Skip to content

2026-07-02 dual audit: determinism, cache, template, consistency fixes #5

Description

@serenakeyitan

Umbrella issue for the fixes from the 2026-07-02 dual audit (Fable 5 six-dimension multi-agent workflow, 62 confirmed findings + Codex CLI review, 20 findings). One PR per problem cluster, all linking here.

Clusters (in fix order):

  1. Scan-depth determinism — overlapping DEEP/SHALLOW/MINIMAL OR-thresholds, 8-extension whitelist misses Rust/C/C++/C#/PHP/Kotlin/Swift, du counts .git/node_modules, SHALLOW '20% sampling' has no selection rule
  2. Finding ownership uniqueness — input-data-safety still emits E1–E3 rate-limit findings forbidden by rate-limiting.md + SKILL.md matrix (double-count); 'Authentication or Input Safety' style ambiguous dimension mapping
  3. Score = pure arithmetic — no fixed penalty table/rounding/overall formula; JSON schema's closed vertical shape lacks name/score; no top-level score though template needs {{SCORE}}
  4. Cache correctness — key is commit-SHA-only but scan reads working tree (stale report after uncommitted fixes); two conflicting key definitions; cached wrapper never unwrapped; missing report_lang; cache-hit path skips report display
  5. Template rewrite — legacy purple #9e9eff (brand is green #80EE64), radar computed from letter grades A/B/C/F, N/A drawn as radius 0, placeholder map desync, wrong share URL comment, severity colors, HTML-escaping contract
  6. SKILL.md consistency sweep — step renumbering, popup-count rule, language matrix vs AskUserQuestion 4-option cap, no fake localhost 'Hosted report' link, prompt-injection guard, plain issue titles (decision), honest wording on filing status
  7. secrets transcript hygiene — entropy check passes secret as CLI arg, history scan references unshipped redactor, before→after diff reproduces secret lines
  8. Docs sweep — README/DESIGN/ONBOARDING/examples/REVIEWS drift

Product decisions locked (2026-07-02): auto-file issues stays (no ownership check/consent popup; dedicated bot account planned); issue titles plain professional; hosted reports permanent; ids stay human-readable + public list stays; score target = identical on same repo+commit+calibration.

Full findings: internal audit reports (fable-findings.md / codex-findings.md, delivered 2026-07-02).

🤖 Filed by Claude Code on behalf of serenakeyitan

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions