# Codex seat audit — remediation status

The original audit report was not included in the isolated cdx offload snapshot at
`87fdccf2`, nor in any ref advertised by that snapshot's bare remote. This status
record preserves the owner-directed remediation without inventing unavailable audit
text.

## Critical findings

- **FIXED — cdx-exec seat egress was unrestricted.** Commit
  `1932ba7c90cf6710709a693143bfb531f41c6f0c` makes the cdx-exec Podman launch
  default-deny through systemd cgroup IP policy. Package and Git hostnames live in
  `modules/sandbox/host/lib/egress-allowlist.json`; buildbox mirror hosts are derived
  from the dispatch registry and passed explicitly. Resolution, configuration, Podman
  gateway, or systemd failure starts no container. Extra per-task hosts require the
  logged `OD_SANDBOX_EXTRA_EGRESS_HOSTS` escape.

- **FIXED — dispatch snapshots could include secret-shaped files.** Commit
  `1932ba7c90cf6710709a693143bfb531f41c6f0c` filters both git-push snapshots and the
  tree-copy fallback independently of `.gitignore`, logs the matching rule without
  secret contents, and preserves the exact non-secret manifest
  `modules/harness/seat/credentials.json`.

## Follow-up

The separate harness `modules/harness/seat/seat-run.sh` container path does not share
the cdx-exec `modules/sandbox/host/bin/sandbox-run` network launcher. Its egress policy
remains a separate follow-up; this security slice intentionally fixes the owner-used
cdx-exec path first and does not rework the second container system.