Development record
2026-08-20 — Bug-hunt round 1 (hunt A), landed late: the round ran 2026-08-19 on a branch that
2026-08-20 — Bug-hunt round 1 (hunt A), landed late: the round ran 2026-08-19 on a branch that waited while v0.6.1 and bughunt round 2 merged; reconciled onto main today rather than replayed. Captured iss-305..iss-325 (21 findings, each adversarially refuted before capture). Ported with their tests: the privacy-rule leading-boundary gate and Windows-arm case fold (iss-305/308), the scanner ipv4/mac trailing-\b redaction miss (iss-307), the memory-ingest guarded read (iss-310), the record-lint/scaffold-sync isolated-env root discovery (iss-311), the hermetic attribution corpus (iss-313), the .PHONY completion (iss-314), the guard python/perl false "loud warn" claim across all four surfaces (iss-315), the AGENTS/ci.yml job list and dev-README record-map/personas corrections (iss-318/319), and they/them across seven intents (iss-321). Superseded, not re-applied: the SemVer over-int64 rejection (iss-309) — hunt B's iss-293 landed the same fix on main first with tests covering all three component positions, so main's implementation stands and the branch's code and test were dropped; likewise githubRemoteRe's (?i) (iss-306 = round 2's iss-339) and the wrapper-probe cwd isolation (iss-312, fixed on main with a sync.OnceValue probeDir). Re-derived rather than replayed: the doc fixes — main had already fixed iss-316/317/320 its own way (round 2's anchor sweep is on main verbatim), so only the still-true corrections were applied. Open record-only: iss-322..iss-325.
Frontmatter
| id | dcn-2608200000000003 |
|---|---|
| type | decision |
| date | 2026-08-20 |
.abcd/work/decisions/dcn-2608200000000003-bug-hunt-round-1-hunt-a-landed-late-the.md
open on GitHub ↗ · commit history ↗
mentions17
- iss-293launch.ParseSemver discards strconv.Atoi's range error (major,_ := ...), and semverRe's numID is unbounded, so a >int64 version component clamps to MaxInt64: distinct oversized versions collide to one String() and the next Patch++ wraps negative — reachable via GitExistingTags (git tag list) and changelog.DeriveNext; the identical defect was already guarded in spec/spec.go
- iss-305abcd lint privacy-hygiene hard-fails on ordinary committed content because hasAbsHomePath lacks the leading-boundary predicate its scanner twin has
- iss-306scanner githubRemoteRe is case-sensitive on the github.com host, disabling the github_username detector on a mixed-case remote and spuriously hard-failing when name==handle
- iss-307scanner network ipv4Re and macRe rely on a trailing ASCII word boundary, silently missing a hard_fail address whose only sin is an adjacent word char
- iss-309launch ParseSemver discards strconv.Atoi range error so an over-int64 version component clamps to MaxInt64 and can wrap negative in DeriveNext
- iss-310memory ingest materialFromLocal reads a user-typed operand with Stat-then-ReadFile leaving a swap window and an uncapped-growth read
- iss-311cmd record-lint and scaffold-sync resolve the repo root with an unscrubbed git rev-parse so an inherited GIT_WORK_TREE redirects the lint or release gate
- iss-312guard wrapper-probe tests write flock lock files into the tracked package source tree and four zero-byte artefacts are committed
- iss-313check-attribution-cases.sh scratch repos are not hermetic so an inherited GIT_DIR makes the corpus report green while rewriting the ambient repository history
- iss-314Makefile PHONY list omits check-attribution scaffold-sync and scaffold-sync-check so a same-named root file silently no-ops the target
- iss-315guard CHANGELOG code comment and test claim python -c and perl -e already get a loud warn but the shipped behaviour is a silent allow and the pinning test is vacuous
- iss-316README process section asserts two unshipped capabilities a brief-drafting skill and a Socratic interview the framework provides
- iss-318AGENTS.md and the ci.yml header enumerate CI separate jobs as a closed list that omits dependency-review and govulncheck
- iss-321persona pronoun discipline itd-79 is violated by gendered pronouns in seven intent records including a shipped intent
- iss-322lifeboat gvIDNum discards Atoi range error so an over-int64 record id from a foreign repo sorts to the extreme of the graveyard readout
- iss-325no pre-tag CI lane cross-compiles the full release matrix so a darwin-amd64 or linux-arm64 interaction break first surfaces post-tag behind the release approval gate
- iss-339githubRemoteRe matches the remote host case-sensitively, so a mixed-case github.com remote (git@GitHub.com:...) leaves GitRemoteUsername empty and the github_username redaction kind is never compiled — the caller's handle survives history capture redaction and the PII scan