Development record
ultra-v0.6.8 follow-up (review of the branch): WritePages in internal/core/memory/writer.go redacts only PageWrite.Body. PageWrite.Frontmatter is rendered by renderWrites and written verbatim, and on ask --file-back it is host-supplied: source.citation.title, recall entries and any other frontmatter string a distiller echoes reach the committed .abcd/memory store unscanned (reproduced with a synthetic token and a home path in citation.title). Pre-existing on main — Ingest never redacted frontmatter either — but the door beside GHSA-j5f5-phgm-9m73 remains open one field over. Fix: redact every string leaf of the frontmatter mapping through the store redactor inside WritePages before dumpFrontmatter, with the same fail-closed gate as the body; IngestEvent.Origin reaching registry.md is the same class.
ultra-v0.6.8 follow-up (review of the branch): WritePages in internal/core/memory/writer.go redacts only PageWrite.Body. PageWrite.Frontmatter is rendered by renderWrites and written verbatim, and on ask --file-back it is host-supplied: source.citation.title, recall entries and any other frontmatter string a distiller echoes reach the committed .abcd/memory store unscanned (reproduced with a synthetic token and a home path in citation.title). Pre-existing on main — Ingest never redacted frontmatter either — but the door beside GHSA-j5f5-phgm-9m73 remains open one field over. Fix: redact every string leaf of the frontmatter mapping through the store redactor inside WritePages before dumpFrontmatter, with the same fail-closed gate as the body; IngestEvent.Origin reaching registry.md is the same class.
Grounds
- pursued: the frontmatter walk lives in the write primitive beside the body redaction, so the two cannot drift apart again
Frontmatter
| id | iss-2608291941064448 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | major |
.abcd/work/issues/resolved/iss-2608291941064448-memory-page-frontmatter-is-written.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2609012037432966GHSA-x46m-mw9h-5jwj (CWE-312): WritePages redacts only PageWrite.Body; the frontmatter is dumped verbatim by renderWrites, so host-supplied recall, contradicts, citation scalars, sources[].licence and weighting_note land in the committed store unscanned, and the core-copied licence (DetectLicence from an SPDX line or a License: header), the redirect-controlled origin and title (materialFromFetched FinalURL, query string included) and every registry placement (the MergeIngest fresh entry and its fill-if-empty origin, backlinkOtherHashes, the ask --file-back event) reach .sources_index.json, contradictions.md and the ingest --json and ask --json results raw (reproduced at v0.7.0: a PAT in an SPDX header is returned in licence and stored three times in the page and once in the registry). Strict superset of iss-2608291941064448, which names host frontmatter through WritePages only. The fix must walk every string leaf a write introduces — the page frontmatter in WritePages and the registry leaves the merge adds, never the cached ones, so a dirty cached citation cannot lock a re-ingest out — through the store redactor with the same fail-closed discipline as the body (redact, sweep the home, refuse only a BlockingResidual), redact licence, citation and title at the source in Ingest so the returned result matches what was written, and build the redactor on the registry-only fast path too, where today none is built.