Skip to content

chore: resolve iss-65 and iss-70 in the ledger #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
REPPL merged 1 commit into from
Jul 12, 2026
Merged

chore: resolve iss-65 and iss-70 in the ledger #31

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ...65-scanner-serialized-secret-crossleak.md → ...65-scanner-serialized-secret-crossleak.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ category: "bug"
source: "agent-finding"
found_during: "clean-slate-sweep"
found_at: "internal/adapter/scanner/finding.go"
resolution: "Byte-span snippet masking closes the same-line secret cross-leak (both disjoint and overlapping matches); isText mid-rune trim; unreadable->Unscanned. PR #30 merged (main 5a49696). P10 skip-list coverage floor deferred: the zero-coverage sentinel is already the floor. ruthless SHIP + security PASS (security caught an overlap BLOCK on the first fix)."
---

scanner serialized-finding secret cross-leak (BLOCK) + scan hygiene: Finding.MarshalJSON rebuilds the snippet from the full source line but masks only THIS finding own token, so a second secret on the same line (minified JSON, collapsed .env, a=X; b=Y) is serialized verbatim (finding.go:124). Also isText caps the UTF-8 sniff at 8192 bytes and utf8.Valid fails when the cut splits a multibyte rune, misclassifying a valid >8KB text file as binary and skipping the scan (scanner.go:338); ScanBundle drops an unreadable file with a bare continue instead of surfacing it in Unscanned (scanner.go:269); per-repo pii.json skip-lists have a severity floor but no coverage floor (scanner.go:128). Detector: two-secrets-one-line redaction test; mid-rune isText case; unreadable-file-surfaced case; skip-list coverage floor. Corpus: sweep C14/C17, C15, C18, P10.
1 change: 1 addition & 0 deletions ...-70-lint-receipt-gate-detector-binding.md → ...-70-lint-receipt-gate-detector-binding.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ category: "bug"
source: "agent-finding"
found_during: "clean-slate-sweep"
found_at: "internal/core/lint/lint.go"
resolution: "Receipt-gate detector binding (C16), fail-closed empty arming (P9), and gate_lockstep nested-name parser (P4) landed. PR #29 merged (main fcebbc7). ruthless SHIP + security PASS. The cryptographic-signing half toward full C stays dormant behind release.yml's public-flip gate (recorded in DECISIONS + PR)."
---

record-lint receipt-gate hardening (VSA gate): checkReceiptGate does not bind a receipt to the gate it attests — one genuine PROMOTE receipt satisfies EVERY required gate by copying it to each path (lint.go:601, C16); ArmReceiptGate keeps committer-editable required_gates when the caller supplies an empty list, fail-open arming (config.go:136, P9); workflowStepNames captures nested name keys (with: name:) as gate step names (lint.go:857, P4). NOTE C16 adds policy.detector to the receipt JSON schema — a record-lint CONTRACT change, surface for maintainer sign-off before landing. Detector: mismatched policy.detector BLOCKED per gate; empty arming fails closed; only step-indent name captured. Corpus: C16, P9, P4.
Loading