Bug-hunt round 7: guard quoting, redaction case-fold, site-generator and scaffold fixes

[REPPL]

Autonomous all-dimensions bug-hunt, round 7. Five parallel hunt dimensions (code, docs-vs-functionality, infrastructure, internal-record consistency, hardened-primitive sibling sweep), every candidate adversarially refuted before fixing, every behaviour change pinned by a test watched fail before the change and pass after. Baseline (make preflight + gofmt -l .) green before any change and on the final tree.

Fixed — substantive (11)

Security / code

• Guard ANSI-C / locale quoting bypass — internal/core/guard/tokenize.go. The tokenizer implemented single/double/backslash quoting but not $'...'/$"...", so $'--force' tokenised to $--force and a Tier-1 blocker missed while bash handed the child byte-identical argv — contradicting the doc.go invariant that quoting affects tokenisation, not argument semantics. ANSI-C escapes are decoded so $'\x2d\x2dforce' resolves too. (iss-2608221456463223)
• local_username redaction case-fold miss — internal/adapter/scanner/identity.go:165. The hard-fail matcher for the caller's own login lacked the (?i) its home-path sibling carries, so a case variant of the login survived redaction and the blocking residual scan into the stored transcript. The system-dir exemption is lower-cased so iss-31 stays closed. (iss-2608221456469938)
• Site build vs check disagreement on inlined SVGs — internal/core/site/assets.go. An XML prolog/comment/CDATA was inlined verbatim but the emitted-page reader refuses all three, so a normal exporter SVG made the build pass and the check refuse a page whose message named no asset. (iss-2608221456462677)
• Site gate masking on an unparsed page — internal/core/site/check.go:411. A page that failed to parse dropped out of the page-walking gates, which then printed ok for a page they never examined. (iss-2608221456469558)
• Unscreened repository href scheme — internal/core/site/build.go LoadRepoMeta. .claude-plugin/plugin.json's repository reached an href on every page with no executableScheme check; a javascript: address (or scheme-less typo) passed every gate. (iss-2608221456466438)
• Scaffold symlink path leak + ./internal/... race leg — internal/core/launch/scaffold/scaffold.go, templates/release.yml.tmpl. A symlinked target leaf (ELOOP, not ErrNotRegular) leaked an absolute path into the --dry-run --json; and the hardcoded go test -race ./internal/... wedged every release of a bare adopter with no internal/ tree. (iss-2608221456599559, iss-2608221456597173)
• Capture skipped[].error absolute-path leak — internal/core/capture/workflow.go. Scrubbed at the same choke point as skipped[].path. (iss-2608221456599229)
• CODEOWNERS gap over the served install script — .github/CODEOWNERS. site-src/ (incl. install.sh.tmpl, the byte source of the served /install.sh) and docs/requirements.txt now require code-owner review. (iss-2608221456593173)

Docs / record

• Writing-style escape overclaim — docs/reference/writing-style.md. The docs-lint: allow line is honoured only by the banned-token families; links_resolve/stray_root_docs/citation_* ignore it. Also added the shipped names/* row. (iss-2608221456593814)
• Site-build "exactly this set" drift — commands/site.md, brief 22-site.md. The exhaustive read/write set omitted record.js, install.sh.tmpl, CONTRIBUTING.md, ACKNOWLEDGEMENTS.md, install.sh. (iss-2608221457125132)
• Shipped abcd site check still called a design target — 04-surfaces/README.md, 05-internals/10-site.md, and unpinned in release-gate/manifest.json (now pinned, checkerCount 28). (iss-2608221457122761)

Fixed — nitpick (4)

• Site principle-id collision now refused loudly rather than silently overwriting a typed record in record.json; the history walk sets core.quotePath=false so a non-ASCII record path keeps its dates (iss-2608221457123924).
• 03-invariants.md PLACEHOLDER banner over fourteen live invariants → LIVE; brief/README.md evidence-chapter "placeholders" → live (iss-2608221457127152, iss-2608221457128333).
• 00-meta.md open-questions home clause reconciled with the deliberate inline-notes design; install.md planned-Windows sentence; ahoy.md dry-run --json wording; the --no-color help string is US-English (reference regenerated).

Recorded, not fixed (stays open)

• Guard brace-expansion bypass — {--force,} expands to byte-identical argv yet the guard reads the literal token and allows it. Distinct from the $'...' gap (expansion, not quoting; breaks no written invariant); a correct bounded brace-expander is larger than this round's scope. (iss-2608221457227161)

Considered and rejected / refuted

• The commands/site.md "runs in CI" claim for the overflow audit — in-flight PR ci: screenshot audit fails on rendered overflow at phone and desktop widths #436 adds exactly that workflow; touching the line now would invert on merge.
• Install-surface transport-pin (--proto) and -q deltas vs hooks/bootstrap.sh — downgraded to nitpick / defence-in-depth: the pin closes no reachable path (the attacker who can inject a downgrade already holds a trusted cert; GitHub never redirects to http), and the .curlrc/proxy attacker already has code execution.
• The iss-315 guard-warn citation (the record does not disclaim the design target); the CI record-lint job name (prior art iss-304); the prepare-this-repo template path (prior art iss-87).

Model routing: orchestration on Claude Fable 5; five parallel hunters and the per-finding adversarial refuters on Claude Opus 5. The dual pre-merge review (one Opus 5, one Fable 5) and CI status will be posted as a PR comment.

Round 7 — findings: 11 substantive, 4 nitpick, plus 1 recorded-open and several refuted.

Assisted-by: Claude:claude-fable-5

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	abcd	0778f56	Aug 23 2026, 01:08 AM

[REPPL]

Merge gate — CI green, dual review SHIP after remediation

CI status on the final head f9a6276: all checks green — ci (build + vet + gofmt + full test + race on macOS & Linux, record-lint drift, docs-lint, gitleaks, smoke, zizmor, govulncheck, dependency-review), attribution, external-review. The earlier attribution failure was the harness's auto-appended "Generated with" footer on the PR body; it was stripped and the re-run passed.

Two independent adversarial pre-merge reviews of the full diff (one Claude Opus 5, one Claude Fable 5):

• First pass — both NO-SHIP, on the identical single blocker. The new guard ANSI-C $'...' decoder handled \x and octal but omitted bash's \uHHHH / \UHHHHHHHH unicode escapes, so git push $'--force' decoded to --force in bash while the guard read the literal bytes and allowed the Tier-1 block — the exact encoded-spelling class the fix targets, and one the CHANGELOG claimed complete. Both reviewers reproduced the bypass end-to-end. Everything else in the 53-file diff both verified clean: scaffold self-parity byte-identical, rendered release YAML valid, the bare race leg omits ./internal/... and runs ./..., record/docs-lint green, ledger records well-formed, manifest arithmetic (28 = 23 + 5) consistent, no privacy-hygiene regression.

• Remediation — f9a6276 adds \u/\U/\c decoding (UTF-8 encoded, utf8.ValidRune-guarded) with watched-fail tests, making the CHANGELOG completeness claim accurate.

• Re-verification — both SHIP. Opus 5 and Fable 5 independently confirmed on the final head: every unicode-escaped spelling of --force / --no-verify / -rf now blocks (exit 1), \x and plain forms still block, and benign unicode/multi-byte echoes (echo $'AB', echo $'é', echo $'\U0001F600', echo $'\cG') still allow (exit 0) with no crash or over-block — checked against real bash including the greedy-hex edge case where an allow is the correct verdict. The sole bash divergence found (\c immediately before the closing quote) fails closed as exit 2, never an allow, within the guard's documented mistake-filter scope. Guard suite, vet, gofmt, and full make preflight green; the remediation is confined to tokenize.go/tokenize_test.go.

Auto-merge is not authorised: leaving this open for a human to merge.

Assisted-by: Claude:claude-fable-5

---

Generated by Claude Code

[REPPL]

Merge gate resumed — conflict cleared, CI green, dual re-review SHIP

Main moved after the first merge-gate pass (#440, #441, #432), leaving this PR conflicted in the two site brief chapters. Merge commit 0778f56 brought main in: main's newer website-ships prose won every conflicted hunk (it postdates and subsumes this round's corrections of the same passages), while the round's inputs-table rows in 22-site.md (record.js, install.sh.tmpl, the credit sources) were kept — main had not updated that table. No history rewrite.

CI on 0778f56: all 13 checks green — both check legs, record-lint, attribution, external-review, gitleaks, zizmor, govulncheck, smoke, dependency-review, screenshots, Workers build.

Two independent adversarial re-reviews of the full diff (one Claude Opus 5, one Claude Fable 5): both SHIP. Both proved the merge lossless mechanically — the two-dot and three-dot diffs against origin/main are byte-identical, so the merge base is main and nothing from either side was dropped; a git merge-tree replay confirmed exactly the two expected conflicts and no stealth edits outside them. Both re-ran the gates locally (gofmt, build, vet, full test, race, the three lint gates; one reviewer also ran a live site build + site check on the merged tree — all seven gates ok — and confirmed none of main's 32 new livery SVGs trips this round's tightened SVG screen; the other confirmed TestSelfScaffoldParity still holds across main's workflow edits).

The PR was merged by the maintainer while the re-verification ran; git diff 0778f56 c354114 is empty, so both verdicts apply unchanged to what shipped. Follow-up material noted by the reviewers (none merge-gating): the commands/site.md writes-list and 04-surfaces/README.md row 22 now sit slightly narrower than the merged 22-site.md, and the record-id collision guard does not yet cover two frontmatter-free stores sharing an id — candidates for a future round.

Assisted-by: Claude:claude-fable-5

---

Generated by Claude Code