Compatibility gate: isolate avatar renderer command override #181

New issue

Closed

opened 2026-09-08 02:03:09 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:09 +00:00

Owner

Registry P0/security follow-up. zara-avatar resolves ZARA_AVATAR_RENDERER during service start and immediately queues a renderer probe on its managed actor. A compatibility run that inherits this variable can launch a host-specific renderer command, defeating hermetic fake-dependency proof. TDD: strip ZARA_AVATAR_RENDERER only for zara-avatar compatibility lifecycle and restore it afterward. Do not alter the plugin's legitimate runtime override behavior.

Registry P0/security follow-up. `zara-avatar` resolves `ZARA_AVATAR_RENDERER` during service start and immediately queues a renderer probe on its managed actor. A compatibility run that inherits this variable can launch a host-specific renderer command, defeating hermetic fake-dependency proof. TDD: strip `ZARA_AVATAR_RENDERER` only for zara-avatar compatibility lifecycle and restore it afterward. Do not alter the plugin's legitimate runtime override behavior.

nsaspy closed this issue

2026-09-08 02:03:09 +00:00

nsaspy referenced this issue from a pull request that will close it,

2026-09-08 02:19:41 +00:00

registry: confine resolved plugin roots to plugins/ #390