From e1c6e5ba8857dec19e0c44abc40a45dced2c98cf Mon Sep 17 00:00:00 2001 From: REPPL <77722411+REPPL@users.noreply.github.com> Date: Sun, 12 Jul 2026 09:58:24 +0100 Subject: [PATCH] chore: resolve iss-65 and iss-70 in the ledger (PRs #29, #30 merged) Ledger bookkeeping trailing the merged fixes: - iss-70 (PR #29): receipt-gate detector binding + fail-closed arming + parser. - iss-65 (PR #30): byte-span snippet masking (the BLOCK) + isText + Unscanned. Assisted-by: Claude:claude-opus-4-8 --- .../iss-65-scanner-serialized-secret-crossleak.md | 1 + .../iss-70-lint-receipt-gate-detector-binding.md | 1 + 2 files changed, 2 insertions(+) rename .abcd/work/issues/{open => resolved}/iss-65-scanner-serialized-secret-crossleak.md (74%) rename .abcd/work/issues/{open => resolved}/iss-70-lint-receipt-gate-detector-binding.md (74%) diff --git a/.abcd/work/issues/open/iss-65-scanner-serialized-secret-crossleak.md b/.abcd/work/issues/resolved/iss-65-scanner-serialized-secret-crossleak.md similarity index 74% rename from .abcd/work/issues/open/iss-65-scanner-serialized-secret-crossleak.md rename to .abcd/work/issues/resolved/iss-65-scanner-serialized-secret-crossleak.md index 8240a1f7..daeae3f7 100644 --- a/.abcd/work/issues/open/iss-65-scanner-serialized-secret-crossleak.md +++ b/.abcd/work/issues/resolved/iss-65-scanner-serialized-secret-crossleak.md @@ -7,6 +7,7 @@ category: "bug" source: "agent-finding" found_during: "clean-slate-sweep" found_at: "internal/adapter/scanner/finding.go" +resolution: "Byte-span snippet masking closes the same-line secret cross-leak (both disjoint and overlapping matches); isText mid-rune trim; unreadable->Unscanned. PR #30 merged (main 5a49696). P10 skip-list coverage floor deferred: the zero-coverage sentinel is already the floor. ruthless SHIP + security PASS (security caught an overlap BLOCK on the first fix)." --- scanner serialized-finding secret cross-leak (BLOCK) + scan hygiene: Finding.MarshalJSON rebuilds the snippet from the full source line but masks only THIS finding own token, so a second secret on the same line (minified JSON, collapsed .env, a=X; b=Y) is serialized verbatim (finding.go:124). Also isText caps the UTF-8 sniff at 8192 bytes and utf8.Valid fails when the cut splits a multibyte rune, misclassifying a valid >8KB text file as binary and skipping the scan (scanner.go:338); ScanBundle drops an unreadable file with a bare continue instead of surfacing it in Unscanned (scanner.go:269); per-repo pii.json skip-lists have a severity floor but no coverage floor (scanner.go:128). Detector: two-secrets-one-line redaction test; mid-rune isText case; unreadable-file-surfaced case; skip-list coverage floor. Corpus: sweep C14/C17, C15, C18, P10. \ No newline at end of file diff --git a/.abcd/work/issues/open/iss-70-lint-receipt-gate-detector-binding.md b/.abcd/work/issues/resolved/iss-70-lint-receipt-gate-detector-binding.md similarity index 74% rename from .abcd/work/issues/open/iss-70-lint-receipt-gate-detector-binding.md rename to .abcd/work/issues/resolved/iss-70-lint-receipt-gate-detector-binding.md index c247cc79..66cb804f 100644 --- a/.abcd/work/issues/open/iss-70-lint-receipt-gate-detector-binding.md +++ b/.abcd/work/issues/resolved/iss-70-lint-receipt-gate-detector-binding.md @@ -7,6 +7,7 @@ category: "bug" source: "agent-finding" found_during: "clean-slate-sweep" found_at: "internal/core/lint/lint.go" +resolution: "Receipt-gate detector binding (C16), fail-closed empty arming (P9), and gate_lockstep nested-name parser (P4) landed. PR #29 merged (main fcebbc7). ruthless SHIP + security PASS. The cryptographic-signing half toward full C stays dormant behind release.yml's public-flip gate (recorded in DECISIONS + PR)." --- record-lint receipt-gate hardening (VSA gate): checkReceiptGate does not bind a receipt to the gate it attests — one genuine PROMOTE receipt satisfies EVERY required gate by copying it to each path (lint.go:601, C16); ArmReceiptGate keeps committer-editable required_gates when the caller supplies an empty list, fail-open arming (config.go:136, P9); workflowStepNames captures nested name keys (with: name:) as gate step names (lint.go:857, P4). NOTE C16 adds policy.detector to the receipt JSON schema — a record-lint CONTRACT change, surface for maintainer sign-off before landing. Detector: mismatched policy.detector BLOCKED per gate; empty arming fails closed; only step-indent name captured. Corpus: C16, P9, P4. \ No newline at end of file