Development record
Autonomous cloud runs in sibling repos leaked harness attribution footers and a live session URL into public GitHub artifacts: the harness auto-appends a 'Generated with' footer plus a session link when a PR or issue is created, overriding the repos' Assisted-by-only attribution policy (commit messages stayed clean; the leak surface was PR bodies and issue comments, plus GitHub's public edit history retaining the pre-scrub revision). Leak shape only - no session ids reproduced here. Two remedies needed: (a) every autonomous routine prompt must ban session URLs and harness footers in public text AND mandate a post-create re-read-and-strip of every PR/issue/comment the loop creates, because the append happens outside the model's own text; (b) abcd should detect the class - session-URL and harness-footer patterns belong with the shared privacy pattern set (iss-154 family / itd-74 banlist territory) so audit and docs-lint flag them in any committed or posted text.
Autonomous cloud runs in sibling repos leaked harness attribution footers and a live session URL into public GitHub artifacts: the harness auto-appends a 'Generated with' footer plus a session link when a PR or issue is created, overriding the repos' Assisted-by-only attribution policy (commit messages stayed clean; the leak surface was PR bodies and issue comments, plus GitHub's public edit history retaining the pre-scrub revision). Leak shape only - no session ids reproduced here. Two remedies needed: (a) every autonomous routine prompt must ban session URLs and harness footers in public text AND mandate a post-create re-read-and-strip of every PR/issue/comment the loop creates, because the append happens outside the model's own text; (b) abcd should detect the class - session-URL and harness-footer patterns belong with the shared privacy pattern set (iss-154 family / itd-74 banlist territory) so audit and docs-lint flag them in any committed or posted text.
Widened 2026-08-11 by a second shape, found in this repo rather than a sibling: the footer is not always appended by the harness outside the model's own words — it can be MODEL-AUTHORED, written deliberately into a pull request body by an agent reasoning from a generic default plus a too-narrow reading of the repo's own policy (here, concluding the attribution rule was scoped to the documentation lint's configured roots, when CONTRIBUTING.md and the agent-instruction router together confine tool naming to the disclosure trailer plus two named credit files). Remedy (a) as written addresses the harness-append shape; the model-authored shape additionally needs a read-what-is-prescribed step before any outward text is composed, because a ban an agent has reasoned its way around is not a ban. Remedy (b) is unchanged and covers both shapes, since a post-create re-read cannot tell which of the two produced the text it strips — which is the argument for keeping (b) even once (a) is tightened.
Frontmatter
| id | iss-178 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-178-autonomous-cloud-runs-in-sibling-repos.md
open on GitHub ↗ · commit history ↗
References2
- itd-107Autonomous Routines Assemble From One Versioned Templaterelated
- itd-152Autonomous cloud runs in sibling repos leaked harness attribution footers and a live session URL into public GitHub artifacts: the harness auto-appends a 'Generated with' footer plus a session link when a PR or issue is created, overriding the repos' Assisted-by-only attribution policy (commit messages stayed clean; the leak surface was PR bodies and issue comments, plus GitHub's public edit history retaining the pre-scrub revision). Leak shape only - no session ids reproduced here. Two remedies needed: (a) every autonomous routine prompt must ban session URLs and harness footers in public text AND mandate a post-create re-read-and-strip of every PR/issue/comment the loop creates, because the append happens outside the model's own text; (b) abcd should detect the class - session-URL and harness-footer patterns belong with the shared privacy pattern set (iss-154 family / itd-74 banlist territory) so audit and docs-lint flag them in any committed or posted text.related
mentions5
- dcn-26081100000000012026-08-11 — Pull-request lifecycle automation for autonomous rounds settled
- iss-154privacy-hygiene detects only absolute home paths — no network-identifier patterns (IPv4 incl. CGNAT/tailnet 100.64/10, hostnames, device names, ports-in-context). Field incident: an agent committed a Tailscale investigation (tailnet IP, two device hostnames, firewall posture, service port, presence/away patterns) into a public repo's committed tier and audit passed it silently. The v1 deferral note names only emails and private-repo names; network identifiers are not even recorded as deferred.
- iss-2608210923437502The bundled COMMITTING rules domain (the defaults every managed repo inherits from the binary) says Assisted-by-not-Co-Authored-By but omits the two attribution failures that keep recurring operationally and are currently patched by per-agent memory and per-routine prompt text: (1) the harness auto-appends a Generated-by footer plus session link to PR bodies and issue comments it creates — the domain should instruct the post-write read-back-and-strip (iss-178 remedy a, as an injected rule rather than every routine prompt re-carrying it); (2) autonomous runs default their git identity to the tool, which the attribution gate rejects (iss-193's class) — the domain should name the commit-as-the-human requirement. Prevention rung, complementing iss-178's detection remedy b; prompt-carried and memory-carried safety is the anti-pattern itd-114 just retired for minting
- iss-2608282124231752scanner.ScrubOutbound has no front door: it is defined, tested and documented as the outbound-artefact scrub, but no CLI command, plugin verb or routine prompt calls it, and internal/ cannot be imported from outside the module, so the posting-time half of the harness-leak class is unmitigated in practice. This is not an oversight in spc-45, which deliberately scopes a forge client out; the gap is that nothing hands the primitive to the party that does post. Two candidate shapes for a future change: a small stdin-reading verb (abcd scrub --label pr-body) that the autonomous routine prompts pipe every PR body, issue and comment through before posting; or wiring the primitive into whatever posting path lands with itd-107, so an assembled routine scrubs by construction. Until one lands, the operative control is the re-read-and-strip policy in scanner.OutboundPolicy, as AGENTS.md, iss-178 and spc-45 state.
- itd-74abcd Keeps the Names You Ban Out of Everything You Publish