Development record
The capture-time scanner redacts an ordinary word when the local account name happens to be that word. On a machine whose account name is a common three-letter abbreviation for development, a capture containing the phrase 'the source checkout's <that word> build' came back with the word replaced by [redacted-user] and redacted: 1 in the JSON. The private-names layer is doing what it was told, but a banned name that is also a dictionary word or a conventional abbreviation needs a word-boundary and context rule, or at least a diagnostic naming which layer and which entry fired, so the author can tell a real leak from a false positive without reopening the file.
The capture-time scanner redacts an ordinary word when the local account name happens to be that word. On a machine whose account name is a common three-letter abbreviation for development, a capture containing the phrase 'the source checkout's <that word> build' came back with the word replaced by [redacted-user] and redacted: 1 in the JSON. The private-names layer is doing what it was told, but a banned name that is also a dictionary word or a conventional abbreviation needs a word-boundary and context rule, or at least a diagnostic naming which layer and which entry fired, so the author can tell a real leak from a false positive without reopening the file.
Corroboration (2026-09-18, Gropius managed-repo session gropiusllm-56, relayed
to abcd-17). Second independent hit, on a different verb and a different
machine: abcd capture resolve at v0.9.0 rewrote the same three-letter word in
a resolution note to [redacted-user] because it is that machine's account
name; the note was about the binary's default version string, which is that
word. The author found the rewrite only by reading the record back. The
session's ask matches this record's: a whole-word or context rule for a banned
name that is also a dictionary word, or at least a diagnostic naming the span
so the author can reword before the record is written. The launch-payload half
of the same collision is iss-2608291444328326.
Grounds
- pursued: a capture whose prose uses a word equal to a generic account name is stored unredacted while the same name after a home root is still masked; a stored record with the word rewritten on such a machine would show it wrong
Frontmatter
| id | iss-2609061504302157 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2609061504302157-the-capture-time-scanner-redacts-an.md
open on GitHub ↗ · commit history ↗
mentions3
- iss-2608291444328326The launch payload's `local_username` identity rule takes the username from the last segment of HOME and hard-fails every case-insensitive occurrence of it in the payload. On a machine whose account name is an ordinary word that is also product vocabulary (an account named with the same three-letter word as the `ahoy install` track-latest flag and the "-shim" install mode it names, which appears in commands/ahoy.md, commands/update.md, commands/launch.md and docs/reference/cli/commands.md), `TestPayloadTreeImplementationsResolveIdentically` and `TestRenderPayloadLeavesSourceTreeUnversioned` fail on a pristine main (9 hard-fail findings at e6efe28f), and with them `make preflight` and the pre-push hook, so the v0.6.8 release branch could not be pushed from that machine until HOME was pointed at a symlink alias of the real home directory for the push. CI, which runs under a different account name, passes.
- iss-2609100505142469The capture redactor rewrites the leading component of a reverse-DNS identifier when it happens to equal the local account name, silently corrupting technical content in a permanent record. This refines iss-2609061504302157, which reports the same root cause on an ordinary dictionary word; the dotted-identifier class is broader, and its damage is unrecoverable rather than merely noisy.
- iss-2609240311058767The store-before-commit redactor rewrites a hyphenated vocabulary word when its first token equals the local account name. Observed on `abcd intent audit ingest` for itd-4 (receipt rcp-2662745d5344): the verdict's ac-4 rationale named the historical sync verb of the plugin, the two-token hyphenated term the intent's own fourth acceptance criterion carries verbatim, and the ingested Audit Notes now read `[redacted-user]-sync` in two places (the criterion line and the gap-audit claim) while the criterion text forty lines above carries the term unredacted. The identity kinds in internal/adapter/scanner/redact.go (kindLocalUser, replaced by the marker at redactionReplacement) treat a hyphen as a word boundary, so a product term is redacted as a person. The committed record is machine-dependent: on an account with another name the same ingest writes the term. Found during the fidelity audit of itd-4 in the autonomous run.