feat(security): guard-sync + PR-body HMAC grant v2 (pairs orama #260)

.agent/memory/candidates/graduated/084412e4e566.json

@@ -0,0 +1,123 @@
+{
+  "id": "084412e4e566",
+  "key": "manual_084412",
+  "name": "manual_084412",
+  "claim": "Secret-scanning tools like gitleaks scan the full commit history range in a branch/PR by default, not just the current tree state -- a test fixture or example value that merely resembles a secret (e.g. a hardcoded hex digest used as an expected HMAC output) can trip a generic entropy detector, and even after a later commit fixes the pattern by removing the literal value, the scanner keeps flagging the earlier, now-superseded commit on every subsequent CI run for that branch, because the flagged content is still present in that commit's diff within history. This is a real, recurring category of false positive distinct from an actual leaked secret, and the correct fix is a scoped allowlist entry for the specific commit SHA(s) in the scanner's config (with `useDefault = true` or equivalent to keep the rest of the default ruleset intact) -- not editing the current file again, since the flagged content is no longer there, and not disabling the scanner or its ruleset broadly.",
+  "conditions": [
+    "actual",
+    "after",
+    "again",
+    "allowlist",
+    "because",
+    "branch",
+    "broadly",
+    "category",
+    "commit",
+    "config",
+    "content",
+    "correct",
+    "current",
+    "default",
+    "detector",
+    "diff",
+    "digest",
+    "disabling",
+    "distinct",
+    "earlier",
+    "editing",
+    "entropy",
+    "entry",
+    "equivalent",
+    "even",
+    "every",
+    "example",
+    "expected",
+    "false",
+    "file",
+    "fix",
+    "fixes",
+    "fixture",
+    "flagged",
+    "flagging",
+    "full",
+    "generic",
+    "gitleaks",
+    "hardcoded",
+    "hex",
+    "history",
+    "hmac",
+    "intact",
+    "just",
+    "keep",
+    "keeps",
+    "later",
+    "leaked",
+    "like",
+    "literal",
+    "longer",
+    "merely",
+    "now-superseded",
+    "output",
+    "pattern",
+    "positive",
+    "present",
+    "range",
+    "real",
+    "recurring",
+    "removing",
+    "resembles",
+    "rest",
+    "ruleset",
+    "run",
+    "scan",
+    "scanner",
+    "scoped",
+    "secret",
+    "secret-scanning",
+    "sha",
+    "since",
+    "specific",
+    "state",
+    "still",
+    "subsequent",
+    "test",
+    "there",
+    "tools",
+    "tree",
+    "trip",
+    "true",
+    "used",
+    "usedefault",
+    "value",
+    "within"
+  ],
+  "evidence_ids": [
+    "2026-08-02T08:04:00.461112+00:00"
+  ],
+  "cluster_size": 1,
+  "canonical_salience": 8.0,
+  "staged_at": "2026-08-02T08:04:00.461112+00:00",
+  "status": "accepted",
+  "decisions": [
+    {
+      "ts": "2026-08-02T08:04:00.461112+00:00",
+      "action": "staged",
+      "reviewer": "learn"
+    },
+    {
+      "ts": "2026-08-02T08:04:19.653507+00:00",
+      "action": "graduated",
+      "reviewer": "host-agent",
+      "notes": "A genuine, distinct false-positive category (history-range scanning catching already-fixed content) with a concrete, verified remedy.",
+      "provisional": false,
+      "evidence_snapshot": [
+        "2026-08-02T08:04:00.461112+00:00"
+      ],
+      "lessons_sha": "dbb46766d501"
+    }
+  ],
+  "rejection_count": 0,
+  "accepted_at": "2026-08-02T08:04:19.653496+00:00",
+  "reviewer": "host-agent",
+  "rationale": "A genuine, distinct false-positive category (history-range scanning catching already-fixed content) with a concrete, verified remedy."
+}

.agent/memory/candidates/graduated/1a6dc6bccad0.json

@@ -0,0 +1,55 @@
+{
+  "id": "1a6dc6bccad0",
+  "key": "manual_1a6dc6",
+  "name": "manual_1a6dc6",
+  "claim": "Tracked .agent memory and working chronicles must not embed ephemeral scratch path literals \u2014 repo_hygiene flags them like workstation home paths and blocks PT CI.",
+  "conditions": [
+    "agent",
+    "blocks",
+    "chronicles",
+    "embed",
+    "ephemeral",
+    "flags",
+    "home",
+    "like",
+    "literals",
+    "memory",
+    "path",
+    "paths",
+    "repo_hygiene",
+    "scratch",
+    "them",
+    "tracked",
+    "working",
+    "workstation"
+  ],
+  "evidence_ids": [
+    "2026-08-02T04:07:28.914652+00:00"
+  ],
+  "cluster_size": 1,
+  "canonical_salience": 8.0,
+  "staged_at": "2026-08-02T04:07:28.914652+00:00",
+  "status": "accepted",
+  "decisions": [
+    {
+      "ts": "2026-08-02T04:07:28.914652+00:00",
+      "action": "staged",
+      "reviewer": "learn"
+    },
+    {
+      "ts": "2026-08-02T04:07:29.049005+00:00",
+      "action": "graduated",
+      "reviewer": "learn.py",
+      "notes": "PT #320 CI failed when saga notes embedded a scratch-path literal instead of a neutral worktree label; use neutral worktree labels in memory.",
+      "provisional": false,
+      "evidence_snapshot": [
+        "2026-08-02T04:07:28.914652+00:00"
+      ],
+      "lessons_sha": "2d792c79eb15"
+    }
+  ],
+  "rejection_count": 0,
+  "accepted_at": "2026-08-02T04:07:29.048986+00:00",
+  "reviewer": "learn.py",
+  "rationale": "PT #320 CI failed when saga notes embedded a scratch-path literal instead of a neutral worktree label; use neutral worktree labels in memory."
+}

.agent/memory/candidates/graduated/446162929cb3.json

@@ -0,0 +1,60 @@
+{
+  "id": "446162929cb3",
+  "key": "manual_446162",
+  "name": "manual_446162",
+  "claim": "Same-user Keychain HMAC for PR-body grants is escalation control not cryptographic human identity \u2014 agent shells with PTY can read the secret or ack file; MVP raises effort; WebAuthn deferred to security-sentinel v2.1.",
+  "conditions": [
+    "ack",
+    "agent",
+    "control",
+    "cryptographic",
+    "deferred",
+    "effort",
+    "escalation",
+    "file",
+    "grants",
+    "hmac",
+    "human",
+    "identity",
+    "keychain",
+    "mvp",
+    "pr-body",
+    "pty",
+    "raises",
+    "read",
+    "same-user",
+    "secret",
+    "security-sentinel",
+    "shells",
+    "webauthn"
+  ],
+  "evidence_ids": [
+    "2026-08-02T04:07:28.049022+00:00"
+  ],
+  "cluster_size": 1,
+  "canonical_salience": 8.0,
+  "staged_at": "2026-08-02T04:07:28.049022+00:00",
+  "status": "accepted",
+  "decisions": [
+    {
+      "ts": "2026-08-02T04:07:28.049022+00:00",
+      "action": "staged",
+      "reviewer": "learn"
+    },
+    {
+      "ts": "2026-08-02T04:07:28.177266+00:00",
+      "action": "graduated",
+      "reviewer": "learn.py",
+      "notes": "Remediation F3 F4; honest security doctrine per research and autoplan CEO review.",
+      "provisional": false,
+      "evidence_snapshot": [
+        "2026-08-02T04:07:28.049022+00:00"
+      ],
+      "lessons_sha": "c0a5b0b7048b"
+    }
+  ],
+  "rejection_count": 0,
+  "accepted_at": "2026-08-02T04:07:28.177254+00:00",
+  "reviewer": "learn.py",
+  "rationale": "Remediation F3 F4; honest security doctrine per research and autoplan CEO review."
+}

.agent/memory/candidates/graduated/4c65d5956822.json

@@ -0,0 +1,107 @@
+{
+  "id": "4c65d5956822",
+  "key": "manual_4c65d5",
+  "name": "manual_4c65d5",
+  "claim": "A security guard that inspects shell commands by splitting on command separators (&&, ;, ||) to check each resulting segment independently must also split on bare newlines -- a shell interprets a newline as a command separator too, and a guard that omits it leaves an exploitable gap: a legitimate-looking command on the first line can cause the guard to short-circuit to ALLOW, leaving a malicious second command hidden on the next line completely uninspected. When testing such a guard's segment-splitting logic, the test must exercise the actual bypass condition (the legitimate first command's branch must be genuinely capable of returning ALLOW, e.g. via a properly-mocked active authorization state) -- a test where the first segment already denies on its own passes regardless of whether the fix is present, proving nothing about the real vulnerability.",
+  "conditions": [
+    "about",
+    "active",
+    "actual",
+    "allow",
+    "already",
+    "also",
+    "authorization",
+    "bare",
+    "branch",
+    "bypass",
+    "capable",
+    "cause",
+    "check",
+    "command",
+    "commands",
+    "completely",
+    "condition",
+    "denies",
+    "each",
+    "exercise",
+    "exploitable",
+    "first",
+    "fix",
+    "gap",
+    "genuinely",
+    "guard",
+    "hidden",
+    "independently",
+    "inspects",
+    "interprets",
+    "leaves",
+    "leaving",
+    "legitimate",
+    "legitimate-looking",
+    "line",
+    "logic",
+    "malicious",
+    "newline",
+    "newlines",
+    "next",
+    "nothing",
+    "omits",
+    "own",
+    "passes",
+    "present",
+    "properly-mocked",
+    "proving",
+    "real",
+    "regardless",
+    "resulting",
+    "returning",
+    "second",
+    "security",
+    "segment",
+    "segment-splitting",
+    "separator",
+    "separators",
+    "shell",
+    "short-circuit",
+    "split",
+    "splitting",
+    "state",
+    "such",
+    "test",
+    "testing",
+    "too",
+    "uninspected",
+    "via",
+    "vulnerability",
+    "whether"
+  ],
+  "evidence_ids": [
+    "2026-08-02T07:00:06.137706+00:00"
+  ],
+  "cluster_size": 1,
+  "canonical_salience": 8.0,
+  "staged_at": "2026-08-02T07:00:06.137706+00:00",
+  "status": "accepted",
+  "decisions": [
+    {
+      "ts": "2026-08-02T07:00:06.137706+00:00",
+      "action": "staged",
+      "reviewer": "learn"
+    },
+    {
+      "ts": "2026-08-02T07:00:26.921457+00:00",
+      "action": "graduated",
+      "reviewer": "host-agent",
+      "notes": "A real, exploitable security bypass and the specific way the first regression test attempt initially failed to prove anything.",
+      "provisional": false,
+      "evidence_snapshot": [
+        "2026-08-02T07:00:06.137706+00:00"
+      ],
+      "lessons_sha": "a4478e0a1a93"
+    }
+  ],
+  "rejection_count": 0,
+  "accepted_at": "2026-08-02T07:00:26.921437+00:00",
+  "reviewer": "host-agent",
+  "rationale": "A real, exploitable security bypass and the specific way the first regression test attempt initially failed to prove anything."
+}