vivac

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  tools/comment-vocabulary.py, line 40

  run = subprocess.run(

  tools/identifier-vocabulary.py, line 38

  run = subprocess.run(

  tools/measure-artifact-custody.py, line 60

  subprocess.run(["git", "init", "--quiet"], cwd=project, env=env, check=True,

  Show more

  tools/measure-artifact-custody.py, line 64

  result = subprocess.run([str(binary), *command], cwd=project,

  tools/spanish-vocabulary.py, line 115

  listing = subprocess.run(

  tools/spanish-vocabulary.py, line 120

  src = subprocess.run(["git", "show", f"{LAST_SPANISH_COMMIT}:{f}"],

  tools/third-party-notices.py, line 45

  out = subprocess.run(

  tools/web-screenshots.py, line 148

  out = subprocess.run([vivac, *args], cwd=cwd, env=env,

  tools/web-screenshots.py, line 296

  shutil.rmtree(base, ignore_errors=True)

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/update.rs, line 407

  /// Runs `cmd` with every stream silenced -- `curl -fsSL` and `tar -xf`

  src/update.rs, line 515

  // Against the real release, curl may follow GitHub's redirect to its

  src/update.rs, line 543

  SpawnOutcome::NotFound => return fail("curl is not on this machine".to_string()),

  Show more

  src/update.rs, line 545

  return fail(format!("the download failed (curl exited with {code})"))

  src/update.rs, line 558

  SpawnOutcome::NotFound => return fail("curl is not on this machine".to_string()),

  src/update.rs, line 560

  return fail(format!("the download failed (curl exited with {code})"))

  src/update.rs, line 1425

  eprintln!("skipping: curl or tar is not on this machine's PATH");

  src/update.rs, line 1472

  eprintln!("skipping: curl or tar is not on this machine's PATH");

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  src/agents/human.rs, line 1137

  .env(MARKER, &scratch.0)

  src/agents/human.rs, line 1138

  .env("VIVAC_HOME", scratch.0.join("home"))

  src/artifacts/files.rs, line 544

  | "id_rsa"

  Show more

  src/agents/human.rs, line 1139

  .env("NO_COLOR", "1")

  src/agents/terminal.rs, line 430

  .env(MARKER, "1").env("CLICOLOR_FORCE", "1").env_remove("NO_COLOR").env_remove("TERM");

  src/agents/workflow.rs, line 644

  .env(FIXTURE, &root)

  src/agents/workflow.rs, line 645

  .env("CODEX_HOME", root.join(".codex"))

  src/artifacts/files.rs, line 548

  ) || name == ".env"

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  src/artifacts/mod.rs, line 1

  //! Selected local deliveries retain bytes outside the provenance tree.

• Licence

  Note

  no licence file found.

  LICENCE_MISSING

  No file path was stored.

  no licence file found.

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 2d263c6138ea. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. no licence file found.

Date and source

Date checked: 26 Oct 2026

Read how this letter is chosen