From 72a2a6caa9e1c390f589144db2a36c6c8eca0398 Mon Sep 17 00:00:00 2001 From: wshallwshall Date: Wed, 5 Aug 2026 23:42:12 -0500 Subject: [PATCH] backlog: close #325 in place -- case-fold fix shipped in #177 (BACKLOG #325) The leak gate's home-path / worktree-slug case-fold (#325) landed folded into #177 (commit 88703a3a), an ancestor of main -- not on a branch of this item's name -- so there is no code to write in this lane. It only flips the #325 banner to closed and reconciles the item text with the shipped code. Verified against the shipped code and its git history: - scan_forbidden.py:114-121 folds the _HOME_PATH drive-letter arm inline, scoped so the POSIX /users/ REST route stays unmatched (a whole-pattern re.I would have measured 47 false positives). _WORKTREE_SLUG folds whole at :96. - Falsified against the pre-fix code (88703a3a^): the old _HOME_PATH fired on the canonical spelling but missed all three wrong-case spellings; the shipped pattern fires on all four and still skips the benign /users/ routes. The old slug pattern missed an upper-cased slug; the shipped one catches it. - Regression fixtures at tests/test_scan_tokens_source.py:701,731 pass. Added an AMENDED 2026-08-05 blockquote under the closed banner reframing the What / Why / Proposed / Source body -- still voiced as the open finding, with the pre-fix regex and a "Verified open at HEAD" line -- as the historical filing record, not current state, mirroring the same-day #228 close. Without it a reader meets a closed banner over a body that reads as a live gap and could reopen or re-implement it. Banner flipped WITHOUT recomputing the census. The ranked-table row, the census distribution lines, and the cross-references to #325 under other items remain coordinator work for the close-and-archive reconcile sweep. --- docs/BACKLOG.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md index e3142125..26452540 100644 --- a/docs/BACKLOG.md +++ b/docs/BACKLOG.md @@ -2702,7 +2702,9 @@ Note the item is **not** "the scanner is broken" โ€” it is that the token *sourc ## 325. Leak gate's home-path detector is case-blind on Windows paths -> ๐Ÿ”ข **Filed 2026-08-01 โ€” not started.** Value **6/10** ยท Difficulty **2/10** ยท _quick win_. A structural detector in a required merge context โ€” the one control meant to work in a fork with no token source โ€” fires on one of four spellings of the same Windows home path (`_HOME_PATH` compiles with no flags and matches a literal `Users`, `scripts/security/scan_forbidden.py:99-106`), against the module's own "fail toward more detection" rule, though the disclosure is an OS account name and the tree holds zero live hits; an inline `(?i:)` on the drive-letter arm only (whole-pattern `re.I` measured 47 false positives), the sibling two-character `_WORKTREE_SLUG:92` edit, and casing fixtures beside the sole canonical-case test at `tests/test_scan_tokens_source.py:559-577`. +> โœ… **Closed 2026-08-05 โ€” shipped in #177 (commit `88703a3a`), an ancestor of `main`.** The fix and its regression tests landed folded into that batch, not on a branch of this item's name. The `_HOME_PATH` drive-letter arm case-folds inline (`scripts/security/scan_forbidden.py:114-121`) โ€” scoped to that arm, so the POSIX `/users/` REST route stays unmatched (whole-pattern `re.I` would have measured 47 false positives) โ€” and the sibling `_WORKTREE_SLUG` folds whole (`:96`); casing fixtures at `tests/test_scan_tokens_source.py:701,731` pass. Value **6/10** ยท Difficulty **2/10** ยท _quick win_. + +> **AMENDED 2026-08-05 โ€” the What / Why / Proposed / Source block below is the historical filing record, not current state.** Read it as the finding that scoped this work, not as a live gap: the fix and its regression tests shipped in #177 (see the CLOSED banner above). The `_HOME_PATH` snippet quoted under **What** (a literal `Users`, compiled with no flags) is the PRE-fix pattern; the shipped detector folds the drive-letter arm inline at `scripts/security/scan_forbidden.py:114-121` and the `_WORKTREE_SLUG` sibling folds whole at `:96`. The four-spelling FIRES/MISSED table records the pre-fix behaviour, the **Proposed** steps are all built, and the line anchors together with the "Verified open at HEAD (`12efbffc`)" line reflect the state at filing, not today. > **Note on the examples below.** Every path here writes the account segment as the placeholder ``, because `_HOME_PATH`'s negative lookahead exempts a segment beginning `<` โ€” a literal account name in this item would trip the very gate it describes. Read `` as "a real login name"; the FIRES/MISSED column describes what happens once one is substituted. This is [#322](BACKLOG.md) in miniature: a placeholder written into tracked prose is itself scanned.