mirror of
https://github.com/garrytan/gbrain.git
synced 2026-08-14 08:53:22 +00:00
Garry TanandClaude Fable 5
d610a845a8
Three defects a second blind reviewer found that survived round 5. All three
reproduced against cf7a1616 before the fix and are pinned after it.
1. The fence scanner still falsely closed compliant descriptions. CommonMark 4.5
forbids a backtick in a BACKTICK fence's info string, so ```foo`bar is an
ordinary paragraph. The scanner opened a fence on it, never found a closer,
and stripped the body to EOF:
body = '```foo`bar' + three sentences of real prose + an image embed
before: intentWordCount 0, misses [missing_intent, missing_screenshot]
after: intentWordCount 52, misses []
Same class as round 5's closing-length bug and the same cost — opening a
block CommonMark would not open deletes the author's prose exactly the way
closing one late did. Tilde fences keep the permissive rule (4.5 restricts
backtick fences only).
2. The spend guard hashed less than the model consumes. hashInputs covered
title, modelBody, head.sha, exemption and policy ids — but the payload also
carries the changed-file list and the diff, and the workflow degrades the
diff to a marker line when the API 406s on a huge one. So a run that
classified with no diff cached a diff-blind verdict, and the next run — real
diff in hand, same title/body/sha — matched the hash and was served that
verdict permanently (measured: anthropicCalls 1 across both runs). The
assembled payload is now folded in as a fixed-width digest, inside the JSON
tuple where quoting still makes a forged boundary impossible. Round 5's
property is re-pinned: a policy fix past the model's body cap invalidates
even when the payload is byte-identical.
3. The workflow's ${{ }}-in-run scanner missed a legal commented block header.
`run: | # shell block` is valid YAML — js-yaml puts the following
interpolation in the script — but the header fell through to the
single-line branch, which captured `| # shell block` as the whole command
and never looked at the block body. The rule protecting against shell
injection reported clean over an interpolating workflow. The scanner now
handles a trailing comment on the header, and scans the comment text too
rather than leaving itself a hiding place. Guarded against js-yaml's actual
parse, not against the scanner's own opinion.
Also corrected one overstated claim in the file's security block: a BARE url in
a sanitized string still autolinks under GFM. That is a self-labelled link and
the deliberate stopping point — the escaping targets the masking characters so
it cannot forge `` or `[click to approve](…)` — but "no live
links" was too strong for what the code does.
Self-audit: all 13 interpolations into the sticky comment are either literals in
this file or pass sanitizeModelText/sanitizeList; the only unsanitized one
(titleCheck.reason) is a hardcoded literal and renders inside a code span. Every
rendered statement matches behavior the code performs. The four realistic-human
fixtures and the three new fence cases all PASS; empty, "fixes bug", the
unfilled template, ten words of lorem and a fenced-away screenshot all still
FAIL.
test/pr-gate-workflow.test.ts 158 -> 163 pass, 0 fail. Six mutations (the
CommonMark rule, the tilde exemption, the payload digest, the runGate wiring,
the scanner's comment group, the header-comment scan) each fail at least one
test. typecheck, actionlint, verify (34/34) green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>