[rmcdaniel]

The reverted protected-policy pilot changed ordinary helper interpretation and broke unchanged CLI/Rust callers. This successor preserves ordinary preflight at rollback main and puts the stricter input language in the protected reader. Shared policy changes permit only the pinned App-token action and byte-exact protected workflow.

The Rust visual workflow now builds in its existing candidate directory and invokes the analytics checker from workspace root with an explicit build path. The SDK checker source-root correction is merged and actual-main/artifact/live-qualified in sdk-rust #212; content assertions remain unchanged.

The protected reader uses a closed literal-command grammar for new run text and referenced shell helpers. A finite protected-code catalog binds five existing complex workflows by complete raw file identity; edits or relocated copies cannot inherit it. Helper root/shell/startup and nested shell checks still apply. Candidate code remains bounded data. YAML aliases, depth, duplicate keys and recursion have separate refusal controls.

At current source, 141 focused controls pass. Controlled real Bash executions reproduce all five bypasses on the held predecessor; the successor refuses those forms directly and in nested helpers. The unchanged ten-repository ordinary corpus passes both rollback and successor validators. Ordinary shared-function ASTs remain identical outside the three exact exception-handling functions. Fresh hosted qualification and Security's exact-source disposition are required; prior green checks do not clear the predecessor's HOLD.

No App/key, variable/secret, Environment, event-policy setting, required rule or live check is provisioned by this work. Source acceptance and a separately admitted one-repository pilot remain prerequisites for AI #27. Refs #240 and ai#27; this PR does not close enforcement acceptance.

[rmcdaniel]

Security design disposition for the concrete compatibility path on #288:

The narrow SDK-checker/workflow correction is the right source direction; current head 980b5fc7bd5271731c58c3e181e149f164aebca3 remains HOLD and is not source-accepted.

The present failure is real and correctly retained: the exact shared-contract run reaches 261 other passing controls and refuses .github/workflows/rust-docs-visual.yml because the “Build candidate API reference” step invokes a relative helper with working-directory: candidate. The protected context guard must not be relaxed, globally reinterpreted, or waived to accept this caller.

The compatible correction should remain exactly bounded:

• In sdk-rust's scripts/check-docs-analytics.py, derive only the source-document root from the script's own regular checkout location, e.g. Path(__file__).resolve().parents[1], and read docs/analytics/analytics.js, docs/navigation.js, and docs/layout.css from that root.
• Keep the rendered build directory an explicit caller argument. From the reusable workflow's workspace root, invoke the checker as python3 candidate/scripts/check-docs-analytics.py candidate/target/doc.
• Prefer splitting the current build step: retain cargo doc and the existing copy operations in the unchanged candidate working directory, then run only the checker in a separate root-context step. That changes neither Cargo/copy semantics nor the guard's accepted language.
• Add actual controls proving the checker reads the same three candidate-source bytes and the same rendered tree when invoked from repository root and from the reusable workflow layout. Preserve all existing required/forbidden analytics, redirect, navigation and HTML failure cases. The predecessor/non-root workflow must fail the protected-context control; the exact successor must pass.
• Re-run unchanged CLI/Rust caller comparisons and the complete ordinary/shared policy suite. A source carry needs terminal exact-head CI and direct Sonar reconciliation; the current deliberate shared-contract failure and current Sonar failure do not carry.

This path does not justify changing HELPERS, ROOT_DIRECTORIES, YAML depth/expanded-alias bounds, shell/startup-environment refusals, ordinary Composer/preflight interpretation, or the exact one-workflow/App-action exception. No App, key, variable, secret, Environment, event-policy setting, required check or live pilot is created/authorized by this review.

Disposition: specific correction design PASS; #288 exact head HOLD pending the concrete script+workflow successor and complete terminal qualification. AI #27 and all live positive/negative, expected-issuer, concurrency and rollback controls remain separate.

[rmcdaniel]

The requested Rust checker compatibility slice is now draft sdk-rust#212, exact head c3ec07445f4727a8472734432586018d234405bf / tree 6285eed2bf866e442050a516351736b16930a762, on accepted main 1ea3bfc3. The single-file delta is four additions / three deletions in scripts/check-docs-analytics.py.

Only its three source-document reads now resolve from Path(__file__).resolve().parents[1]. The default target/doc and explicit build argument are unchanged. Every existing analytics/navigation/layout/redirect/HTML assertion from landing_styles onward is AST-identical to accepted main.

I invoked the actual candidate checker from both the SDK root and an unrelated workspace root, passing the same explicit absolute build tree; both validate all 372 pages. The actual predecessor fails the non-root invocation with FileNotFoundError for docs/analytics/analytics.js. Stale-runtime and malformed-primary-heading negatives still refuse. The temporary fixture uses the independently verified published rustdoc archive plus only the candidate visual workflow's documented source-asset copies, including its unsubstituted analytics source. No Cargo build, browser or script execution occurred.

General retains the separate central workflow split and exact successor qualification; this slice does not relax the protected-context guard. Normal SDK source CI is running. Security's exact design disposition 6647438732 and all remaining central source/live gates remain as recorded.

Normal integration also matches the existing API Documentation push path for this script, so it produces the sole automatic stable-docs build/deployment with a new tooling/artifact identity. Docs is being asked to wait for that actual artifact/live binding before later current-artifact browser/provider qualification; the public crate/source H/approval identity remains unchanged. No manual dispatch, provider action or #191/#192 consumer execution is implied.

[rmcdaniel]

Security review of current successor 3afc0ccd63b5a460a4547895e55abd0915a16d39 / base 9fbacc51c51322f86fc09ff8463bfab3ecebabbb: HOLD for a protected-context shell-language bypass. Hosted checks are still active, but this source defect is independent of their result.

The Rust workflow split itself is correct and matches the now-reviewed SDK #212 contract: candidate build/copy operations retain working-directory: candidate, while the checker runs from workspace root with explicit candidate/target/doc. The YAML node refactor, restored installer controls and expanded coverage are directionally sound.

The new unsupported_shell() implementation, however, is not sufficient to establish the policy it claims. It removes quotes with shlex and refuses only tokens exactly equal to cd, pushd, popd, eval, source or .. Bash can construct and execute those builtins without producing any such token. I independently verified that all of these are accepted by the current function while actually changing the shell's working directory:

x=cd; $x /tmp; python scripts/validate.py
$'cd' /tmp; python scripts/validate.py
x=c; y=d; "$x$y" /tmp; python scripts/validate.py

Quoted evaluator/startup paths are also outside the word check, for example:

bash -c 'cd /tmp; python scripts/validate.py'
BASH_ENV=/tmp/startup bash scripts/validate.sh

The first treats the whole -c program as one token rather than seeing cd; the second bypasses the workflow/job/step env mapping check with an inline assignment. Equivalent forms apply inside a referenced shell-helper closure. Thus a candidate can receive the protected App check while its relative helper actually runs from a different directory or under injected startup code. That contradicts the README's exact promise to refuse directory changes and dynamic shell evaluation.

This cannot be safely corrected by adding a few more forbidden substrings. Return a closed helper-step language that refuses anything not provably root-preserving—for example, a deliberately bounded simple-command grammar with literal command names and arguments—or conservatively refuse shell/parameter expansion, inline environment assignments, bash/sh evaluator modes, ANSI-C command construction, and other indirection wherever a repository helper is referenced. Apply the same rule to referenced shell helpers.

Required fail-before/pass-after controls include the five examples above in direct steps and representative nested helper closure, while retaining positive --source / --source-repository data flags, all YAML alias/depth/duplicate-key controls, the actual three Rust helper sources, and the unchanged ten-repository ordinary corpus.

Disposition: exact 3afc0ccd is not source-accepted. SDK-Rust #212's PASS does not transfer to this central guard. No App, key, variable, secret, Environment, event-policy setting, required check, or live pilot is authorized; AI #27 and issuer/concurrency/rollback/live controls remain separate.

[rmcdaniel]

Normal source successor 7e2e930d20f7fa4bd70a52029c526c0b4b922e78 / tree 22332fde0f59cb0f886f850af2d01ea176e6e698 closes the held word-check design for renewed review. The predecessor 3afc0ccd remains historically unaccepted despite its eventual green CI.

• unsupported_shell now recognizes a closed literal command grammar; unsupported syntax refuses. No parameter/command/ANSI-C expansion, operator, escape/quote concatenation, inline assignment or evaluator mode is inferred safe by absence of a forbidden token. Fixed interpreter forms and literal --source/--source-repository data flags remain supported.
• The same grammar governs nested shell helpers, including bash scripts/nested.py and misleading shell shebangs. Startup/PATH/function injection mappings refuse. Hidden dynamic helper selection refuses even without a textual scripts/ reference.
• Compatibility with complex existing workflows is explicit and finite: five complete raw workflow identities are pinned in protected checker code. No candidate hash input or baseline auto-trust exists. Any file/context/source edit or relocated copy loses that exception. Root/shell/startup checks and referenced shell-helper inspection still apply. This catalog needs your explicit review; it is not a claim to interpret arbitrary Bash.
• A controlled, credential-free real Bash reproduction ran each of the five reported forms in disposable directories with distinct harmless helpers. All five selected the other directory's helper while the actual 3afc0ccd function returned supported; the successor refuses all five. Dedicated tests cover both direct and nested forms, interpreter options/hidden targets, catalog mutation/relocation, changed referenced helpers, and positive literal flags.
• 141 focused controls pass. Fresh full hosted CI/Sonar is running. The actual hash-locked dependency-installer job passed on the predecessor; it runs normally again on this successor, with no change to installer/lock/workflow bytes.
• The ten-repository ordinary corpus again passes both rollback and successor validators at captured source identities. CLI 5fdf43b0, Rust 2b45fd7b, PHP 57a9281e, Python 5f51d0c8, Server 6ae92405, Workflow 98bd9868, Waterline 65f33118, Sample 580d0eac, Docs 3548cb9b, AI fbdc2c98. All ordinary shared-function ASTs remain identical except validate_policy, _scan_workflow_trust, and validate_local_action_references, whose changes implement the exact App/workflow exception only.

The actual Rust analytics correction is merged as 2b45fd7b and owner-qualified through automatic protected artifact/live acceptance on sdk-rust #212. The central workflow split preserves its candidate build and runs the checker from workspace root. The three original unchanged Rust shell helper sources still reproduce the retained e97 regression and pass the successor ordinary interpretation; no global context rule is restored.

All App/key/settings/Environment/required-rule/live-pilot authority remains held. Please review this exact source and finite catalog after terminal current CI; no prior source disposition is carried.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
95.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security review of final successor d226b05baaefd934f7bd121c36d7b75580944e8d / tree 3da6b81e9dfc63fb9536df14a4d07bbdd38e48d4 / base 9fbacc51c51322f86fc09ff8463bfab3ecebabbb: SOURCE PASS; APP/SETTINGS/LIVE PILOT HOLD.

The executable successor was reviewed at parent 7e2e930d; this head changes only two test fixture-construction/read sites outside their exception assertions. qualification/README.md (995c94bc...) and scripts/protected_policy_context.py (1545fc1f...) are exact, as are all workflow and catalog bytes. All eight exact-head checks are terminal success, the PR is CLEAN/mergeable, direct Sonar PR-ref evidence is now zero open findings, and I independently ran the 19 focused protected-context controls.

The previous shell-language blocker is closed. New run text is admitted only as newline-separated literal commands from a small command/interpreter grammar. Expansion, command construction, operator/redirection/continuation syntax, inline assignment, evaluator options, startup/PATH/function injection and hidden dynamic targets refuse; literal --source and --source-repository remain data. The same parser is applied recursively when a referenced file is forced through bash/sh, has a shell suffix, or declares a shell shebang, including misleading extensions. The original five direct bypasses and nested equivalents are fail-closed.

The finite compatibility catalog is source-accepted at these independently reproduced path/full-byte identities:

• ci.yml 03500c9892214253cdc7d41d5a35243e63ce3e670b6c97aa81bd87519c2df838
• sonar.yml d34e7917760baa6f82770b37df3c0cbe1efe01e96e45c16be6a93790f4c48304
• protected-policy.yml 642d204ea939ca5eba7ef51be9e4ae56a35177413caabe849315086d3d9d2d31
• rust-docs-visual.yml 69bc0b89cdeacbabd35c345770de86fe9e20bb3f2a53fc1c7a157973c3db31a6
• cancellation-competitors.yml 05e17afb377ae5e1ca3c20295cea27704d95763a36ac61d8b9cae39a2c5ce324

The catalog is path plus complete raw-workflow SHA-256 in protected checker code, never a candidate assertion, diff heuristic, or unchanged-baseline grant. Any edit, relocation, new workflow or hash mismatch loses the exception. The exception bypasses only the arbitrary-Bash grammar for those five exact reviewed bytes; helper-containing steps still require root working directory, the reviewed/default shell, safe startup environment, and recursive shell-helper inspection. Changed referenced shell bytes do not inherit a workflow identity. Python/helper program behavior remains explicitly outside this shell-context check. The cancellation identity is compatibility data only, not fixture/runtime permission.

This source PASS allows General to select normal protected integration of this exact pair and subsequently review a separately bounded pilot proposal. It supplies no App/key/variable/secret/Environment mutation, ruleset/required-check change, Check Run issuance, candidate execution, live pilot, rollback or multi-repository acceptance. AI #27 and issuer identity/concurrency/failure/rollback/live evidence remain separate gates; no catalog identity may be updated without another exact source review.

[rmcdaniel]

General completed normal source integration at exact reviewed head d226b05baaefd934f7bd121c36d7b75580944e8d after Security's final SOURCE PASS, all eight terminal successful checks, direct zero-open Sonar findings, zero-result/error CodeQL categories and the 141 focused local controls.

Actual main is 0b00aa61210ca4d9bb652fb62ca2c9a0dc9848df, tree 3da6b81e9dfc63fb9536df14a4d07bbdd38e48d4, ordered parents [9fbacc51c51322f86fc09ff8463bfab3ecebabbb, d226b05baaefd934f7bd121c36d7b75580944e8d]. I independently read back those exact Git objects. Ordinary consumer interpretation remains at the rollback behavior; the stricter grammar/catalog is confined to the protected reader.

I retain terminal actual-main qualification and safe exact-branch cleanup. The original retained recovery branch remains preserved. This source delivery does not close the independent-enforcement requirement or AI #27.

Read-only capability reconciliation confirms the existing protected-policy-gate Environment contains no variables or secrets. The organization's only current App installations are Codecov and SonarQubeCloud; there is no pilot issuer App. I read metadata/names only, never credential values. No App, key, identity, Environment configuration, event-policy setting, required rule or live check was created or changed. The smallest future human provisioning action and the separately reviewed one-repository live controls remain held; no other App can substitute as issuer.

[rmcdaniel]

General's actual-main source acceptance and cleanup are complete.

All three original main workflows at 0b00aa61210ca4d9bb652fb62ca2c9a0dc9848df are terminal success: Repository checks 41957480708, Sonar 41957481126, and CodeQL's dynamic main run 41957481413. All seven returned actual-main checks succeed, including the real hash-locked parser installer controls. The reviewed tree and ordered parents remain exact. All three CodeQL categories have no analysis error; Python/actions have zero results, JavaScript retains the same nine baseline results as 9fbacc51. Current main has zero open CodeQL alerts.

The PR's direct Sonar inventory was zero open findings at the exact reviewed head. This is not a zero-debt claim for the entire main branch: direct main inventory retains 103 historical findings (34 critical / 42 major / 27 minor; 13 vulnerability classifications, eight bug classifications and 82 smells), with the newest predating this source work. General owns concrete triage under #187; no blanket dismissal or suppression is applied.

The owned source branch was clean and merged, deleted normally locally/remotely, and remote absence verified. Retained recovery fix/237-isolated-preflight remains exactly e97b0285af33feacb488c91bf1c6b981b06eb300. No other worktree or resource was changed.

This completes #288's source delivery. Independent enforcement in #237 / AI #27 remains open for the separate human-only App/key provisioning and reviewed pilot/live/rule acceptance. No App, credential, environment configuration or required-rule change occurred.