io.github.New1Direction/korg-ledger

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  demos/gen_deliverable_data.py, line 71

  os.remove(j)

  demos/gen_deliverable_data.py, line 81

  os.remove(j)

  demos/arena/match.py, line 151

  os.remove(out)

  Show more

  packages/mcp-native-client/src/mcp_native_client/client.py, line 50

  self._process: Optional[subprocess.Popen] = None

  packages/mcp-native-client/src/mcp_native_client/client.py, line 70

  self._process = subprocess.Popen(

  src/agent.py, line 2091

  os.remove(path)

  src/background_tasks.py, line 46

  proc = subprocess.Popen(["bash", "-c", command], stdout=subprocess.PIPE,

  src/cli.py, line 52

  subprocess.run([candidate, "--version"], capture_output=True, check=True)

  src/cli.py, line 61

  result = subprocess.run(cmd, cwd=cwd, capture_output=True, text=True)

  src/cli.py, line 100

  proc = subprocess.Popen(

  src/cli.py, line 307

  subprocess.Popen([code, str(ext_path)])

  src/cli.py, line 398

  result = subprocess.run(

  src/memory.py, line 175

  os.remove(filepath)

  src/rewind.py, line 84

  os.remove(path)

  src/skill_curator.py, line 157

  shutil.rmtree(os.path.dirname(sk.path), ignore_errors=True)

  src/skill_install.py, line 117

  shutil.rmtree(out_dir)

• Install and update

  Serious

  install fetches a script from the network.

  INSTALL_REMOTE_SCRIPT

  requirements.txt, line 4

  anthropic>=0.40.0

  sandbox/Dockerfile, line 25

  RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \

  sandbox/Dockerfile, line 35

  RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  inject_session.py, line 40

  resp = requests.post(ENDPOINT, json=payload, timeout=5)

  korg_dogfood.py, line 58

  resp = requests.get(url, timeout=5)

  src/browser.py, line 836

  page = fetch(url) or {}

  Show more

  src/dashboard.py, line 346

  const resp = await fetch('/api/state');

  src/dashboard.py, line 371

  const sb = await fetch('/api/sandbox');

  src/dashboard.py, line 378

  await fetch('/api/approve-plan', { method: 'POST' });

  src/dashboard.py, line 385

  await fetch('/api/new-task', {

  src/github_api.py, line 47

  r = requests.post(url, headers=_headers(), json={

  src/github_api.py, line 60

  r = requests.get(url, headers=_headers())

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  integrations/witness/witness.py, line 128

  hmac_key=os.environ.get("KORG_LEDGER_HMAC_KEY"))

  src/agent.py, line 384

  budget = int(os.environ.get("KORGEX_LEAN_CONTEXT_TOKENS", "800"))

  src/edit_policy.py, line 43

  SENSITIVE_BASENAMES = {".npmrc", ".pypirc", ".netrc", ".htpasswd", ".dockercfg"}

  Show more

  src/agent.py, line 1962

  return int(os.environ.get("KORGEX_MIN_CACHED_TOKENS", "1024"))

  src/agent_resolve.py, line 70

  return (os.environ.get("VENICE_API_KEY") or None), base # api-key, not OAuth

  src/edit_policy.py, line 70

  if base.startswith(".env"): # .env, .env.local, .env.production

  src/edit_policy.py, line 72

  if base.startswith("id_"): # ssh private keys (id_rsa, id_ed25519)

  src/github_api.py, line 16

  token = os.environ.get(GITHUB_TOKEN_ENV) or os.environ.get("GITHUB_TOKEN", "")

  src/google_auth.py, line 157

  key = os.environ.get("GEMINI_API_KEY") or os.environ.get("GOOGLE_API_KEY")

  src/google_auth.py, line 270

  secret = os.environ.get("GOOGLE_OAUTH_CLIENT_SECRET")

  src/korg_ledger.py, line 910

  k = os.environ.get("KORG_LEDGER_HMAC_KEY")

  src/model_router.py, line 542

  "google-vscode-extension/auth/application_default_credentials.json"

  src/skills_builtin/codebase-onboarding/SKILL.md, line 43

  docker-compose*, .github/workflows/, .env.example, CI configs

  .gitignore, line 30

  # Environment

  .gitignore, line 31

  .env

  CHANGELOG.md, line 414

  - **Edit-approval policy + checkpoint-before-mutation + ledger trail** (`src/edit_policy.py`). Before any file-mutating tool runs, korgex consults a policy (`ASK`/`WORKSPACE`/`SESS

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  the file cap was reached before every file was read.

  OBFUSCATION_FILE_CAP_REACHED

  tests/test_shared_journal_interleaved.py, line 1

  """ONE shared ledger - the interleaved cross-subsystem integration test (#3).

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit b2331322e57e. can delete files. install fetches a script from the network. accepts a host from input, with no fixed list in this file. reads a credential or environment file. the file cap was reached before every file was read.

Date and source

Date checked: 19 Oct 2026

Read how this letter is chosen