ultra-v0.6.8 altitude 5: the .git first-segment exclusion in internal/core/positioning/config.go Surface.validate is a one-off guard layered on fsutil.ValidRelPath, which every other repo-relative path consumer (site manifest, lint config, record-lint) relies on without it — so another committed config naming a repo-relative file can still quote .git/config and leak a credential-bearing remote URL. Deeper fix: a shared fsutil predicate (denied root segments, case-folded) used by every validator, or enforcement in ReadGuardedInRoot for repo roots.

ultra-v0.6.8 altitude 5: the .git first-segment exclusion in internal/core/positioning/config.go Surface.validate is a one-off guard layered on fsutil.ValidRelPath, which every other repo-relative path consumer (site manifest, lint config, record-lint) relies on without it — so another committed config naming a repo-relative file can still quote .git/config and leak a credential-bearing remote URL. Deeper fix: a shared fsutil predicate (denied root segments, case-folded) used by every validator, or enforcement in ReadGuardedInRoot for repo roots.

Grounds

• pursued: no committed config can name a path inside .git that abcd then reads or writes; shown wrong if a config field joined onto the repo root and read still accepts .git/config