Development record
2026-08-22 — All-dimensions bug-hunt round 7 (branch `bughunt-b/round-7`).
2026-08-22 — All-dimensions bug-hunt round 7 (branch bughunt-b/round-7).
Fixed 11 substantive and 4 nitpick findings across five hunt dimensions, each
adversarially refuted before fixing and each behaviour change pinned by a
watched-fail test. Security/code: the guard tokenizer now recognises $'...'
ANSI-C and $"..." locale quoting (a Tier-1 blocker bypass); the hard-fail
local_username redaction matcher folds case; five site-generator fixes
(SVG prolog/comment/CDATA build-vs-check disagreement, unparsed-page gate
masking, unscreened repository href scheme, record-id collision, non-ASCII
path dates); the launch scaffold's symlink path leak and its ./internal/...
race leg that wedged a bare adopter; a capture skipped[].error absolute-path
leak. Infra/docs/record: CODEOWNERS now covers site-src/ and
docs/requirements.txt; the shipped abcd site check is called shipped in the
brief and pinned in the release-gate manifest; the site-build read set, the
writing-style escape scope, the invariants and evidence-chapter banners, and
several doc/string nitpicks corrected. The guard brace-expansion bypass
({--force,}) is recorded open (iss-2608221457227161) as a distinct
expansion-not-quoting follow-up. Refuted/out of scope this round: the site.md
"runs in CI" claim (in-flight PR #436), the iss-315 guard-warn citation, the
install-surface transport-pin and -q deltas (defence-in-depth, no reachable
attack), the record-lint job-name and prepare-this-repo template path (prior
art iss-304/iss-87).
Frontmatter
| id | dcn-2608220000000009 |
|---|---|
| type | decision |
| date | 2026-08-22 |
.abcd/work/decisions/dcn-2608220000000009-all-dimensions-bug-hunt-round-7-branch.md
open on GitHub ↗ · commit history ↗
mentions4
- iss-87prepare-this-repo adopt phase is not self-contained in the abcd record: Phase 3-5 reference templates at a machine-local path outside both the abcd repo and the target (pre-commit-config.yaml, prepare-commit-msg, AGENTS.md, DECISIONS.md, NEXT.md). A fresh clone of abcd-cli onboarding a repo would not have them, so the adoption step silently degrades against loud-staging. Detector: an onboarding self-containment check -- every asset the adopt phase applies resolves from within the abcd record or the binary, never an external machine-local path. Acceptance: the Phase 3/4/5 template references in prepare-this-repo.md.
- iss-304Confirmed nitpicks deferred from bughunt round 1 (recorded not fixed): (a-4) memory ingest --source reads its operand with os.Stat-then-unbounded os.ReadFile, a size TOCTOU the URL branch's io.LimitReader avoids; (b-4) the generated CLI reference claims to list every user-facing command but omits Cobra's completion/help commands; (d-12) the CI job id 'record-lint' actually runs scripts/check-reviews.sh (reviews-charter), a misleading required-check name whose safe rename needs a coordinated live-ruleset edit
- iss-315guard CHANGELOG code comment and test claim python -c and perl -e already get a loud warn but the shipped behaviour is a silent allow and the pinning test is vacuous
- iss-2608221457227161The guard tokenizer does not perform brace expansion, so a flag wrapped in a single-element brace group with an empty alternative (git push {--force,} origin main) expands in bash to byte-identical argv --force yet the guard reads the literal token {--force,} and allows it — a Tier-1 blocker miss of the same mutate-the-flag-token shape as the round-6 redirection fix. Distinct from the $'...' quoting gap (this is expansion, not quoting, and breaks no written invariant); recorded for a scoped follow-up because a correct bounded brace-expander is larger than this round's scope.