chore(housekeeping): round 9 — doc-drift, dead artifacts, PR-time anti-pattern gating (no build bump)

First round in the 552->629 hardening series with no build bump. All
edits are repo housekeeping; no runtime behavior change. Appropriate
signal that we're now in pure cleanup territory.

Tier 1.1: fim_code_modified -> fim_file_modified doc drift fix.
    Round 8 verification showed the actual emitted action name is
    fim_file_modified; prose in 4 sites called it fim_code_modified.
    Fixed bin/wl_fim.py comments (2) and prior CHANGELOG round-7 +
    round-6 entries (2). The round-8 drift-discovery entry is left
    intact (it correctly reports both names).

Tier 1.2: stale dist/ artifacts removed. wl_manager-1.0.0.spl and
    wl_manager-2.0.0.spl (+ .sha256 sidecars) predated build 406;
    current is 629. Empty dist/ now; package.sh writes fresh
    artifacts on next run.

Tier 1.3: 17 root-level PNG screenshots gitignored via /*.png
    (root-only). Session debris from past Playwright runs no longer
    pollutes git status. Canonical product screenshots under
    docs/screenshots/ remain tracked.

Tier 1.4: PR-time anti-pattern gating via Semgrep. New rule
    tests/semgrep/payload-from-flag-bypass-splunk.yaml catches at
    PR-review time what TestNoUnderscoreFlagPayloadBypass catches
    at test-run time. Pattern-mode (not taint-mode) because the
    anti-pattern is a structurally-illegitimate code shape, not a
    tainted dataflow. Writes (LHS of assignment) excluded via
    pattern-not-inside. Verified: 4/4 positive cases fire, 0/3
    negative cases fire, 0 findings on current bin/ (existing
    code already clean per round 7 A1 cleanup).

Author: wildleo91

.gitignore

@@ -53,6 +53,13 @@ login-check
 *.log
 *.patch
 
+# Session debris — screenshots taken during dev / Playwright runs end up
+# at the repo root and accumulate. Canonical product screenshots live
+# under docs/screenshots/ (still tracked because they don't match this
+# root-only pattern). Round 9 (2026-04-29) — was 17 untracked PNGs at
+# the root from past sessions, all session debris.
+/*.png
+
 # OS files
 .DS_Store
 .DS_Store?

CHANGELOG.md

@@ -2,6 +2,60 @@
 
 All notable changes to this project will be documented in this file.
 
+## Unreleased — 2026-04-29 (build 629, no app changes)
+
+### Round 9: housekeeping — doc-drift, dead artifacts, PR-time anti-pattern gating
+
+No runtime behavior change. All edits are repo housekeeping that the
+prior 8 rounds accumulated. First round in the 552→629 series with no
+`app.conf [install] build` bump — appropriate signal that we're now
+in pure cleanup territory.
+
+#### Fixed (doc drift only)
+
+- **`fim_code_modified` → `fim_file_modified`** in `bin/wl_fim.py`
+  comments (2 sites) and prior round-7 + round-6 CHANGELOG prose
+  entries. Round 8 verification surfaced the drift: a search for
+  `fim_code_modified` returned zero rows because the actual emitted
+  action name is `fim_file_modified`. Code unchanged; only prose
+  was wrong. The round-8 drift-discovery entry that DOCUMENTS the
+  drift is left intact (it correctly reports both names).
+
+#### Cleaned up
+
+- **Stale `dist/` artifacts removed**: `wl_manager-1.0.0.spl` and
+  `wl_manager-2.0.0.spl` (+ their `.sha256` sidecars). Both
+  predated build 406 (current is 629). They were untracked
+  (`dist/` is gitignored) but confused anyone running
+  `package.sh` for the first signed release. Empty `dist/` now;
+  `package.sh` writes fresh artifacts on next run.
+- **Root-level PNG screenshots gitignored**: 17 untracked PNGs at
+  the repo root (e.g. `csv-loaded.png`, `stress-pending-table-build615.png`)
+  from past dev/Playwright sessions polluted `git status`.
+  `.gitignore` now has `/*.png` (root-only) so session debris
+  doesn't accumulate in tracked-file status. Canonical product
+  screenshots under `docs/screenshots/` remain tracked.
+
+#### Added
+
+- **PR-time anti-pattern gating via Semgrep**:
+  `tests/semgrep/payload-from-flag-bypass-splunk.yaml`. Catches at
+  PR-review time what
+  `tests/unit/test_ascii_validation.py::TestNoUnderscoreFlagPayloadBypass`
+  catches at test-run time. Earlier feedback in the dev loop = lower
+  fix cost. Pattern-mode (not taint-mode) because the anti-pattern is
+  a structurally-illegitimate code shape, not a tainted dataflow:
+  any `payload.get("_from_*")` or `payload["_from_*"]` READ is wrong
+  regardless of subsequent sanitization. Writes (LHS of assignment)
+  are explicitly excluded via `pattern-not-inside`. Verified: 4/4
+  positive cases fire, 0/3 negative cases fire, 0 findings on
+  current `bin/`. Past incidents addressed:
+  - Round 1-3: `_from_approval` reads in 4 action wrappers
+  - Round 5: `_from_dual_approval` reads in dual-admin paths
+  - Round 7 A1: 7 dead writes removed (writes were OK; reads were not)
+- `tests/semgrep/README.md` updated to document the new rule and
+  why it's pattern-mode while the other three are taint-mode.
+
 ## Unreleased — 2026-04-29 (build 629)
 
 ### Round 8: residue + recurring guards + supply-chain hardening
@@ -144,7 +198,7 @@ All notable changes to this project will be documented in this file.
   downstream customers. Tampering means a poisoned release ships
   without ever modifying runtime code in the container — supply-chain
   surface that was upstream of every other monitored path. FIM now
-  alerts within ~15 s on any edit (`fim_code_modified` HIGH).
+  alerts within ~15 s on any edit (`fim_file_modified` HIGH).
 - **Per-job `permissions:` blocks** on every CI workflow
   (`.github/workflows/{ci,release,semgrep,validate-and-package}.yml`).
   Each job declares its required scope independently of the
@@ -291,7 +345,7 @@ All notable changes to this project will be documented in this file.
   and `scripts/pre-commit-doc-drift.sh`. Tampering with these
   unsigned bash scripts (which perform privileged operations like
   clearing tamper flags or appending to the recovery log) now
-  surfaces as a `fim_code_modified` event within ~15s.
+  surfaces as a `fim_file_modified` event within ~15s.
 
 #### Splunk version audit (preliminary)
 

bin/wl_fim.py

@@ -159,7 +159,7 @@ def _expand_globs(patterns):
     # KV records, append to recovery log). An attacker with file
     # write could modify them to skip the audit log append or to
     # silently no-op. FIM coverage means tampering surfaces as a
-    # `fim_code_modified` event within 15s.
+    # `fim_file_modified` event within 15s.
     os.path.join(APP_DIR, "scripts", "emergency_unlock.sh"),
     os.path.join(APP_DIR, "scripts", "reset_cooldowns.sh"),
     os.path.join(APP_DIR, "scripts", "fim_deploy_window.sh"),
@@ -169,7 +169,7 @@ def _expand_globs(patterns):
     # `package.sh` could ship a poisoned release without ever
     # touching the runtime code — supply-chain attack surface that
     # is upstream of every other monitored path. FIM coverage means
-    # tampering surfaces as a `fim_code_modified` event within 15s.
+    # tampering surfaces as a `fim_file_modified` event within 15s.
     os.path.join(APP_DIR, "scripts", "package.sh"),
 ])
 

tests/semgrep/README.md

@@ -10,11 +10,19 @@ Splunk-adapted Semgrep rules that gate every PR via
 | `ssrf-splunk.yaml` | Splunk handler payload flowing into `urllib.request.urlopen` / `urllib.request.Request` / `requests.{get,post}` without a hardcoded-localhost prefix | ERROR |
 | `command-injection-splunk.yaml` | Payload reaching `subprocess.{run,Popen,call,check_call,check_output}(..., shell=True, ...)` without `shlex.quote` / `shlex.join` | ERROR |
 | `path-traversal-splunk.yaml` | Payload reaching `open`, `os.path.join`, `shutil.copy*`, `os.rename`, `os.remove`, etc. without going through one of our validation wrappers (`build_csv_path`, `resolve_csv_path`, `is_safe_filename`) or a path-canonicalization sanitizer (`abspath`, `realpath`, `Path(...).resolve()`, `basename`, `startswith` containment check) | ERROR |
+| `payload-from-flag-bypass-splunk.yaml` | Reads of `_from_*` flags from the user-controlled REST `payload` dict (e.g. `payload.get("_from_approval")` or `payload["_from_dual_approval"]`). Writes (LHS of assignment) are explicitly allowed because they're server-controlled mutations by replay code. | ERROR |
 
-All three are **taint mode**: they follow data from source (our handler's
+The first three are **taint mode**: they follow data from source (our handler's
 payload accessors) to sink (dangerous calls) and only fire if no sanitizer
 breaks the flow.
 
+The fourth (`payload-from-flag-bypass-splunk.yaml`) is **pattern mode** — it
+matches a structurally-illegitimate code shape rather than a tainted dataflow.
+It pairs with
+`tests/unit/test_ascii_validation.py::TestNoUnderscoreFlagPayloadBypass` for
+post-merge enforcement; the Semgrep rule fires earlier in the dev loop (PR
+review) so a regression is caught before reaching a human reviewer.
+
 ## Origin
 
 Adapted from [`gadievron/raptor`](https://github.com/gadievron/raptor)'s

tests/semgrep/payload-from-flag-bypass-splunk.yaml

@@ -0,0 +1,85 @@
+# ─────────────────────────────────────────────────────────────────────
+# Semgrep rule: forbidden `_from_*` payload-bypass anti-pattern
+# ─────────────────────────────────────────────────────────────────────
+#
+# Round 9 (build 629, 2026-04-29). Catches at PR-review time what
+# `tests/unit/test_ascii_validation.py::TestNoUnderscoreFlagPayloadBypass`
+# catches at test-run time. Earlier feedback in the dev loop = lower
+# fix cost.
+#
+# What this catches:
+#
+#   if payload.get("_from_approval"):     # READ — bypass-bypass
+#       skip_security_check = True
+#
+#   if payload["_from_dual_approval"]:    # READ — same anti-pattern
+#       skip_security_check = True
+#
+# What this does NOT catch (legitimate writes by server-controlled code):
+#
+#   replay_payload["_from_approval"] = True       # WRITE, server-set
+#   exec_payload.setdefault("_from_dual_approval", True)
+#
+# Why this anti-pattern is forbidden: the REST `payload` is the raw
+# user-supplied JSON envelope. Any remote caller can put
+# `{"_from_approval": true}` in the body. If the handler reads that as
+# a security flag, the caller can self-grant the bypass. The fix is
+# always the same: move the flag to a kwarg on the receiving function,
+# set only by server-side replay code.
+#
+# Past incidents (per `MEMORY.md` / `feedback_silent_exception_security.md`):
+#   - Round 1-3: `_from_approval` reads in 4 action wrappers
+#   - Round 5: `_from_dual_approval` reads in dual-admin paths
+#   - Round 7 A1: 7 dead writes removed (writes are OK; reads are not)
+#
+# Pairs with: `tests/unit/test_ascii_validation.py::TestNoUnderscoreFlagPayloadBypass`
+# (same property, post-merge enforcement). Both layers must agree. If
+# this rule fires but the unit test doesn't (or vice versa), one of
+# them has drifted — investigate.
+
+rules:
+  - id: payload-from-flag-bypass-splunk
+    message: |
+      SECURITY: reading `_from_*` flags from the user-controlled
+      `payload` dict is a security-bypass anti-pattern. Move this
+      flag to a kwarg on the receiving function, set only by server-
+      side replay code. See
+      `tests/unit/test_ascii_validation.py::TestNoUnderscoreFlagPayloadBypass`
+      for the regression test that enforces this post-merge.
+    severity: ERROR
+    languages: [python]
+    metadata:
+      category: security
+      cwe: "CWE-285: Improper Authorization"
+      owasp: "A01:2021 - Broken Access Control"
+      confidence: HIGH
+    paths:
+      include:
+        - bin/
+    patterns:
+      - pattern-either:
+          # `payload.get("_from_...")` — always a read, no false-positive form.
+          - patterns:
+              - pattern: payload.get($KEY)
+              - metavariable-regex:
+                  metavariable: $KEY
+                  regex: ^["\047]_from_
+          - patterns:
+              - pattern: payload.get($KEY, $DEFAULT)
+              - metavariable-regex:
+                  metavariable: $KEY
+                  regex: ^["\047]_from_
+          # `payload["_from_..."]` — could be read OR write. Exclude the
+          # write forms (LHS of assignment) using `pattern-not-inside`
+          # so server-controlled mutations by replay code stay clean.
+          # `pattern-not` would not work here: the subscript node is a
+          # CHILD of the assignment in the AST, not equal to the
+          # assignment itself.
+          - patterns:
+              - pattern: payload[$KEY]
+              - pattern-not-inside: payload[$KEY] = $V
+              - pattern-not-inside: payload[$KEY] += $V
+              - pattern-not-inside: payload[$KEY] -= $V
+              - metavariable-regex:
+                  metavariable: $KEY
+                  regex: ^["\047]_from_