Development record
2026-09-30 — Building the 2026-09-25 ruling on iss-2608291814575788 (lane gitleaksAug of autonomous run A) took four calls the ruling left open. (1) Only the not-installed binary is the recorded gap: the scanner declares `scanner.ErrAugmenterNotFound`, which `gitleaks.ErrConfiguredNotFound` matches, and every other state the augmenter reports — a refused configured path, a broken `gitleaks.json`, a run that fails, a report the scanner cannot place at its line and column, or more than 10,000 findings from one scan — degrades the scanner, so every consumer treats it as it treats a broken `pii.json`. The ruled `Scan(text, file) []Finding` has no error, so a failed run is reported through the next `Available()`, which the scanner asks after every scan; a write path therefore consults `Unavailable()` after scanning as well as before. (2) The two outward-bound consumers the ruling does not name fail closed on the gap as launch does: `disembark pack` refuses (a lifeboat leaves the repository as a release does), and the privacy lint reports it as an error finding citing `.abcd/config/gitleaks.json`. (3) The augmenter's output is untrusted: the scanner keeps only a finding whose bytes sit where it says, forces hard_fail, namespaces a kind that would choose a native redaction (an identity, network or PEM kind, or any un-namespaced one) under `augmented:`, drops its snippet and suggestion for its own, and sanitises and caps an error it prints; the gitleaks runner runs in `gitutil.IsolatedEnv` and discards the binary's own output. (4) A write path verifies what the augmenter found by its bytes (`scanner.UnsealedAugmented`) beside a native-only re-scan (`ScanTextNative`), never by re-running gitleaks over redacted text; `history migrate` builds its scanner without the augmenter, as its redaction of lineage scalars never ran gitleaks.
2026-09-30 — Building the 2026-09-25 ruling on iss-2608291814575788 (lane gitleaksAug of autonomous run A) took four calls the ruling left open. (1) Only the not-installed binary is the recorded gap: the scanner declares scanner.ErrAugmenterNotFound, which gitleaks.ErrConfiguredNotFound matches, and every other state the augmenter reports — a refused configured path, a broken gitleaks.json, a run that fails, a report the scanner cannot place at its line and column, or more than 10,000 findings from one scan — degrades the scanner, so every consumer treats it as it treats a broken pii.json. The ruled Scan(text, file) []Finding has no error, so a failed run is reported through the next Available(), which the scanner asks after every scan; a write path therefore consults Unavailable() after scanning as well as before. (2) The two outward-bound consumers the ruling does not name fail closed on the gap as launch does: disembark pack refuses (a lifeboat leaves the repository as a release does), and the privacy lint reports it as an error finding citing .abcd/config/gitleaks.json. (3) The augmenter's output is untrusted: the scanner keeps only a finding whose bytes sit where it says, forces hard_fail, namespaces a kind that would choose a native redaction (an identity, network or PEM kind, or any un-namespaced one) under augmented:, drops its snippet and suggestion for its own, and sanitises and caps an error it prints; the gitleaks runner runs in gitutil.IsolatedEnv and discards the binary's own output. (4) A write path verifies what the augmenter found by its bytes (scanner.UnsealedAugmented) beside a native-only re-scan (ScanTextNative), never by re-running gitleaks over redacted text; history migrate builds its scanner without the augmenter, as its redaction of lineage scalars never ran gitleaks.
Frontmatter
| id | dcn-2609300000000015 |
|---|---|
| type | decision |
| date | 2026-09-30 |
.abcd/work/decisions/dcn-2609300000000015-building-the-2026-09-25-ruling-on.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2608291814575788ultra-v0.6.8 altitude 2: the opt-in gitleaks augmentation is bolted onto history.Capture alone (internal/core/history/history.go), while the other write paths that build scanner.New — capture, memory ingest, launch dry-run, repolint, the CLI scan — never see it. Deeper fix: fold the gitleaks adapter into internal/adapter/scanner so scanner.New reads the opt-in, ScanText/ScanBundle return the union, and ErrConfiguredNotFound surfaces as the existing Unavailable state; every consumer then inherits it.