Development record
abcd lint privacy-hygiene hard-fails on ordinary committed content because hasAbsHomePath lacks the leading-boundary predicate its scanner twin has
abcd lint privacy-hygiene hard-fails on ordinary committed content because hasAbsHomePath lacks the leading-boundary predicate its scanner twin has
Evidence
internal/core/repolint/rule_privacy.go:178 — hasAbsHomePath runs
absPathRe.FindAllStringIndex(line, -1) with no leading-boundary predicate,
unlike its scanner twin genericHomeRe which is gated by leadingBoundaryOK
(internal/adapter/scanner/identity.go:238). Any relative path segment
home/<x> or Users/<x> — src/pages/home/index.tsx, const Route = "/home/dashboard", a docs URL https://docs.example.com/home/getting-started —
matches and returns SeverityError, exit 2, on the shipped abcd lint
conformance gate.
rule_privacy.go:32-35 asserts this rule and the scanner "can never disagree
about what a leak is"; measured, they disagree on both detection and severity
for this class. This repo's own main already trips a fifth privacy-hygiene
error beyond the four iss-274 documents:
.abcd/development/research/notes/2026-08-19-issue-ledger-forge-sync-sota.md:85
(a plain https://fossil-scm.org/home/doc/... citation URL).
Adversarial verdict: CONFIRMED (major)
A shipped conformance gate hard-fails on ordinary committed content. Fix:
mirror the scanner's leading-boundary gate using repolint's own
isPathSegmentChar (which excludes /, keeping file:///home/... flagged).
Measured: FP corpus 6→2, the fossil-scm URL FP cleared, iss-274's four true
findings untouched, 12/12 genuine leak shapes still caught, package tests pass.
Not prior art: iss-274 (abcd lint red on main) describes different lines and calls them illustrative; iss-146/iss-236/iss-153/154/156 are unrelated FP classes. The code comment at rule_privacy.go:51-57 deliberates only the trailing separator — the leading boundary was never considered.
Frontmatter
| id | iss-305 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | major |
.abcd/work/issues/resolved/iss-305-abcd-lint-privacy-hygiene-hard-fails-on.md
open on GitHub ↗ · commit history ↗
mentions7
- dcn-26082000000000032026-08-20 — Bug-hunt round 1 (hunt A), landed late: the round ran 2026-08-19 on a branch that
- iss-146guard-bash false positive class: a compound command chaining a gh write verb with a LOCAL command taking an absolute path argument (gh pr merge ... ; git worktree remove /abs/path) is blocked by the line-level privacy regex, which cannot see that the path never reaches GitHub. Second guard incident of 2026-07-27 (the first, blocking --no-verify, was a true positive). Both are fixture material for itd-103's calibration corpus: this one is a known-good case the TNR floor must protect; the workaround (split the compound) is recorded here so the friction is not silent.
- iss-153privacy-hygiene absPathRe flags /Users/Shared/... (and would flag /Users/Guest/...) — macOS system directories, not usernames. Exempt well-known non-user segments after /Users/ so product code that legitimately uses /Users/Shared does not need per-line waivers.
- iss-236launch --dry-run hard-fails on a local_username false positive: the scan matches the maintainer's short username against the documented '--dev' CLI flag text, so the release preview reports 5 hard fails on a clean tree. The matcher needs a word-boundary/flag-context exemption.
- iss-274abcd lint exits 2 on a clean main checkout: four privacy-hygiene errors flag illustrative example paths (internal/core/ahoy/fsutil.go:40+42, internal/core/ahoy/store.go:170, internal/surface/cli/staleness_test.go:14 — comment prose and a test fixture like /home/alice/.local/bin/abcd), and no CI job runs the full conformance verb, so the repo's own lint sits red between releases. Either the lines take the sanctioned abcd-lint:allow marker (they are deliberately illustrative) or the rule learns the persona convention; and whether abcd lint belongs in CI is a separate maintainer call.
- iss-324scanner isPathSegmentByte includes the slash so a third partys home path inside a file URL escapes stage-one redaction
- iss-2608231000561060The repo-conformance lint runs in no gate while the record says it gates CI, and it is not currently gate-ready, which are two problems needing separate decisions. Verified 2026-08-23 on origin/main. brief/04-surfaces/README.md row 16 describes /abcd:lint as checking the three-tier layout, AGENTS.md router, durable decisions, docs currency, privacy hygiene and identity positioning, and states it 'backs prepare-this-repo and gates CI (itd-85)'. It does not gate CI. The Makefile's preflight target is lint-reviews record-lint docs-lint plus build, vet, test and race, with no abcd lint, and the Makefile has no abcd lint or repolint target at all. Searching .github/workflows for an invocation of the repo-conformance lint, excluding the unrelated 'abcd docs lint', returns nothing in ci.yml or release.yml, whose only lint steps are go run ./cmd/record-lint and go run ./cmd/abcd docs lint. The surface runs only when a human types it. The second problem is why simply wiring it up does not work. On current main the lint emits 19 privacy-hygiene findings, 17 at blocker severity, and the sampled ones are not leaks. Nine of the 19 are in the scanner's own source or in ledger entries about the scanner, where the patterns appear as subject matter. Three sampled outside that set are documentation examples: a Linuxbrew prefix in a spec table and again in [dcn-2608200000000006](../../decisions/dcn-2608200000000006-homebrew-distribution-recorded-and.md), and a CHANGELOG entry recording that certain path shapes stopped being read as usernames. So gating it today would fail every build on content that is correct. iss-305, resolved, records the mechanism -- hasAbsHomePath lacks the leading-boundary predicate its scanner twin has -- and iss-307, iss-308 and iss-324 are adjacent boundary defects in the same family. A waiver marker exists, abcd-lint:allow with the legacy spelling abcd-audit:allow, and the rule's own source uses it on two lines, so the mechanism is available but is not applied across the corpus. What makes this worth deciding rather than filing and forgetting: the rule is right about the case that actually bit. An absolute home path written into a ledger issue body is exactly what its pattern catches, and on 2026-08-23 two sessions independently wrote one. Neither was caught by an instrument. record-lint did not see them because its roots are ['.abcd/development'] and the ledger is in .abcd/work; the lint that would have seen them does not run. Note the two are not interchangeable, since record-lint is scoped to the durable record while privacy-hygiene scans every tracked file, so widening record-lint's roots is a different fix from running the lint. Decide in order: whether the record's gates-CI claim is corrected or made true, and if made true, whether the false-positive rate is addressed by waivers, by the iss-305 boundary fix, or by narrowing what blocks. Leaving the claim standing while the surface runs nowhere is the shape enforcement-claims-are-facts names, and iss-2608230847432286 records the class.