Development record
An empty or all-whitespace rule string passes rules.json validation and renders as a bare contentless bullet in the injected block: the loader validates domain names and states but not rule bodies. Refuse empty or whitespace-only rules at load, or drop them at render loudly.
issueresolvedminoriss-2608261550497978
An empty or all-whitespace rule string passes rules.json validation and renders as a bare contentless bullet in the injected block: the loader validates domain names and states but not rule bodies. Refuse empty or whitespace-only rules at load, or drop them at render loudly.
Frontmatter
| id | iss-2608261550497978 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2608261550497978-empty-rule-strings-validate-and-render-a.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2609012039210402An override `{"PII": {"rules": []}}` passes `Validate` (internal/core/rules/rules.go) and injects a heading-only `## PII` block — suppression wearing the domain's name, which the agent reads as a domain that says nothing; a custom domain declared with recall but no rules does the same. Reproduced at v0.7.0 (a 43-byte block, exit 0). The documented way to silence a domain is `{"state": "dormant"}`; a domain whose merged rules are empty should not render at all, and the loader should say which domain it dropped and name the dormant remedy, in line with the empty-rule-body refusal (iss-2608261550497978). Sibling of GHSA-22f8-qf5r-gjgq.