chore: receipts store=ref — no receipt files in PRs or on main#2
Open
anandgupta42 wants to merge 1 commit into
Open
chore: receipts store=ref — no receipt files in PRs or on main#2anandgupta42 wants to merge 1 commit into
anandgupta42 wants to merge 1 commit into
Conversation
Receipts now travel as refs/receipts/<branch> (the 0.9.0 default for new adopters); this back-fills the knob and removes legacy committed receipts. The pre-push hook and CI check are unchanged.
sahrizvi
pushed a commit
that referenced
this pull request
Jul 16, 2026
Companion codex-plugin PR #2 review flagged three issues in this SKILL.md content (this file is cloned from the same SoT that ships into the codex sibling, so both fixes land in lockstep): 1. **YAML fold split `altimate-code` into `altimate- code` (MAJOR).** The `>-` folded scalar from the earlier commit on this branch wrapped mid-token; the fold turned the newline into a space, corrupting the exact trigger the description exists to match. Adopted the SKILL.md verbatim from `altimate-claude-plugin` (the Anthropic-compliance rewrite), whose description is on one physical line — no fold, no ambiguity. PyYAML confirms the parsed description contains "altimate-code" and NOT "altimate- code". 2. **Shell injection in the documented invocation (HIGH).** `altimate-code run "<user's task>"` interpolates user text into a double-quoted shell arg, so `$(...)` and backticks fire before altimate-code runs, and `--yolo` removes the confirmation gate. Fixed via here-doc into a variable in both the first-invocation and `--continue` blocks. 3. **Hardcoded `/tmp/altimate-result.md` (MAJOR).** Shared, world-readable path can hold warehouse rows / PII from a delegation. Fixed via `umask 077; OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)"` and instructed to delete after reading. Also swept: the "separate from Claude Code's" line — this is agent-facing content injected into the opencode host prompt, so a "Claude Code" reference is factually wrong about cost/rate attribution. Changed to "host agent's". Parallel PRs on `altimate-claude-plugin` (the direct source) and `data-engineering-skills` (the wider SoT). Typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Back-fills the
RECEIPTS_STORE=refknob (the 0.9.0initdefault): receipts travel asrefs/receipts/<branch>— zero files in PR diffs, zero accumulation onmain. Removes any legacy committed receipts. Hook + CI unchanged.