docs(records): lead decision 39, helper lead check passed, C1 in D (row 12)

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-09-26 21:45:23 -05:00
parent 4c53f8c738
commit cdcedb2741
1 changed files with 22 additions and 0 deletions
@@ -513,3 +513,25 @@ which stay with him. Each item names who decided it and what happened.
    Darkwing applies it. Sage checks it with Rocko's reproducer and the
    ledger tests. That is a lead check, not a review round. If the check
    fails, the raw path is cut.
 39. **Lead check passed on helper.patch 48edd46b (decision 38), and C1
    goes into D.**
    - `export -n CFG` follows the checked assignment directly. Darkwing
      also found `SHELLOPTS=allexport` as a second route to the same leak,
      and the same line closes it.
    - Sage checked it with dummy credentials and stub `curl` and `git`:
      raw and JSON files, GET and POST, with an exported `CFG`, with
      `SHELLOPTS=allexport`, and with both. On the patch all 12 cases
      keep the token out of curl's environment, argv, stdout and stderr,
      and the token appears only in the config stream. With the
      `export -n` line removed, all 12 leak it into curl's environment.
    - Ledger tests pass 58/58 on the patch alone at 8efc0ff3. The helper
      ships with the D commit, together with Rocko's two reports
      (e896192f, 2096b0a3).
    - Filbert's D round 1 (a2dc2302) raised C1: on a comment round,
      in-review→waiting-on-jason needed no reviewer approvals, so an
      owner could move a Jason-gated row past its reviewers. It is fixed
      in D, not deferred: that move gets the approval and unresolved
      checks of in-review→done, plus a regression. No semantics-2 entry
      is logged yet, so the fix is cheap now.
    - Filbert's plan correction (293747cd) goes into the D commit.
      Round 2 of D is Filbert's.