays readable on Linux, which has no read allowlist: the rest of the home directory, other users' world-readable files and any credential kept outside these paths. What bwrap confines beyond the masks is writes (a private tmpfs /tmp, the report dir, TMPDIR and declared writes), /run and /var/run (an empty tmpfs, so no host socket is reachable), device nodes (only /dev/null, /dev/zero, /dev/full, /dev/random and /dev/urandom stay usable) and the network (severed under none, otherwise a private namespace through pasta). A declared write, report dir or TMPDIR inside a store macOS denies is refused on both platforms.

A lane that needs more declares it on the check: sandboxExtraReads (posture-scorecard reads ~/.config/gh for the token gh auth token hands scorecard; the PHP lanes read ~/.composer) and sandboxExtraWrites (a tool's own cache: ~/.semgrep, ~/Library/Caches/trivy, ~/.codeql, ~/.npm, ~/.cargo/advisory-db). Prefixes are /, ~/, ./ (the scanned tree) and @usercache/ (the per-user cache directory, from getconf DARWIN_USER_CACHE_DIR), nothing else. Per lane on purpose: a lane that executes repository code and also writes a cache a later lane executes from is a supply-chain path, and the declaration is what makes it reviewable.

What the row says. isolation is full, fs-only or none; none always carries an isolationReason (CW_SANDBOX=off, the probe's reason the tool is unavailable, or the undeclared class). With no host sandbox, a lane that executes repository code (runsRepoCode: it declares executesRepoCode or requiresRepoTrust, or buildsScannedTree matches its command) does not run: it records noscan with the reason executes repository code and no sandbox is available; CW_SANDBOX=off runs it unconfined, and doctor lists those lanes. CW_SANDBOX=off disables the wrapper for a run and is printed once and written on every row; it is never silent. CW_SANDBOX=require (set in container/Dockerfile) refuses as noscan a host lane with no egress class, and every host lane when the sandbox tool is unavailable. Under CW_SANDBOX=off bin/lib/isolation.mjs demotes coverage to reduced on any lane that declares executesRepoCode: true and ran with isolation: none — today, in security-baseline.json, sast-codeql-swift (builds through bin/codeql-swift-build.sh), sast-codeql-go (CodeQL's Go extractor over each module), lint-rust-clippy (build.rs and proc macros), authz-test (the tree's own script, and only with --trust-repo-manifest: it also declares requiresRepoTrust), sast-php-psalm (loads the tree's vendor/autoload.php) and deps-reachability (cdxgen, in its container), and in build-health.json its format, lint, toolchain and boottest checks, and in hermetic-tests.json test-hermetic (the Rust suite itself). The probe (probeHostSandbox) runs the tool once per process with a trivial command; the per-lane preflight (preflightHostSandbox) runs the generated profile with exit 0 before the real command, so a profile the tool cannot apply records noscan with the tool's own first line of stderr and the lane never runs unconfined by accident.

executesRepoCode is decided per tool from what it does, never from the lane's name, and the READ verdicts matter as much as the EXECUTE ones: a false declaration demotes coverage that was real. The declared set is the one above (bin/test/manifest-egress.test.mjs holds it against each command's text); as of 2026-09-16, this is why the rest are not.

sast-codeql-go and test-hermetic were declared executing at introduction and are not part of this audit.

As of 2026-09-18, an executing lane with egress: none runs under the host sandbox at isolation: full and one with egress: registry at fs-only, so the demotion no longer fires for the declared lanes above — the container build is not needed while sandbox-exec/bwrap is available. Where the host tool is absent the row says so (isolationReason) and the demotion fires, so their rows say coverage: reduced rather than claim an isolation they do not have.

Observing what a lane dials. CW_EGRESS_OBSERVE=1 makes the runner start bin/egress-proxy.mjs on loopback for every lane whose egress class is not none, hand the lane HTTP_PROXY/HTTPS_PROXY, open that one loopback port in the host sandbox (proxyPort), and write what proxy-honouring clients asked for to $CW_REPORT_DIR/egress-observed.json (coverage: proxy-honouring clients only: direct egress stays allowed, so a client that ignores the proxy is unobserved). The proxy refuses a loopback, unspecified or link-local destination in every mode, judged on the address the name resolves to, which is also the address it connects to; its ledger is kept under ~/.commitwork/egress-ledgers (CW_EGRESS_STATE_DIR), where a sandboxed lane cannot write. A lane run with an upstream HTTP(S)_PROXY set, or whose command runs a container, is recorded as unobserved with the reason rather than as one that dialled nothing. monitor/egress-suggest.mjs aggregates those into reports/egress/allowlist.suggested.json in the shape manifests/egress-allowlist.json takes; promoting an entry is a person copying it with the reason rewritten. That manifest does not ship: a person writes it. CW_EGRESS_OBSERVE=enforce refuses hosts outside it (CW_EGRESS_ALLOWLIST overrides the path) and refuses to run the lane at all while the file is absent or unusable.

What an analyser lane inherits. A lane not marked executesRepoCode gets the environment minus the harness prefixes, the two operator switches and every credential-shaped name it did not declare: requires.secrets, the check's envPassthrough list, or the gh names where it declares sandboxExtraReads: ~/.config/gh. An envPassthrough entry ending in * is a prefix, and * alone keeps every credential, for a lane whose names come from its own input (bola-run reads them from the BOLA manifest it is given). dast-authz-bola, posture-scorecard and cspm-github in the baseline, and authz-bola, bola-run and cspm-github in runtime.json, declare theirs; bin/test/scanner-env.test.mjs holds the list. The runner names, once per lane, the credential-shaped variables it withheld, so a lane that fails to authenticate says why.

Each area in the fleet registry (monitor/private/projects.json) can carry a deploy block (hostnames, service, public, requiresAuth, authAt). node bin/deploy.mjs turns declarations into a cloudflared ingress fragment — dry-run by default; --write refuses ~/.cloudflared/ because writing where the daemon reads is applying. Declaration is split from authority: no Cloudflare credentials, no DNS mutation, no tunnel restarts — applying stays a human act (and bin/commitwork.mjs executes manifest-supplied shell, so credentials here would sit one traversal away from it). The central safety property: public: true + requiresAuth: true with no authAt is refused — generated ingress carries no auth layer, so it must be impossible to accidentally publish an auth-requiring origin. authAt: 'origin' | 'edge' names where the required layer lives and is the only way to declare a published origin that authenticates itself.

--verify compares registry vs reality on five axes (declared / routed / dns / origin / tls), exits 1 on drift, and re-checks authAt as an attestation — the origin is probed unauthenticated with the public Host header (via node:http, because fetch silently drops the Host header) and a 2xx is drift: the registry claiming a protection the service does not provide. For an https origin, origin requires a completed, verified TLS handshake, and the TLS failure modes are reported as their own states (ORIGIN-TLS-*, CERT-EXPIRING); an origin whose TLS did not verify cannot attest authAt at all. The comparison lives in monitor/deploy-state.mjs so the panel's Exposure view runs the same code.

Both exist because several writers can share one working tree and one .git/index. Neither infers its scope: the caller declares the exact paths it is committing, and everything outside that declaration is counted and named but never touched. "Whatever is staged" is another session's staging as often as it is yours.

Neither is a clearance to commit: a file can be individually clean and still import something untracked. Closure over the change set is test/tracked-imports.test.mjs, which reads HEAD.

The version stamp on every other commit path. version-stamp.mjs is the git-hook half of the stamp commit-phase.mjs writes, from the same rule in commit-phase-core.mjs, and install-version-hooks.mjs installs it (dry run without --write; a hook another tool wrote is chained, and --uninstall puts it back). pre-commit stamps a bare git commit, -a, --amend (from the amended commit's parents) and a pathspec commit, whose locked index keeps its old entry until git reset -q -- package.json. A merge is stamped from its higher parent; git writes a clean merge's tree before pre-merge-commit runs, so that hook stages the stamp and stops the merge for git commit --no-edit. post-rewrite replays a rebased stack whose versions do not rise one per commit with commit-phase --onto <base>. reference-transaction refuses to move refs/heads/main forward over a first-parent commit that does not raise the version, whatever wrote it. CW_VERSION_STAMP=0 skips the stamp and the restamp, CW_VERSION_GUARD=0 the guard, and a hook whose program is missing refuses.

The message is refused before any index work, by lib/conventional-commit.mjs: subject <type>[(<scope>)][!]: <description> within 72 characters, type from DEFAULT_TYPES, a description that opens with a lower-case imperative verb from lib/imperative-verbs.mjs (fail patches that delete the flagged line, not the gate fails a patch), a scope, when given, from DEFAULT_SCOPES with at least one declared path under its prefixes, and no prose tell anywhere in subject or body. The scope set and the tells belong to a rule set, which git config commitwork.rules names per repository (RULE_SETS; unset is commitwork's own): cobolwork, ironwork and cobolwork-web take any scope, and cobolwork and ironwork skip the shouting tell, which fires on COBOL syntax. commit-msg.mjs applies the same rules, less the declared-path check (a bare commit declares no paths), to a bare git commit as the repository's commit-msg hook, passes fixup!, squash! and amend! subjects, and refuses a Co-Authored-By trailer there too; install-commit-msg.mjs installs it and records the rule set, and monitor/install-git-hook.mjs installs it here. The tells are lib/prose-tells.mjs (em dash and dash splices, , so, just, adverbs about the author, hedges, shouting, session names, inflated words, land, loose shape, text about the text, not-X-but-Y). The same module has a comment surface that adds dates, history, because, a second colon and the old trailer; no gate consumes it yet, and comment-schema.mjs does not import it. Widening any of the sets is a commit to the module, never an env var.

A commit made with a plain git commit instead fires the repository's post-commit hook, which starts a background self-sweep in the main checkout. The hook exits in a linked worktree; for a hook installed before that guard, prefix worktree commits with CW_SELF_SWEEP=0. commit-phase.mjs writes its commits with git commit-tree, which runs no hooks.

commitwork hook install [--repo <path>] writes a pre-commit hook into any git repository, at the path git itself reports (rev-parse --git-path hooks, so core.hooksPath is honoured). The hook runs hook.mjs run, which checks the index, the content the commit is built from, never the working copy: it inherits GIT_INDEX_FILE, so git commit -a and git commit <paths> are checked through their temporary index.

A lane that cannot run (scanner missing, git failure, an unreadable report) is never reported clean: --unrun block (the default) refuses the commit with exit 21, --unrun warn lets it through labelled ALLOWED UNCHECKED. Findings exit 20. An existing hook commitwork did not write is refused (exit 22) and left untouched; --chain moves it to pre-commit.commitwork-chained and runs it after the check, and hook uninstall puts it back. The installed hook refuses the commit if node or hook.mjs has gone. Nothing in the target repository executes: a repo-local commitwork.json is never read. .pre-commit-hooks.yaml at the root exposes the same check to pre-commit.com as commitwork-secrets.

npm test runs node bin/test-run.mjs, not node --test directly. It runs the suite serially (--test-concurrency=1) over the module test globs, or over the paths you pass it, with every env var that redirects a write (AMBIENT_OUTPUTS: the perf-feedback, forensics and observables reports, the chain-tips and slop-sweep stores, the panel code stamp, the sweep live log, the other job kinds' <kind>-latest.log directory, the panel restart log, the sweep refusals journal, the gate verdict journal directory, the EPSS detail record and the nondeterministic divergence store) pointed into a scratch directory unless the caller already set it. It fingerprints each live path before and after (for a directory entry, each file it owns: <kind>-latest.log in the job-log directory, *.jsonl in the verdict journal and the divergence store) and fails the run if one moved, whatever the suite's own verdict, and it warns (never fails) on any other file under reports/ or .claude/ that changed during the run, since a peer or a sweep may have written it. npm run test:raw is the bare node --test form.

lib/model-provider.mjs (at the repository root, not under bin/) is one chat interface over a local model server and, when the operator configures one, a hosted API. resolveModelProvider({ local }) picks the provider and chatComplete(provider, { messages, system, temperature, maxTokens, jsonSchema, extra }) makes the call. Local is the default and first in PROVIDER_ORDER. A hosted provider is used only when CW_MODEL_PROVIDER names it. Setting a key does not select one, and a hosted failure is reported, never retried against the local server (or the reverse). localProvider(local) is the local server whatever CW_MODEL_PROVIDER says, for a caller whose request names a local engine or whose material must not leave the machine.

local is { baseUrl, engine } (the server root; /v1 is appended) or { apiBase, engine } (an API root used as given). tokenEnv names the env var holding the local server's bearer token, read at request time and sent only to that server. maxTokens: null sends no ceiling on the OpenAI wire; the Messages API requires one and gets 16,000. jsonSchema: { name, schema } is response_format on the OpenAI wire and output_config.format on the Messages API. extra carries OpenAI-wire fields with no Anthropic equivalent (a local server's reasoning_effort, a seed); a call that sets it on the Anthropic wire is refused, never sent without it.

A key is sent only to the configured host. Redirects are not followed, a key is refused over plain http to anything but loopback, and a base URL carrying credentials is refused. Requests go through node:http, not fetch, because fetch drops a response whose headers take more than 300 s, and a local model sends none until it finishes. Every result carries answeredBy: { provider, engine, model, host }. model is the model the server says answered. HTTP errors, non-JSON bodies, replies with no completion and empty answers all return { ok: false, error, status }. An empty answer has code: 'empty-answer' and keeps any reasoning the model produced. A transport failure has code timeout, unreachable, stopped or too-large. A success carries the server's usage when it sent one.

A success and an empty answer carry temperature: the value sent, or null when the model fixes its own sampling and none was sent. samplingOf() names that basis pinned-<t> or model-default. A caller records what was sent, never what it requested. A model-default result is a weaker basis than a pin at 0. A re-run of the same evidence need not reproduce it: it records how one sample of the model judged, not a repeatable result. The raters and the CodeQL analyst run on such a model and state the weaker basis on every record they write. Every reader of those records counts model-default results apart from pinned ones.

Still calling a model server directly: the reducer's ollama branch, which uses ollama's own native chat endpoint for num_ctx and keep_alive.

create-pr.mjs pushes a repository's HEAD to a commitwork/ branch and opens a pull request with gh (CW_GH_BIN names the binary; a .mjs runs under node). The panel's feed starts it as the create-pr job (admin/routes/pull-request.mjs, operator port only, behind the pull-request feature flag): the branch is named from the finding group, the body carries places and fixes and never finding evidence, a secrets-lane group is refused outright, and the credential reaches the child in GH_TOKEN only — never argv — with the job runner scrubbing it from the stream on both ports. The default branch is never pushed; merging stays human.

Exits 0 opened or already open, 21 refused with the reason printed, 22 a git or gh command failed.

issue.mjs fronts monitor/issue-store.mjs: a JIRA-shaped durable work queue with none of JIRA — atomic claims, derived ready-work detection, and closes that demand evidence. Store format, hash chain and auto-close semantics are documented in the monitor README; this is the operator surface.

Exit codes: 0 ok · 2 usage / unknown id · 3 store verify failed or identity problems remain · 4 missing, stale or not-newer evidence, or a check that could not run · 5 claim conflict.

issue-loop.mjs is the headless remediation driver over the same store: pick ready work, claim it, spawn an agent per issue (CW_ISSUE_AGENT_CMD), release it on success or timeout, and block it on a failed run, a BLOCKED: line, a failed gate or an escape in the run's own record: the agent runs PROFILES.issueLoop (Read, Edit, Write, Grep and Glob with edits accepted and no shell; tests run in the gate afterwards) with --output-format stream-json, and monitor/agent-run-judge.mjs reads the calls before the diff is accepted. A record past the output cap, or one that is not stream-json, blocks the issue as unjudged. A credential path, a guard bypass, a fetch-and-execute, an exfil-shaped command or a tool outside the list blocks the issue with the rule named, writes the judged record to <area out>/agent-runs/, and leaves the working tree as the agent left it for the operator to read. Dry-run is the default — it prints what it would claim and spawns nothing until --apply is passed. It refuses to run on stale evidence (the ingest staleness gate, exit 4) and never closes issues itself: evidence-gated auto-close happens at ingest, and manual closes stay a human act with --evidence in hand. --issue <id> pins a run to one issue rather than the severity-ordered head — it narrows the selection and never overrides a refusal, so a pinned issue that is blocked, claimed or authority-gated is still declined. It exists for the shared-tree case: when the top issue anchors in a file another session is editing, work a quieter one instead of blocking the queue to reach it.

issue-rekey.mjs declares the tenant and migrates flat ISS-000000 ids to org- and class-scoped ISS-<ORG>-<CLASS>-<SUFFIX> (--org PORTLL to preview, --write to apply). It is a migration, not a rename: the store is an append-only hash chain whose hashes cover each event's issueId, so rewriting past events would force the chain to be recomputed — and a chain recomputed at will proves nothing. Instead it only appends: historical events keep their ids and still verify, each issue records priorIds, an issue-updated event carrying rekeyedFrom enters the chain as evidence, and aliases{} keeps every historical id resolvable. It refuses (exit 3) a chain that does not verify before or after, a store already declared for another org, and any issue it cannot classify; lock contention is exit 4. Declaring an org is optional: --org defaults to PERSONAL, and a store with no declared org mints ISS-PERSONAL-<CLASS>-<SUFFIX>.

Two further one-shot migrations follow the same rules — dry-run by default, --write under the issues lock, the chain and identity checks gating the save, idempotent on a second run:

• issue-rekey-depsretire.mjs moves gs:<repo>|<category>|undefined group keys (the rule-less lanes: depsRetire, and via --category cspm, supplyChainPosture, accessibility) onto identity-bearing keys derived from the repo's latest scan rows; an ambiguous record is refused unless --split is given.
• issue-retire-cobolsecurity.mjs carries the open issues of the retired cobolSecurity category (the sast-cobol lane, removed as a duplicate of sast-cobol-cobolwork) onto sastCobol keys. A record whose target key is already held by an open sastCobol issue closes as superseded with duplicateOf; one whose target is held by a closed issue, or a duplicate that carries a live claim, is refused and listed. It refuses to run while cobolSecurity is still registered in SCANNER_SPECS.

Tests: node bin/test-run.mjs 'bin/**/*.test.mjs' (part of npm test). Quote the glob; a bare node --test bin/test/ resolves the directory as a module and fails on Node 26.