Take a shell scalar only from a line that opens with one literal assignment

.agents/pm/history/pm-github-tko1.jsonl

@@ -0,0 +1,10 @@
+{"ts":"2026-08-28T22:09:55.294Z","author":"claude","author_source":"asserted","agent_harness":"claude-code","agent_instance":"f992699797bca763a9b53afd","agent_provenance":{"model":null,"effort":{"value":"xhigh","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"create","patch":[{"op":"add","path":"/metadata/id","value":"pm-github-tko1"},{"op":"add","path":"/metadata/title","value":"The publish-attestation gate misses a publish routed through an unquoted shell variable"},{"op":"add","path":"/metadata/description","value":""},{"op":"add","path":"/metadata/type","value":"Issue"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":1},{"op":"add","path":"/metadata/tags","value":[]},{"op":"add","path":"/metadata/created_at","value":"2026-08-28T22:09:55.294Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-08-28T22:09:55.294Z"},{"op":"add","path":"/metadata/author","value":"claude"}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"137ded4c5cea997218e47efc0dc67df526fe452165dd504d1689238fe1ab9dea","item_hash_version":2,"message":"","context":{"agent_provenance_outcomes":{"model":{"status":"failed","reason":"resolver_failed","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"failed","reason":"resolver_failed","resolver":"claude_session_file","rule_version":"v1"}}}}
+{"ts":"2026-08-28T22:09:57.974Z","author":"codex","author_source":"configured","agent_harness":"claude-code","agent_instance":"f992699797bca763a9b53afd","agent_provenance":{"model":null,"effort":{"value":"xhigh","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-08-28T22:09:57.974Z"},{"op":"add","path":"/metadata/notes","value":[{"created_at":"2026-08-28T22:09:57.888Z","author":"codex","text":"author=claude\ncreated_at=now\ntext=shellScalars indexed only quoted assignments, so a bare NPM=npm was never recorded. expandScalars then left $NPM unresolved, tokenizeCommands saw a program named \"$NPM\" rather than npm, and the line was not recognised as a publish at all. Because the workflow's own legitimate attested publish still satisfied the non-vacuity guard, auditPublishAttestation returned zero failures and the gate reported a clean pass over a workflow containing an unattested publish. The gate was blind rather than wrong, which is the failure mode that keeps a gate trusted while it is not looking.\n\nMeasured behaviourally across the fleet rather than by reading the sources, by importing each repository's own verify-release-publish-attestation.ts and auditing a fixture holding one attested publish plus one variable-routed unattested publish. 12 of 17 repositories returned failures=0: pm-graph, pm-starter, pm-csv, pm-context, pm-web, pm-presets, pm-ts-starter, pm-todos, pm-linear, pm-brief, pm-github and pm-slack-standup. 5 already caught it: pm-jira, pm-beads, pm-ops, pm-slack and pm-gantt-chart.\n\nFix: shellScalars accepts a third alternative for an unquoted single-word value, matching what pm-jira already carries. The existing guard that refuses to inline a value containing a substitution, backtick, quote or parenthesis is unchanged, so a value that would change how its line parses is still never inlined.\n\nThe regression test asserts the audit-level property rather than the map contents, so it fails for the reason the gate exists: with the fix reverted it reports failures=0 where 1 is required. The neighbouring assertion that an unquoted value cannot hold a command encoded the old behaviour as intentional and was updated to match, exactly as pm-jira updated it.\n\nThis is the fifth time this class of bypass has been fixed in one vendored copy while the others stayed exposed. The root cause is that the verifier is vendored into every package instead of being consumed from pm-ops; that is tracked in the companion repository as pm-cli-website-bunt."}]}],"before_hash":"137ded4c5cea997218e47efc0dc67df526fe452165dd504d1689238fe1ab9dea","after_hash":"46ff051dfbbb099d93a90805a1dc80ea934a96bdab11383f7ed7e45e7b9d1f64","item_hash_version":2,"context":{"agent_provenance_outcomes":{"model":{"status":"failed","reason":"resolver_failed","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"failed","reason":"resolver_failed","resolver":"claude_session_file","rule_version":"v1"}}}}
+{"ts":"2026-08-28T22:36:31.424Z","author":"codex","author_source":"configured","agent_harness":"claude-code","agent_instance":"f992699797bca763a9b53afd","agent_provenance":{"model":null,"effort":{"value":"xhigh","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"add","path":"/metadata/notes/1","value":{"created_at":"2026-08-28T22:36:31.406Z","author":"claude","text":"Bot review on the first round (Greptile P1 x2, Sourcery x2) found that reading scalar assignments out of the raw text indexes bindings the shell never makes. All four were reproduced before fixing:\n1. A name defined only in a COMMENT was indexed. `# FLAG=--provenance` followed by `npm publish --access public $FLAG` audited as attested and returned zero failures: an unattested publish borrowed its flag from a comment and passed the gate. This is a bypass, and it pre-dates the unquoted-value change because the quoted form (`# CMD=\"npm publish\"`) was indexed the same way.\n2. A name inside a quoted argument was indexed. `echo \"config NPM=npm\"` bound NPM, so a later literal `$NPM publish` was audited as an npm publish the shell never runs.\n3. An unquoted value continuing into an expansion was truncated to its prefix. `NPM=npm$SUFFIX` bound NPM to `npm`; the literal guard then saw no `$` because the `$` had been excluded from the capture, so a value the scan cannot resolve was treated as one it could.\n4. The docstring still said only quoted values are indexed.\nFixed by reading assignments from tokenizeCommands instead of from raw text. The tokeniser has already dropped comments and resolved quoting, so a word is only treated as an assignment where the shell would treat it as one; it keeps `$SUFFIX` inside the word, so the literal guard sees the whole value rather than a prefix; and only a command-leading word can assign, so `npm publish FOO=bar` is an argument rather than a binding.\nOne consequence found by the existing suite rather than by a bot: the tokeniser consumes a substitution instead of keeping its text, so `SUBST=\"$(node -p 1)\"` arrives as an empty value that the literal guard would accept. Inlining it would ERASE `$SUBST` from the command, turning \"not understood\" into \"carries no flags\" — the exact false-pass this module already warns about. Empty values are therefore never indexed.\nBoth new tests were observed failing against the previous implementation and passing after. Verified behaviourally in all 17 packages carrying this file: the comment bypass, the quoted-argument binding, the truncation and the substitution are all refused, while `NPM=npm`, `CMD=\"npm publish\"` and a leading `FOO=bar` still resolve."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-28T22:36:31.424Z"}],"before_hash":"46ff051dfbbb099d93a90805a1dc80ea934a96bdab11383f7ed7e45e7b9d1f64","after_hash":"983b44659c4464f6a200c04e1ae00d9f10e13ee7390fec720d4cf1a23f8b462f","item_hash_version":2,"context":{"agent_provenance_outcomes":{"model":{"status":"failed","reason":"resolver_failed","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"failed","reason":"resolver_failed","resolver":"claude_session_file","rule_version":"v1"}}}}
+{"ts":"2026-08-28T22:57:20.281Z","author":"codex","author_source":"configured","agent_harness":"claude-code","agent_instance":"f992699797bca763a9b53afd","agent_provenance":{"model":null,"effort":{"value":"xhigh","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"add","path":"/metadata/notes/2","value":{"created_at":"2026-08-28T22:57:20.179Z","author":"claude","text":"Round 3. Greptile raised three further P1 security findings against the tokeniser-based implementation, and all three reproduced:\n1. Substitution suffix. `NPM=npm$(printf foo)` — the tokeniser consumes the substitution before the literal guard sees the value, so NPM was bound to the prefix `npm`. The scan then analysed a different command from the one the shell runs.\n2. Command-scoped assignment leaked file-wide. `FLAG=--provenance some-command` binds only for that one command, but it was stored in the file-global map, so a LATER `npm publish --access public $FLAG` was rewritten into an attested-looking publish. Audit returned zero failures: a false pass.\n3. Subshell escape. `$(FLAG=--provenance)` is a binding the outer shell never sees, but the recursive tokeniser returns the nested command and its assignment was promoted into the outer map. Also a false pass, also measured at zero failures.\nReplaced the rule rather than patching three more cases. A name is now taken only from a line that is EXACTLY one assignment carrying a fully literal value, anchored at both ends. Anchoring closes the truncation pair, because a value that does not reach the end of the line is not the value. Requiring the line to hold nothing else closes the comment, quoted-argument, command-scoped and subshell cases in one rule instead of four special cases. Escapes are honoured so `NPM=npm\\ publish` still holds a command in one word, which was a Sourcery finding, and the existing refusal of any value carrying a substitution, backtick, quote or parenthesis now applies after unescaping.\n`FOO=bar npm publish` is deliberately no longer indexed. It is command-scoped, and the publish on that same line is visible to the scan directly, so nothing is lost.\nVerified across all 17 packages carrying this file by exercising 16 properties against each package's own verifier rather than by comparing files. The two regression tests were observed failing against the previous implementation and passing after.\nOne finding was accepted as valid but deliberately left out of this change: scalars are still resolved from a file-wide map, so a later assignment can rewrite an earlier use. Raised by Sourcery, reproduced, and filed as companion item pm-cli-website-1j4o because it is a different defect needing position-aware resolution."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-28T22:57:20.281Z"}],"before_hash":"983b44659c4464f6a200c04e1ae00d9f10e13ee7390fec720d4cf1a23f8b462f","after_hash":"72ff127d052da809bc49cf94456efdf37dc8dda63cf544b26ee76ec30b2922d7","item_hash_version":2,"context":{"agent_provenance_outcomes":{"model":{"status":"failed","reason":"resolver_failed","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"failed","reason":"resolver_failed","resolver":"claude_session_file","rule_version":"v1"}}}}
+{"ts":"2026-08-29T04:11:56.170Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-sol","agent_model_source":"environment","agent_instance":"50ec9a4c6e15dbcecef5b53d","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-08-29T04:11:56.170Z"},{"op":"add","path":"/metadata/assignee","value":"pi-agent"},{"op":"add","path":"/metadata/claim_principal","value":"pi-agent"}],"before_hash":"72ff127d052da809bc49cf94456efdf37dc8dda63cf544b26ee76ec30b2922d7","after_hash":"ebc325f833c9eb464ed79c05a599125133d9dad407994c4b0f5942e78f8f2034","item_hash_version":2}
+{"ts":"2026-08-29T04:11:56.621Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-sol","agent_model_source":"environment","agent_instance":"50ec9a4c6e15dbcecef5b53d","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-08-29T04:11:56.621Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"ebc325f833c9eb464ed79c05a599125133d9dad407994c4b0f5942e78f8f2034","after_hash":"c57ea7420fe8c434488c1e934dd5a2c455ce643b6bf3128047775247a2d235cb","item_hash_version":2}
+{"ts":"2026-08-29T04:11:57.118Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-sol","agent_model_source":"environment","agent_instance":"50ec9a4c6e15dbcecef5b53d","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-08-29T04:11:57.118Z"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-08-29T04:11:57.118Z","author":"pi-agent","text":"PR #60 review follow-up: resolving scalar bindings by source position, excluding heredoc bodies, and supporting persistent assignment-only lists."}]}],"before_hash":"c57ea7420fe8c434488c1e934dd5a2c455ce643b6bf3128047775247a2d235cb","after_hash":"0b78b4f3cc951a73e3d4303f5d2af49745b2c3744712e439da3297bd8bf1b685","item_hash_version":2}
+{"ts":"2026-08-29T04:13:43.866Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-sol","agent_model_source":"environment","agent_instance":"50ec9a4c6e15dbcecef5b53d","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"environment"},"effort":null,"role":null,"topic":null},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/1","value":{"created_at":"2026-08-29T04:13:43.866Z","author":"pi-agent","text":"Implemented and verified: source-position scalar resolution prevents later reassignment from rewriting earlier commands; heredoc bodies are excluded; assignment-only lists retain each persistent literal binding. Full tests and coverage pass."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-29T04:13:43.866Z"}],"before_hash":"0b78b4f3cc951a73e3d4303f5d2af49745b2c3744712e439da3297bd8bf1b685","after_hash":"bf36e824195d8c9416287b922337386f0d2ef6db9beec545da679769b088074a","item_hash_version":2}
+{"ts":"2026-08-29T04:13:44.483Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-sol","agent_model_source":"environment","agent_instance":"50ec9a4c6e15dbcecef5b53d","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"close","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-29T04:13:44.483Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-08-29T04:13:44.451Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-08-29T04:13:44.451Z"},{"op":"add","path":"/metadata/close_reason","value":"PR #60 review findings fixed with end-to-end regressions; full suite, coverage, changelog, and strict health gates pass."}],"before_hash":"bf36e824195d8c9416287b922337386f0d2ef6db9beec545da679769b088074a","after_hash":"d376377b333789c762cffaed34ee96e65b764fa7935e672248eac4cdbdb97763","item_hash_version":2}
+{"ts":"2026-08-29T04:13:45.084Z","author":"pi-agent","author_source":"asserted","agent_harness":"pi","agent_model":"gpt-5.6-sol","agent_model_source":"environment","agent_instance":"50ec9a4c6e15dbcecef5b53d","agent_provenance":{"model":{"value":"gpt-5.6-sol","source":"environment"},"effort":null,"role":{"value":"implementer","source":"argv"},"topic":null},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"replace","path":"/metadata/updated_at","value":"2026-08-29T04:13:45.084Z"}],"before_hash":"d376377b333789c762cffaed34ee96e65b764fa7935e672248eac4cdbdb97763","after_hash":"aefb17914d55a182f475b36a31467964ac99adbd578bf2451cd3b58b84ebf2b0","item_hash_version":2}