v1.4.0 — Class-3 content grounding (admin.html FP), B4 unscoped UPDATE/DELETE warn (incl. tautology WHERE), MCP-SQL scanner hole closed
-
LIVE FP (hindsight f7df5ae9, same-day report): Class 3 flagged "claimed
a change to admin.html, but it is absent from the diff" when the agent
edited CLAUDE.md's MENTION of admin.html and said so. Class 3 grounded
claim-named files against changed PATHS only; it now also grounds on the
diff's ± content lines (the ledger's grounds() has since Phase 6), with
boundaries so site-admin.html can't ground admin.html while
public/admin.html does. Review found + fixed the col-0 deletion-marker
asymmetry ('-admin.html' failed to ground while '+admin.html' grounded). -
New B4 (WARN only, user request): UPDATE/DELETE whose WHERE is absent
OR a tautology (1=1, 0=0 OR 1=1, true, 'x'='x') — B3's constant-predicate
class applied to writes. Fires only on a complete;-terminated statement
whose head anchors UPDATE/DELETE FROM; incomplete tails, CTE heads,
comments, ON CONFLICT DO UPDATE, prose all abstain. Identifiers are
\p{L} (unquoted non-ASCII columns scope) and $n params scope. -
FN (silent-inertness): the pseudo-file — captured expressly
so MCP-applied SQL reaches the security scanners — never matched B1/B3's
\.sql$; an apply_migration CREATE TABLE with no RLS produced ZERO
findings. Matcher fixed; opening the channel exposed a block-tier FP
(read-only SELECT quoting DDL in a string literal fired B1/B3), closed at
root by blanking single-quoted literals before every SQL check — which
also fixed B4's literal-;FP and literal-"where" FN.
Adversarial review (Fable), three passes: marker asymmetry; the SELECT
block-tier FP + literal blanking; the ASCII-only identifier hole. Each
CHANGES REQUIRED → fixed at root → re-verified → APPROVED for the batch.
Self-check 726 → 763; red-team 14/14; corpus unchanged (17/23).
Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Full symptom → root-cause → fix → regression-test in FIXES.md (v1.4.0).