feat(investigate): reserve case_open binding + cloud parsed-egress ack - #40
Conversation
Hash-pin evidence into FINDEVIL_CASE_OPEN_BINDING and pass expected_sha256 in tool hints so findevil-mcp accepts host paths. On cloud routes set FINDEVIL_ACKNOWLEDGE_PARSED_EVIDENCE_EGRESS=1 after the operator cloud-ack gate so agent tool results can return (true cloud seal path).
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7e3f95b7f3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| stream.on("end", () => resolve()) | ||
| }) | ||
| const sha256 = fileHash.digest("hex") | ||
| const bindingJson = JSON.stringify({ artifacts: [{ path: canonicalPath, sha256 }] }) |
There was a problem hiding this comment.
For directory evidence with more than one supported file, evidenceToolHint still instructs the agent to call case_open on every remaining inventory file, but the new FINDEVIL_CASE_OPEN_BINDING only reserves the first caseOpenPath artifact. Since this change notes that unreserved case_open sources fail, those subsequent opens will be rejected as unreserved, so mixed or multi-EVTX investigations cannot cover all artifacts. Build the binding over every supported inventory path and provide the matching hashes before enabling the reservation.
Useful? React with 👍 / 👎.
1 participant
Summary
FINDEVIL_CASE_OPEN_BINDINGand passexpected_sha256in MCP tool hints so findevil-mcp accepts hostcase_openpaths (fixes unreserved-source denial).FINDEVIL_ACKNOWLEDGE_PARSED_EVIDENCE_EGRESS=1so parsed tool results may return to the model (true cloud seal path).Test plan
npm run buildnode scripts/selftest.mjs— 207/0CASEFORGE_CLOUD_ACK=1 caseforge investigate <public.evtx> --privacy cloud-ok --evidence public --route xai-grok-oauth --cloud-ack