Repository navigation
Round 4 adversarial review. Five findings, all addressed — four of them about the spec overclaiming what it can actually deliver.
Medical scrub scope narrowed. The atomic temp-dir scrub previously claimed to prevent PHI from reaching filesystem journals, backup systems, and model transcripts. That's false — it only cleans .context/ files. New wording is explicit: scrub covers written artifacts only. A warning now states clearly that PHI may still exist in model transcripts and tool logs outside that directory. This is not a weaker scrub — it's the same mechanism with honest claims about what it does.
TRUST BOUNDARY downgraded to best-effort prompt-hardening. The same LLM reads both the trust-boundary instructions and the hostile corpus — there is no parser-level enforcement. A sufficiently adversarial document can still steer extraction. The prompt block reduces this risk but cannot eliminate it. README now says "prompt-hardening" not "guard." This is the correct framing for what the mechanism actually is.
Ask-miss logging fixed — own regression from v1.4.0. Ask mode was appending miss entries directly to per-file notes, which immediately invalidated the note-integrity SHA-256 hashes added in the same release. Misses now go to a separate .context/ASK_LOG.md — append-only, excluded from note hashing, never used as evidence in build or verification. Diff mode surfaces ASK_LOG counts in CHANGES.md for the next build pass to pick up. ASK_LOG.md added to filename exclusion list.
Partial-pack ask mode refuses by default. Relevance detection via keyword grep of note paths is not a sound dependency check — aliases, abbreviations, and indirect references escape it, producing exactly the confident-but-incomplete answer this tool exists to prevent. Default is now refuse with gap list shown. A narrow --partial-ok flag exists for explicit override; it caps confidence at LOW (not MEDIUM) and logs the override to ASK_LOG.md.
Hardlink inode dedup corrected. Inode tracking was being used to suppress duplicate-inode regular files from the corpus — silently dropping valid in-scope paths that share a hardlink. Inode tracking is now used only for directory-cycle detection. Two paths sharing an inode both appear in the corpus with their own notes. Out-of-root hardlinks remain unresolved scope violations that permanently block coverage: 100; user acknowledgment records the decision but does not unlock full coverage.