Umbrella issue for the fixes from the 2026-07-02 dual audit (Fable 5 six-dimension multi-agent workflow, 62 confirmed findings + Codex CLI review, 20 findings). One PR per problem cluster, all linking here.
Clusters (in fix order):
- Scan-depth determinism — overlapping DEEP/SHALLOW/MINIMAL OR-thresholds, 8-extension whitelist misses Rust/C/C++/C#/PHP/Kotlin/Swift, du counts .git/node_modules, SHALLOW '20% sampling' has no selection rule
- Finding ownership uniqueness — input-data-safety still emits E1–E3 rate-limit findings forbidden by rate-limiting.md + SKILL.md matrix (double-count); 'Authentication or Input Safety' style ambiguous dimension mapping
- Score = pure arithmetic — no fixed penalty table/rounding/overall formula; JSON schema's closed vertical shape lacks name/score; no top-level score though template needs {{SCORE}}
- Cache correctness — key is commit-SHA-only but scan reads working tree (stale report after uncommitted fixes); two conflicting key definitions; cached wrapper never unwrapped; missing report_lang; cache-hit path skips report display
- Template rewrite — legacy purple #9e9eff (brand is green #80EE64), radar computed from letter grades A/B/C/F, N/A drawn as radius 0, placeholder map desync, wrong share URL comment, severity colors, HTML-escaping contract
- SKILL.md consistency sweep — step renumbering, popup-count rule, language matrix vs AskUserQuestion 4-option cap, no fake localhost 'Hosted report' link, prompt-injection guard, plain issue titles (decision), honest wording on filing status
- secrets transcript hygiene — entropy check passes secret as CLI arg, history scan references unshipped redactor, before→after diff reproduces secret lines
- Docs sweep — README/DESIGN/ONBOARDING/examples/REVIEWS drift
Product decisions locked (2026-07-02): auto-file issues stays (no ownership check/consent popup; dedicated bot account planned); issue titles plain professional; hosted reports permanent; ids stay human-readable + public list stays; score target = identical on same repo+commit+calibration.
Full findings: internal audit reports (fable-findings.md / codex-findings.md, delivered 2026-07-02).
🤖 Filed by Claude Code on behalf of serenakeyitan
Umbrella issue for the fixes from the 2026-07-02 dual audit (Fable 5 six-dimension multi-agent workflow, 62 confirmed findings + Codex CLI review, 20 findings). One PR per problem cluster, all linking here.
Clusters (in fix order):
Product decisions locked (2026-07-02): auto-file issues stays (no ownership check/consent popup; dedicated bot account planned); issue titles plain professional; hosted reports permanent; ids stay human-readable + public list stays; score target = identical on same repo+commit+calibration.
Full findings: internal audit reports (fable-findings.md / codex-findings.md, delivered 2026-07-02).
🤖 Filed by Claude Code on behalf of serenakeyitan