@event4u/agent-config 9.6.0 → 9.7.0

package/docs/benchmark.md

@@ -559,7 +559,7 @@ replication on a per-token-billed key.
 - Runner: `src/scripts/bench_ab_v2_run.ts --host codex` (checkpoint-resumable).
 - Roadmap: `agents/roadmaps/archive/road-to-opt-measurement-unblock.md` Phase 2.
 
-## adversarial-verification-council finding coverage — UNBACKED (pending corpus + run)
+## adversarial-verification-council finding coverage — HONEST NULL (resolved 2026-07-21)
 
 Pre-registered claim `adversarial-council-finding-coverage` (docs/CLAIMS.md,
 ADR-122): on the RESIDUAL defect pool — defects that survive a single strong
@@ -574,14 +574,38 @@ controversial-but-correct control.
   **AND** absolute >= +8 pp, **AND** panel FP not worse than baseline within
   noise — encoded + tested in
   [`src/scripts/_lib/adversarial_council_gate.ts`](../src/scripts/_lib/adversarial_council_gate.ts).
-- **Status: UNBACKED.** The corpus-validity gate BLOCKS the registered run: the
-  existing `internal/bench/orchestration/corpus/` was built for cross-vendor
-  *parity* (obvious, model-differentiating defects), not judge-survivable
-  residual subtleties, so a run on it would be a measurement artifact (the
-  council's Round-1 critique). Resolving the claim needs (1) a curated
-  judge-survivable-subtlety corpus with a published distribution, then (2) a
-  maintainer-gated paid cross-vendor run. Honest-null on that run keeps the
-  surface default-off permanently, like recursive-verification.
+- **Status: HONEST NULL (resolved 2026-07-21).** A curated judge-survivable
+  corpus was built (`internal/bench/adversarial-council/`: 12 planted-defect
+  fixtures across 4 subtlety classes + 3 controversial-but-correct clean
+  controls; subtlety distribution published; passed an independent validity
+  audit after one fixture was repaired). The registered cross-vendor run
+  (anthropic `claude-sonnet-4-5` + openai `gpt-4o`, spend-authorized) resolved
+  the claim NEGATIVE:
+
+  | quantity | value |
+  |---|--:|
+  | judge-passed residual pool | 5–7 defects (missed by both neutral passes) |
+  | single-skeptic residual recall | 0.60 |
+  | 2-vendor panel residual recall | 0.60 (**zero lift**) |
+  | single-skeptic FP on clean controls | 1.00 |
+  | panel FP on clean controls | 1.00 |
+
+  The second vendor's residual catches were a **strict subset** of the first's,
+  so the panel added no marginal coverage; both recall thresholds (+25% rel,
+  +8 pp abs) missed → **honest-null**. Under the adversarial-skeptic posture
+  both the single skeptic and the panel false-flagged **all three**
+  controversial-but-correct controls (100% FP) — the posture over-flags correct
+  code. Stable across two runs. Per the locked gate, the Mode 9 surface stays
+  **default-off permanently** (like recursive-verification). Reproducible
+  artifact: `internal/bench/adversarial-council/runs/`.
+- **Transport lesson.** The first run attempted via `council_cli run` was
+  REJECTED as a measurement artifact: that transport runs multi-round
+  peer-review with cross-member visibility and returns prose ("Round 2 …
+  Reviewer A"), which both violates the independent-skeptic requirement and
+  defeats JSON scoring. The valid run uses direct, independent per-vendor
+  client calls (`bench_adversarial_council.ts`) with a strict-JSON system
+  prompt and a deterministic, pre-validated scorer
+  (`adversarial_bench_score.ts` + its synthetic red/green test).
 
 
 ## Defect-finding: team vs self-review vs council (2026-07-20) — HONEST NULL (ceiling-limited) {#honest-null-defect}

package/docs/decisions/ADR-122-adversarial-verification-council.md

@@ -134,3 +134,33 @@ Each settled decision this roadmap does NOT touch:
   ADR-120 (council chairman mode), ADR-109 (subagent-v1 contract).
 - `docs/CLAIMS.md#adversarial-council-finding-coverage` — the pre-registered claim.
 - `cross-vendor-parity` (backed) — the evidence the finding-coverage scope rests on.
+
+## Addendum (2026-07-21) — finding-coverage claim resolved HONEST-NULL
+
+The pre-registered `adversarial-council-finding-coverage` claim was executed and
+resolved **negative**. A curated judge-survivable corpus
+(`internal/bench/adversarial-council/`: 12 planted-defect fixtures across
+multi-file-interaction / logic-inversion / security-masked / complex-state + 3
+controversial-but-correct clean controls; subtlety distribution published;
+passed an independent validity audit after one fixture was repaired) was run
+cross-vendor (anthropic `claude-sonnet-4-5` + openai `gpt-4o`) under the
+maintainer spend authorization.
+
+**Result:** on the judge-passed residual, the 2-vendor skeptic panel matched the
+single skeptic exactly (residual recall 0.60 = 0.60, **zero lift** — the second
+vendor's catches were a strict subset of the first's), at a **100%** false-
+positive rate on the controversial-but-correct controls under the adversarial-
+skeptic posture. Both locked recall thresholds missed -> honest-null. **The
+Mode 9 `adversarial-verification-council` surface stays default-off permanently**
+(no settings change — it already ships off), recorded like recursive-verification
+(ADR-106). Detail + reproducible artifact:
+`docs/benchmark.md#adversarial-verification-council`,
+`internal/bench/adversarial-council/runs/`.
+
+**Transport lesson (durable):** `council_cli run`/`debate` is a *deliberation*
+transport — multi-round peer-review with cross-member visibility, prose output.
+It is the WRONG tool for an independent-skeptic, structured-output benchmark (it
+violated the independence requirement and defeated JSON scoring; the first run
+through it was rejected as an artifact). The valid measurement uses direct,
+independent per-vendor client calls with a strict-JSON contract and a
+deterministic, pre-validated scorer.

package/docs/decisions/ADR-123-runtime-security-scope-and-spawn-hardening.md

@@ -109,3 +109,34 @@ are also rejected: per-file pragma containment (`security_lint.ts`) only.
   costs nothing to keep.
 - **Env allowlist instead of deny-by-family.** Rejected — would strip env the
   provider CLIs need and rot as new good vars appear.
+
+## Follow-up (2026-07-21) — `road-to-spawn-env-completion`
+
+The 9.6.0 external review reproduced a working exploit against the fix this ADR
+shipped: `GIT_CONFIG_COUNT` / `GIT_CONFIG_KEY_<n>` / `GIT_CONFIG_VALUE_<n>` (and
+`GIT_CONFIG_GLOBAL` / `_SYSTEM`) survived the deny-by-family scrub — the
+`GIT_*_COMMAND` family missed them (no `_COMMAND` suffix) — letting an attacker
+set arbitrary git config (`core.fsmonitor` runs shell on every `git status`,
+which the consumer-runtime hooks trigger). `GIT_ALTERNATE_OBJECT_DIRECTORIES`
+and `HOSTALIASES` also leaked. **Confirmed empirically (all 5) and closed:**
+`hardenedSpawnEnv` now denies the whole `GIT_CONFIG`/`GIT_CONFIG_*` family by
+prefix plus the two exact vars, with falsifiable test vectors (red without the
+fix, green with it).
+
+**`maintainer-ci-spawn-sweep` blocker — resolved by classification, not mass
+migration.** Rather than migrate ~15 low-risk maintainer/CI sites, all spawn
+sites are now classified in `docs/spawn-site-policy.md` (Consumer Runtime /
+Maintainer CLI / trusted CI / install-time). The consumer-runtime dispatcher
+(`hooks/dispatch_hook.ts`) — missed in PR #984 — now routes through
+`hardenedSpawnEnv`; the maintainer/CI/install sites are documented exempt with
+rationale (env is maintainer- or workflow-controlled, not attacker-influenced).
+
+**Secure-spawn lint — rejected (council 2026-07-21, claude-sonnet-4-5 +
+gpt-4o).** A CI lint forbidding raw spawn in runtime paths was proposed (P0 in
+the review) but rejected: it is net-new governance surface (a CI gate +
+allowlist + exemption-adjudication + false-positive triage), which the folded
+complexity-budget lock (PR #983) forbids — the lock text explicitly lists
+"linter". The "retires ad-hoc review" justification failed the retirement test
+(no such review gate exists to retire). `docs/spawn-site-policy.md` is the
+self-enforcing substitute: its completeness claim is checked by git-diff
+visibility at review time, not a build gate.

package/docs/spawn-site-policy.md

@@ -0,0 +1,72 @@
+# Spawn-Site Policy — subprocess env-hardening classification
+
+> Every place agent-config spawns a subprocess is classified into one of four
+> buckets. The bucket decides whether the spawn MUST route its environment
+> through `hardenedSpawnEnv()` (`src/scripts/_lib/spawn_env.ts`). This document
+> is the single authoritative inventory — a new spawn site is visible in a PR
+> diff as either an addition to a bucket below or an unclassified site that
+> contradicts this doc's completeness claim. That git-diff visibility is the
+> enforcement mechanism (a dedicated lint was considered and **rejected** — see
+> ADR-123 and the "No lint" note below).
+
+## The buckets
+
+| Bucket | Definition | Env rule |
+|---|---|---|
+| **Consumer Runtime** | Runs on the end-user's machine as part of the installed package — the hook dispatcher, dispatched hook concerns, and the AI-council CLI transport. The parent `process.env` is whatever the user's agent/shell exposes and is influenceable by repo content the agent just read. | **MUST** pass `env: hardenedSpawnEnv(overrides?)`. |
+| **Maintainer CLI / tooling** | Runs on a maintainer's dev machine, invoked explicitly (benchmarks, fixture replay, wizards, one-off scripts). The env is the maintainer's own. | SHOULD prefer the helper; MAY use raw env with a stated reason. Not attacker-controlled. |
+| **CI (trusted)** | Runs inside this repo's GitHub Actions on the repo's own refs (git/gh helpers reading `git log` / `gh pr view`). Env is set by the workflow file, not by PR content; fork PRs get no secrets. | Raw env permitted. Migrate only if a job begins consuming untrusted fork content into its env. |
+| **Install-time** | Runs during `npx`/install (the installer spawning package managers from a lockfile). | Raw env permitted; installs are lockfile-pinned. Revisit if an installer step ingests untrusted input. |
+
+## Consumer-Runtime inventory (the security-critical set)
+
+All Consumer-Runtime spawns route through `hardenedSpawnEnv()`:
+
+| Site | Spawns | Status |
+|---|---|---|
+| `src/scripts/ai_council/clients.ts::_runSubprocess` | provider CLIs (`codex`/`claude`/`gemini`) | ✅ hardened (ADR-123 / PR #984) |
+| `src/scripts/hot_context_hook.ts` | `git rev-parse` | ✅ hardened (PR #984) |
+| `src/scripts/roadmap_progress_hook.ts` | tsx regenerator (runs git) | ✅ hardened (PR #984) |
+| `src/scripts/hooks/dispatch_hook.ts` | every hook concern via tsx | ✅ hardened (this roadmap) |
+| `src/scripts/hooks/replay_hook.ts` | re-dispatches through the runtime | Maintainer/fixture tool; its downstream concern spawn is hardened by `dispatch_hook` above. Exempt at this layer. |
+
+Any NEW consumer-runtime spawn (a new hook that shells out, a new installed
+runtime path) MUST be added to this table and route through `hardenedSpawnEnv`.
+
+## Maintainer / CI / Install (exempt, with rationale)
+
+The remaining spawn sites (benchmarks `bench_*`, `consumer_matrix`, the
+installer `install.ts`, the fleet CLI, and the ~15 git/gh maintainer helpers
+such as `check_trunk_drift`, `evidence_report`, `print_required_checks`,
+`check_release_pr_shape`, `migration_status`, …) are Maintainer CLI, trusted CI,
+or install-time. Their environment is the maintainer's own or GitHub Actions'
+workflow-controlled env — not influenced by untrusted repo content the agent
+read at runtime. They are exempt from the MUST rule. A maintainer/CI site moves
+to the Consumer-Runtime bucket (and MUST harden) only if it starts running on an
+end-user machine or ingesting untrusted fork content into its spawn env.
+
+## What `hardenedSpawnEnv` scrubs
+
+Deny-by-family (not an allowlist — the CLIs legitimately need arbitrary env):
+dynamic loader (`LD_*`, `DYLD_*`, `GCONV_PATH`), git command hooks
+(`GIT_*_COMMAND`, `GIT_EXTERNAL_DIFF`, `GIT_SSH_COMMAND`, `GIT_PAGER`, `PAGER`),
+**git config-injection** (`GIT_CONFIG` and the whole `GIT_CONFIG_*` family —
+`GIT_CONFIG_COUNT`/`_KEY_<n>`/`_VALUE_<n>`/`_GLOBAL`/`_SYSTEM`, the
+`core.fsmonitor` RCE primitive), `GIT_ALTERNATE_OBJECT_DIRECTORIES`,
+`HOSTALIASES`, runtime auto-exec hooks (`NODE_OPTIONS`, `BASH_ENV`, `ENV`,
+`PYTHON*`, `PERL5*`, `RUBYOPT`), and `IFS`. Everything else is preserved.
+
+## No lint (deliberate)
+
+A CI lint forbidding raw spawn in runtime paths was proposed and **rejected**
+(council 2026-07-21; recorded in ADR-123): it is net-new governance surface (a
+CI gate + allowlist + exemption-adjudication + false-positive triage), which the
+complexity-budget lock forbids ("must not become a new rule/linter/gate"). This
+inventory doc is the self-enforcing substitute — its completeness claim is
+checked by git-diff visibility at review time, not by a build gate.
+
+## See also
+
+- `docs/decisions/ADR-123-runtime-security-scope-and-spawn-hardening.md` — the runtime-security scope decision + the rejected-lint record.
+- `docs/threat-model.md` row (g) — the subprocess-env-inheritance vector.
+- `src/scripts/_lib/spawn_env.ts` — the helper.

package/docs/threat-model.md

@@ -16,7 +16,7 @@ and holds no user data. Threats are about **artifact integrity** and
 | d | **Lethal-trifecta surface** — a skill combining private-data access + untrusted-content ingestion + external communication on one autonomous path enables confused-deputy / data-exfiltration attacks | Prompt-injected content inside a fetched doc instructs an agent to read a local secret and POST it to an attacker-controlled endpoint | `src/rules/lethal-trifecta-guard.md` (Iron Law: break one leg or gate egress behind human-in-the-loop); `src/rules/untrusted-input-defense.md` (untrusted content is data, never instructions; spotlighting); `lint_skill_frontmatter_safety.py` (flags over-broad tool grants) | These are authoring-time controls — no runtime *behavioural-enforcement* layer exists (input sanitization ≠ enforcement — see ADR-123) | Runtime behavioural enforcement stays out of scope for AC (`ADR-123-runtime-security-scope-and-spawn-hardening`): AC ships the rules, the consumer's tool-execution layer enforces them; the outbound content-scan guard is deferred with a `revisit-if`, not silently dropped. `lethal-trifecta-guard.md` and `untrusted-input-defense.md` are the canonical reference — do not re-describe here |
 | e | **Malicious metadata / frontmatter injection** — a PR embeds hostile YAML in a skill's frontmatter (e.g. injecting a trigger keyword that causes a dangerous skill to fire in unintended contexts, or adding `permissionMode: bypassPermissions`) | PR contributor adds `permissionMode: bypassPermissions` or a wildcard `allowed_tools: ["*"]` entry to an existing skill's frontmatter; or crafts a trigger keyword to hijack routing | `lint_skill_frontmatter_safety.py` — HIGH-severity block on `bypassPermissions`, wildcard `allowed_tools`, unsafe `execution.type: automated` without safety floor; `lint_hidden_unicode.py` — catches invisible chars inside frontmatter YAML values; PR review gate; `scripts/validate_frontmatter.py` schema validation | Schema validation does not verify trigger-keyword semantic safety (a plausible keyword that causes over-broad firing is not caught) | Extend `validate_frontmatter.py` to flag trigger keywords that match security-sensitive path prefixes (e.g. a skill triggering on `"auth"` when it has `execution.type: automated`) |
 | f | **Skill self-update — safety-floor rewrite** — an agent is social-engineered (via chat or a PR) into weakening a kernel rule, safety floor, or MCP/tool allowlist | A PR removes the Iron Law block from `non-destructive-by-default.md`; or a chat prompt instructs the agent to edit `security-sensitive-stop.md` to narrow its self-modification clause; or a PR modifies `scope-control` to remove the Hard Floor | `src/rules/security-sensitive-stop.md` — "self-modification via chat" clause: requests to weaken safety floors / kernel rules / MCP allowlists must route through `scope-control` gates; `src/rules/scope-control.md` — kernel-rule edits require own PR + ≥ 24 h soak; `dist/agent-src/` is read-only (source-of-truth rule); `scripts/check_condensation.py` detects Iron-Law section deletion or downgrade | No automated per-rule diff check that fires specifically when a kernel rule's Iron Law section is removed; relies on PR reviewer recognising the file class | Add a CI check (`scripts/check_kernel_rule_integrity.py` — P3+) that asserts Iron Law fenced-code blocks survive unchanged in all files listed in `docs/contracts/kernel-membership.md` |
-| g | **Subprocess spawn-env inheritance** — AC's own transport spawns an external CLI (the AI-council provider CLIs; consumer-runtime hooks spawn `git`) with the full parent `process.env`, so an attacker-influenced env var in the parent becomes RCE when the child (or a `git` it invokes internally) runs | A poisoned `GIT_EXTERNAL_DIFF` / `core.pager` / `GIT_SSH_COMMAND`, a dynamic-loader `LD_PRELOAD` / `DYLD_INSERT_LIBRARIES` / `GCONV_PATH`, or a runtime hook `NODE_OPTIONS` / `BASH_ENV` / `PYTHONSTARTUP` present in the parent env executes attacker code inside the spawned process (CWE-426, CWE-88, CWE-427) | `src/scripts/_lib/spawn_env.ts::hardenedSpawnEnv()` scrubs the code-execution-injection env families (deny-by-family: loader `LD_*`/`DYLD_*`/`GCONV_PATH`, git `*_COMMAND`/`GIT_EXTERNAL_DIFF`/`GIT_SSH_COMMAND`/`GIT_PAGER`/`PAGER`, runtime hooks `NODE_OPTIONS`/`BASH_ENV`/`ENV`/`PYTHON*`/`PERL5*`/`RUBYOPT`, `IFS`) and preserves the rest; wired into `clients.ts::_runSubprocess`, `roadmap_progress_hook.ts`, `hot_context_hook.ts`; falsifiable regression test in `tests/scripts/ai_council/spawn_env.test.ts` (ADR-123) | Maintainer-only CI/git-helper spawn sites (~15) still inherit env — lower risk (trusted CI, low attacker-control) | Mechanical sweep applying `hardenedSpawnEnv` to the remaining CI/git-helper spawn sites (deferred — `maintainer-ci-spawn-sweep` blocker) |
+| g | **Subprocess spawn-env inheritance** — AC's own transport spawns an external CLI (the AI-council provider CLIs; consumer-runtime hooks spawn `git`) with the full parent `process.env`, so an attacker-influenced env var in the parent becomes RCE when the child (or a `git` it invokes internally) runs | A poisoned `GIT_EXTERNAL_DIFF` / `core.pager` / `GIT_SSH_COMMAND`, the `GIT_CONFIG_COUNT`/`_KEY_<n>`/`_VALUE_<n>` config-injection trio (sets `core.fsmonitor` → shell on every `git status`), a dynamic-loader `LD_PRELOAD` / `DYLD_INSERT_LIBRARIES` / `GCONV_PATH`, `GIT_ALTERNATE_OBJECT_DIRECTORIES` / `HOSTALIASES`, or a runtime hook `NODE_OPTIONS` / `BASH_ENV` / `PYTHONSTARTUP` present in the parent env executes attacker code inside the spawned process (CWE-426, CWE-88, CWE-427) | `src/scripts/_lib/spawn_env.ts::hardenedSpawnEnv()` scrubs the code-execution-injection env families (deny-by-family: loader `LD_*`/`DYLD_*`/`GCONV_PATH`, git `*_COMMAND` + the whole `GIT_CONFIG`/`GIT_CONFIG_*` family + `GIT_ALTERNATE_OBJECT_DIRECTORIES`/`HOSTALIASES`/`GIT_EXTERNAL_DIFF`/`GIT_SSH_COMMAND`/`GIT_PAGER`/`PAGER`, runtime hooks `NODE_OPTIONS`/`BASH_ENV`/`ENV`/`PYTHON*`/`PERL5*`/`RUBYOPT`, `IFS`) and preserves the rest; wired into ALL consumer-runtime spawns — `clients.ts::_runSubprocess`, `hooks/dispatch_hook.ts`, `roadmap_progress_hook.ts`, `hot_context_hook.ts`; falsifiable regression test in `tests/scripts/ai_council/spawn_env.test.ts` (ADR-123 + 2026-07-21 follow-up) | — (consumer-runtime surface fully hardened; maintainer/CI/install sites are env-controlled, not attacker-influenced) | Spawn sites classified in `docs/spawn-site-policy.md` (Consumer Runtime MUST harden / Maintainer / CI / install exempt with rationale); the deferred lint was rejected — the policy doc is the self-enforcing substitute |
 
 ## Review cadence
 

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
-    "version": "9.6.0",
-    "description": "Universal AI Agent OS — audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
+    "version": "9.7.0",
+    "description": "Universal AI Agent OS — audited skills, governance rules, commands and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
     "license": "MIT",
     "private": false,
     "type": "module",

package/src/agent-src/README.md

@@ -1,8 +1,8 @@
 # Agent Infrastructure
 
 > **⚠️ DO NOT edit files in `dist/agent-src/` or `.augment/` directly.**
-> The source of truth is `.agent-src.uncondensed/`. Edit there, then run `task sync`.
-> See `.agent-src.uncondensed/commands/condense.md` for the full workflow.
+> The source of truth is `src/` (`src/skills/`, `src/rules/`, `src/agent-src/`). Edit there, then run `task sync`.
+> See the `source-of-truth` rule and the `/condense` command for the full workflow.
 
 This directory contains the shared agent infrastructure: skills, commands, rules, guidelines,
 templates, and contexts that power the AI coding assistant across all projects.

package/src/scripts/_lib/adversarial_bench_score.ts

@@ -0,0 +1,106 @@
+/**
+ * Deterministic scorer for the adversarial-council residual-detection benchmark
+ * (road-to-adversarial-council-benchmark Phase 1).
+ *
+ * Pure + countable — never LLM-computed (the anti-lesson from ADR-122). Given a
+ * corpus item's ground truth and a reviewer's structured findings, decide
+ * whether the reviewer CAUGHT the planted defect (for a defect fixture) or
+ * raised a FALSE POSITIVE (for a clean control). The two-stage recalls and FP
+ * rates this produces feed `evaluateCouncilBench` (adversarial_council_gate.ts).
+ *
+ * Matching rule (deliberately NOT exact file:line — the scorer bug from the
+ * earlier defect-finding benchmark required an exact line token and mis-scored
+ * genuine catches that cited a nearby line): a finding CATCHES a planted defect
+ * iff it names one of the defect's file(s) by basename AND its category falls in
+ * the same normalized family as the planted defect. Line numbers are advisory,
+ * never required. This credits a real catch that localizes the right file +
+ * defect class, and denies credit for a scattershot "something's wrong here"
+ * with the wrong class.
+ */
+
+/** Normalize a free-form category string to a coarse family. */
+export function categoryFamily(raw: string): string {
+    const c = raw.toLowerCase().replace(/[^a-z]/g, '');
+    if (/(accesscontrol|authz|authorization|idor|bola|ownership|privilege|rbac)/.test(c)) return 'access-control';
+    if (/(auth|authentication|session|credential|login)/.test(c)) return 'auth';
+    if (/(ssrf|serverside)/.test(c)) return 'ssrf';
+    if (/(pathtraversal|traversal|directorytraversal|lfi)/.test(c)) return 'path-traversal';
+    // NB: no bare "rce" token — it substring-matches inside "resou[rce]leak".
+    if (/(injection|sqli|xss|commandinjection|deserial|remotecodeexec)/.test(c)) return 'injection';
+    if (/(crypto|cryptographic|timing|constanttime|hash|signature)/.test(c)) return 'crypto';
+    if (/(concurrency|race|atomic|deadlock|idempoten)/.test(c)) return 'concurrency';
+    if (/(resourceleak|leak|memory|handle|unsubscrib|cleanup)/.test(c)) return 'resource-leak';
+    if (/(dataintegrity|integrity|corrupt|consistency|stale)/.test(c)) return 'data-integrity';
+    if (/(correctness|logic|offbyone|boundary|edgecase|bug)/.test(c)) return 'correctness';
+    return 'other';
+}
+
+export interface Finding {
+    /** File the finding points at (any path form; matched by basename). */
+    file: string;
+    /** Reviewer-supplied category (free text; normalized via categoryFamily). */
+    category: string;
+    /** Reviewer confidence, if given. Low-confidence findings can be excluded from FP counting. */
+    confidence?: 'high' | 'medium' | 'low';
+}
+
+export interface GroundTruth {
+    id: string;
+    /** true = clean control (no defect); a finding here is a false positive. */
+    is_clean: boolean;
+    /** Basenames of the file(s) the planted defect lives in (empty for clean). */
+    defect_files: string[];
+    /** Planted defect category family (via categoryFamily); empty for clean. */
+    defect_category: string;
+}
+
+function basename(p: string): string {
+    return p.split(/[\\/]/).pop() ?? p;
+}
+
+/**
+ * Did the reviewer CATCH the planted defect? file-basename match on any defect
+ * file AND category-family match. Clean controls always return false (they have
+ * no defect to catch — use `isFalsePositive` for them).
+ */
+export function caughtDefect(truth: GroundTruth, findings: Finding[]): boolean {
+    if (truth.is_clean) return false;
+    const wantFiles = new Set(truth.defect_files.map(basename));
+    const wantFamily = truth.defect_category;
+    return findings.some(
+        (f) => wantFiles.has(basename(f.file)) && categoryFamily(f.category) === wantFamily,
+    );
+}
+
+/**
+ * Did the reviewer raise a FALSE POSITIVE on a clean control? Any finding that
+ * points at the control file counts (a claimed defect where none exists).
+ * Low-confidence findings are excluded — a hedged "might check X" is not a FP
+ * claim. Non-clean fixtures always return false.
+ */
+export function isFalsePositive(truth: GroundTruth, findings: Finding[]): boolean {
+    if (!truth.is_clean) return false;
+    return findings.some((f) => (f.confidence ?? 'high') !== 'low');
+}
+
+export interface StageResult {
+    /** Per-defect-fixture: id → caught?. Excludes clean controls. */
+    caught: Record<string, boolean>;
+    /** Per-clean-control: id → false-positive?. */
+    fp: Record<string, boolean>;
+}
+
+/** Recall over a set of defect ids, given per-id caught flags. */
+export function recall(caught: Record<string, boolean>): number {
+    const ids = Object.keys(caught);
+    if (ids.length === 0) return 0;
+    const hits = ids.filter((id) => caught[id]).length;
+    return hits / ids.length;
+}
+
+/** FP rate over clean controls. */
+export function fpRate(fp: Record<string, boolean>): number {
+    const ids = Object.keys(fp);
+    if (ids.length === 0) return 0;
+    return ids.filter((id) => fp[id]).length / ids.length;
+}

package/src/scripts/_lib/spawn_env.ts

@@ -14,6 +14,11 @@
  *   - git command-injection (CWE-88): GIT_EXTERNAL_DIFF, GIT_SSH,
  *     GIT_SSH_COMMAND, GIT_PROXY_COMMAND, any GIT_*_COMMAND, GIT_PAGER, PAGER —
  *     git runs these as shell commands (`core.pager` / external-diff RCE).
+ *   - git config-injection (CWE-88): the GIT_CONFIG* family (GIT_CONFIG,
+ *     GIT_CONFIG_GLOBAL/_SYSTEM, and inline GIT_CONFIG_COUNT / GIT_CONFIG_KEY_<n>
+ *     / GIT_CONFIG_VALUE_<n>) sets ANY git config — `core.fsmonitor` runs shell
+ *     on every `git status`; GIT_ALTERNATE_OBJECT_DIRECTORIES / HOSTALIASES
+ *     redirect object stores / hostname resolution.
  *   - runtime auto-exec hooks: NODE_OPTIONS (`--require attacker.js`),
  *     BASH_ENV / ENV (sourced by non-interactive shells), PYTHONPATH /
  *     PYTHONSTARTUP / PYTHONINSPECT, PERL5OPT / PERL5LIB, RUBYOPT.
@@ -45,6 +50,13 @@ const DENY_EXACT: ReadonlySet<string> = new Set([
     'GIT_PROXY_COMMAND',
     'GIT_PAGER',
     'PAGER',
+    // git config-injection: GIT_ALTERNATE_OBJECT_DIRECTORIES can point git at
+    // attacker-controlled object stores; the GIT_CONFIG* family is handled by
+    // prefix below (it is a general arbitrary-config-injection primitive).
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+    // resolver hijack: HOSTALIASES remaps hostnames via an attacker file,
+    // redirecting any network fetch the child performs (CWE-427-adjacent).
+    'HOSTALIASES',
     // runtime auto-exec hooks
     'NODE_OPTIONS',
     'BASH_ENV',
@@ -61,14 +73,22 @@ const DENY_EXACT: ReadonlySet<string> = new Set([
 
 /**
  * Prefix families removed by pattern. `LD_` / `DYLD_` cover loader variants we
- * did not enumerate; `GIT_*_COMMAND` covers every git config-command hook
- * (e.g. GIT_ASKPASS is intentionally NOT here — it is a path, not a shell
- * command, and legitimate credential helpers need it; the *_COMMAND family is
- * the shell-executed one).
+ * did not enumerate; `GIT_*_COMMAND` covers every git config-command hook; the
+ * `GIT_CONFIG` family (GIT_CONFIG, GIT_CONFIG_GLOBAL, GIT_CONFIG_SYSTEM, and the
+ * inline GIT_CONFIG_COUNT / GIT_CONFIG_KEY_<n> / GIT_CONFIG_VALUE_<n> trio) is a
+ * general arbitrary-config-injection primitive — an attacker can set ANY git
+ * config key, e.g. `core.fsmonitor` / `core.pager` / `core.sshCommand` /
+ * `core.hooksPath` / `alias.*`, all of which git executes as shell on ordinary
+ * operations (`git status` alone runs `core.fsmonitor`). The plain `GIT_*_COMMAND`
+ * check missed it (no `_COMMAND` suffix), so it is denied by its own prefix.
+ * (GIT_ASKPASS is intentionally NOT denied — it is a path, not a shell command,
+ * and legitimate credential helpers need it; the *_COMMAND family is the
+ * shell-executed one.)
  */
 function isDeniedByFamily(name: string): boolean {
     if (name.startsWith('LD_') || name.startsWith('DYLD_')) return true;
     if (name.startsWith('GIT_') && name.endsWith('_COMMAND')) return true;
+    if (name === 'GIT_CONFIG' || name.startsWith('GIT_CONFIG_')) return true;
     return false;
 }