Development record
harness_session_url's opacity heuristic accepts a UUID, a base62 token (digit plus uppercase) and a long lowercase-hex run, and rejects an all-lowercase non-hex id such as session_zk3n9q2mvx8rtq. The rejection is deliberate: without it every documentation slug that follows the word session (there is one in .abcd/development/research/notes/2026-08-22-context-window-management-sota.md) becomes a finding. Whether any harness in scope mints an all-lowercase id is a fact about external services that cannot be settled from the repository. Settle it by enumerating the session-URL spellings the covered harnesses actually emit, then either widen the opacity test or record the coverage boundary in the pattern's own comment. Found by adversarial security review of itd-152.
harness_session_url's opacity heuristic accepts a UUID, a base62 token (digit plus uppercase) and a long lowercase-hex run, and rejects an all-lowercase non-hex id such as session_zk3n9q2mvx8rtq. The rejection is deliberate: without it every documentation slug that follows the word session (there is one in .abcd/development/research/notes/2026-08-22-context-window-management-sota.md) becomes a finding. Whether any harness in scope mints an all-lowercase id is a fact about external services that cannot be settled from the repository. Settle it by enumerating the session-URL spellings the covered harnesses actually emit, then either widen the opacity test or record the coverage boundary in the pattern's own comment. Found by adversarial security review of itd-152.
Grounds
- pursued: the boundary is written where the rule lives and a widening fails a test; a covered harness later shown to mint lower-case non-hex ids would show the stated boundary needs a host-specific rule
Frontmatter
| id | iss-2608281948217899 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2608281948217899-harness-session-url-s-opacity-heuristic.md
open on GitHub ↗ · commit history ↗
mentions1
- itd-152Autonomous cloud runs in sibling repos leaked harness attribution footers and a live session URL into public GitHub artifacts: the harness auto-appends a 'Generated with' footer plus a session link when a PR or issue is created, overriding the repos' Assisted-by-only attribution policy (commit messages stayed clean; the leak surface was PR bodies and issue comments, plus GitHub's public edit history retaining the pre-scrub revision). Leak shape only - no session ids reproduced here. Two remedies needed: (a) every autonomous routine prompt must ban session URLs and harness footers in public text AND mandate a post-create re-read-and-strip of every PR/issue/comment the loop creates, because the append happens outside the model's own text; (b) abcd should detect the class - session-URL and harness-footer patterns belong with the shared privacy pattern set (iss-154 family / itd-74 banlist territory) so audit and docs-lint flag them in any committed or posted text.