topher
9154a006de
ci/woodpecker/pr/ci Pipeline was successful
The parent-escape rejection grep used a double-escaped ERE ('\\.\\.'), which
matches a literal backslash followed by any character - never a normal '..'
component - so an absolute HOME containing '/../' traversed to a planted tree
and executed it (rev-code-02 delta probe: rc 0, no diagnostic, sentinel
present). Corrected to the single-escaped ERE ('\.\.'), which matches a
literal dot-dot component.
Suite: A8 parent-escape hostile arm added (absolute HOME
<base>/../escape-target, executable planted at the resolved tree outside the
seat home) - the real launcher must refuse with the parent-escape diagnostic
and leave the sentinel absent, and a guard-bypassed mutant copy MUST execute
the same plant under the identical arm (sentinel present), proving the check
is what stands. The arm's HOME traversal was also corrected during authoring:
the first draft double-prefixed the worktree path, which made the candidate
nonexistent and would have let the mutant pass vacuously (the same
wrong-resolved-path class B3 caught).
Marker T110-DISPATCH-TOPHER-1N2O / ORCH-T110-B2FIX-X8Y9.