fix: 2026-11-03 principal review findings (7.3.0) by PrzemekGalarowicz · Pull Request #416 · pharn-dev/pharn-oss

PrzemekGalarowicz · 2026-11-03T21:59:16Z

Fixes the findings of the 2026-11-03 principal review of main @ dd0bb3d (7.2.1) in one release, 7.3.0.

Ten fix groups each ran on their own branch (nine through /pharn-dev-ship, one small-fixes group without it) and were merged into batch/audit-2026-11-03. Every edit to a protected file (the four hooks, .claude/settings.json, the four trusted docs, memory-bank canon) was applied by the maintainer through a sha256-pinned script. Each hook script was first reviewed by an independent adversarial agent in a throwaway clone; the scope-setter patch was sent back twice before it passed. GATE 1 and GATE 2 of every group were decided by the batch orchestrator (a model) under the maintainer's delegation, and each SHIP.md records them that way.

What changed

Plan scope (BLOCKER, narrowed, not closed): set-writes-scope.cjs --from-plan refuses the following:
- memory-bank canon, everywhere, with no opt-in;
- CI and hook config (.github/workflows, .github/actions, .husky, core.hooksPath, .mcp.json), everywhere, unless a human opts in;
- instruction files (CLAUDE.md, CLAUDE.local.md, AGENTS.md) in an installed project;
- PHARN's own surface and the instruction files while a /pharn-loop or /pharn-ship marker is open;
- absolute, escaping, --led and quoted entries;
- ## Files lists that hide items in comments, raw HTML or split sections.
The dev build's formatter step passes paths NUL-separated, after --, and only for literal regular files. A model-approved dev plan with no product run open can still scope pharn/floor/**; GATE 1 and GitHub review guard that.
Guards: "onFailure": "block" is set on both write guards (Claude Code 2.1.295 or later). protect-trusted-paths.cjs denies the write tools everything below pharn/.run/pharn-{loop,ship,review}/.
Loop marker:
- --open records the mode, refuses to overwrite an open marker, and writes atomically.
- MODE_UNWITNESSED refuses a record whose mode differs from the marker's.
- The blocked: vocabulary is closed.
- --accept-host-execution is no longer pre-approved.
- Repeated keys in reports are refused.
- Placeholder attestations are refused.
- The loop commit leaves out the user's own pre-run edits.
Floor checkers:
- One CRLF-safe frontmatter reader replaces seven copies, and a displaced fence turns the floor RED.
- A symlinked directory turns validate RED.
- Zero capabilities under a capability root is INCONCLUSIVE.
- One lesson-heading grammar now skips fences and comments.
Reconcile:
- A second run can no longer reset an open run's window.
- CI exec-config is always reconciled.
- The cost-ledger exception is narrowed.
Review:
- REVIEW.md is rendered by the floor (render-review.mjs), with every lens-supplied value fenced and capped.
- type is closed to two members.
- An unrecorded lens directory is refused.
Dev process:
- /pharn-dev-verify runs on the gate runner and checks the result with --stamp.
- A red verdict is a STOP that delegation cannot override.
- A new per-PR check:ship-record requires a green record for product-path PRs.
Docs: the four trusted docs, CLAUDE.md, README, SECURITY and CONTRIBUTING now match the code. New lesson L82 corrects L14.

Gates on `8343100` (with origin/main `ab77455` merged)

npm run check: exit 0, 6467 tests, 0 failed.
validate: GREEN, 37 capabilities.
check:changelog-entry: GREEN.
check:surface-bump: GREEN, 7.2.1 → 7.3.0.
check:ship-record: GREEN.
check:instruction-growth: within budget.

Remaining bounds and owner decisions (the ruleset bypass, older Claude Code versions, Bash writes) are stated in pharn/LIMITS.md and .dev/features/*/SHIP.md.

🤖 Generated with Claude Code