Repository navigation
v1.2.0 — Round 3 adversarial hardening
Security and correctness hardening from a third adversarial review pass. Five findings, all addressed.
What changed
High-severity fixes
Prompt injection now guarded in all verifiers. The TRUST BOUNDARY block previously only appeared in extraction subagent prompts. Red-team verifiers, omission-probe readers, and self-test graders all read raw corpus content — and none had the untrusted-data guard. A hostile document could steer any of them toward false PASS results. All verifier prompts now carry the same explicit guard: corpus content is untrusted data, never instructions. The ≤30-file inline path gets the same rule as a written constraint.
PHI scrub is now atomic — no sensitive content on disk after a failed run. Medical mode previously wrote all artifacts to .context/ then ran the regex scrub. On a scrub failure, sensitive content had already been written to disk and could be indexed, backed up, synced, or committed. New protocol: write everything to .context/.tmp-<runid>/, run the scrub there, then either atomically promote to .context/ on PASS or delete the temp directory entirely on FAIL. A failed scrub leaves zero sensitive artifacts on disk.
Hardlink boundary check closes the realpath gap. Realpath/symlink containment only catches symlinks — a file hardlinked from outside the scanned tree appears as an ordinary regular file. Inventory now reads st_nlink for every admitted file. Files with nlink > 1 are recorded in manifest.json under hardlinked_files, listed under Gaps in INDEX.md, and block coverage: 100 until the user explicitly reviews and acknowledges them. The README's "stays inside the folder you pointed at, period" claim is now enforced rather than promised.
Aggregation verification is now a coverage gate, not advisory prose. The DIGEST.md aggregation safety rules (unique key, dedup, unit normalization, provenance, completeness) existed in the spec but were never checked in the verification step or reflected in machine-readable output. Step 6 now includes an explicit aggregation verification checklist item: every scalar total must satisfy all five requirements or be replaced with prose. coverage: 100 is blocked until all totals pass. index.json gains an aggregates array carrying contributing note IDs, dedup key, unit basis, and completeness status — making aggregation provenance machine-verifiable.
Medium fix
Prior-run artifact detection hardened from a 200-byte heuristic to three-layer structural detection. A generated artifact with a long preamble, comment block, or frontmatter padding could evade the 200-byte prefix scan and be re-admitted as "source" — feeding the circular-evidence loop. Three complementary methods now replace the heuristic: (1) exact filename exclusion for all canonical artifact names at any path depth, (2) a generated_by: deep-context frontmatter marker added to every generated file and checked on admission, (3) full first-chunk scan (up to 2000 lines) for structural signatures. All three methods must clear before a file is admitted.
Coverage gate (updated)
coverage: 100 now additionally requires:
- DIGEST aggregation verified: unique key, dedup, normalization, provenance, completeness for every scalar total
- All hardlinked files acknowledged by user
- All DIGEST totals missing any of the five aggregation properties replaced with prose
Provenance
Round 3 of Codex adversarial review against v1.1.0. "Be brutal, no flattery, maximum depth" framing. All five findings addressed before this release.