Scan the pull request description for home paths and credentials - #991

Scope

• What this PR changes: the required sota-sources job also scans the pull request description for an absolute home path or a credential-shaped string, and fails closed naming only the rule id. It detects a repeat of the command center's privacy correction Blind lanes round 2: sanitized export, receipt aliases, two-family adjudication #145 (home paths had reached eleven places in public PR bodies and comments, all masked since) and keeps such a pull request from landing. It does not prevent the leak: GitHub publishes a description before any check runs, and the gate reads only the current description, not titles, comments or the edit history.
• Base commit: 83cec12ee. Rebased from c4f499073 onto 0f1537841, and with the terminal commit onto 83cec12ee, each time for a manifest-only conflict (without manifests/evidence.json every commit's patch-id is identical; e15d1259 is now 260803e1, so the delta then called terminal is 260803e1..30f2e005; 4360b9e2 and d9eb2691 follow it).
• Lane: lane:foundation.
• Owned paths touched: .github/workflows/pr-metadata.yml and .github/workflows/sota-sources-gate.yml (the same job, byte for byte), scripts/validate.py (the private-key, graph-id, home-path and bearer rules), tests/test_sota_sources_gate.py, tests/test_validate.py, tests/fixtures/cmark-gfm-rendered-rules-587a12bb.json, docs/decisions/2026-09-25-top-rule-sota-sources.md, manifests/evidence.json.

How:

• The rules are the home-path and credential rules of scripts/validate.py's PRIVATE_CONTENT, written in JavaScript in the job's github-script: personal home path, Windows user path, encoded home path, and the Hugging Face, GitHub, Tavily, API-secret, private-key and bearer-credential rules, plus a gate-only macOS home rule in any case.
• No host name is needed. ~/ paths, <user> where GitHub shows it (escaped as \<user> or in a code span; GitHub hides a bare tag, so a forward-slash profile with one is refused) and the documented example home pass. A WSL home through its Windows UNC path (\\wsl$\, \\wsl\, \\wsl.localhost\, also as a device path \\?\UNC\... or \\.\UNC\..., in either slash, and JSON-escaped) is a home path in both scans.
• Validate's two session-identifier rules are left out on purpose: a description may cite a session or request id.
• The body is the current one, from the REST "Get a pull request" endpoint, as the job already reads it. It is judged before it is read (type, encoding, control characters other than tabs and line breaks, and a bound of 262,144 code points), and the rules see it as written and through the compositions of four decoders: percent escapes, JSON escapes, HTML character references, and the text GitHub displays, by a port of cmark-gfm's inline parser at 587a12bb (since d9eb2691); each chain is read as written and with every Cc, Cf, Zl, Zp and Default_Ignorable_Code_Point character but tab, LF and CR removed and NFKC applied.
• The failure message names rule ids only, never the matched text, and a missing SOTA section and a private body are reported together.

Review rounds:

• The co-op's GPT read at 07595323 (three P2s) was fixed in de4eed8f: body guards, decoded forms, Python's Unicode classes spelled out.
• Codex's GitHub review of de4eed8f (four P1s, three P2s) is answered in fc60da90:
  • Correction: GitHub does not refuse a description over 65,536 characters. Probes of this description through the REST update, each restored at once, show that it keeps at most 262,144 UTF-8 bytes; over that it answers 200 but stores nothing. Organic-invocation E2E v1.1: protocol, pilot spec and the promptfoo-driven harness (run of record smoke-20261006c) #786 has 75,726 characters. The bound is now the gate's own, 262,144 code points, which no stored description reaches. (d81969dd had claimed a 1,048,577-character body was stored, from that 200 answer; a GET read-back corrected it.)
  • The decoders compose, so text written with several escapes at once is judged as it reads.
  • The private-key rule takes gitleaks's header form in both scans, catching PKCS Install native token-saving tools and publish portable lifetime evidence #8 ENCRYPTED and OpenPGP key blocks.
  • The gate didn't read the graph-id form inside an http(s) URL, so a repository named like one could be cited (removed in 6a06673d: the gate reads it everywhere, as validate.py does). The graph-id name is bounded to 256 characters in both scans: a quadratic run of 21 to 93 s now takes 0.05 to 0.1 s.
  • The macOS rule takes any number of leading slashes.
  • A test fails when validate.py gains a rule the gate does not carry.
  • The publication-order finding is answered in the record without a code change: the gate is the backstop, and prevention is scanning the text before gh pr create or gh pr edit.
• Codex's GitHub review of d81969dd (one P1, one P2): T8, a value split by an HTML comment, which GitHub hides, passed; fixed in 6a06673d (the projection). T9, an invalid character reference such as � inside a path, is decoded to nothing, so contrived text is refused though GitHub shows U+FFFD there: a fail-safe false positive, kept, in Follow-ups.
• Codex's GitHub review of fc60da90 (two P2s): T10, a graph cache path carried in an http(s) URL was exempt; fixed in 4e5ef13d (the exemption then covered code hosts only) and moot since 6a06673d removes it. T11, an unresolved reference link such as [<part>][missing] is collapsed, so contrived text is refused though GitHub shows it literally: fail-safe, kept, in Follow-ups.
• The co-op's GPT read at fc60da90 (two P2s) is answered in 4e5ef13d:
  • The graph-id URL exemption covered any http(s) URL, so a graph id behind a loopback or localhost URL passed. The exemption then covered only the path of a public code host's URL: an allowlist of seven hosts, lower case, stopping at : @ ? #. Loopback, localhost, private-address and unlisted hosts stay caught. (752d9618 narrows it to a repository name.)
  • Link labels admitted [, so 262,144 unmatched [ gave no verdict within 125 s. Labels now hold no bracket, as in CommonMark. That body takes 0.16 s, and 21 adversarial shapes at the bound took at most 0.26 s each; that set missed an unclosed link of whitespace (below).
  • The new tests fail on the rebased previous head (18 failures, 1 error), and 12 of 13 weakened copies fail them. The survivor is equivalent and is explained in the record.
• The co-op's GPT read at 4e5ef13d (fix3): ACK, no blocker.
• The command center's Claude read at 4e5ef13d (CHANGES_REQUESTED; its adjudication ruled B3 and B4 privacy P1s) is answered in one commit, 752d9618:
  • B3: the code-host exemption reached 256 characters past the host, across Markdown and prose delimiters and an inner scheme, so a graph id behind https://github.com/ inside a local URL or its query, as a link destination, after a comma or deeper in the path passed both copies. It now covers only a repository name, the segment right after one owner segment of a listed host's URL, and that URL must start its token. The read's 5 bodies, a pipe, a table cell, a semicolon and a comma now fail both copies, as in validate.py; a linked or autolinked repository named like a graph id still passed (until 6a06673d removed the exemption).
  • B4: \\wsl.localhost\<distro>\home\<name>, \\wsl$\..., \\wsl\... and the JSON-escaped form are now personal home path in validate.py and both copies, cited to Microsoft's "Working across file systems" and the WSL release notes. The 19 tracked lines that write the form, all masked, stay clean.
  • B1: the body guard admits tabs and line breaks, a line break being a paragraph separator (Unicode Bidi_Class B: LF, CR, U+001C to U+001E, U+0085), so Verify the code citations in a PR's SOTA sources (W1b phase A, report-only) #1003's mirror test passes again (the 4 subtests that kept the required validate red). Every other C0 and C1 control is still refused; a test runs all 65 in both copies.
  • B2: the link decoder's parentheses are read as runs that cannot overlap, so [a]( followed by spaces, line feeds or tabs up to the 262,144-code-point bound gets a verdict at once; at 4e5ef13d, 65,536 spaces gave none within 130 s. 35 adversarial shapes at the bound took at most 0.25 s each in my run; the command center's micro measured 0.26 to 0.28 s at a load of about 26, so 6a06673d restates the bound as measured.
  • F1 and F2: the hashed-file count and the Blind lanes round 2: sanitized export, receipt aliases, two-family adjudication #145 wording above are corrected.
  • The new tests fail at 4e5ef13d (34 failures, 1 error), and 13 of 13 weakened copies fail them.
• The command center's Claude micro at 752d9618 (CHANGES_REQUESTED; the adjudication ruled M1, M2 and Codex's T8 privacy P1s, and the class recurring, rule 4) is answered in 6a06673d, fix round 2 of 2, and a comment-only second commit, e15d1259 (the M3 path in the job's comment made the OpenHands push gate count the mirror's reads and turned the required validate red; the command center's go):
  • M1 and T8: the rules also read a projection of the body: HTML comments removed as CommonMark 0.31.2 reads them (one linear scan), and the 234 Cc, Cf, Zl and Zp characters but tab, LF and CR removed (Unicode 17.0, Node 24.21's; the same set in Python 3.13.16's 15.1). The decoders compose over it as over the body, and each decoder's output there is projected again. A value split by an admitted line break (U+001C to U+001E, U+0085), a zero-width, soft-hyphen or bidi character, or a comment is caught in both copies: 187 split bodies, where 752d9618 let 143 through. Clean bodies with these characters still pass.
  • M2: the code-host exemption is removed. A code-host URL glued inside another URL after (, ', ", [, < or > still exempted a graph id; now the gate reads the graph-id form as validate.py does, and a repository named like one is refused by both.
  • The rarer UNC forms: device paths (\\?\UNC\, \\.\UNC\), either slash, a distribution name with a space or up to 255 characters, and <distro>\mnt\<drive>\Users\<name>, in all three copies (.NET's file path formats). The B4 citation now names WSL/filesystems.md:34 only.
  • The two link shapes 752d9618 stopped decoding (a title on the next line, a title holding an unmatched parenthesis) are decoded again by a second, linear link pattern.
  • M3: the mirror is tools/sota-sources/verify_sources.py, and it counts the four admitted line breaks as section content; the record names the path, and since e15d1259 the job's comment names the mirror without it.
  • Timing, restated as measured: on Node 24.21, 52 adversarial shapes at the bound each get a verdict within 0.46 s on this 64-CPU host at a load of about 25 (four runs, worst 0.39, 0.43, 0.41 and 0.46 s).
  • The new tests fail at 752d9618 (183 failures), and 12 of 12 weakened copies fail them. Codex's threads T1 to T11 are answered and resolved.
• The co-op's GPT read over 752d9618..e15d1259 (fix5): ACK, no blocker; its 7 P3s are in Follow-ups.
• The command center's Claude micro at e15d1259 (CHANGES_REQUESTED; three new privacy P1s, the class's third recurrence, rule 4) is answered in one commit, 30f2e005 (called terminal then; 4360b9e2 and d9eb2691 follow it). Each enumeration is replaced by the set a specification defines, in both copies:
  • N1: raw HTML other than a comment (an unknown tag, <font>, <input>, CDATA, a processing instruction) split a value, and GitHub drops it. The projection removes every raw-HTML construct of the GFM grammar (github/cmark-gfm@587a12bb test/spec.txt:9360-9431), from the body as written, a backslash-escaped < being text, by one linear scan. A construct standing alone between separators, such as a <user> placeholder in a path, is kept, since removing it would join the separators around it.
  • N2: named references outside the 16-name map (­, ‍, _, $) split or completed a value. Names are decoded from the HTML5 table as cmark-gfm pins it (src/entities.inc, 2,125 names), limited mechanically to the 297 whose text after the character projection is ASCII or nothing; a test regenerates that subset from a pinned fixture of the table.
  • N3: invisible characters outside Cc, Cf, Zl and Zp (variation selectors, CGJ, Hangul fillers, Mongolian free variation selectors, tag characters) split a value. The projection also removes every Default_Ignorable_Code_Point (UCD 17.0.0, 4,174 code points; Node 24.21's \p{Default_Ignorable_Code_Point} matches the same set).
  • Width forms: the projection applies NFKC, so a fullwidth solidus or fullwidth and mathematical letters read as ASCII.
  • S1: this description's stale sentences are corrected (the round-2 commit, the M3 comment, the obfuscation follow-up, the code-host exemption, the commands' head).
  • What the gate guarantees (since d9eb2691): a value spelled with its own characters is refused when it shows whole in the body as written, in the text the pinned renderer's inline parser displays for it (block structure approximated as the record states), or in their decodings. (This said "whatever is inserted between them" until d9eb2691; the GPT read and the micro at 4360b9e2 disproved it.) What it does not: a look-alike that substitutes a character (a division slash, a Cyrillic letter, another UTS Attach native command returns and usable dashboard evidence #39 confusable); a skeleton projection is a P2 follow-up.
  • Timing: on Node 24.21, 67 adversarial shapes at the bound each get a verdict within 0.47 s on this 64-CPU host at a load of about 18 (four runs, worst 0.46, 0.46, 0.45 and 0.47 s).
  • The new tests fail at e15d1259 (51 failures, 2 errors), and 11 of 11 weakened copies fail them.
• The co-op's GPT read at 30f2e005 (fix6, CHANGES_REQUESTED: one new P1 the terminal commit introduced, six P3s) is answered in one commit, 4360b9e2, as the command center's addendum 01 at e15d1259 accepted:
  • The placeholder exception shielded a comment between whitespace, so x Bearer <!--x--> and a 40-character token was refused at 260803e1 and accepted at 30f2e005, while GitHub hides the comment and shows the token whole; a tag, a processing instruction or CDATA in that place passed at both heads.
  • Two projections now: the credential rules read the body with every raw-HTML construct removed, wherever it stands; the home-path rules keep only a tag that stands alone between separators (the placeholder form). Every comment, processing instruction, declaration and CDATA section is removed from both.
  • Regressions in both copies: each construct between Bearer and its token and at the start of every ported token's value (ghp_, github_pat_, sk-ant-, hf_, tvly-), and a comment, processing instruction, declaration or CDATA between the separators of a Windows profile. They fail at 30f2e005 (12 failures) and pass at 4360b9e2; the placeholder controls pass on both; 3 of 3 weakened copies fail them. AKIA and xox prefixes have no ported rule here (the stated scope), so they are not among them.
  • Timing: on Node 24.21, 70 adversarial shapes at the bound each get a verdict within 0.83 s on this 64-CPU host at a load of about 15 (four runs, worst 0.67, 0.83, 0.63 and 0.65 s).
• The GPT read at 4360b9e2 (fix7, CHANGES_REQUESTED: Codex's five open threads, each a P1) and the command center's Claude micro at 4360b9e2 (CHANGES_REQUESTED: four new shape families and the guarantee) are answered in one commit, d9eb2691, under the command center's process for this class (the verdict files are the input). Each was a shape the hand-written Markdown decoder did not model, so the fix matches the text the pinned renderer shows instead of adding to the list:
  • The job's Markdown decoder is a port of github/cmark-gfm@587a12bb's inline parser for the text it displays (src/inlines.c: escapes, code spans, references, autolinks, raw HTML, links and images, emphasis with the flanking rules and the rule of three; extensions/strikethrough.c), with the block structure approximated (fenced code, container markers, table cells, emphasis matched by paragraph and by line).
  • Threads 4246122618 (a nested link destination: parentheses nest up to 32 deep, src/inlines.c:1074-1077), 4246122624 (a defined shortcut reference: the reference map, :1209, :1224) and 4246122650 (nested emphasis); the micro's 2a (escaped or emphasized underscores in a token), 2b (emphasis around _ or a separator), 2c (a tag before a forward-slash profile name: GitHub hides the tag, so the placeholder exception is gone) and 2d (all 2,125 named references now; the "no other name" premise was false).
  • Threads 4246122631 and 4246122640, in scripts/validate.py and both copies: an account name of any word characters (Unicode letters and digits too), and a bearer value in RFC 6750 2.1's b64token alphabet with = padding (rfc6750.txt:252-254). Over every tracked file the widened rules add no match.
  • The adjudicated T9 and T11 are settled by the port: an invalid numeric reference reads as U+FFFD, and an undefined reference stays as written.
  • Evidence: the built renderer passes its own specification harness (670 of 670); the port's text equals the renderer's on all 242 single-paragraph examples; over 76,360 generated bodies, 0 values the renderer shows are missed; a 3,732-body fixture of the renderer's verdicts is checked in both copies, and regenerated where gcc and the mirror are present.
  • The new tests fail at 4360b9e2 (35 failures) and pass at d9eb2691; 14 of 14 weakened copies fail them (one more, taking one emphasis delimiter at a time, shows the same text and is not counted).
  • Timing: on Node 24.21 the 70 adversarial shapes of the earlier rounds each get a verdict within 0.69 s at the bound (two runs, worst 0.65 and 0.69 s), against 0.77 s at 4360b9e2 run back to back, on a 64-CPU host at a load of about 16.
  • The micro's P3s: xox is in Follow-ups; the timing ratio is the measured one; the evidence table's timing row is this head's; the control that pinned the double-slash gap is gone (the gap stays a follow-up); the superseded weakened-copies run is noted beside the later one.
  • Codex's five threads are answered and resolved.

Follow-ups (not in this change):

• From the GPT read and the micro at 4360b9e2:
  • A renderer replacement (rendering in the job through GitHub's own Markdown API, or a maintained library) is the research-queue comparison the read names for the secrets-credentials layer.
  • Block structure is approximated: a footnote reference is shown as written, an HTML block or indented code is read as inline text, and GitHub's own additions beyond cmark-gfm (mentions, emoji, its sanitizer's allowlist) are not modeled.
  • Retained captures for the cited public sources, and the two live locators (blueprints/runtime-workers/openhands/resolver.py:456, blueprints/native-skill-practice/p1/README.md:14), as before; 18 existing hostname lines in manifests/evidence.json, none in the patch.
• From the co-op's GPT read at 30f2e005 (fix6):
  • T9 and T11, fail-safe false refusals as adjudicated, are settled in d9eb2691 (above).
  • Retained captures for the cited public sources, an ECMA-262 locator for String.prototype.normalize (NFKC), and a link-definition locator.
  • Two live locators still point before their targets: blueprints/runtime-workers/openhands/resolver.py:456 and blueprints/native-skill-practice/p1/README.md:14.
  • 18 existing hostname lines in manifests/evidence.json, none in the patch.
  • The adjacent limits stay explicit: publication before the check, retrieval and retry, the outgoing guard's order, and a tag standing alone between separators shown as escaped text by GitHub (C:\Users\<x>\alice is accepted: GitHub shows the escaped <x>, so the name is behind visible markup; a forward-slash profile behind a hidden tag is refused since d9eb2691).
• Main's stale final-stack source hash, which the read found on the merged base (rated P2, base only): Regenerate the final-stack manifest after #1018 changed one of its sources #1025 regenerated catalogs/landscape/final-stack.json after Move the claude-native-practice skill row to the commit that holds #1001, #1005 and #986 #1018, so it is fixed on main; recheck with python3 scripts/final_stack.py --check at the landing rebase.
• Two live line locators the diff moved: blueprints/runtime-workers/openhands/resolver.py:456 and blueprints/native-skill-practice/p1/README.md:14.
• Correction provenance: retained, pinned captures for the handwritten Markdown approximation, the URL exemption, the 256-character bound and the POSIX leading-slash rule; and the CommonMark qualification for bracket-free labels.
• The intentional decoding boundary (no fixed point), kept explicit in the record and in future test corpora.
• Machine-name references in the unchanged portions of manifests/evidence.json.
• Look-alikes (P2, the command center's ruling at e15d1259): a division slash, a fraction slash, a set minus, Cyrillic letters in home, Users, a graph id or ghp_, and other UTS Attach native command returns and usable dashboard evidence #39 confusables substitute a character rather than insert one, so the projection does not read them; a skeleton projection from the UTS Attach native command returns and usable dashboard evidence #39 confusables data would.
• Raw HTML inside a code span or code block was removed by the projection too, though GitHub shows it as text (settled in d9eb2691: the port shows it as text in a code span or fenced code, as GitHub does).
• From the co-op's GPT read over 752d9618..e15d1259 (fix5, ACK):
  • T9 and T11 stay fail-safe false positives (rated P3; settled in d9eb2691).
  • Retained, hashed captures for the cited public documents (CommonMark 0.31.2, the Unicode 17.0 data files, dotnet/docs, MicrosoftDocs/wsl), pinned mirrors, and a link-definition locator for the titled link pattern; the older provenance gaps (the handwritten Markdown approximation, the 256-character bound, the POSIX leading-slash rule).
  • Two live locators still point before their targets: blueprints/runtime-workers/openhands/resolver.py:456 and blueprints/native-skill-practice/p1/README.md:14.
  • 18 existing machine-name lines in manifests/evidence.json, none in the patch.
  • The adjacent boundaries (publication before the check, the outgoing guard's order, Verify the code citations in a PR's SOTA sources (W1b phase A, report-only) #1003's section-comment regex) stay explicit; a maintained renderer goes through the research queue.
  • The read's merge overlay lost executable bits for main's new landing scripts; rerun those tests in a mode-preserving merge.
• From Codex's reviews and the command center's micro at 752d9618:
  • T9: an invalid numeric character reference decoded to nothing, so /ho&#x110000;me/<name>/x was refused though GitHub shows U+FFFD; T11: an unresolved reference link was collapsed, so <home>/x was refused. Both failed safe on contrived text; settled in d9eb2691.
  • A value split across a line break or by a carriage return is not joined, and two layers of one encoding are not decoded.
  • #1003's section regex removes comments with <!--[\s\S]*?-->, which rescans from every unclosed <!--: 65,536 characters of them in the section take 0.49 s (7.8 s at the bound) on Node 24.21. Verify the code citations in a PR's SOTA sources (W1b phase A, report-only) #1003's mirror test pins that regex, so a linear form belongs with that test.
  • The 13 modules run below are named there; the micro found 12 that name PRIVATE_CONTENT (1,222 tests).
• From the command center's Claude read at 4e5ef13d:
  • Home-path forms that pass both scans: \home\<name>\ without a UNC prefix, \Users\<name>\ without a drive, \\host\c$\Users\<name>\, ~<name>/, /home//<name>/, and a Windows profile name that starts with a non-ASCII letter (caught since d9eb2691).
  • Double percent-encoding passes (the documented boundary: decoders run once). A zero-width space or a soft hyphen inside home is caught since 6a06673d, and a fullwidth solidus since 30f2e005 (NFKC); look-alikes are above.
  • A token glued after _ (KEY_sk-ant-...) has no word boundary in either scan, and gitleaks misses it too.
  • Credentials outside the ported set (AWS AKIA, Slack xox, a generic api_key): GitHub's partner secret scanning covers public pull request descriptions; running pinned gitleaks over the body is a research-queue candidate.
  • Titles, comments and the edit history are not scanned. After a body is fixed, the leaked revision stays public; the failure message could tell the author so.
  • The MDN capture digests in the record (cd0a2f97..., cf1a8e20...) no longer reproduce: retain the captures or cite the mdn/content commit.
  • The hand-written link decoder had two backtracking defects; it is replaced by the port in d9eb2691, and a maintained renderer stays in the research queue.

SOTA sources

• GitHub REST, Get a pull request, https://docs.github.com/en/rest/pulls/pulls#get-a-pull-request (read 2026-10-10T19:54Z): the pull request's body, which the job already reads through github.rest.pulls.get in actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 (v9.0.0).
• This repository's scripts/validate.py, PRIVATE_CONTENT at c4f499073 (lines 38-61): the rules ported. tests.test_sota_sources_gate keeps the JavaScript and Python versions in agreement, over a shared corpus and every assigned code point.
• gitleaks config/gitleaks.toml, rule private-key, at 83d9cd684c87 (https://github.com/gitleaks/gitleaks/blob/83d9cd684c87d95d656c1458ef04895a7f1cbd8e/config/gitleaks.toml#L2784-L2788): the private-key header form, kept case-sensitive.
• GitHub's REST update of a pull request, measured: the body-length probes above (2026-10-11T13:34Z to 14:19Z).
• Microsoft, "Working across file systems", https://learn.microsoft.com/en-us/windows/wsl/filesystems (read 2026-10-12T03:48:54Z): \\wsl$ in File Explorer. Its source and the WSL release notes at MicrosoftDocs/wsl@a1473a69: WSL/filesystems.md:34; WSL/wsl-config.md:162 (\\wsl.localhost\Ubuntu-20.04\etc\wsl.conf); WSL/release-notes.md:24 (Build 21354, \\wsl.localhost, and \\wsl$ keeps working), :76 (Build 20175, \\wsl), :145 (Build 19013, the \\wsl$ check is case-insensitive).
• Unicode's Bidi_Class B (paragraph separator) for the guard's line breaks, from the UCD 15.1.0 in Python 3.13.16's unicodedata (unicodedata.bidirectional); the test computes the set.
• CommonMark 0.31.2, an HTML comment is <!-->, <!--->, or <!-- up to --> (spec.txt:8986; https://spec.commonmark.org/0.31.2/spec.txt, read 2026-10-12T05:21:42Z, sha256 bfef4ddc...).
• Unicode 17.0.0, extracted/DerivedGeneralCategory.txt (https://www.unicode.org/Public/17.0.0/ucd/extracted/, read 05:21:42Z, sha256 d62e5bab...): Cc, Cf, Zl and Zp, 234 code points without tab, LF and CR; Node 24.21 carries Unicode 17.0 (ICU 78.3), and Python 3.13.16's 15.1.0 gives the same 234.
• dotnet/docs@8a189e07f74e50fa0e49551857c3b88d69a7630b docs/standard/io/file-path-formats.md: :94-95 (\\.\UNC\ and \\?\UNC\ device paths), :155 (forward slashes are separators), :206 (names are case-insensitive).
• github/cmark-gfm@587a12bb54d95ac37241377e6ddc93ea0e45439b: test/spec.txt:9360-9431 ("Raw HTML": open and closing tags, comments, processing instructions, declarations, CDATA) and :5946-5950 (entity references, with WHATWG's entities.json as the authority); src/entities.inc (the HTML5 table, 2,125 names, sha256 3932dfa6...), kept as tests/fixtures/cmark-gfm-entities-587a12bb.json.
• Unicode 17.0.0, DerivedCoreProperties.txt, Default_Ignorable_Code_Point (https://www.unicode.org/Public/17.0.0/ucd/, read 2026-10-12T08:01:08Z, sha256 24c7fed1...), and NFKC (String.prototype.normalize, ECMA-262).
• Verify the code citations in a PR's SOTA sources (W1b phase A, report-only) #1003's mirror, tools/sota-sources/verify_sources.py:141-143 (JS_LINE_BREAKS, JS_TRIM), and its test, tests/test_verify_sources.py:231 (test_the_mirror_and_the_workflow_script_pass_and_fail_the_same_bodies), with the edge bodies at :203 and :204.

Evidence-class table

Local commands run

# at d9eb2691 (on main 83cec12ee; it merges cleanly with main 9cfe3a964)
$ python3 -m unittest <the 27 modules that name PRIVATE_CONTENT, the gate or pr-metadata, the WSL recipe, the manifest and the push gate>
Ran 2179 tests, OK (skipped=6)
$ python3 -m unittest tests.test_sota_sources_gate tests.test_validate   # the new test files on 4360b9e2's code
FAILED (35 failures)
$ python3 scripts/validate.py
exit 0 (11758 hashed files); evidence_manifest.py --check: exit 0
$ actionlint .github/workflows/pr-metadata.yml .github/workflows/sota-sources-gate.yml
exit 0
$ zizmor --offline .github/workflows/pr-metadata.yml .github/workflows/sota-sources-gate.yml
No findings to report (6 suppressed)
$ gitleaks git --log-opts="4360b9e2..HEAD"
no leaks found
# at 4360b9e2
$ python3 -m unittest tests.test_sota_sources_gate tests.test_verify_sources tests.test_validate tests.test_workflow_hardening tests.test_workflow_security_coverage tests.test_workflow_policy tests.test_evidence_manifest tests.test_wsl_new_distro_recipe tests.test_runtime_worker_openhands_push_gate
Ran 555 tests, OK (skipped=1)
$ python3 -m unittest tests.test_sota_sources_gate tests.test_verify_sources   # the new test file on 30f2e005's job
FAILED (12 failures)
$ python3 -m unittest tests.test_validate tests.test_native_token_ci tests.test_host_receipts tests.test_hardware_profile tests.test_jev_p1_casepack tests.test_landscape_sweep_harness tests.test_memory_lifecycle_v2 tests.test_runtime_worker_openhands tests.test_runtime_worker_openhands_resolver tests.test_sdk_usage_scope tests.test_sota_convergence tests.test_sota_sources_gate tests.test_evidence_manifest
Ran 1234 tests, OK (skipped=4) (at the commit before the rebase)
$ python3 -m unittest tests.test_sota_sources_gate tests.test_verify_sources   # the new test file on e15d1259's job
FAILED (51 failures, 2 errors)
$ python3 scripts/validate.py
exit 0 (11757 hashed files); evidence_manifest.py --check: exit 0
$ actionlint .github/workflows/pr-metadata.yml .github/workflows/sota-sources-gate.yml
exit 0
$ zizmor --offline .github/workflows/pr-metadata.yml .github/workflows/sota-sources-gate.yml
No findings to report (6 suppressed)
$ gitleaks git --log-opts="$(git merge-base origin/main HEAD)..HEAD"
no leaks found
$ git merge-tree --write-tree origin/main HEAD   # main bb945f1cf
exit 0
# At 4e5ef13d the earlier body and the lane's record said 11422 hashed files; the read measured 11,658 there.

Decision record

docs/decisions/2026-09-25-top-rule-sota-sources.md, "PR-body privacy scan (2026-10-10)", "After the first review", "After Codex's review (2026-10-11)", "After the second GPT read (2026-10-11)" "After the command center's Claude read of 4e5ef13d (2026-10-12)", "After the command center's Claude micro of 752d9618 (2026-10-12, fix round 2)" "After the command center's Claude micro of e15d1259 (2026-10-12, the terminal commit)", with its addendum 01 and addendum 02 (d9eb2691).

🤖 Generated with Claude Code