P2 hardening: close seven G01 evidence-packet review gaps

[jjangg96]

Context

Codex exact-head review of PR #78 at b6dbf021801ef5d920d1a9e7659f8bd97be11695 reported seven P2 findings in the reusable G01 evidence packet. Under the maintainer review policy, these are tracked separately and do not block the current candidate solely by severity.

Source review comment: #78 (comment)

Follow-up findings

• Path filesystem readers beyond read_text/read_bytes can bypass the reviewed-path boundary: packet lines
• Environment values from loops/comprehensions are not tainted before sinks: packet lines
• Launcher aliases obtained through iterable targets can bypass command checks: packet lines
• Shell export/set forms can dump inherited variables: packet lines
• Git child environments can forward unrelated credentials: packet lines
• Exact-head parity does not reject intent-bit or raw-byte divergence: packet lines
• Git configuration includes are not rejected before read-only commands: packet lines

Acceptance

• Reproduce each finding with a focused negative test.
• Add the smallest fail-closed correction for the affected scanner/verification boundary.
• Preserve safe positive cases and current evidence reuse semantics.
• Record exact red/green commands, review URLs, and rollback evidence.
• Re-review only the changed boundary and batch the fixes into one candidate.

This issue is intentionally separate from PR #78 to keep the current delivery moving. Promote it to a blocking gate only if a maintainer explicitly classifies a finding as release, security, data-loss, or live-safety critical.

[jjangg96]

Audit bookkeeping follow-up

The independent exact-head audit also found non-blocking documentation bookkeeping gaps in PR #78 at b6dbf021801ef5d920d1a9e7659f8bd97be11695:

• the packet's current fence certification line reports raw marker counts instead of the matching-style count (474 raw lines versus 472 semantic markers / 236 pairs);
• the current packet ledger still reflects the prior six-finding review rather than the fresh seven-P2 review;
• two historical Codex issue-comment URLs are not yet represented in the packet ledger.

These remain P2 follow-up work under the maintainer policy. They do not block PR #78 solely by severity; promote only with explicit release/security/data-loss/live-safety classification.

[jjangg96]

Dispatch: 2026-09-26 KST

Selected under the maintainer request to continue as many eligible issues as possible until 21:00 KST. The seven recorded findings remain an independently useful offline hardening task; PR #78 is merged at 554fe78e0abff10803ca9fe856f084717d60bf99. No full G01/G02 gate depends on this task being treated as complete.

Promote this item from Backlog to Ready before dispatch, then In progress. Use one dedicated issue worktree and goal, GPT-6-Luna with max reasoning (the maintainer model override), meaningful failing synthetic probes before fixes, one stable candidate, independent contract/security review, GitHub Codex review of the final PR head, and hosted PR quick checks. The coordinator owns GitHub/Project changes and merge.

Scope: the existing evidence-packet scanner and verification prescriptions, focused offline regression harnesses, and the issue's recorded documentation bookkeeping corrections. Preserve safe positives and evidence reuse. Use synthetic credentials/paths only; never execute a malicious specimen, contact a live runner, dispatch a workflow, access real credentials, or alter host services. Full G01/G02 gates remain open.

[jjangg96]

Scheduling update: the maintainer extended this evening work window to 21:40 KST on 2026-09-26. Existing scope, model override, review and live-operation authorization gates are unchanged.