fix(skill): bicameral-report-bug — config.yaml keys-only by default (#200 A4)

[Knapp-Kevin]

Summary

• Closes A4 of skill(bicameral-report-bug): Windows portability + privacy hardening (4 findings from in-session audit) #200's audit findings (the .bicameral/config.yaml verbatim leak). Companion PR to feat(mcp): MCP UX improvement #201 (just merged) which closed A1 + A6 + part of A7 by going bash-free.
• Default config.yaml inclusion in bug-report bodies is now top-level keys only (sorted, no values, no nested keys, no comments). Workspace IDs, tokens, allowlists, and env-specific settings stay on the operator's machine by default.
• Explicit opt-in toggle in Step 3.5's transparency preview: "Yes, but include config.yaml verbatim" lets the operator elect verbatim when the bug genuinely needs the values (e.g. a YAML parser regression). Defense-in-depth: the secret-redaction regex still runs on verbatim contents.
• When the operator picks the verbatim toggle, the body regenerates and the preview re-displays — operator sees the actual shipping shape before clicking through.

Linked issues

Closes A4 in #200 (A1 + A6 + partial A7 closed by #201)

Test plan

• python scripts/lint_plan_grounding.py plan-200-config-yaml-redaction.md — exit 0 (PR feat(#114): CI grounding lint — plan paths + PR-body refs #121's plan-grounding lint accepts this plan)
• grep -n "<contents>" skills/bicameral-report-bug/SKILL.md — single match, on line 240 inside the documented opt-in path (Step 3.5's "Yes, but include config.yaml verbatim" outcome handler). Default body assembly no longer references <contents>.
• grep -nE "config\.yaml.*verbatim|keys only" skills/bicameral-report-bug/SKILL.md — 5 matches across Step 2 instruction, Step 3 template note, Step 3.5 redaction summary, and both AskUserQuestion option descriptions + outcome handlers.

Notes for review

• Branch is based on current upstream/dev (post-feat(mcp): MCP UX improvement #201 merge).
• Risk grade: L1 (single skill markdown edit; no production code surfaces touched; no CHANGELOG/lint regressions).
• This is the fifth audit-passed plan in this session that ships under the doctrine-test-functionality carve-out for LLM-consumed agent-instructions (precedent: plan-156 PR A Phase 2, plan-156b Phase 1, plan-187 Phase 2, plan-197 Phase 1, this PR). The runtime preview IS the validation; static substring lints would be presence-only by construction.
• The verbatim opt-in path preserves the pre-skill(bicameral-report-bug): Windows portability + privacy hardening (4 findings from in-session audit) #200 behavior for operators whose bugs genuinely need config values, with explicit consent. The secret-redaction regex (api[_-]?key|token|secret|password|bearer) still runs as a backstop.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bc02c377-e536-44f5-8232-240b117dcb09

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 200-config-yaml-redaction

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}