[codex] OM-SEC-12: Bind update inhibitor cleanup to process identity - #9467

Draft

AFOliveira wants to merge 27 commits into

omacom:quattrofrom

AFOliveira:codex/om-sec-12-update-inhibitor-identity

Commits on Aug 31, 2026

OM-SEC-12: Bind update inhibitor cleanup to process identity
AFOliveira
committed
68d8141
OM-SEC-14: Run update hooks without reusable sudo authority
AFOliveira
committed
1136a71

Commits on Sep 1, 2026

OM-SEC-01: Make passwordless sudo expiry fail closed
AFOliveira
committed
87625c2
Document privileged Bash startup exception
AFOliveira
committed
2f816a8

Commits on Sep 6, 2026

Merge commit 'b71dcad96e9d0b2962b7d225828a5cb6000ad720' into codex/review-9469-20260906
AFOliveira
committed
7f9a401
Complete command-scoped authentication across update phases
AFOliveira
committed
35b318e
Keep update regressions isolated from host authentication
AFOliveira
committed
c52381f
Revoke before session cleanup and protect standalone inhibition
AFOliveira
committed
f2c3925
Integrate current quattro before security review
AFOliveira
committed
1f8f5ba
Clarify unattended updates still require sudo authorization
AFOliveira
committed
a9e9954
Use required gum directly in AI removal prompts
AFOliveira
committed
978dffa
Wait for the actual Stay Awake launcher
AFOliveira
committed
d41ca88
Wait for notifications when restarting the shell
AFOliveira
committed
177d572
Disable the Yay sudo loop with its supported option
AFOliveira
committed
35551b0

Commits on Sep 7, 2026

Merge current Quattro while preserving command checks
AFOliveira
committed
aa422fc
Preserve user PATH across updater relaunches
AFOliveira
committed
5b692c5
Bind protected update commands to their source root
AFOliveira
committed
f37c73f
Resolve security libraries beside canonical entrypoints
AFOliveira
committed
5bc41b2
Keep channel transitions inside command-scoped sudo
AFOliveira
committed
c869740
Check dev update support before changing the system
AFOliveira
committed
0add43f
Merge remote-tracking branch 'refs/remotes/portfolio/quattro' into codex/portfolio-9457-20260907
AFOliveira
committed
bc235d2
Keep temporary sudo grants bounded through lifecycle failures
AFOliveira
committed
4ae25cd
Bound sudo policy natively and guard expiry package transactions
AFOliveira
committed
a6385e6
Integrate the shared sudo lifecycle foundation
AFOliveira
committed
75e58f0
Merge update inhibitor identity hardening
AFOliveira
committed
104c776
Roll back interrupted inhibitor launches
AFOliveira
committed
76f0abe
Open launch authorization without recreating cancelled state
AFOliveira
committed
0240113