[kerdofficial]

The Codex Security Cloud report identified seven weaknesses in account linking, runner authorization, host isolation and site deployment. This PR addresses all seven findings.

• Browser-bound GitHub linking (csf_47282db2fad9a2f4d44249ee): bind OAuth initiation and callback to a server-generated Secure/HttpOnly browser cookie. Confirmation requires the original authenticated owner and a separate completion cookie. PKCE, expiry and replay protection remain enforced.
• Private fork approval (csf_0851e5f73ece87c4e56acd62): require private repository fork workflows to be disabled or require approval, both when connecting a repository and before JIT registration. Preserve public repository checks, read-only queries and runner cleanup. Policy failures carry actionable guidance through the service and remote client.
• Private service files (csf_aa32b876410df5e58be0585f): repair existing home permissions to 0700 and connection, SQLite and sidecar permissions to 0600 without losing state. Reject symlinks, non-regular files and foreign ownership, use umask 0077, and publish the connection atomically.
• Safe font artifacts and deployment (csf_ec8096b288874408c19107dc): pin archive and font file sizes and hashes, extract only selected member bytes, and verify cached files without following links. Separate site build and deployment into disposable jobs; deployment checks the build's artifact digest and publishes the existing worker without rebuilding.
• Per-instance Linux SSH identities (csf_7cdbdd7278cf85f27f816b99): generate and pin a different host key for each instance, delivered through read-only identity media and installed before SSH starts. Refuse legacy SSH images, preserve their metadata, and expose the new requirement in manual desktop registration. The identity installer runs before SSH socket activation without creating a systemd boot dependency cycle.
• Windows guest network isolation (csf_a6a871f489b1ced3ac42b936): add a targeted QEMU/libslirp ingress filter that blocks host interface addresses, loopback, private and link-local destinations while preserving public IPv4 internet, virtual DNS, DHCP and the loopback SSH forward. Require a compatible patched runtime before VM or disk creation, including packaging and source verification.
• Approval-safe PR metadata checks (csf_949222f4c1766062fe4343b3): move the two pull_request_target metadata jobs to GitHub-hosted runners, because these events do not wait for fork approval before consuming Vectis capacity. Their checking and labeling behavior is unchanged.

Ship the web and Convex changes together. Existing Linux SSH runner images must be prepared again. Windows requires the newly patched runtime and uses IPv4 guest networking; its existing base image does not need reinstalling. Documentation changes cover only these changed setup, approval and release requirements.

Validation:

• pnpm check passes: 407 tests across 98 files, plus format, lint and typecheck. Headless and web/docs builds, artifact verification and the exact site deployment dry-run pass.
• Prepared a fresh Ubuntu image and booted 13 disposable Linux instances. Verified separate SSH pins, rejection of a sibling key before guest command execution, clean clone state, Docker, public HTTPS, active boot/socket targets and complete VM cleanup.
• Exercised the actual Worker and Convex HTTP handlers in a real HTTPS browser with synthetic Clerk/GitHub identities. Missing browser cookies block callback processing before state consumption; the cross-site return, owner confirmation, cookie clearing and replay rejection work.
• Built QEMU 11.1.1 with both patches and packaged the runtime. Native packet tests and the packaged QEMU/libslirp backend verify blocked host TCP/UDP access and working public TCP, DNS, DHCP and SSH forwarding. The normalized patch applies to upstream and produces exactly the source used for the build.

Windows is not installed on the test host, so no Windows guest boot was exercised. The browser test uses synthetic providers; no live account linking, deployment or release was performed.

All Apple helpers build locally in release mode. The original Native CI job stopped before compilation because the Vectis macOS image lacks Xcode/Command Line Tools. The helper check temporarily uses GitHub's macOS 26 ARM64 runner, with the same build command, until that image has its toolchain. The original Ubuntu CI runner lost communication before uploading any step logs. On commit 98b7e2b, the full CI check passes on Vectis, the Native release build passes on the hosted ARM64 runner, and both PR metadata checks pass.