[lia-by-librechat]

Summary

• Require processor-specific bearer authentication on both v1 endpoints over HTTP. Default bind: 0.0.0.0:8000; deployment overrides: EXTRACTION_HOST, EXTRACTION_PORT, EXTRACTION_TOKEN_FILE.
• Add one-shot node dist/provision.js with atomic, no-overwrite token publication, restart validation, and cross-UID read permissions. Mount only this dedicated credential volume read-only into extraction/callers.
• Replace worker socket stdio with /dev/null and a regular status file. Validate descriptors before parsing, explicitly deny network/message syscalls, and bound status/result reads after worker exit.
• Require an additive native AF_UNIX/descriptor-message filter before Node, health checks and provisioning. Keep Docker's default seccomp, Landlock, nonroot execution and existing resource/deadline/cancellation bounds.
• Use a private internal Compose network with no host ports or fixed container name. Add the extraction runtime image to existing image CI.

Verification

• npm test: 19 passed.
• npm run typecheck, npm run format:check, git diff --check: passed.
• Native launchers and negative probe compile with -Wall -Wextra -Werror.
• npm run test:container: passed against the shipped hardened recipe with two replicas, authenticated health, missing/wrong auth, cross-UID token reads, idempotent provisioning, restart persistence, 75 adversarial fixtures, independent gateway/worker probes, socket-stdio negative tests, bounded output, cancellation, deadlines and fail-closed startup.

Limits

• Shared host still means a shared kernel. This is not kernel-escape immunity; Landlock ABI 3 and seccomp remain mandatory.
• The strict gateway blocks glibc dual-stack DNS. IPv4 libc DNS and c-ares IPv4 DNS were qualified. The service/health path uses literal bind addresses and requires no remote DNS or document-selected network access.
• Remote deployments require verified HTTPS termination at ingress. No native TLS or application/database/cloud credentials are added.
• Container qualification was Linux amd64. Other service images were not built locally.

Base: 77bcd2ec2e63be523bfab2dfa11159a2ceec0088.

[lia-by-librechat]

Review head: c7bfe421243c66d4d5d9c6e3d08d276586ac47bf (base/merge-base 77bcd2ec2e63be523bfab2dfa11159a2ceec0088). Authenticated private HTTP, automatic processor-only credential provisioning, socket-free parser stdio, mandatory pre-runtime AF_UNIX/message filtering, and replica-safe Compose. Local qualification: 19 focused tests, 75 adversarial fixtures, typecheck/format/native compile, two hardened replicas, restart/auth/cancellation/fail-closed checks passed. Current CI has no failed or pending checks. Independent exact-head review is running. Shared-kernel residual risk remains; no kernel-escape immunity claim. No merge or deployment.

[lia-by-librechat]

Head c7bfe421243c66d4d5d9c6e3d08d276586ac47bf: independent review complete, no findings. Reviewer read the full 22-file diff and passed 14 source-level credential/HTTP tests. CI: 24 passed, 1 skipped. Implementation qualification additionally passed 19 focused tests, 75 adversarial fixtures, typecheck/format/native compilation, and hardened two-replica authentication, descriptor/syscall, cancellation, restart and fail-closed checks. Independent reviewer did not rerun native/container/image qualification. Linux amd64 qualified locally; arm64 extraction and external ingress qualification not run. Both consumer PRs are being updated to pin this head. No merge or deployment.

[danny-avila]

@codex review the latest head, final review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T13:53:15.074546Z	c7bfe42	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: c7bfe42124

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".