[codex] OM-SEC-14: Run update hooks without reusable sudo authority - #9469

Open

AFOliveira wants to merge 24 commits into

omacom:quattrofrom

AFOliveira:codex/om-sec-14-cold-update-hooks

Commits on Aug 31, 2026

OM-SEC-14: Run update hooks without reusable sudo authority
AFOliveira
committed
1136a71

Commits on Sep 1, 2026

OM-SEC-01: Make passwordless sudo expiry fail closed
AFOliveira
committed
87625c2
Document privileged Bash startup exception
AFOliveira
committed
2f816a8

Commits on Sep 6, 2026

Merge commit 'b71dcad96e9d0b2962b7d225828a5cb6000ad720' into codex/review-9469-20260906
AFOliveira
committed
7f9a401
Complete command-scoped authentication across update phases
AFOliveira
committed
35b318e
Keep update regressions isolated from host authentication
AFOliveira
committed
c52381f
Revoke before session cleanup and protect standalone inhibition
AFOliveira
committed
f2c3925
Integrate current quattro before security review
AFOliveira
committed
1f8f5ba
Clarify unattended updates still require sudo authorization
AFOliveira
committed
a9e9954
Use required gum directly in AI removal prompts
AFOliveira
committed
978dffa
Wait for the actual Stay Awake launcher
AFOliveira
committed
d41ca88
Wait for notifications when restarting the shell
AFOliveira
committed
177d572
Disable the Yay sudo loop with its supported option
AFOliveira
committed
35551b0

Commits on Sep 7, 2026

Commits on Sep 10, 2026

Clarify update hook timing in the user manual
AFOliveira
committed
212a454