John Smith 3f8ea505f6 Audit remediation C: OH-6.5 env-var containment P1 + command display P3 + README LOC P3 + taint-fork P2 plumbing ...

- Port preserved dirty-tree delta: README LOC note, taint-fork comment
  narrowing, contract-adapter execute.before+after fork mirroring,
  session-interceptors headers key + model.request fork linking, 4 fork tests.
- OH-6.5-env-var-target-escape (P1): fail-closed $ / backtick escape in
  shellTargetEscapesWorkspace after -//dev/null carve-outs (rule-0 deny for
  $HOME/${HOME}/$TMPDIR/$(...)/backtick write-planting; rm -rf $HOME
  still rule-1-destructive; quoted-literal over-block documented+tested).
- OH-6.5-command-display-doc-drift (P3): exempt command -v/-V display
  queries from unwrapped-candidate write-ness in classifyShellCommand
  (read-only; destructive payloads through command still destructive).
- OH-scope-readme-loc-stale (P3) + formal LOC-cap revision to raw 12100 /
  stripped 10100 (net-zero impossible; rationale in check-loc.sh history;
  CI gate, README, gate-test updated; over-cap probe still fails).
- OH-6.6-taint-fork-gap (P2, narrowed): keep delta plumbing, no daemon;
  residual silent-fork gap documented (hosts call recordSessionForkLink).
- 12 new regression tests; tsc clean; wave-1 accept ALL GREEN; full suite
  377 pass / 2 fail (both pre-existing TMPDIR-override env artifacts).

2026-10-18 06:00:31 -04:00

..

ci.yml

Audit remediation C: OH-6.5 env-var containment P1 + command display P3 + README LOC P3 + taint-fork P2 plumbing

2026-10-18 06:00:31 -04:00

publish.yml

Wave 8: remediate all AUDIT_REPORT_FINDINGS (P0 guards/taint/symlink, P1 roles/SSRF/rollback/retry, P2/P3 deps/CI/receipts)

2026-10-17 02:32:00 -04:00