Development record
The store-before-commit redactor rewrites a hyphenated vocabulary word when its first token equals the local account name. Observed on `abcd intent audit ingest` for itd-4 (receipt rcp-2662745d5344): the verdict's ac-4 rationale named the historical sync verb of the plugin, the two-token hyphenated term the intent's own fourth acceptance criterion carries verbatim, and the ingested Audit Notes now read `[redacted-user]-sync` in two places (the criterion line and the gap-audit claim) while the criterion text forty lines above carries the term unredacted. The identity kinds in internal/adapter/scanner/redact.go (kindLocalUser, replaced by the marker at redactionReplacement) treat a hyphen as a word boundary, so a product term is redacted as a person. The committed record is machine-dependent: on an account with another name the same ingest writes the term. Found during the fidelity audit of itd-4 in the autonomous run.
The store-before-commit redactor rewrites a hyphenated vocabulary word when its first token equals the local account name. Observed on abcd intent audit ingest for itd-4 (receipt rcp-2662745d5344): the verdict's ac-4 rationale named the historical sync verb of the plugin, the two-token hyphenated term the intent's own fourth acceptance criterion carries verbatim, and the ingested Audit Notes now read [redacted-user]-sync in two places (the criterion line and the gap-audit claim) while the criterion text forty lines above carries the term unredacted. The identity kinds in internal/adapter/scanner/redact.go (kindLocalUser, replaced by the marker at redactionReplacement) treat a hyphen as a word boundary, so a product term is redacted as a person. The committed record is machine-dependent: on an account with another name the same ingest writes the term. Found during the fidelity audit of itd-4 in the autonomous run.
Grounds
- declined: the finding is carried whole by iss-2609061504302157; this would be wrong if iss-2609061504302157 were closed without answering it
Frontmatter
| id | iss-2609240311058767 |
|---|---|
| type | issue |
| lifecycle | wontfix |
| severity | minor |
.abcd/work/issues/wontfix/iss-2609240311058767-the-store-before-commit-redactor.md
open on GitHub ↗ · commit history ↗
mentions2
- iss-2609061504302157The capture-time scanner redacts an ordinary word when the local account name happens to be that word. On a machine whose account name is a common three-letter abbreviation for development, a capture containing the phrase 'the source checkout's <that word> build' came back with the word replaced by [redacted-user] and redacted: 1 in the JSON. The private-names layer is doing what it was told, but a banned name that is also a dictionary word or a conventional abbreviation needs a word-boundary and context rule, or at least a diagnostic naming which layer and which entry fired, so the author can tell a real leak from a false positive without reopening the file.
- itd-4Nothing You Notice Gets Lost