v1.8.14 — security hotfix

v1.8.14 — security hotfix

v1.8.14 is v1.8.13 plus one security fix (T-4485). It closes a way around v1.8.13's own T-4367 fix. Nothing else
changed. If you are on v1.8.13, upgrade.

About version numbers: this hotfix takes the number v1.8.14. The broad bleeding-edge release that was pre-released
as v1.8.14-be.1 to be.3 will ship as v1.8.15.

Fix

T-4485: git's --output option is recognised however it is written.

• What v1.8.13 missed. v1.8.13 (T-4367) treats git diff/log/show/… --output=FILE as a write. But it matched
  the option against the raw words of the command. These forms therefore still passed as reads while git wrote the
  file:
  • a quoted "--output=FILE" or '--output=FILE';
  • an escaped --out\put=;
  • a variable (o=--output=F; git diff $o);
  • a parameter default (${O:---output=F});
  • a loop variable;
  • $'…' quoting;
  • a brace expression.
• What v1.8.14 does.
  • The words are read the way bash will pass them to git: quotes removed, $'…' decoded, braces expanded.
  • A diff-family git command whose arguments contain an unresolvable $, a backtick, an unquoted glob or a brace
    expression is refused.
  • The shell write scanner flags the same words as a write, as a second line of defence.

How it was tested

• Field test: ring20-dashboard, who reported the gap, ran their probe on the fix (classification only, nothing
  executed). All --output shapes were gated, including git's abbreviated --outp=, $'…', brace forms and
  format-patch -o. Seven of the probe lines classified SAFE on v1.8.13. There were no false positives: git diff --stat, git log --oneline and git show --stat stay reads.
• Targeted suite comparison, v1.8.14 vs v1.8.13 (safe-commands, shell write scanner and boundary suites, plus the
  T-4367/T-4396/T-4408/T-4409/T-4485 files, each run alone): 0 failures attributed to the hotfix. Evidence:
  docs/reports/T-4489-hotfix.md.

Why it was released

The operator approved it ("go with v1.8.14 for the hotfix and ship it", 2026-10-20). It also meets the standing
field-evidence rule: the one fix has a positive field test from another project, and the release's own gates are
green. The decision is recorded in .context/releases/decisions.jsonl.

Upgrading

cd /path/to/your/project && .agentic-framework/bin/fw upgrade