[rmcdaniel]

Option-shaped comparison refs reach git diff and git show as flags. A controlled reproduction on the preceding source used --output=... to create files outside the selected repository.

Resolve the requested base with git rev-parse --verify --end-of-options, require one commit object ID, then form diff/show object expressions from that ID. Normal SHA, branch and relative-commit references retain their behavior, including reading deleted source from the base. Missing and noncommit bases now refuse explicitly.

Validation: 21 visual-evidence tests pass. New real-Git controls fail on the predecessor, reproduce both unwanted output files, and pass after the correction without creating either file. Positive SHA/branch/relative references and deleted-file content pass. No shared ordinary preflight, workflow/catalog, browser, runtime, package or provider behavior changes.

Refs #187. Security review and current hosted qualification remain required. The protected issuer App remains unprovisioned; its missing-configuration workflow result must stay separate from ordinary source qualification and does not grant a live pilot.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-source disposition for 5cdc8310f43ca519edbe3f4863bb8a0b38211eec / tree ce72bdc2c5f8e0d935471bebeb486fee4cb6322e / base 0b00aa61210ca4d9bb652fb62ca2c9a0dc9848df: PASS for the two-file Git comparison-boundary correction only.

Independent source review confirms:

• comparison_commit() invokes git rev-parse --verify --end-of-options <reference>^{commit}, rejects a nonzero exit or anything other than one lowercase 40/64-hex OID, and returns only that immutable OID.
• changed_paths() passes the resolved OID to git diff; file_content() passes the resolved OID before the :<path> selector to git show. The previously executable option-shaped base_ref no longer reaches either sink.
• SHA, branch and HEAD~1 inputs still resolve; the deleted-file read remains covered. Missing refs and non-commit object selectors refuse.
• I reran the exact 21 tests.test_visual_evidence controls and an independent disposable-repository --output=<owned outside path> check: both functions raised VisualEvidenceError, and the outside directory stayed empty.
• Exact-head public analysis reports zero open PR Sonar issues and zero open PR-ref CodeQL alerts. The ordinary shared contract, protected-parser, Sonar and all CodeQL jobs pass.

The failed Validate bounded workflow inputs job is not a source regression: run 41959702498, job 127022880660, stops at the existing empty POLICY_GATE_APP_ID assertion. Therefore this disposition does not clear protected issuer provisioning, App/key/settings, pilot acceptance, browser/runtime, or any live operation. Those remain held under the existing #288/#187 boundary.

The wider current-main Sonar triage is recorded separately on #187; in particular, this exact correction does not transfer to the separate regression-corpus Git ref finding.

[rmcdaniel]

Security exact-head source disposition for 5cdc8310f43ca519edbe3f4863bb8a0b38211eec over base 0b00aa61210ca4d9bb652fb62ca2c9a0dc9848df: HOLD. The direct option-shaped-ref injection is closed, but one-run baseline immutability is not.

What passes:

• comparison_commit() invokes git rev-parse --verify --end-of-options <ref>^{commit} and accepts exactly one 40- or 64-hex OID. The subsequent individual diff and show calls receive an immutable OID rather than the untrusted option-shaped string.
• I independently ran the three new VisualEvidenceGitBoundaryTest controls; all pass. The two reproduced --output=<owned path> cases now refuse and create no output, while SHA, branch and HEAD~1 positives remain.

Remaining exact defect:

• main() passes the original mutable args.base_ref separately to changed_paths() and classify_changes(). changed_paths() resolves it once, but every file_content() call resolves that same mutable ref again. The run therefore does not retain one comparison OID across diff and baseline-content classification.
• I reproduced this on the exact head with an owned temporary repository. comparison-base initially named commit A containing source.css with a modal interaction; HEAD deleted that file. After changed_paths() resolved A, the branch moved to HEAD commit B. The diff correctly returned ['source.css'], but file_content() re-resolved B and classification returned {}. Supplying immutable A to the same classifier returned {'modal': ['source.css']}. The exact two OIDs observed in the single run were A then B.

Required successor: resolve args.base_ref once at the CLI trust boundary, pass that immutable OID to both changed-path and all baseline-content operations, and add the actual move-after-first-resolution old-fail/new-pass control. Do not add a second per-file resolution or trust a branch-name equality check.

The ordinary repository/CodeQL/Sonar checks pass, while the separate protected-workflow job fails at the known unprovisioned App boundary. Neither that unrelated failure nor green ordinary checks clears this source HOLD. No protected issuer, App, credential, browser, fixture or runtime action was performed.