Third review cycle + Red Team, all reproduced before the fix:
- With no repository, the wrapper adopted cwd as the repo root, so a review
launched from HOME (URL mode can run from anywhere) rejected every
HOME-rooted install as "repository-local", reported the user's own skill
install with the wrong hint, and, for targets, accepted all of HOME
(~/.ssh/id_rsa scanned). A project directory is now one strictly below
HOME: `git init ~` never turns the user's installs into repository files,
and from HOME only the designs allow-list qualifies as a target.
- --no-inline-ignores keyed on "not inside the repo", which misclassified
dumps when GSTACK_HOME sits under the repo and stripped the design-html
gate's own `<!-- impeccable-disable -->` from finalized.html. Targets are
classified as project / dom-dump (designs/<audit>/dom/**, the page's bytes)
/ artifact (other designs/ files, gstack-authored); only dumps drop inline
ignores.
- A repository's .impeccable/config.json can hide rules from the review;
detector.ignoreValues was never surfaced. The probe prints
IMPECCABLE_IGNORED_VALUES beside the rules, and the prose stops calling
repo-config ignores "a decision the user made".
- An engine id named `constructor` corrupted byRule through
Object.prototype and `__proto__` counts vanished; byRule is a null-
prototype object and an id that fails the shape check is `unmapped` as a
key too.
- Batches ran with no total budget (10,000 un-ignored files: hours). The
scan stops at 5x the per-batch timeout with DETECT_TIMEOUT and exit 1.
- The scan JSON carries an `untrusted` list of the engine- and page-derived
fields, so the agent reading past the fenced DETECT_TOP block is told what
is evidence.
- The PATH walk keeps launcher-present for a .cmd wrapper or a differently
named real file (the name gate applies to READY only).
Tests: probe and scan from a fake HOME (cache READY, HOME file refused, dump
scanned without inline ignores), artifact vs dump batches, prototype-member
ids, the whole-scan budget over 11 batches, ignoreValues surfaced, the
`untrusted` field.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
