RomanSlack/jev-drone

Review signals: 1 connection review, 82 known vulnerability, 1 outside write, 1 sensitive read.

Reviewed as expected for a test run: a Python interpreter or package manager probed its own interpreter file under a system program folder.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 140.82.114.3:443 3 attributed processes.

OSV reports a known vulnerability in this dependency version. 4 distinct locations. 82 findings.

Repository processes attempted these writes outside documented output/cache paths. /dev/udmabuf 9 attributed processes.

A repository process attempted to read this sensitive path. Kind of file: saved web login. 3 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The no-Jev ablation (free baseline) runs headless and seed 1 stays stuck near 18 m: Real input produced the expected result: "max_x_m": 18.4, "crossed_barrier": false

  Source: The baseline stops dead at station 2 every single time.

  Input: run.py --no-jev --fast --seconds 65 --seeds 0 1 2

  Expected: seed 1 max_x 18.4 m, not crossed; NOTE seed 0 reached 77.2 m and crossed, contradicting 'every single time'

  Command: <guest-path> run.py --no-jev --fast --seconds 65 --seeds 0 1 2

  Observed: "max_x_m": 18.4, "crossed_barrier": false, "crashed_at_s": null, "flew_s": 65.0} {"seed": 2, "jev": false, "collisions": 0, "target_visible_pct": 21.8, "mean_standoff_m": 28.49, "max_standoff_m": 63.87, "final_gap_m": 63.87, "distance_flown_m": 16.0, "steps_jev_acted_pct": 0.0, "steps_reflex_pct": 76.6, "max_x_m": 18.2, "crossed_barrier": false, "crashed_at_s": null, "flew_s": 65.0}

Examples

• Free no-Jev ablation command from the Run it section: command completed successfully

  Source: README.md Run it: `.venv/bin/python run.py --no-jev --fast --seconds 65 --seeds 0 1 2 # ablation (free)`

  Input: --no-jev --fast --seconds 65 --seeds 0 1 2

  Expected: one JSON metrics line per seed, exit 0

  Command: <guest-path> run.py --no-jev --fast --seconds 65 --seeds 0 1 2

  Observed: 1, "jev": false, "collisions": 1, "target_visible_pct": 21.0, "mean_standoff_m": 28.57, "max_standoff_m": 64.24, "final_gap_m": 64.24, "distance_flown_m": 15.9, "steps_jev_acted_pct": 0.0, "steps_reflex_pct": 78.0, "max_x_m": 18.4, "crossed_barrier": false, "crashed_at_s": null, "flew_s": 65.0} {"seed": 2, "jev": false, "collisions": 0, "target_visible_pct": 21.8, "mean_standoff_m": 28.49, "max_standoff_m": 63.87, "final_gap_m": 63.87, "distance_flown_m": 16.0, "steps_jev_acted_pct": 0.0, "steps_reflex_pct": 76.6, "max_x_m": 18.2, "crossed_barrier": false, "crashed_at_s": null, "flew_s": 65.0}

• Jev-engaged flight from the Run it section: Needs TYPESAFE_API_KEY (from .env.example). Not provided; the documented call fails with 'RuntimeError: set TYPESAFE_API_KEY (see .env.example)'. Not obtained or faked.

  Source: README.md Run it: .venv/bin/python run.py --seconds 65 --seeds 1 # Jev engaged

  Expected: documented command completes successfully

  Observed: Needs TYPESAFE_API_KEY (from .env.example). Not provided; the documented call fails with 'RuntimeError: set TYPESAFE_API_KEY (see .env.example)'. Not obtained or faked.

• replay.py re-renders a recorded flight without API calls: Needs course.mp4.tape.npy from a --video run; that run writes binary mp4 output and no fresh UTF-8 expected text is possible for it. Not run.

  Source: README.md Run it: replay.py course.mp4.tape.npy out.mp4

  Expected: documented command completes successfully

  Observed: Needs course.mp4.tape.npy from a --video run; that run writes binary mp4 output and no fresh UTF-8 expected text is possible for it. Not run.

Local or hosted: local

Run the jev-drone MuJoCo quadrotor obstacle-course simulation from the README 'Run it' section

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -200
cd <guest-path> && sed -n 200,400p README.md; echo ----SETUP; cat setup.sh; echo ----ENV; cat .env.example; echo ----REQ; cat requirements.txt; echo ----GI; cat .gitignore; ls -la .coldpass docs site
cd <guest-path> && (git init -q 2>&1; git remote add origin https://github.com/RomanSlack/jev-drone 2>&1; timeout 120 git fetch --depth 1 origin 974b47378c14c6dcf7d11f7c813fba0f5f4d8b6a 2>&1; git reset --mixed FETCH_HEAD 2>&1) ; git log --oneline -1 2>&1; git status --short 2>&1 | head; echo ---; which git curl python3 ffmpeg; python3 -m venv --help >/dev/null 2>&1 && echo venv-ok || echo venv-missing; ls /usr/lib/x86_64-linux-gnu | grep -iE 'libGL|libEGL|osmesa' | head; cat /etc/os-release | head -2
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 ./setup.sh 2>&1 | tail -40; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && sudo -n apt-get update -qq 2>&1 | tail -3; sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3.12-venv 2>&1 | tail -3; echo "apt exit=$?"; rm -rf .venv && export NODE_USE_ENV_PROXY=1 && timeout 1200 ./setup.sh 2>&1 | tail -30; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && grep -n "argparse\|add_argument\|TYPESAFE\|getenv\|environ\|no.jev\|import typesafe\|from typesafe" run.py tactics.py | head -60; ls mujoco_menagerie/skydio_x2 assets | head; ls -la .venv/bin | head -5
cd <guest-path> && export MUJOCO_GL=egl && timeout 1500 .venv/bin/python run.py --no-jev --fast --seconds 65 --seeds 0 1 2 2>&1 | tail -40; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq libegl1 libgl1 libgl1-mesa-dri libosmesa6 libglfw3 2>&1 | tail -3; export MUJOCO_GL=egl && timeout 1500 .venv/bin/python run.py --no-jev --fast --seconds 65 --seeds 0 1 2 2>&1 | tail -40; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && export MUJOCO_GL=egl && env -u TYPESAFE_API_KEY -u JEV_API_KEY timeout 600 .venv/bin/python run.py --seconds 65 --seeds 1 2>&1 | tail -8; echo "exit=${PIPESTATUS[0]}"; echo ---; grep -nE "cron|schedule|webhook|--once|--now|while |time.sleep" run.py tactics.py replay.py flight.py hud.py | head -20; sed -n 105,125p tactics.py
cd <guest-path> && export MUJOCO_GL=egl && env -u TYPESAFE_API_KEY -u JEV_API_KEY timeout 600 .venv/bin/python run.py --seconds 65 --seeds 1 > /tmp/cred_run.log 2>&1; echo "exit=$?"; grep -n "RuntimeError\|TYPESAFE\|Error" /tmp/cred_run.log | head -10; ls -la /tmp/cred_run.log
cd <guest-path> && grep -n "stops dead at station 2\|then put your key in it\|Jev engaged\|ablation (free)\|Clamping" README.md | cat -A | cut -c1-200
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import json, os
W = "<guest-path>"
PY = W + "/.venv/bin/python"
ARGV = [PY, "run.py", "--no-jev", "--fast", "--seconds", "65", "--seeds", "0", "1", "2"]
ENV = {"MUJOCO_GL": "egl"}
SRC_ABL = "`.venv/bin/python run.py --no-jev --fast --seconds 65 --seeds 0 1 2   # ablation (free)`"
probe = {"kind": "cli", "argv": ARGV, "cwd": W, "env": ENV,
         "expected_text": '"seed": 0, "jev": false, "collisions": 3'}
claims = [
 {"kind": "claim",
  "claim": "The no-Jev ablation (free baseline) runs headless and seed 1 stays stuck near 18 m",
  "source": "The baseline stops dead at station 2 every single time.",
  "input": "run.py --no-jev --fast --seconds 65 --seeds 0 1 2",
  "expected": "seed 1 max_x 18.4 m, not crossed; NOTE seed 0 reached 77.2 m and crossed, contradicting 'every single time'",
  "probe_kind": "cli", "argv": ARGV, "env": ENV, "cwd": W,
  "expected_text": '"max_x_m": 18.4, "crossed_barrier": false'},
]
examples = [
 {"kind": "example", "claim": "Free no-Jev ablation command from the Run it section",
  "source": "README.md Run it: " + SRC_ABL,
  "input": "--no-jev --fast --seconds 65 --seeds 0 1 2", "expected": "one JSON metrics line per seed, exit 0",
  "argv": ARGV, "cwd": W, "env": ENV, "expected_text": '"seed": 1, "jev": false'},
 {"kind": "example", "claim": "Jev-engaged flight from the Run it section",
  "source": "README.md Run it: .venv/bin/python run.py --seconds 65 --seeds 1 # Jev engaged",
  "reason": "Needs TYPESAFE_API_KEY (from .env.example). Not provided; the documented call fails with 'RuntimeError: set TYPESAFE_API_KEY (see .env.example)'. Not obtained or faked."},
 {"kind": "example", "claim": "replay.py re-renders a recorded flight without API calls",
  "source": "README.md Run it: replay.py course.mp4.tape.npy out.mp4",
  "reason": "Needs course.mp4.tape.npy from a --video run; that run writes binary mp4 output and no fresh UTF-8 expected text is possible for it. Not run."},
]
cycles = {"detected": False,
  "reason": "Entry points inspected (run.py, tactics.py, replay.py, flight.py, hud.py): no cron, scheduler, webhook, --once/--now. run.py runs a finite episode loop per seed for --seconds, and tactics.py has an in-episode ~2.5 Hz judgment thread; these are control loops, not product cycles.",
  "checks": []}
def w(name, obj):
    p = os.path.join(W, ".coldpass", name)
    with open(p, "w", encoding="utf-8") as f: json.dump(obj, f, indent=2); f.write("\n")
w("probe.json", probe); w("claims.json", claims); w("examples.json", examples); w("cycles.json", cycles)
print("written")
EOF
cd <guest-path> && python3 -I <guest-path> && ls -la .coldpass && grep -c . .coldpass/claims.json
cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && cat > <guest-path> <<'EOF'
import json
r = {
 "outcome": "needs_credentials",
 "fault_owner": "prerequisite",
 "operation": "Run the jev-drone MuJoCo quadrotor obstacle-course simulation from the README 'Run it' section",
 "operation_scope": "Free no-Jev ablation (run.py --no-jev --fast, seeds 0 1 2) works end-to-end headless. The headline Jev-engaged flight needs a TypeSafe API key (TYPESAFE_API_KEY), which was not provided and was not obtained. Replay of a recorded flight was not run (needs a tape from a video run).",
 "steps": [
  "git init; git remote add origin https://github.com/RomanSlack/jev-drone; git fetch --depth 1 origin 974b47378c14c6dcf7d11f7c813fba0f5f4d8b6a; git reset --mixed FETCH_HEAD (HEAD now 974b473, clean tree)",
  "./setup.sh (failed first: ensurepip missing; see deviations) then, after install, ./setup.sh exit 0 (venv, pip install -r requirements.txt, git clone mujoco_menagerie sparse skydio_x2, asset symlink)",
  "export MUJOCO_GL=egl; .venv/bin/python run.py --no-jev --fast --seconds 65 --seeds 0 1 2  -> exit 0, three JSON metric lines",
  "env -u TYPESAFE_API_KEY .venv/bin/python run.py --seconds 65 --seeds 1 (Jev engaged) -> RuntimeError: set TYPESAFE_API_KEY (see .env.example), exit 1",
  "<env-var>=<guest-path> python3 -I <guest-path> --validate --replay -> valid true, no problems, replay PASS"
 ],
 "deviations": [
  "setup.sh failed: python3 -m venv could not run ensurepip. Fixed by sudo apt-get install python3.12-venv (Python 3.12.3), then re-ran ./setup.sh unchanged; succeeded.",
  "MUJOCO_GL=egl failed at import (OpenGL EGL platform None). Fixed by sudo apt-get install libegl1 libgl1 libgl1-mesa-dri libosmesa6 libglfw3 (system libraries, not product source). README does not list these.",
  "Jev-engaged run not executed successfully: no TYPESAFE_API_KEY. Not faked; credentials_error recorded in examples.json.",
  "README claim 'The baseline stops dead at station 2 every single time' was NOT reproduced for seed 0: --no-jev --fast seed 0 reached max_x 77.2 m and crossed_barrier true (seeds 1 and 2 stayed at ~18 m as claimed). The README table lists 17.7 m for baseline. Possible cause: --fast/sim-time settings or repo version; not investigated further.",
  "git init and the pinned fetch were run as instructed; setup.sh itself does not need git metadata of the repo."
 ],
 "stuck_step": "Jev-engaged flight: .venv/bin/python run.py --seconds 65 --seeds 1 (needs TYPESAFE_API_KEY)",
 "main_blocker": "No TypeSafe API key (TYPESAFE_API_KEY) available in the guest, so the Jev judgment layer cannot be exercised.",
 "plain_failure": "The drone simulation installs and flies the free no-AI baseline correctly. The part the README is mainly about, the AI-assisted flight, cannot run without a paid TypeSafe API key, which was not provided. Also, one README claim (baseline always stuck at the second station) did not hold for one of the three test seeds.",
 "suggested_fix": "Provide TYPESAFE_API_KEY (copy .env.example to .env and add a key) to run the Jev-engaged flight and its replay. Document apt packages python3.12-venv and Mesa EGL/OSMesa libraries in the README for headless setup. Re-check the baseline seed 0 result against the README table."
}
json.dump(r, open("<guest-path>", "w", encoding="utf-8"), indent=2)
open("<guest-path>", "a").write("\n")
print("ok")
EOF
python3 -I <guest-path> && python3 -I -c "import json;json.load(open('<guest-path>'));print('valid json')" && ls -la <guest-path> <guest-path> | head -30; pgrep -fa "run.py|replay.py" || echo "no servers/background processes running"