fix(security): sync grant remediation F1–F7 from orama canonical

Replay state machine, GH_BIN append test, saga path hygiene for CI gate.

Author: diazMelgarejo

.agent/memory/working/PR_BODY_GRANT_HMAC_MVP_SAGA_2026-08-02.md

@@ -29,7 +29,7 @@ stay in v2.1 **security-sentinel** orbit (do not half-implement passkeys in shel
 | 2026-08-02 | EXA + Firecrawl deep research on TTY/HITL gap | Proved v1 is forgeable; Vallum HMAC + GoodRoom passkey patterns |
 | 2026-08-02 | `/autoplan` on remediation plan (local, no git ops) | Refined: digest binding, nonce replay, append independent verify, BACKUP wire-up |
 | 2026-08-02 | can-4.md (CodeRabbit on PT #320) | DRY hooks, restore BACKUP emission, tighten worktree test, `range_for_ref` in pre-push |
-| 2026-08-02 | Implementation on `2026-08-02-pr-body-grant-hmac-mvp` | Single worktree consolidation (`/tmp/orama-grant-mvp` → commit → sync to PT) |
+| 2026-08-02 | Implementation on `2026-08-02-pr-body-grant-hmac-mvp` | Single worktree consolidation (grant-mvp worktree → commit → sync to PT) |
 
 ## Research that preceded code (read before changing grants)
 
@@ -134,8 +134,8 @@ python3 scripts/cursor/hooks/pr-body-guard-core.py manage_pr <<< \
 4. **Sync direction:** orama canonical for `scripts/cursor/*` grant stack. Commit orama first;
    then `sync-attribution-guard-scripts.sh` to PT. Never blind orama→PT on dirty worktrees.
 
-5. **Worktree consolidation:** Multiple agents used `/tmp/orama-grant-mvp`, `/tmp/orama-pr255`,
-   `/tmp/pt-pr320`. Before commit: one clean worktree on the PR branch, `git status` clean,
+5. **Worktree consolidation:** Multiple agents used dedicated grant-mvp, pr255, and
+   pt-pr320 worktrees. Before commit: one clean worktree on the PR branch, `git status` clean,
    single push. Stash/pop caused plan doc conflicts — resolve before commit.
 
 6. **autoplan artifacts** live in `~/.gstack/projects/orama-system/` (test plans, restore points).

scripts/cursor/append-pr-body.sh

@@ -118,31 +118,75 @@ if [[ -n "$append_file" && ! -f "$append_file" ]]; then
   exit 1
 fi
 
-if ! command -v gh >/dev/null 2>&1; then
+GH_BIN="${GH_BIN:-gh}"
+if ! command -v "$GH_BIN" >/dev/null 2>&1; then
   echo "error: gh CLI required" >&2
   exit 1
 fi
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 GRANT_LIB="$SCRIPT_DIR/pr-body-grant-lib.py"
 
-verify_cmd=(python3 "$GRANT_LIB" verify --repo "$repo_slug" --pr "$pr_number")
+grant_append_args=(--repo "$repo_slug" --pr "$pr_number")
 if [[ -n "$append_file" ]]; then
-  verify_cmd+=(--file "$append_file")
+  grant_append_args+=(--file "$append_file")
 else
-  verify_cmd+=(--message "$append_message")
+  grant_append_args+=(--message "$append_message")
 fi
+
+verify_cmd=(python3 "$GRANT_LIB" verify "${grant_append_args[@]}")
 if ! "${verify_cmd[@]}"; then
   echo "hint: operator runs grant-pr-body-human-override.sh with the same --file|--message" >&2
   exit 1
 fi
 
+if [[ -z "$title" ]]; then
+  title="$(normalize_follow_up_title "Follow-up ($(date -u +%Y-%m-%d))")"
+else
+  title="$(normalize_follow_up_title "$title")"
+fi
+
 if [[ -n "$append_file" ]]; then
   append_block="$(cat "$append_file")"
 else
   append_block="$append_message"
 fi
 
+remote_tmp="$(mktemp)"
+out="$(mktemp)"
+grant_finalized=0
+release_on_fail() {
+  if [[ "$grant_finalized" -eq 1 ]]; then
+    return 0
+  fi
+  python3 "$GRANT_LIB" release "${grant_append_args[@]}" >/dev/null 2>&1 || true
+}
+trap 'release_on_fail; rm -f "$out" "$remote_tmp"' EXIT
+
+"$GH_BIN" pr view "$pr_number" --repo "$repo_slug" --json body --jq .body >"$remote_tmp"
+reconcile_rc=0
+reconcile_cmd=(
+  python3 "$GRANT_LIB" reconcile "${grant_append_args[@]}"
+  --title "$title" --remote-body-file "$remote_tmp"
+)
+reconcile_cmd_output="$("${reconcile_cmd[@]}" 2>&1)" || reconcile_rc=$?
+if [[ "$reconcile_rc" -eq 0 ]]; then
+  echo "$reconcile_cmd_output"
+  grant_finalized=1
+  echo "updated: https://github.com/${repo_slug}/pull/${pr_number}"
+  exit 0
+fi
+if [[ "$reconcile_rc" -ne 2 ]]; then
+  echo "$reconcile_cmd_output" >&2
+  exit 1
+fi
+
+reserve_cmd=(python3 "$GRANT_LIB" reserve "${grant_append_args[@]}")
+if ! "${reserve_cmd[@]}"; then
+  echo "hint: operator runs grant-pr-body-human-override.sh with the same --file|--message" >&2
+  exit 1
+fi
+
 if [[ "$append_block" == *"$CURSOR_BODY_END"* || "$append_block" == *"$CODERABBIT_MARKER"* ]]; then
   echo "error: append content must not contain reserved PR body delimiters" >&2
   exit 1
@@ -154,7 +198,7 @@ ts="$(date -u +%Y%m%dT%H%M%SZ)"
 safe_slug="${repo_slug//\//-}"
 backup_path="$(mktemp "${backup_dir}/${safe_slug}-pr${pr_number}-${ts}.XXXXXX")"
 
-current_body="$(gh pr view "$pr_number" --repo "$repo_slug" --json body --jq .body)"
+current_body="$(cat "$remote_tmp")"
 printf '%s\n' "$current_body" >"$backup_path"
 echo "backup: $backup_path"
 
@@ -169,12 +213,6 @@ if ((coderabbit_delim_count > 1)); then
   exit 1
 fi
 
-if [[ -z "$title" ]]; then
-  title="$(normalize_follow_up_title "Follow-up ($(date -u +%Y-%m-%d))")"
-else
-  title="$(normalize_follow_up_title "$title")"
-fi
-
 follow_up=$(
   cat <<EOF
 
@@ -196,27 +234,30 @@ else
   merged="${merged}${follow_up}"
 fi
 
-remote_body="$(gh pr view "$pr_number" --repo "$repo_slug" --json body --jq .body)"
+remote_body="$("$GH_BIN" pr view "$pr_number" --repo "$repo_slug" --json body --jq .body)"
 if [[ "$remote_body" != "$current_body" ]]; then
   echo "error: PR body changed since initial read; aborting to avoid overwrite" >&2
   echo "hint: review concurrent edits and re-run append-pr-body.sh" >&2
   exit 1
 fi
 
-out="$(mktemp)"
-trap 'rm -f "$out"' EXIT
 printf '%s\n' "$merged" >"$out"
-gh pr edit "$pr_number" --repo "$repo_slug" --body-file "$out"
+if ! "$GH_BIN" pr edit "$pr_number" --repo "$repo_slug" --body-file "$out"; then
+  echo "error: gh pr edit failed" >&2
+  exit 1
+fi
 
-consume_cmd=(python3 "$GRANT_LIB" consume --repo "$repo_slug" --pr "$pr_number")
-if [[ -n "$append_file" ]]; then
-  consume_cmd+=(--file "$append_file")
-else
-  consume_cmd+=(--message "$append_message")
+mark_cmd=(python3 "$GRANT_LIB" mark-applied "${grant_append_args[@]}")
+if ! "${mark_cmd[@]}"; then
+  echo "error: grant mark-applied failed after PR body update — treat as security incident" >&2
+  exit 1
 fi
+
+consume_cmd=(python3 "$GRANT_LIB" consume "${grant_append_args[@]}")
 if ! "${consume_cmd[@]}"; then
   echo "error: grant consume failed after PR body update — treat as security incident" >&2
   exit 1
 fi
 
+grant_finalized=1
 echo "updated: https://github.com/${repo_slug}/pull/${pr_number}"