Summary

• make .brigade/** and other trailing /** exclusions prune their repo-relative subtree before files are opened
• replace line-addressed finding fingerprints with rule, path, redacted matched content, duplicate cardinality, and duplicate occurrence
• preserve exact legacy singleton suppressions across the upgrade with a validated local legacy-to-primary map
• keep show, suppress, unsuppress, report review, diff, accepted-risk health, and work imports consistent with the new identity

#529 root cause

exclude_paths was already parsed, resolved, applied by the scan engine, and projected into reports. The failure was in _path_matches_any: it treated .brigade/** as literal path text, so neither .brigade nor its descendants matched and the walk entered evidence bundles.

The reported null config clue did not identify dropped plumbing. brigade security config --json nests resolved settings under .config, so the resolved value is .config.exclude_paths, not a top-level field.

The matcher keeps path settings as literal repo-relative prefixes. Only a trailing /** is accepted as an alias for the same prefix, including the named root. Bracketed paths such as app/[id] remain literal.

#530 identity and migration

The primary fingerprint no longer contains the absolute line. It hashes rule_id, repo-relative path, a normalized redacted excerpt, and occurrence. Identical matches in one file include duplicate cardinality and occurrence, so suppressing one does not hide another. Adding or removing an identical duplicate rekeys that group and requires review instead of transferring a suppression.

Each finding also carries the old line-based fingerprint. An exact legacy singleton suppression is migrated to the primary fingerprint and recorded in .brigade/security/fingerprint-migration-map.json. Duplicate groups never inherit a singleton legacy alias. Old report bundles and direct legacy IDs remain manageable through the map.

For the observed fingerprints, 68041634653069ec and 3076e8de762703a9 remain legacy line-based identities. If the first upgraded scan sees the finding at the original location, 68041634653069ec maps to one content fingerprint; after lines move, that primary stays unchanged and 3076e8de762703a9 is only the current legacy alias. If the first upgraded scan happens after the move, the old fingerprint cannot be matched safely and needs one review under the content identity.

This stops new history entries caused only by unrelated line shifts. Existing reports, imported history, and historical totals are not rewritten.

Verification

brigade work verify run --target . --command "./scripts/verify" --capture brigade-work

All checks passed!
532 files already formatted
Success: no issues found in 317 source files
version=0.25.1 checked=13 locations
managed snapshot: ok (6 manifests)
4252 passed, 3 skipped in 327.34s (0:05:27)
Total coverage: 82.77%

Codex review found and drove regression coverage for duplicate cardinality, symlinked closeout state, historical report IDs and diffs, accepted-risk health, stale-report unsuppression, scan-time map use, and severity changes in work imports.

Closes #529
Closes #530