GHSA-gxhr-pmwv-r99p (CWE-359): memory identity redaction follows the repo git identity, not the caller. memory.newStoreRedactor builds scanner.New(repoRoot) whose ProbeIdentity reads the single effective user.name and user.email, so with a work persona in the repo the caller global identity is stored verbatim in the page body and the kept original. Evidence: memory/redact.go newStoreRedactor, scanner.ProbeIdentity. One fix in the probe (union of every configured scope) covers the memory, history and capture stores; neither identity may survive in any store write.

GHSA-gxhr-pmwv-r99p (CWE-359): memory identity redaction follows the repo git identity, not the caller. memory.newStoreRedactor builds scanner.New(repoRoot) whose ProbeIdentity reads the single effective user.name and user.email, so with a work persona in the repo the caller global identity is stored verbatim in the page body and the kept original. Evidence: memory/redact.go newStoreRedactor, scanner.ProbeIdentity. One fix in the probe (union of every configured scope) covers the memory, history and capture stores; neither identity may survive in any store write.

Grounds

• pursued: one probe change in the shared scanner covers the ledger, memory, transcript and intent stores alike; the union is read from a single unscoped git config --get-all listing because neither --local nor --global sees an includeIf persona for what it is