Hardened ahoy install to contain its writes within the repository root and to refuse a non-real .abcd directory.

Frontmatter

.abcd/work/issues/resolved/iss-2608270735428527-hardened-ahoy-install-to-contain-its.md
open on GitHub ↗ · commit history ↗

mentions2

• iss-2609012039118971Observation from the lane LA assessment: the two 0.6.7 security fixes 81f81f67 (GHSA-xrf8-4432-gw2f) and 15a31ea7 (GHSA-h2gm-w3hm-8xpq) were committed without `Resolves:` trailers and their records (iss-2608270735428527, iss-2608270735420161) moved to resolved/ without `resolved_by` stamps, so the RS001-RS003 gates either did not exist or did not fire on the security-release-2026-08-27 integration branch. Worth checking whether the other records from that pass share the gap, and whether the gates run on every integration branch today. Not fixed in this run; the two advisories are bound to their fixing commits by their own ledger markers instead.
• iss-2609012039119927GHSA-xrf8-4432-gw2f ledger marker: the advisory (ahoy install writes escaping the working tree through a committed .abcd ancestor symlink) was fixed before this run by 81f81f67df7132067cc04fedda9609224fd052a0 "fix(ahoy): contain install writes against a committed .abcd ancestor symlink" (first tag v0.6.7). On main, `internal/core/ahoy/apply.go:Install` refuses up front via `abcdDirHazard` (a symlink or non-directory .abcd is `Status: "refused"`), `store.go:writeRepoJSON` and `writeConfig` resolve through `os.OpenRoot(cwd)` plus `fsutil.WriteFileAtomicPreserveModeInRoot`, and `internal/core/ahoy/symlink_escape_test.go:TestInstallRefusesAbcdDirSymlinkEscape` passes. The existing resolved record iss-2608270735428527 describes the fix but names no GHSA id and carries no resolved_by stamp, so the advisory was not findable from the ledger by id; this record binds the two and is not a second defect.