Development record
record-lint's armed agent-diff check counts any added diff line starting `+prompt_version:` as a version bump, so an instruction edit under `agents/` passes at an unchanged `prompt_version` when the diff also adds a body line `prompt_version: <same>` or adds one trailing space to the frontmatter line.
record-lint's armed agent-diff check counts any added diff line starting +prompt_version: as a version bump, so an instruction edit under agents/ passes at an unchanged prompt_version when the diff also adds a body line prompt_version: <same> or adds one trailing space to the frontmatter line.
Private security advisory GHSA-5c9h-7q8p-gpj5 (draft, severity medium). Present since v0.6.8. GHSA-q333-3p8r-xc2f's pins stop a diff driver forging the line, not git's own diff carrying it. Full text, evidence and reproduction: .abcd/.work.local/scratch/security-drain-2026-10-11/advisories/ in the main checkout's local tier. This record stays uncommitted until its fix lands; the fix commit adds it directly to resolved/.
Evidence (main 3d171421a): promptVersionChanged (internal/core/lint/agentcontract.go) returns true on the first diff line with prefix +prompt_version: and never compares the parsed version on the two sides. Confirmed by reading the code at that commit; not re-run.
Frontmatter
| id | iss-2610111600065621 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2610111600065621-unbumped-prompt-edit-passes-agent-diff.md
open on GitHub ↗ · commit history ↗
mentions2
- iss-2610111724587800record-lint's agent-contract bump check never sees an edit made through a symlink: when agents/<name>.md is a symlink to a file elsewhere in the repository, editing the target changes nothing under agents/ in the diff, so an instruction change ships with no prompt_version bump and no finding. Found by lane X while fixing the unbumped-prompt check (iss-2610111600065621) on 2026-10-11; predates that change. Under abcd-fixes-what-it-adds this is abcd's own check not doing what it claims, so it is abcd's to fix.
- iss-2610111737295671The agent-contract bump check counts any different prompt_version as a bump, so an instruction edit that moves an agent's prompt_version back to an older value whose changelog entry already exists passes both halves of the check with no new entry. Found by the Fable review of lane X on 2026-10-11 (probe: main...HEAD and main..HEAD both report zero findings); predates the fix for iss-2610111600065621 and is outside its remedy.