fix: red-team review fixes (9 findings, 2 critical)

Red team reviewed what four specialists missed — cross-cutting and
self-contradiction class:

CRITICAL: the release-body banner tripwire failed OPEN on the exact leak it
guards (grep -c prints 0 AND exits 1 on no-match, so a fallback echo
double-emitted "0" twice and the -gt comparison fell into the clean branch) —
counts now default via parameter expansion, and a functional drift test
executes the rendered tripwire block against a 0->1 banner delta to prove the
ABORT branch fires. CRITICAL: evidence fingerprints were captured AFTER the
child exited, so a working-tree edit made DURING a long suite was certified as
tested content — wtree is now captured before spawn and re-checked after;
mid-run drift omits the fingerprint (grades STALE) with a warning.

Also: the review-grading rule dropped its dirty-gates (they nullified the
keystone dirty-record->commit->CURRENT property that evidence checks already
honor — wtree equality alone proves identical content); careful's HIGH
force-push tier falls back to probing origin/main|master when the origin/HEAD
symbolic ref is absent (Conductor worktrees — the tier was silently inert in
the primary deploy environment); quoted tokens (rm -rf "/", push "main") no
longer dodge the deny; freeze fails CLOSED when its own helper file is missing
(bash makes a missing source target fatal non-interactively, so an existence
pre-check guards it); spec dedupe distinguishes pipeline failure from zero
matches instead of silently skipping dedupe on gh/jq breakage; land 3.5b sets
the cross-session --expect-cmd mismatch expectation; hook analytics JSON
fields are encoder-built per this wave's own rule.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/binding-template-drift.test.ts

@@ -57,11 +57,35 @@ describe('content-binding template drift', () => {
     expect(rendered('land-and-deploy/SKILL.md')).toMatch(rowList);
   });
 
-  test('release-body write side carries the banner tripwire', () => {
+  test('release-body write side carries the banner tripwire (and it actually fires)', () => {
     const body = rendered('document-release/sections/release-body.md');
     expect(body).toContain('grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-$$.md');
     expect(body).toContain('grep -c "UNTRUSTED TRACKER CONTENT" /tmp/gstack-pr-body-orig-$$.md');
+    // The fail-open shape: grep -c prints 0 AND exits 1 on no-match, so an
+    // `|| echo 0` double-emits and breaks the -gt into the clean branch.
+    expect(body).not.toContain('|| echo 0');
     expect(body).toContain('banner tripwire clean');
+
+    // Functional: execute the template's tripwire block against a 0-banner
+    // original and a 1-banner outgoing body — the ABORT branch must fire.
+    const block = body.match(/_ORIG_BANNERS=\$\(grep[\s\S]*?fi\n/);
+    expect(block).not.toBeNull();
+    const fs = require('fs');
+    const os = require('os');
+    const path = require('path');
+    const { execSync } = require('child_process');
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-banner-'));
+    try {
+      fs.writeFileSync(path.join(dir, 'orig.md'), 'clean body\n');
+      fs.writeFileSync(path.join(dir, 'new.md'), 'body with UNTRUSTED TRACKER CONTENT banner leak\n');
+      const script = block![0]
+        .replaceAll('/tmp/gstack-pr-body-orig-$$.md', path.join(dir, 'orig.md'))
+        .replaceAll('/tmp/gstack-pr-body-$$.md', path.join(dir, 'new.md'));
+      const out = execSync(`bash -c ${JSON.stringify(script + '; true')}`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+      expect(out).not.toContain('banner tripwire clean');
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
   });
 
   test('greptile triage reads bodies through the guard (metadata/body split)', () => {

test/evidence.test.ts

@@ -147,6 +147,18 @@ describe('gstack-evidence run', () => {
     expect(rec.exit).toBe(0);
   });
 
+  test('TOCTOU guard: a mid-run working-tree edit omits the fingerprint (never certifies unseen content)', () => {
+    // The command itself mutates the tree — wtreeBefore != wtreeAfter.
+    const r = run(['run', '--label', 'tests', '--', 'echo mutated >> src.txt && echo green']);
+    expect(r.status).toBe(0);
+    const rec = records().pop();
+    expect(rec.wtree).toBeUndefined();
+    expect(r.stderr).toContain('changed during the run');
+    const chk = run(['check', '--label', 'tests']);
+    expect(chk.status).toBe(1);
+    expect(chk.stdout).toContain('no content fingerprint');
+  });
+
   test('a HIGH credential in the command is stored redacted', () => {
     const r = run(['run', '--label', 'sec', '--', 'echo ghp_A8bC2dE4fG6hI8jK0lM2nO4pQ6rS8tU0vW2x deploy']);
     expect(r.status).toBe(0);

test/fixtures/golden/claude-ship-SKILL.md

@@ -993,7 +993,7 @@ Display:
 - If \`skip_eng_review\` config is \`true\`, Eng Review shows "SKIPPED (global)" and verdict is CLEARED
 
 **Staleness detection:** After displaying the dashboard, check if any existing reviews may be stale:
-- **Content-first rule (diff-scoped rows only: \`review\`, \`adversarial-review\`, \`codex-review\`, ship-stage entries).** Parse the \`---WTREE---\` and \`---DIRTY---\` sections from the bash output. If an entry has a \`wtree\` field AND it equals the current \`---WTREE---\` value AND the entry's \`dirty\` is false AND \`---DIRTY---\` is false, the review is CURRENT — identical content, regardless of commit count, rebase, or amend. Skip the commit-count heuristic for that entry and show no staleness note.
+- **Content-first rule (diff-scoped rows only: \`review\`, \`adversarial-review\`, \`codex-review\`, ship-stage entries).** Parse the \`---WTREE---\` and \`---DIRTY---\` sections from the bash output. If an entry has a \`wtree\` field AND it equals the current \`---WTREE---\` value, the review is CURRENT — identical content, regardless of commit count, rebase, amend, or whether it was committed yet (wtree equality alone proves identical content; that is the keystone property). Skip the commit-count heuristic for that entry and show no staleness note.
 - Plan-tier rows (plan-ceo-review, plan-eng-review, plan-design-review) grade a plan file, not the repo tree — never apply the wtree rule to them; they keep the 7-day freshness logic. If such an entry carries a \`plan_sha256\` field, you MAY compare it against the current plan file's sha256 and note "plan changed since review" on mismatch.
 - Fallback (no \`wtree\` on the entry, wtree mismatch, or either side dirty): parse the \`---HEAD---\` section to get the current HEAD commit hash. For each review entry that has a \`commit\` field: compare it against the current HEAD. If different, count elapsed commits: \`git rev-list --count STORED_COMMIT..HEAD\`. If that command FAILS (the stored commit was rebased away), grade UNKNOWN and treat as stale — do not error. Display: "Note: {skill} review from {date} may be stale — {N} commits since review"
 - For entries without a \`commit\` field (legacy entries): display "Note: {skill} review from {date} has no commit tracking — consider re-running for accurate staleness detection"

test/fixtures/golden/codex-ship-SKILL.md

@@ -964,7 +964,7 @@ Display:
 - If \`skip_eng_review\` config is \`true\`, Eng Review shows "SKIPPED (global)" and verdict is CLEARED
 
 **Staleness detection:** After displaying the dashboard, check if any existing reviews may be stale:
-- **Content-first rule (diff-scoped rows only: \`review\`, \`adversarial-review\`, ship-stage entries).** Parse the \`---WTREE---\` and \`---DIRTY---\` sections from the bash output. If an entry has a \`wtree\` field AND it equals the current \`---WTREE---\` value AND the entry's \`dirty\` is false AND \`---DIRTY---\` is false, the review is CURRENT — identical content, regardless of commit count, rebase, or amend. Skip the commit-count heuristic for that entry and show no staleness note.
+- **Content-first rule (diff-scoped rows only: \`review\`, \`adversarial-review\`, \`codex-review\`, ship-stage entries).** Parse the \`---WTREE---\` and \`---DIRTY---\` sections from the bash output. If an entry has a \`wtree\` field AND it equals the current \`---WTREE---\` value AND the entry's \`dirty\` is false AND \`---DIRTY---\` is false, the review is CURRENT — identical content, regardless of commit count, rebase, or amend. Skip the commit-count heuristic for that entry and show no staleness note.
 - Plan-tier rows (plan-ceo-review, plan-eng-review, plan-design-review) grade a plan file, not the repo tree — never apply the wtree rule to them; they keep the 7-day freshness logic. If such an entry carries a \`plan_sha256\` field, you MAY compare it against the current plan file's sha256 and note "plan changed since review" on mismatch.
 - Fallback (no \`wtree\` on the entry, wtree mismatch, or either side dirty): parse the \`---HEAD---\` section to get the current HEAD commit hash. For each review entry that has a \`commit\` field: compare it against the current HEAD. If different, count elapsed commits: \`git rev-list --count STORED_COMMIT..HEAD\`. If that command FAILS (the stored commit was rebased away), grade UNKNOWN and treat as stale — do not error. Display: "Note: {skill} review from {date} may be stale — {N} commits since review"
 - For entries without a \`commit\` field (legacy entries): display "Note: {skill} review from {date} has no commit tracking — consider re-running for accurate staleness detection"
@@ -2515,9 +2515,16 @@ EOF
 The evidence ledger is the mechanical arm of this law. Check it FIRST:
 
 ```bash
-$GSTACK_ROOT/bin/gstack-evidence check --label tests --label vitest --max-age 24 --allow-paths CHANGELOG.md,VERSION,package.json
+$GSTACK_ROOT/bin/gstack-evidence check --label tests --expect-cmd '<exact tests-lane command from Step 5>' --label vitest --expect-cmd '<exact vitest-lane command from Step 5>' --max-age 24 --allow-paths CHANGELOG.md,VERSION,package.json
 ```
 
+Pass each `--expect-cmd` the exact command string the wrapped Step 5 lane ran —
+that binds FRESH to the real suite (a green `echo ok` recorded under the label
+can never satisfy the check). Residual risk, accepted: `package.json` sits on
+the allow-list because Step 12's version bump writes its version field between
+the test run and this gate; a behavior-changing package.json edit in that
+window would not invalidate evidence. The check is advisory either way.
+
 - **Every line FRESH (exit 0):** the recorded runs were green and the working-tree
   content is identical to what was tested, modulo the allow-listed release files
   (this mechanizes the "CHANGELOG edits don't count" rule — VERSION/CHANGELOG

test/fixtures/golden/factory-ship-SKILL.md

@@ -966,7 +966,7 @@ Display:
 - If \`skip_eng_review\` config is \`true\`, Eng Review shows "SKIPPED (global)" and verdict is CLEARED
 
 **Staleness detection:** After displaying the dashboard, check if any existing reviews may be stale:
-- **Content-first rule (diff-scoped rows only: \`review\`, \`adversarial-review\`, ship-stage entries).** Parse the \`---WTREE---\` and \`---DIRTY---\` sections from the bash output. If an entry has a \`wtree\` field AND it equals the current \`---WTREE---\` value AND the entry's \`dirty\` is false AND \`---DIRTY---\` is false, the review is CURRENT — identical content, regardless of commit count, rebase, or amend. Skip the commit-count heuristic for that entry and show no staleness note.
+- **Content-first rule (diff-scoped rows only: \`review\`, \`adversarial-review\`, \`codex-review\`, ship-stage entries).** Parse the \`---WTREE---\` and \`---DIRTY---\` sections from the bash output. If an entry has a \`wtree\` field AND it equals the current \`---WTREE---\` value AND the entry's \`dirty\` is false AND \`---DIRTY---\` is false, the review is CURRENT — identical content, regardless of commit count, rebase, or amend. Skip the commit-count heuristic for that entry and show no staleness note.
 - Plan-tier rows (plan-ceo-review, plan-eng-review, plan-design-review) grade a plan file, not the repo tree — never apply the wtree rule to them; they keep the 7-day freshness logic. If such an entry carries a \`plan_sha256\` field, you MAY compare it against the current plan file's sha256 and note "plan changed since review" on mismatch.
 - Fallback (no \`wtree\` on the entry, wtree mismatch, or either side dirty): parse the \`---HEAD---\` section to get the current HEAD commit hash. For each review entry that has a \`commit\` field: compare it against the current HEAD. If different, count elapsed commits: \`git rev-list --count STORED_COMMIT..HEAD\`. If that command FAILS (the stored commit was rebased away), grade UNKNOWN and treat as stale — do not error. Display: "Note: {skill} review from {date} may be stale — {N} commits since review"
 - For entries without a \`commit\` field (legacy entries): display "Note: {skill} review from {date} has no commit tracking — consider re-running for accurate staleness detection"
@@ -2931,9 +2931,16 @@ EOF
 The evidence ledger is the mechanical arm of this law. Check it FIRST:
 
 ```bash
-$GSTACK_ROOT/bin/gstack-evidence check --label tests --label vitest --max-age 24 --allow-paths CHANGELOG.md,VERSION,package.json
+$GSTACK_ROOT/bin/gstack-evidence check --label tests --expect-cmd '<exact tests-lane command from Step 5>' --label vitest --expect-cmd '<exact vitest-lane command from Step 5>' --max-age 24 --allow-paths CHANGELOG.md,VERSION,package.json
 ```
 
+Pass each `--expect-cmd` the exact command string the wrapped Step 5 lane ran —
+that binds FRESH to the real suite (a green `echo ok` recorded under the label
+can never satisfy the check). Residual risk, accepted: `package.json` sits on
+the allow-list because Step 12's version bump writes its version field between
+the test run and this gate; a behavior-changing package.json edit in that
+window would not invalidate evidence. The check is advisory either way.
+
 - **Every line FRESH (exit 0):** the recorded runs were green and the working-tree
   content is identical to what was tested, modulo the allow-listed release files
   (this mechanizes the "CHANGELOG edits don't count" rule — VERSION/CHANGELOG

test/hook-scripts.test.ts

@@ -584,6 +584,37 @@ describe('check-careful.sh', () => {
       });
     });
 
+    test.each(['rm -rf "/"', "rm -rf '~'", 'rm -rf //'])('quoted root targets still deny: %s', (command) => {
+      const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput(command));
+      expect(exitCode).toBe(0);
+      expect(output.hookSpecificOutput?.permissionDecision).toBe('deny');
+    });
+
+    test('quoted default-branch ref still denies (git push -f origin "main")', () => {
+      withGitRepo('main', 'feature', (repoDir) => {
+        const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('git push -f origin "main"'), undefined, repoDir);
+        expect(exitCode).toBe(0);
+        expect(output.hookSpecificOutput?.permissionDecision).toBe('deny');
+      });
+    });
+
+    test('missing origin/HEAD symbolic ref falls back to origin/main probe (Conductor worktrees)', () => {
+      const repoDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-careful-nohead-'));
+      try {
+        const git = (args: string[]) => gitArgvIn(repoDir, args);
+        git(['init', '-q', '-b', 'main']);
+        git(['commit', '--allow-empty', '-q', '-m', 'init']);
+        // No symbolic-ref — only a plain remote-tracking ref, like a Conductor worktree.
+        git(['update-ref', 'refs/remotes/origin/main', 'HEAD']);
+        git(['checkout', '-q', '-b', 'feature']);
+        const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('git push --force origin main'), undefined, repoDir);
+        expect(exitCode).toBe(0);
+        expect(output.hookSpecificOutput?.permissionDecision).toBe('deny');
+      } finally {
+        fs.rmSync(repoDir, { recursive: true, force: true });
+      }
+    });
+
     test('--force-with-lease is never HIGH (the safe force variant)', () => {
       withGitRepo('main', 'main', (repoDir) => {
         const { exitCode, output } = runHook(CAREFUL_SCRIPT, carefulInput('git push --force-with-lease origin main'), undefined, repoDir);
@@ -817,6 +848,28 @@ describe('check-freeze.sh', () => {
     });
   });
 
+  describe('broken install fails closed', () => {
+    test('a missing hook-extract helper DENIES instead of proceeding', () => {
+      // Copy the freeze hook into a tree with NO careful sibling — the source
+      // fails, and a deny-tier boundary must fail CLOSED, not fall through.
+      const base = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-freeze-broken-'));
+      const binDir = path.join(base, 'freeze', 'bin');
+      fs.mkdirSync(binDir, { recursive: true });
+      const script = path.join(binDir, 'check-freeze.sh');
+      fs.copyFileSync(FREEZE_SCRIPT, script);
+      try {
+        withFreezeDir('/Users/dev/project/src/', (stateDir) => {
+          const { exitCode, output } = runHook(script, freezeInput('/Users/dev/project/src/x.ts'), { CLAUDE_PLUGIN_DATA: stateDir });
+          expect(exitCode).toBe(0);
+          expect(output.hookSpecificOutput?.permissionDecision).toBe('deny');
+          expect(output.hookSpecificOutput?.permissionDecisionReason).toContain('fail closed');
+        });
+      } finally {
+        fs.rmSync(base, { recursive: true, force: true });
+      }
+    });
+  });
+
   describe('symlink boundary escape', () => {
     // The old resolver followed the parent directory but NOT the final path
     // component, so an in-boundary symlink pointing outside the boundary was