[dezren39]

Summary

• Replace the machine-specific c1-connect dependency and hardcoded executable paths with repository-relative paths and runtime resolution.
• Add a locked Nix app and documented nix run ...#c2-lab entry point for probes and the full C2 matrix.
• Write timestamped results under spikes/c2-holepunch/results/; report clearly labels the results as Linux netfilter emulation.

Evidence

• Before: clean checkout could not run the lab because of an absolute path dependency and Nix-store-specific binaries.
• After: C2_WINDOW=8 nix --extra-experimental-features "nix-command flakes" run ./doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/c2-holepunch#c2-lab completed three NAT probes and all 9/9 matrix cells (dial exit 0 for all nine). A timestamped report was generated at doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/c2-holepunch/results/20261104T222140Z-emulated-c2-matrix.md.
• bash -n on all three lab scripts, cargo metadata --locked --no-deps, Nix flake evaluation, and git diff --check passed.

Merge Danger

Door: two-way. Blast Radius: low — limited to the C2 spike lab and its documented entry point; networking remains inside unshare -Urn.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 12 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 877bf077-59b8-4199-a1cd-307ba27d7684

Commits

Reviewing files that changed from the base of the PR and between 19aa97c and 89a3d1d.

Files ignored due to path filters: 1

• doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/c2-holepunch/flake.lock is excluded by !**/*.lock

Files selected for processing: 6

• doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/c2-holepunch/Cargo.toml
• doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/c2-holepunch/flake.nix
• doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/c2-holepunch/lab/README.md
• doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/c2-holepunch/lab/probe-nat.sh
• doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/c2-holepunch/lab/reproduce.sh
• doc/2026-10-11T03-44-33Z_design_groups_events_delegation/spikes/c2-holepunch/lab/run.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T22:29:52.134144Z	89a3d1d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 89a3d1d069

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Synchronize report writes before counting successful cells

When tee lags behind the matrix runner, for example because its stdout consumer is slow, this grep can read the report before the final successful-cell markers have been written. The process substitution started on line 30 runs asynchronously, and completing run.sh only guarantees its output reached the pipe, not that tee wrote it to the report. Consequently, an otherwise successful nine-cell run can report fewer than nine successes and exit 1. Collect statuses directly from the cell runs or synchronize the report writer before reading its output.

Useful? React with 👍 / 👎.

[dezren39]

CI coverage note: gh pr checks shows CodeRabbit skipping and no policy-listed checks. The PR changes the local Nix flake/lock; .github/ci-policy.md classifies these as elevated/Nix-expression changes, but .github/workflows/nix-ci.yml is triggered only by schedule and workflow_dispatch (no pull_request), and the dedicated .github/workflows/proxy-port-fallbacks.yml currently triggers only on merge_group. I am not treating CI as passed. Local nix flake show and the documented Nix/netns run passed (3 probes, 9/9 cells).}