Privacy scan mislabels successful task as skipped (#557 bug 8)

[IBondarenko-iwg]

What happened

Child of #557 (bug 8), in src/hooks/verify/00-privacy-scan.ps1, src/runtime/Plugins/Hooks/Transitions/enter-done/script.ps1, and the runner retry loop in src/runtime/Scripts/Invoke-WorkflowProcess.ps1.

(a) Privacy scan blocks the done-transition on a framework-induced artifact. enter-done runs the verify chain, including 00-privacy-scan.ps1, whose windows_user_path pattern ([A-Za-z]:[/\\]+Users[/\\]+\w+, L21) flags absolute paths. The implementation prompt tells the agent to author an outcomes document with a "File Path" table (content/workflows/start-from-jira/prompts/09-implement-changes.md → implementation/outcomes.md template); if those paths are absolute (C:\Users\...), the scan trips. This doc is committed to the initiative branch → tracked → scanned. The $excludePatterns (L39-53) cover .bot/.control, .bot/workspace/tasks, etc., but not the product/outcomes deliverables.

Correction to the original report: the culprit is this tracked, agent-authored outcomes doc, not the framework's handoff.md — .bot/ is gitignored, so .bot/.handoffs/handoff.md is --exclude-standard'd and never scanned.

(b) A done-transition block consumes the retry budget → skipped(max-retries). When the verify hook fails, the runtime reverts the transition and the task returns to in-progress; $taskSuccess is never set, so the needs-input escalations (AuthError, post-script, outputs, merge — all gated on $taskSuccess) are bypassed. The runner just retries to attemptNumber ≥ maxRetriesPerTask and calls Invoke-TaskMarkSkipped skip_reason='max-retries' (Invoke-WorkflowProcess.ps1 ~L2078). Completion is status-only, so a task that already pushed 4 branches, opened 3 draft PRs, and moved 3 Jira stories is recorded as skipped even though its external work succeeded.

What you expected

• The outcomes/handoff templates emit repo-relative paths (preferred), and/or the privacy scan excludes framework-authored outcomes deliverables — without masking real leaks in normal product code.
• A verify-hook block on the done-transition escalates to needs-input (operator-recoverable), like the other post-task failures, instead of consuming the retry budget.
• A task whose declared external work completed is never finalized skipped — distinguish "framework finalization blocked" from "work not done".

Steps to reproduce

1. Run an implementation task that authors outcomes.md with absolute local paths and completes its external work (branches pushed, PRs opened, Jira moved).
2. task_set_status(done) triggers the enter-done verify chain → 00-privacy-scan.ps1 flags the Windows user paths → transition reverts, task back to in-progress.
3. After the retry budget, the task is finalized skipped (max-retries) despite the shipped deliverables.

Environment

OS: Windows 11
dotbot: v4.0.0
Runtime: PowerShell

Severity

medium

Logs / screenshots

hook 'enter-done' failed: Verify '00-privacy-scan.ps1' failed: 1 privacy violation(s) found
skip_reason: max-retries
skip_detail: Retry budget exhausted after 2 attempt(s)