GHSA-v826-5jf4-p8xg (CWE-359): transcript identity redaction is keyed on the repo effective git identity, storing the caller other git identity in clear text. history.Capture uses scanner.New(repoRoot), whose ProbeIdentity resolves one user.name and user.email under -C repoRoot with global config in effect (gitutil.ScrubbedEnv); git last-wins resolution means a repo-local or includeIf persona replaces the unconditional global identity, so a transcript carrying both stores the personal one verbatim with the frontmatter reporting no identity redaction. Evidence: scanner.ProbeIdentity, history.Capture. The fix must union the effective identity with every other value git resolves for the key (git config --get-all), keeping the persona redacted and redacting the global identity too.

GHSA-v826-5jf4-p8xg (CWE-359): transcript identity redaction is keyed on the repo effective git identity, storing the caller other git identity in clear text. history.Capture uses scanner.New(repoRoot), whose ProbeIdentity resolves one user.name and user.email under -C repoRoot with global config in effect (gitutil.ScrubbedEnv); git last-wins resolution means a repo-local or includeIf persona replaces the unconditional global identity, so a transcript carrying both stores the personal one verbatim with the frontmatter reporting no identity redaction. Evidence: scanner.ProbeIdentity, history.Capture. The fix must union the effective identity with every other value git resolves for the key (git config --get-all), keeping the persona redacted and redacting the global identity too.

Grounds

• pursued: one probe change in the shared scanner covers the ledger, memory, transcript and intent stores alike; the union is read from a single unscoped git config --get-all listing because neither --local nor --global sees an includeIf persona for what it is