From cdcedb27410b1499200918880d29844f0534908c Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Sat, 26 Sep 2026 21:45:23 -0500 Subject: [PATCH] docs(records): lead decision 39, helper lead check passed, C1 in D (row 12) Co-Authored-By: Claude Opus 5.5 --- docs/plans/2026-09-26_lead-decisions.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/docs/plans/2026-09-26_lead-decisions.md b/docs/plans/2026-09-26_lead-decisions.md index 7e5c7cbb..a15e3704 100644 --- a/docs/plans/2026-09-26_lead-decisions.md +++ b/docs/plans/2026-09-26_lead-decisions.md @@ -513,3 +513,25 @@ which stay with him. Each item names who decided it and what happened. Darkwing applies it. Sage checks it with Rocko's reproducer and the ledger tests. That is a lead check, not a review round. If the check fails, the raw path is cut. +39. **Lead check passed on helper.patch 48edd46b (decision 38), and C1 + goes into D.** + - `export -n CFG` follows the checked assignment directly. Darkwing + also found `SHELLOPTS=allexport` as a second route to the same leak, + and the same line closes it. + - Sage checked it with dummy credentials and stub `curl` and `git`: + raw and JSON files, GET and POST, with an exported `CFG`, with + `SHELLOPTS=allexport`, and with both. On the patch all 12 cases + keep the token out of curl's environment, argv, stdout and stderr, + and the token appears only in the config stream. With the + `export -n` line removed, all 12 leak it into curl's environment. + - Ledger tests pass 58/58 on the patch alone at 8efc0ff3. The helper + ships with the D commit, together with Rocko's two reports + (e896192f, 2096b0a3). + - Filbert's D round 1 (a2dc2302) raised C1: on a comment round, + in-review→waiting-on-jason needed no reviewer approvals, so an + owner could move a Jason-gated row past its reviewers. It is fixed + in D, not deferred: that move gets the approval and unresolved + checks of in-review→done, plus a regression. No semantics-2 entry + is logged yet, so the fix is cheap now. + - Filbert's plan correction (293747cd) goes into the D commit. + Round 2 of D is Filbert's.