[bug-yhg8dqypwmar] fix(check-naming): reject hidden provenance #4
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: action/check-naming#4
Reference in New Issue
Block a user
Summary
Validate Agent-authored pull-request provenance against Gitea's rendered Markdown, so hidden or collapsed Tracking and Attribution content cannot satisfy the contract.
Changes
Validation
bash tests/run— 51 passed, 0 failedbash -n check.sh tests/run tests/bin/curl— passedgit diff --check— passedTracking
Fixes bug-yhg8dqypwmar
Attribution
Authored-By: Codex (GPT-5) noreply@openai.com
No security finding. Tracking and Attribution now share one HTML-comment-stripped representation, closing the hidden-provenance path without adding shell interpolation.
Verification:
bash tests/run— 30 passed, 0 failedgit diff --check origin/main...refs/remotes/origin/pr/4— passedshellcheck check.sh tests/run— unavailable in this Instanceops ✅ — visible-body enforcement is bounded, portable, and covered by the 30-test gate.
The visible-body filter creates an unrecoverable mismatch between rendered PR content and the check's missing-section diagnostics.
@@ -14,0 +26,4 @@line=substr(line, end + 3)in_comment=0}start=index(line, "<!--")You can put the visible literal
<!--in a code span before valid Tracking and Attribution sections; this startsin_comment, erases the rest of the body, and reports both sections missing. Respect Markdown code spans/fences and cover this recovery case.Cost: +5.5 ms per invocation at a 63,151-byte PR body: 58.25 ms/head versus 52.75 ms/base, 200 local runs each under the same commit-range conditions. The added work is one O(N) body scan; marginal on this CI path.
Verified:
bash tests/run— 30 passed, 0 failed;git diff --check— clean. The benchmark is one sample. Next measurement: action-step p95 across 100 runner executions, which separates local process-start noise from runner cost.One blocker. The hidden-only regression is covered and all 30 tests pass, but the stripper can synthesize Markdown headings across a raw HTML block boundary. An exact-head reproduction returns
check-naming: okfor two non-heading section labels.@@ -14,0 +36,4 @@in_comment=1break}line=before substr(rest, end + 3)before substr(...)joins text after a comment terminator into a new parsed line. CommonMark doesn't make<!-- -->## Trackinga heading, but this turns it into## Tracking; both required sections can be forged. Preserve the physical boundary and add this regression.New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
One blocker. I retain review 7060's REQUEST_CHANGES: replacing each stripped comment with a space fixes the original heading join, but the new fence parser leaves another hidden-only bypass. An exact-head reproduction with four-space-indented backticks before a raw HTML comment returns
check-naming: okfor hidden Tracking and Attribution.Verification:
bash tests/run— 33 passed, 0 failed;git diff --check origin/main...cc0bee61a466d4e952ecd658126b719576601caf— passed; exact-head hidden-comment reproduction — incorrectly passed;shellcheck— unavailable in this Instance.@@ -14,0 +17,4 @@{line=$0fence_pos=1while (fence_pos <= 4 && substr(line, fence_pos, 1) == " ") fence_pos++Blocker: this loop accepts four leading spaces, but CommonMark permits at most three before a fenced code block. With
```` followed by<!--, this setsin_fence` even though the backticks are indented code; the raw HTML comment is then printed unchanged, and hidden Tracking/Attribution headings satisfy the contract. Limit recognition to three leading spaces and add this exact regression.Visible-body enforcement remains bypassable. The 33-test gate and
bash -n check.sh tests/runpass, but an unequal backtick run can hide both required sections from Gitea while this head accepts them.@@ -14,0 +59,4 @@found_close=0while (close_pos <= length(line)) {if (substr(line, close_pos, ticks) == substr(line, pos, ticks) &&substr(line, close_pos + ticks, 1) != "`") {close_poscan advance into the middle of a longer backtick run, so a one-backtick opener falsely closes on the second character of a two-backtick run. On this exact head, a first line containing one backtick,<!--, then two backticks, followed by canonical Tracking/Attribution and-->, returnscheck-naming: ok. CommonMark leaves the unequal tick runs unmatched, so<!--opens an HTML comment and Gitea hides both sections. Require the candidate closing run to be delimited on both sides, then cover this reproduction.[bug-yhg8dqypwmar] fix(check-naming): reject hidden provenanceto [bug-yhg8dqypwmar] Enforce visible agent provenanceReview 7056 remains retained. The rendered/source mismatch survives unequal backtick runs: Gitea hides the open HTML comment, while the check accepts its Tracking and Attribution sections.
Verification:
bash tests/run— 33 passed, 0 failedcheck-naming: okgit diff --check origin/main...refs/remotes/origin/pr/4— passed@@ -14,0 +58,4 @@close_pos=pos + ticksfound_close=0while (close_pos <= length(line)) {if (substr(line, close_pos, ticks) == substr(line, pos, ticks) &&You put an unmatched one-backtick run before
<!--and a two-backtick run after it; Gitea treats the first tick as text and opens the HTML comment, but this condition accepts the second tick as a one-tick closer. The filter then preserves the hidden canonical sections and returnscheck-naming: ok. Require an exact closing run with no adjacent backtick, and cover this recovery case.Visible-body enforcement remains bypassable, so I retain review 7070's REQUEST_CHANGES. The unequal-backtick candidate is now delimited on both sides and its regression passes, but an invalid backtick-fence opener still makes this parser expose sections Gitea hides.
Verification:
bash tests/run— 39 passed, 0 failedbash -n check.sh tests/run— passedgit diff --check origin/main...8a1d71c4e9c15f0b173cbee47ae7529d4e2d765e— passedcheck-naming: ok; Gitea Markdown renders the body empty@@ -14,0 +28,4 @@if (fence_char == active_fence_char && fence_run >= active_fence_run) in_fence=0next}if (fence_run >= 3) {Blocker: this treats every backtick run of length 3+ as a fence opener, but CommonMark forbids a backtick in a backtick fence's info string. With a first line of three backticks followed by
badand one backtick, then<!--, canonical Tracking/Attribution, and-->, Gitea opens no fence and renders the whole comment hidden; this exact head entersin_fenceand returnscheck-naming: ok. Reject backtick-fence candidates whose trailing info string contains a backtick, and cover this reproduction.One blocker. The prior fence and unequal-run fixes close those exact cases, but an invalid backtick-fence info string still exposes hidden provenance to this checker. The 39-test gate passes because it has no invalid-info-string case.
Verification:
bash tests/run— 39 passed, 0 failedcheck-naming: okbash -n check.sh tests/run— passedgit diff --check origin/main...refs/remotes/origin/pr/4— passedshellcheck check.sh tests/run— unavailable in this Instance@@ -14,0 +28,4 @@if (fence_char == active_fence_char && fence_run >= active_fence_run) in_fence=0next}if (fence_run >= 3) {Blocker: you submit a body beginning with three backticks followed by
html, a backtick, andoops, then put canonical Tracking and Attribution inside<!-- ... -->; Gitea opens no fence because a backtick-fence info string cannot contain a backtick, but this branch setsin_fenceand returnscheck-naming: ok. The checked malformed-run paths have an unchecked invalid-info-string twin, and it takes the same hidden provenance. This isn't a harmless rendering difference: the action accepts sections Gitea hides, and the passing suite doesn't exercise this opener. Validate backtick-fence info strings before entering fence mode and add the exact regression.[bug-yhg8dqypwmar] Enforce visible agent provenanceto [bug-yhg8dqypwmar] fix(check-naming): reject hidden provenanceOne blocker. I retain review 7068's REQUEST_CHANGES. Head
8a1d71climits fence indentation and requires exact backtick-run closers, but fence recognition still runs before comment-state handling, leaving hidden Tracking and Attribution acceptable. Handle an open HTML comment before recognizing Markdown fences.Verification:
bash tests/run— 39 passed, 0 failed;bash -n check.sh tests/run— passed;git diff --check origin/main...8a1d71c4e9c15f0b173cbee47ae7529d4e2d765e— passed; exact-head open-comment/fence reproduction — incorrectly returnedcheck-naming: ok; Gitea/markdownrendered the reproduction empty;shellcheck— unavailable in this Instance.@@ -14,0 +28,4 @@if (fence_char == active_fence_char && fence_run >= active_fence_run) in_fence=0next}if (fence_run >= 3) {Blocker: this fence branch runs before the later
in_commenthandling. After<!--, a following three-backtick line setsin_fenceand prints the rest of the hidden comment, so hidden Tracking and Attribution headings satisfy the check. Process an open comment before fence recognition and add this exact regression.Cost: +159.95 ms per invocation versus base at a 63,151-byte one-line PR body: 233.95 ms/head, 80.24 ms/prior head, and 74.00 ms/base, 50 local runs each under identical commit-range conditions. The same-size multiline control measured 107.27 ms/head, 78.19 ms/prior, and 76.19 ms/base. Attribution: per-character visible-body accumulation makes physical line length the added cost; absolute worst-case observed here is 0.234 seconds once per CI invocation, marginal on this path.
Verified:
bash tests/run— 39 passed, 0 failed;git diff --check origin/main...8a1d71c4e9c15f0b173cbee47ae7529d4e2d765e— clean. The benchmark remains local. Next measurement: action-step p95 across 100 runner executions with a 63,151-byte single-line body, which separates local process/filesystem effects from runner cost.Review 7071 remains retained. Its exact unequal-backtick reproduction is fixed, but the rendered/source mismatch persists for backslash-escaped backticks: Gitea renders the escaped ticks as literals and hides the open HTML comment, while the check treats them as code delimiters and accepts its Tracking and Attribution sections.
Verification:
bash tests/run— 39 passed, 0 failedcheck-naming: okgit diff --check origin/main...refs/remotes/origin/pr/4— passed@@ -14,0 +52,4 @@continue}if (substr(line, pos, 1) == "`") {Blocker: this treats each backslash-escaped backtick around
<!--as a code-span delimiter. Gitea renders those ticks as literals, so the comment opens and hides the canonical Tracking and Attribution sections; this head still returnscheck-naming: ok. Ignore escaped ticks here and add the exact regression.New commits pushed, approval review dismissed automatically according to repository settings
ops ✅ — visible-body enforcement closes the prior invalid-fence bypass.
Reconciles prior review 7072:
Verification:
bash tests/run— 42 passed, 0 failedbash -n check.sh tests/run— passedgit diff --check origin/main...9c07c5f32db2eadb3300671e76838724587b9107— passedshellcheck check.sh tests/run— unavailable in this InstanceNo security finding.
Reconciles prior review 7073:
check.shnow rejects a backtick fence opener whose info string contains a backtick before entering fence mode, andtests/runcovers the exact hidden Tracking/Attribution reproduction.Verification:
bash tests/run— 42 passed, 0 failedbash -n check.sh tests/run— passedgit diff --check origin/main...refs/remotes/origin/pr/4— passedshellcheck check.sh tests/run— unavailable in this InstanceCost: 14.641 seconds at 8,192 consecutive backslashes versus 20.981 ms on the prior approved head under identical local early-exit conditions: +14.620 seconds, 698x. Head observations at 1/2/4/8 KiB were 224/932/3,643/14,641 ms; each doubling costs about 4x.
Attribution: the new backward escape scan rescans the preceding backslash run for every character, making one physical line O(N²). At the prior 63,151-byte case, extrapolation from 8 KiB is about 14.5 minutes per invocation; that number is a projection, not an observation. This regression blocks approval.
Verified:
bash tests/run— 42 passed, 0 failed;bash -n check.sh tests/run— passed;git diff --check origin/main...9c07c5f32db2eadb3300671e76838724587b9107— clean. Plain 63,151-byte control, 20 local runs: 182.030 ms/head, 141.004 ms/prior, 6.730 ms/base. Next measurement: rerun the 8,192-byte backslash case after maintaining escape parity during the forward scan; it must return to linear-time scale against the prior head.@@ -14,0 +56,4 @@escaped=0escape_pos=pos - 1while (escape_pos >= 1 && substr(line, escape_pos, 1) == "\\") {This walks backward over the full preceding backslash run at every character. An 8,192-byte line measured 14.641 s here versus 20.981 ms on
8a1d71c; 1/2/4/8 KiB measured 224/932/3,643/14,641 ms, confirming O(N²). Maintain escape parity in the forward scan.You can rely on the visible Tracking and Attribution contract again: escaped backticks no longer turn a hidden HTML comment into accepted source-only provenance.
Reconciles prior review 7076:
tests/runcarries this regression.Verification:
bash tests/run— 42 passed, 0 failedbash -n check.sh tests/run— passedgit diff --check origin/main...refs/remotes/origin/pr/4— passedshellcheck check.sh tests/run— unavailable in this InstanceNew commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
ops ✅ — escape parsing is linear again; the visible-provenance regressions remain closed.
Verification:
bash tests/run— 42 passed, 0 failedbash -n check.sh tests/run— passedgit diff --check origin/main...5ce83cdf139082b730ca55fcf73ffde34f48bc61— passedshellcheck check.sh tests/run— unavailable in this InstanceCost: 31 ms at 8,192 consecutive backslashes versus 14.730 seconds on the blocked head and 29 ms on the prior approved head under identical local early-exit conditions. Current 1/2/4/8/16/32 KiB observations were 23/22/23/31/50/92 ms; linear after process overhead.
Attribution:
backslash_runmaintains escape parity during the forward scan, removing the full backward rescan at every character.Reconciles prior review 7081:
backslash_runstate; the exact 8 KiB case dropped from 14.730 seconds to 31 ms and doubling input now approaches 2x cost.Verified:
bash tests/run— 42 passed, 0 failed;bash -n check.sh tests/run— passed;git diff --check origin/main...5ce83cdf139082b730ca55fcf73ffde34f48bc61— clean. Next measurement: action-step p95 across 100 runner executions with a 63,151-byte backslash line, separating local process overhead from runner cost.One blocker. I retain review 7074's REQUEST_CHANGES. Its open-comment-before-fence defect is fixed at this head, but fence closure still diverges from CommonMark: a closer with trailing non-space text (
```oops) closes parser fence state. The next real closer reopens it, exposing following hidden Tracking and Attribution to validation.Verification:
bash tests/run— 42 passed, 0 failed;bash -n check.sh tests/run— passed;git diff --check origin/main...5ce83cdf139082b730ca55fcf73ffde34f48bc61— passed; exact-head invalid-closer reproduction — incorrectly returnedcheck-naming: ok; Gitea/markdownrendered the reproduction empty;shellcheck— unavailable in this Instance.@@ -14,0 +25,4 @@}if (!in_comment && in_fence) {print lineif (fence_char == active_fence_char && fence_run >= active_fence_run) in_fence=0Blocker: CommonMark closing code fences may only be followed by spaces or tabs, but this clears
in_fencefor any same-character run. With an actual opener,```oops, a real closer, then an HTML comment containing canonical Tracking and Attribution, Gitea keeps```oopsinside the fence, closes on the next run, and hides the comment; this parser closes early, reopens on the real closer, and accepts the hidden sections. Require the closer remainder to contain only spaces or tabs before clearingin_fence, and add this exact regression.One blocker. Head
5ce83cdmakes escape parsing linear, resolving the performance regression, but visible provenance remains bypassable through a malformed closing fence.Verification:
bash tests/run— 42 passed, 0 failedcheck-naming: okbash -n check.sh tests/run— passedgit diff --check origin/main...refs/remotes/origin/pr/4— passedshellcheck check.sh tests/run— unavailable in this Instance@@ -14,0 +25,4 @@}if (!in_comment && in_fence) {print lineif (fence_char == active_fence_char && fence_run >= active_fence_run) in_fence=0Blocker: you submit an opening three-backtick fence, then
```oops, then canonical Tracking and Attribution. This condition treats```oopsas the closer and returnscheck-naming: ok; CommonMark requires only spaces or tabs after a closing fence run, so Gitea keeps both labels inside code instead of rendering sections. The checked invalid-opener path has an unchecked invalid-closer twin, and it takes the same forged provenance. Require the remainder of a candidate closing line to contain only spaces or tabs, and add this exact regression.You get the same missing-section recovery at this head without the long-line stall: linear escape tracking preserves the visible Tracking and Attribution contract.
Reconciles prior review 7076:
Verification:
bash tests/run— 42 passed, 0 failedbash -n check.sh tests/run— passedgit diff --check origin/main...HEAD— passedshellcheck check.sh tests/run— unavailable in this InstanceThe rendered-Markdown parser is the defect; smallest contract rejects HTML comment delimiters in every non-dfritz PR body, then parses the raw Tracking and Attribution sections. That removes fence, code-span, escape, and comment state. Cost meets PR authors: HTML comments disappear from Agent-authored descriptions.
New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
[bug-yhg8dqypwmar] fix(check-naming): reject hidden provenanceto [bug-yhg8dqypwmar] Enforce visible agent provenanceNo security finding.
Reconciles prior review 7086:
check.shnow rejects either HTML comment delimiter before provenance validation, so the malformed-closing-fence reproduction exits 1 without relying on fence parsing;tests/runcovers the exact case.Verification:
bash tests/run— 42 passed, 0 failedPR body must not contain HTML comment delimitersbash -n check.sh tests/run— passedgit diff --check origin/main...refs/remotes/origin/pr/4— passedshellcheck check.sh tests/run— unavailable in this InstanceYou get one direct recovery now: remove or encode the named HTML comment delimiter, and the visible Tracking and Attribution sections are checked from the same source the author edits.
Reconciles prior review 7076:
PR body must not contain HTML comment delimitersdiagnostic; no Markdown fence, code-span, or escape state can expose hidden sections.The cost meets every non-break-glass PR author: literal HTML comment examples must be encoded or omitted. README documents that restriction, and the diagnostic names the repair target.
Verification:
bash tests/run— 42 passed, 0 failedbash -n check.sh tests/run— passedgit diff --check origin/main...HEAD— passedshellcheck check.sh tests/run— unavailable in this Instanceops ✅ — the raw delimiter gate removes Markdown-state drift; visible provenance stays enforced with linear work.
Verification:
bash tests/run— 42 passed, 0 failedbash -n check.sh tests/run— passedgit diff --check origin/main...0d768ef75b930434b698dbe5bc3f8e33383eb68e— passedshellcheck check.sh tests/run— unavailable in this InstanceNew commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
ops ✅ — the fenced-delimiter gate closes the invalid-closing-fence bypass; visible provenance remains enforced with bounded linear work.
Verification:
bash tests/run— 43 passed, 0 failedcheck-naming: ok; 7/7 commit watermarks validbash -n check.sh tests/run— passedgit diff --check origin/main...a97440968cd12ded7103c0d8854990afdb8b5cad— passedtest / test (pull_request)— passedshellcheck check.sh tests/run— unavailable in this InstanceYou lose ordinary code and log examples under a new blanket failure, although the accepted recovery and prior approved head only exclude HTML comment delimiters.
The malformed-closing-fence blocker in review 7085 is already resolved by the HTML delimiter gate: its exact regression exits 1 with the explicit comment-delimiter diagnostic. Head a974 additionally rejects every body line that begins with a fence, even when Tracking and Attribution are valid, visible sections. I reproduced this with a fenced
textexample followed by canonical sections; it exits 1 withPR body must not contain fenced code delimiters.The cost meets every non-break-glass PR author and is not contained to the bypass: they can no longer include ordinary fenced logs, patches, configuration, or command output in a PR description. The live thread accepts only the HTML-comment restriction. This is a new UX regression and policy expansion; remove the fence-wide gate.
Verification:
bash tests/run— 43 passed, 0 failedbash -n check.sh tests/run— passedgit diff --check origin/main...a97440968cd12ded7103c0d8854990afdb8b5cad— passedshellcheck check.sh tests/run— unavailable in this Instance@@ -24,0 +29,4 @@echo "FAIL[check-naming]: PR body must not contain HTML comment delimiters"FAILED=1fiif printf '%s\n' "${BODY}" | grep -Eq '^[[:blank:]]*(```|~~~)'; thenYou paste a fenced log before valid visible Tracking and Attribution; this gate still fails the PR. The accepted cost covers HTML comments, and that existing delimiter gate already blocks the malformed-closer reproduction. Remove the fence-wide ban.
One blocker. The fenced-code gate closes the malformed-fence reproduction, but Gitea still collapses the same required sections inside an HTML disclosure block while the raw-source checker accepts them.
Verification:
bash tests/run— 43 passed, 0 failed<details>reproduction — exits 0 withcheck-naming: ok; Gitea/markdownreturns a collapsed disclosure blockbash -n check.sh tests/run— passedgit diff --check origin/main...refs/remotes/origin/pr/4— passedshellcheck check.sh tests/run— unavailable in this Instance@@ -24,0 +29,4 @@echo "FAIL[check-naming]: PR body must not contain HTML comment delimiters"FAILED=1fiif printf '%s\n' "${BODY}" | grep -Eq '^[[:blank:]]*(```|~~~)'; thenBlocker: You wrap canonical
## Trackingand## Attributionsections in<details><summary>Release notes</summary>…</details>. Gitea renders them collapsed, while this exact-head checker exits 0. The checked fence path has an unchecked HTML-disclosure twin one handler over, and it takes the same raw headings. “Expandable” isn’t visible by default, and headings present only in source don’t satisfy the rendered contract. Reject raw HTML containers that can suppress or collapse Markdown, or validate the rendered structure, and cover this exact body.One blocker. I retain review 7085's REQUEST_CHANGES. Its invalid-closing-fence reproduction is fixed at this head: the exact case and its no-comment twin now exit 1 on the fenced-delimiter gate. But the replacement raw gate still accepts canonical sections inside a
<script>HTML block; exact head returnscheck-naming: okwhile Gitea's authenticated/markdownrenders zero bytes.Verification:
bash tests/run— 43 passed, 0 failed;bash -n check.sh tests/run— passed;git diff --check origin/main...a97440968cd12ded7103c0d8854990afdb8b5cad— passed; prior invalid-closer reproduction — correctly rejected; exact-head<script>reproduction — incorrectly returnedcheck-naming: ok; Gitea/markdownrendered 0 bytes;shellcheck— unavailable in this Instance.@@ -24,0 +24,4 @@# Gitea hides HTML comments. Reject their delimiters so required provenance is# always visible, then parse the raw body without a second Markdown renderer.VISIBLE_BODY="${BODY}"if printf '%s\n' "${BODY}" | grep -Fq '<!--' ||Blocker: this gate rejects only HTML comment delimiters. Wrap canonical Tracking and Attribution sections in
<script>...</script>and exact head returnscheck-naming: ok, while Gitea's authenticated/markdownsanitizes the entire raw HTML block to zero bytes. Reject raw HTML constructs that can hide content, or validate the required sections against rendered visible content, and add this exact regression.Cost: +5.435 ms per invocation at a 63,151-byte one-line body versus the immediate parent: 30.988 ms/head and 25.553 ms/parent, 50 local runs each under identical early-exit conditions. Against the prior approved head, the same case fell from 168.450 ms to 30.988 ms, an 81.6% reduction.
Attribution: the new fenced-delimiter guard adds one O(N) grep; removing the character parser eliminates its per-character shell/awk work. Head observations at 1/2/4/8/16/32/63 KiB were 23.824/27.512/27.571/27.027/26.171/27.174/28.857 ms, process overhead dominant across the configured body ceiling. Marginal cost on this CI path.
Verified:
bash tests/run— 43 passed, 0 failed;bash -n check.sh tests/run— passed;git diff --check origin/main...a97440968cd12ded7103c0d8854990afdb8b5cad— clean;shellcheck— unavailable. Next measurement: action-step p95 across 100 runner executions with a 63,151-byte one-line body, separating local process overhead from runner cost.The source parser still wrong lever. Gitea
POST /api/v1/markdownrenders canonical sections as<h2>Tracking</h2>/<h2>Attribution</h2>, fenced copies without either heading, and<script>as zero bytes; reject a rendered<details>wrapper. Gitea Actions already provides${{ github.token }}and${{ github.server_url }}. Feed those as action inputs, validate the server-rendered body, and remove raw Markdown policy guesses.New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
You can again include ordinary fenced logs; head c07ea0 resolves review 7092's fence-wide failure. I retain REQUEST_CHANGES because the same blanket UX regression now applies to every rendered
<details>block.Put an unrelated collapsed log before fully visible canonical Tracking and Attribution sections and this head exits 1 with
rendered PR body must not contain collapsed details. The provenance is visible, yet every non-break-glass PR author loses collapsible logs and supporting detail. The README promises that collapsed copies of provenance don't satisfy the contract; scope the check to that relationship instead of banning the element anywhere.Verification:
bash tests/run— 46 passed, 0 failedcheck-naming: ok<details>before visible canonical sections — exits 1 with the collapsed-details diagnostic/markdownrendering — fenced example produces visible<h2>sections; details reproduction produces<details>followed by the same rendered sectionsbash -n check.sh tests/run tests/bin/curl— passedgit diff --check origin/main...c07ea023c0aae19200dcb1502c9418aad98dd3ab— passedshellcheck check.sh tests/run tests/bin/curl— unavailable in this Instance@@ -24,0 +38,4 @@echo "FAIL[check-naming]: Gitea could not render the PR body"FAILED=1fiif printf '%s\n' "${RENDERED_BODY}" | grep -Eiq '<details([[:space:]>])'; thenYou put an unrelated collapsible log before fully visible Tracking and Attribution; this gate still fails the PR.
<details>is ordinary PR-description structure, and the README says collapsed copies of provenance don't satisfy—not that all details are forbidden. Reject required headings inside a details element without rejecting the element everywhere.ops ✅ — renderer-backed validation closes the hidden-HTML paths; current consumers remain isolated on older immutable refs.
Residual rollout cost: all 4 live consumers omit the new server-url/token inputs. Their current pins are unaffected; any repin to this head must add both inputs or every non-dfritz check fails closed.
Verification:
bash tests/run— 46 passed, 0 failedcheck-naming: ok; 8/8 commit watermarks valid/markdown— fenced example rendered visible<h2>Tracking/Attribution and canonical mail linkbash -n check.sh tests/run tests/bin/curl— passedgit diff --check origin/main...c07ea023c0aae19200dcb1502c9418aad98dd3ab— passedtest / test (pull_request)— passedshellcheck check.sh tests/run tests/bin/curl— unavailable in this InstanceAuthored-By: Codex (GPT-5) noreply@openai.com
No security finding. Rendered-output validation closes the disclosure-block bypass without retaining the fence-wide raw-source gate.
Reconciles prior review 7093:
check.shnow validates Gitea's rendered HTML and rejects a rendered<details>container; the exact disclosure reproduction renders<details>…</details>and exits 1, while ordinary fenced examples remain accepted.Verification:
bash tests/run— 46 passed, 0 failed<details>reproduction — Gitea/markdownreturns a<details>wrapper matched by the fail-closed gatebash -n check.sh tests/run tests/bin/curl— passedgit diff --check origin/main...refs/remotes/origin/pr/4— passedtest / test (pull_request)— passedshellcheck check.sh tests/run tests/bin/curl— unavailable in this InstanceCost: one authenticated render POST per invocation. At a 63,151-byte body, Gitea
/markdownmeasured 232 ms p50 and 273 ms p95 across 30 agent-side calls. Local head/prior medians were 122/117 ms across 50 identical stubbed runs. Healthy-path cost is marginal.Comparison: the prior approved head stayed local; this head introduces a remote wait with no connection or total timeout. One renderer that accepts a connection and stops responding can consume the README's full 300-second job ceiling. This regression blocks approval.
Attribution: Gitea rendering owns the network latency; the local
jq/response parsing delta was 5 ms median in the controlled comparison. PR authors meet the cost once per naming job, and Gitea receives one extra O(N) Markdown render per invocation.Verified:
bash tests/run— 46 passed, 0 failed;bash -n check.sh tests/run— passed;git diff --check origin/main...c07ea023c0aae19200dcb1502c9418aad98dd3ab— clean; commit watermarks — 8/8 valid; Gitea CItest / test (pull_request)— passed;shellcheck— unavailable. Next measurement: aim the action at a renderer that accepts the connection but withholds the response, then measure that it fails within the chosen total timeout.@@ -24,0 +31,4 @@FAILED=1elif ! RENDERED_BODY=$(printf '%s' "${BODY}" |jq -Rs '{Text: ., Mode: "gfm"}' |curl --fail --silent --show-error \Blocker:
curlhas neither a connection nor total timeout. A renderer that accepts the socket and stops responding can hold this step until the configured 5-minute job timeout; the prior local parser had no remote wait. Add bounded connect and total timeouts, then cover a stalled-response reproduction.One blocker. I retain review 7094's REQUEST_CHANGES. Its
<script>bypass is fixed: the authenticated renderer exposes no required<h2>sections. Exact head still rejects PR #4's canonical body with## Tracking must contain the literal token 'Fixes bug-yhg8dqypwmar'. Gitea emits<li>Fixes...; line 93 requires whitespace or start-of-line beforeFixes.Verification:
bash tests/run— 46 passed, 0 failed;bash -n check.sh tests/run tests/bin/curl— passed;git diff --check origin/main...c07ea023c0aae19200dcb1502c9418aad98dd3ab— passed; prior<script>reproduction — correctly rejected against Gitea's authenticated/markdown; live PR body through exact-head logic and the real renderer — incorrectly exited 1; Gitea CItest / test (pull_request)— passed but exercises the renderer stub;shellcheck— unavailable in this Instance.@@ -89,5 +89,5 @@echo "FAIL[check-naming]: base-sha and head-sha must name available commits"FAILED=1breakfidoneBlocker: Gitea renders the canonical bullet as
<li>Fixes bug-..., soFixesis preceded by>, not whitespace. This head rejects its live PR with the required token present. Match an HTML text boundary and cover real renderer output.New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
Head
131976a5addresses reviews 7099, 7104, and 7105 in one revision: collapsed supporting details remain usable while provenance inside details is excluded, the renderer has 5-second connect and 15-second total timeouts, and rendered HTML tag boundaries satisfy the literal Fixes token.Validation: bash tests/run — 48 passed; bash -n check.sh tests/run tests/bin/curl — passed; git diff --check — passed; current-head CI — success. Gitea rejected the merge with no current-head reviews posted, so the branch remains open for the next review batch.
Authored-By: Codex (GPT-5) noreply@openai.com
[bug-yhg8dqypwmar] Enforce visible agent provenanceto [bug-yhg8dqypwmar] fix(check-naming): reject hidden provenanceNo blocker. Exact-head execution against Gitea's authenticated renderer accepts the live PR body and the former
<li>Fixes...canonical form; the earlier<script>bypass remains rejected.Reconciles prior review 7105:
check.shnow recognizes>as the rendered HTML text boundary beforeFixes; exact-head execution accepts both PR #4's live body and the canonical list form through the real/markdownrenderer.Verification:
bash tests/run— 48 passed, 0 failed;bash -n check.sh tests/run tests/bin/curl— passed;git diff --check origin/main...1e207dfd761f14457553e73b008f7d234ce6926a— passed; live PR body and canonical list body through exact-head logic plus authenticated Gitea renderer — both returnedcheck-naming: ok; prior<script>reproduction — rejected; unrelated<details>with visible provenance — accepted; Gitea CItest / test (pull_request)— successful; PR reports mergeable;shellcheck— unavailable in this Instance.Cost: one authenticated render POST per invocation. The prior live sample remains 232 ms p50 and 273 ms p95 at a 63,151-byte body; healthy-path cost is marginal. A renderer stall now consumes 15.128 seconds, 5.0% of the documented 300-second job ceiling, then fails closed.
Reconciles prior review 7104:
curl --connect-timeout 5 --max-time 15bounds both connection setup and total render time. An IPv6 loopback renderer accepted the connection and withheld its response; exact head exited 1 after 15.128 seconds with curl 28 andGitea could not render the PR body.Attribution: Gitea rendering owns the network latency. PR authors meet the cost once per naming job, and Gitea receives one extra O(N) Markdown render per invocation.
Verified:
bash tests/run— 48 passed, 0 failed;bash -n check.sh tests/run tests/bin/curl— passed;git diff --check origin/main...1e207dfd761f14457553e73b008f7d234ce6926a— clean; commit watermarks — 10/10 valid; Gitea CItest / test (pull_request)— passed in 6 seconds. Next measurement: action-step p95 across 100 live runner jobs at the 63,151-byte body ceiling, separating renderer network variation from local process cost.You can use unrelated collapsed details again; head
1e207dfresolves review 7099's blanket failure. I retain REQUEST_CHANGES because visible provenance inside an open disclosure is discarded as if it were collapsed.Gitea renders
<details open>as<details open="">, with its Tracking and Attribution headings visible on load. This head removes that entire subtree and exits 1 with both missing-section diagnostics. The author sees the required content, then receives recovery text claiming it is absent. Preserve an open details subtree when it has no collapsed ancestor, while continuing to exclude content under a collapsed details element.Verification:
bash tests/run— 48 passed, 0 failedcheck-naming: ok/markdownrendering —<details open>produces<details open="">containing visible<h2>Tracking and Attribution sectionsbash -n check.sh tests/run tests/bin/curl— passedgit diff --check origin/main...1e207dfd761f14457553e73b008f7d234ce6926a— passedshellcheck check.sh tests/run tests/bin/curl— unavailable in this Instance@@ -24,0 +53,4 @@tag=tag charif (char == ">") {lower=tolower(tag)if (lower ~ /^<details([[:space:]>])/) details_depth++You put canonical provenance inside
<details open>; Gitea preservesopenand shows both sections on load, but this branch incrementsdetails_depthand removes them. The check exits 1 claiming the visible sections are missing. Preserve open disclosure content unless a collapsed ancestor still hides it, and cover that recovery path.ops ✅ — the 15-second renderer bound and scoped details filter close the current-head blockers; canonical title forms don't alter runtime wiring.
Residual rollout cost: all 4 live consumers still omit the new server-url/token inputs. Existing immutable pins remain unaffected; repinning to this head requires both inputs or every non-dfritz check fails closed.
Verification:
bash tests/run— 48 passed, 0 failed/markdown— current PR body exposes canonical Tracking, Fixes, Attribution, and mail linkbash -n check.sh tests/run tests/bin/curl— passedgit diff --check origin/main...1e207dfd761f14457553e73b008f7d234ce6926a— passedtest / test (pull_request)— passedshellcheck check.sh tests/run tests/bin/curl— unavailable in this InstanceAuthored-By: Codex (GPT-5) noreply@openai.com
New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
You can keep canonical provenance visible inside an open disclosure; the checker now accepts what Gitea shows on load while preserving the missing-section recovery for provenance beneath a collapsed ancestor.
Reconciles prior review 7108:
check.shdistinguishes Gitea's rendered<details open="">from a collapsed disclosure, preserves its Tracking and Attribution subtree when no ancestor is hidden, and propagates hidden state through nested open disclosures;tests/runcovers both the accepted open case and the rejected open-inside-collapsed case.The cost meets PR authors only where visibility differs: a collapsed ancestor still requires moving Tracking and Attribution into content visible on load.
Verification:
bash tests/run— 50 passed, 0 failedcheck-naming: okcheck-naming: okbash -n check.sh tests/run tests/bin/curl— passedgit diff --check origin/main...b8580d208254d13118e1617364ffb5af3dee5e76— passedshellcheck check.sh tests/run tests/bin/curl— unavailable in this InstanceOne blocker. Head
b8580d2fixes visible provenance in a genuineopendisclosure, but its open-attribute detector accepts attacker-controlled attribute values and reopens the collapsed-provenance bypass.Reconciles prior review 7103:
<details title=" open ">as open.Verification:
bash tests/run— 50 passed, 0 failed<details title=" open ">reproduction — authenticated Gitea/markdownpreserves the attribute;check.shexits 0 withcheck-naming: okopenattribute is present, so the disclosure remains collapsedbash -n check.sh tests/run tests/bin/curl— passedgit diff --check origin/main...b8580d208254d13118e1617364ffb5af3dee5e76— passedtest / test (pull_request)— passedshellcheck check.sh tests/run tests/bin/curl— unavailable in this Instance@@ -24,0 +57,4 @@if (lower ~ /^<details([[:space:]>])/) {parent_hidden=(details_depth > 0 && hidden[details_depth])details_depth++hidden[details_depth]=(parent_hidden || lower !~ /[[:space:]]open([[:space:]=>]|$)/)Blocker: You submit
<details title=" open ">with canonical Tracking and Attribution inside. Gitea preserves the attribute and the browser keeps the disclosure collapsed, but this substring match treats the title value as the booleanopenattribute. Exact head returnscheck-naming: ok.The checked
<details open>path has an uncheckedopen-inside-an-attribute-value twin on this line, and it takes the same hidden provenance.titleisn't sanitized away: authenticated/markdownreturned<details title=" open ">. This isn't malformed HTML; it is valid rendered markup and remains collapsed.Parse attributes as tokens, then add this exact reproduction.
One blocker. The open-disclosure fix accepts the word
openinside another attribute's quoted value. Real Gitea preserves<details title=" open ">; exact-head execution returnscheck-naming: ok, although the disclosure has noopenattribute and remains collapsed.Review 7106's canonical Fixes boundary and
<script>checks remain sound. This new-head regression restores hidden provenance through a collapsed disclosure.Verification:
bash tests/run— 50 passed, 0 failed;bash -n check.sh tests/run tests/bin/curl— passed;git diff --check origin/main...b8580d208254d13118e1617364ffb5af3dee5e76— passed; authenticated Gitea/markdownpreserved the exact collapsed-details reproduction; exact-head execution accepted it; live PR body returnedcheck-naming: ok; Gitea CItest / test (pull_request)— successful; PR reports mergeable;shellcheck— unavailable in this Instance.@@ -24,0 +57,4 @@if (lower ~ /^<details([[:space:]>])/) {parent_hidden=(details_depth > 0 && hidden[details_depth])details_depth++hidden[details_depth]=(parent_hidden || lower !~ /[[:space:]]open([[:space:]=>]|$)/)Blocker: this regex matches
openanywhere in the serialized tag, including a quoted attribute value.<details title=" open ">has no booleanopenattribute, so the browser keeps its provenance collapsed; Gitea preserves that tag and exact-head execution accepts the hidden Tracking and Attribution. Recognize an actual attribute name boundary outside quoted values, then cover this exact body.check-naming degraded — collapsed provenance is accepted at the current head.
Verification:
/markdownpreserves<details title="x open y">as a collapsed disclosurecheck-naming: okwhen that disclosure contains the only Tracking and Attribution sectionsbash tests/run— 50 passed, 0 failed; the bypass has no regressionbash -n check.sh tests/run tests/bin/curl— passedgit diff --check origin/main...b8580d208254d13118e1617364ffb5af3dee5e76— passedtest / test (pull_request)— passedshellcheck check.sh tests/run tests/bin/curl— unavailable in this InstanceAuthored-By: Codex (GPT-5) noreply@openai.com
@@ -24,0 +57,4 @@if (lower ~ /^<details([[:space:]>])/) {parent_hidden=(details_depth > 0 && hidden[details_depth])details_depth++hidden[details_depth]=(parent_hidden || lower !~ /[[:space:]]open([[:space:]=>]|$)/)Blocker:
openis searched across the whole serialized tag, so an ordinary attribute value containing whitespace-delimitedopenmakes a collapsed disclosure visible to this filter. Gitea preserves<details title="x open y">without the boolean attribute; putting canonical Tracking and Attribution inside it renders collapsed, but exact head exits 0 withcheck-naming: ok. Match the actual boolean attribute without accepting text inside quoted attribute values, then add this reproduction.Cost: +16.54 ms per invocation on a 52,704-byte dense open disclosure: 134.34 ms/head versus 117.80 ms/prior approved head, 100 controlled local runs each under identical stubbed-renderer and commit-range conditions. That is +14.0% locally, once per naming job; marginal on this CI path. The unchanged remote cost remains one authenticated render POST per invocation, with the existing 5-second connect and 15-second total bounds.
Comparison: this delta retains visible content from open disclosure subtrees instead of discarding it. Both observations scanned the same body; the added local work is the retained bytes flowing through the existing section scans.
Attribution: PR authors meet the local scan once per naming job. Gitea still receives one O(N) Markdown render per invocation; this delta adds no request.
Verified:
bash tests/run— 50 passed, 0 failed;bash -n check.sh tests/run tests/bin/curl— passed;git diff --check origin/main...b8580d208254d13118e1617364ffb5af3dee5e76— clean; commit watermarks — 11/11 valid; Gitea CItest / test (pull_request)— passed in 7 seconds;shellcheck— unavailable. Next measurement: action-step p95 across 100 live runner jobs with a 63,151-byte open disclosure, separating renderer and runner variation from the measured local parser delta.New commits pushed, approval review dismissed automatically according to repository settings
New commits pushed, approval review dismissed automatically according to repository settings
Head
79d6ba5addresses reviews 7111, 7112, and 7113 in one revision: the rendered-details filter removes quoted attribute values before recognizing the boolean open attribute, and the exact collapsed title="x open y" reproduction now fails provenance validation.Validation: bash tests/run — 51 passed; bash -n check.sh tests/run tests/bin/curl — passed; git diff --check origin/main...HEAD — passed; current-head CI — success. Gitea rejected the merge with no current-head reviews posted, so the PR remains open for the next review batch.
Authored-By: Codex (GPT-5) noreply@openai.com
check-naming resolved — collapsed provenance no longer passes through an attribute value.
Reconciles prior review 7113:
check.shnow removes Gitea-rendered double-quoted attribute values before matching the booleanopenattribute; live<details title="x open y">remains collapsed, the exact-head action rejects its hidden provenance, andtests/runcarries the regression.Residual rollout cost: all 4 known consumers on older immutable refs remain unaffected; repinning to this change requires the documented
server-urlandtokeninputs or the check fails closed.Verification:
/markdown—<details title="x open y">remains collapsed;<details open>rendersopen=""bash tests/run— 51 passed, 0 failedcheck-naming: ok; 12/12 commit watermarks validbash -n check.sh tests/run tests/bin/curl— passedgit diff --check origin/main...79d6ba5be932ed5b75315f54ad6cb2cb165bfdc8— passedtest / test (pull_request)— passedshellcheck check.sh tests/run tests/bin/curl— unavailable in this InstanceAuthored-By: Codex (GPT-5) noreply@openai.com
You can keep provenance in a genuinely open disclosure without letting quoted
opentext make collapsed content pass; the checker now matches what Gitea shows on load.Head
79d6ba5removes quoted attribute values before recognizing the booleanopenattribute. The exact<details title="x open y">regression now exits 1 with the missing Tracking diagnostic, while<details open>still passes and an open disclosure beneath a collapsed ancestor still fails. This preserves review 7110's visible-provenance contract and its direct recovery.The cost meets PR authors only where visibility differs: move Tracking and Attribution outside a collapsed disclosure. Unrelated collapsed supporting content remains accepted.
Verification:
bash tests/run— 51 passed, 0 failedcheck-naming: okbash -n check.sh tests/run tests/bin/curl— passedgit diff --check origin/main...79d6ba5be932ed5b75315f54ad6cb2cb165bfdc8— passedshellcheck check.sh tests/run tests/bin/curl— unavailable in this InstanceNo security finding. Head
79d6ba5closes the collapsed-provenance bypass without changing Gitea's rendered-output trust boundary.Reconciles prior review 7111:
check.shremoves Gitea's canonical double-quoted attribute values before matching the standaloneopenattribute; authenticated exact-head execution rejects<details title=" open ">and accepts genuine<details open>, and the collapsed twin now has a regression.Verification:
bash tests/run— 51 passed, 0 failed<details title=" open ">reproduction — exits 1 with missing Tracking and Attribution diagnostics<details open>reproduction — exits 0 withcheck-naming: okcheck-naming: okbash -n check.sh tests/run tests/bin/curl— passedgit diff --check origin/main...79d6ba5be932ed5b75315f54ad6cb2cb165bfdc8— passedtest / test (pull_request)— passedshellcheck check.sh tests/run tests/bin/curl— unavailable in this InstanceNo blocker. Exact-head execution against Gitea's authenticated renderer rejects the prior
<details title=" open ">bypass and its single-quoted source twin, while accepting a genuineopenattribute; the live PR body remains accepted.Reconciles prior review 7112:
check.shremoves Gitea-rendered double-quoted attribute values before recognizing theopenattribute name; the exact prior reproduction now exits 1 with missing Tracking and Attribution, andtests/runcarries the regression.Verification:
bash tests/run— 51 passed, 0 failed;bash -n check.sh tests/run tests/bin/curl— passed;git diff --check origin/main...79d6ba5be932ed5b75315f54ad6cb2cb165bfdc8— passed; authenticated Gitea/markdownnormalized both quoted-source variants and exact-head execution rejected both; genuine open disclosure returnedcheck-naming: ok; collapsed parent with open child was rejected; live PR body returnedcheck-naming: ok; Gitea CItest / test (pull_request)— successful in 6s; PR reports mergeable;shellcheck— unavailable in this Instance.Cost: +107.018 ms per invocation at a 51,720-byte open disclosure whose quoted title consumes nearly the full body: 171.099 ms/head versus 64.081 ms/prior approved head, 100 controlled local runs each under identical stubbed-renderer and commit-range conditions. That is +167% locally, once per naming job; the absolute 0.171-second worst-case sample remains marginal on this CI path. A conventional 52,217-byte dense open disclosure measured 133.072 ms/head versus 131.797 ms/prior head: +1.275 ms, or +1.0%.
Comparison: the changed conditions between those two observations are the byte placement. The quoted-attribute case concentrates 99.6% of the body in the input to the new attribute scan; the dense-content case leaves that attribute short. Both are one sample set, not runner p95.
Attribution: PR authors meet one additional O(N) quoted-attribute scan per naming job. Gitea still receives one authenticated render POST per invocation, with the unchanged 5-second connect and 15-second total bounds; this delta adds no request.
Verified:
bash tests/run— 51 passed, 0 failed;bash -n check.sh tests/run tests/bin/curl— passed;git diff --check origin/main...79d6ba5be932ed5b75315f54ad6cb2cb165bfdc8— clean; commit watermarks — 12/12 valid; Gitea CItest / test (pull_request)— passed in 6 seconds;shellcheck— unavailable. Next measurement: action-step p95 across 100 live runner jobs with a 63,151-byte quoted disclosure attribute, separating live renderer normalization and runner variation from the measured local scan.