quality-debt: batch D concern splits and measured residuals

docs/evidence/quality-debt-2026-09/allocation.json

@@ -317,6 +317,16 @@
     "AaB3XkkoIqdfylE4c2pW",
     "AaB3XknlIqdfylE4c2qa",
     "AaB3XkpTIqdfylE4c2q_",
+    "AaCFAMP8z18_BjK2pBK8",
+    "AaCFAMP8z18_BjK2pBK7",
+    "AaCFAMJqz18_BjK2pBK4",
+    "AaCFAMJqz18_BjK2pBK5",
+    "AaCFAMWuz18_BjK2pBK_",
+    "AaCFANODz18_BjK2pBOa",
+    "AaCFANODz18_BjK2pBOZ",
+    "AaCFANNFz18_BjK2pBOW",
+    "AaCFANNFz18_BjK2pBOX",
+    "AaCFANUaz18_BjK2pBOd",
     "d3b9d9cfec9a260b9bc67f7dc5bfd707",
     "365aff788b569c400b4b80434ec21768",
     "dafdbd571c370b7fba8ce99f3564089e",
@@ -466,7 +476,13 @@
     "AaB3XkpTIqdfylE4c2rC",
     "AaB3XkpTIqdfylE4c2rD",
     "AaB3XkpTIqdfylE4c2rE",
-    "AaB3XkpTIqdfylE4c2rF"
+    "AaB3XkpTIqdfylE4c2rF",
+    "AaCFAMJqz18_BjK2pBK3",
+    "AaCFAMJqz18_BjK2pBK6",
+    "AaCFAMTgz18_BjK2pBK9",
+    "AaCFANNFz18_BjK2pBOV",
+    "AaCFANNFz18_BjK2pBOY",
+    "AaCFANRiz18_BjK2pBOb"
   ],
   "B2": [
     "AaB3XkbGIqdfylE4c2na",
@@ -523,7 +539,11 @@
     "AaB3Xki0IqdfylE4c2o0",
     "AaB3XkmSIqdfylE4c2p3",
     "AaB3XkkoIqdfylE4c2pU",
-    "AaB3XkkoIqdfylE4c2pX"
+    "AaB3XkkoIqdfylE4c2pX",
+    "AaCFAMXmz18_BjK2pBLB",
+    "AaCFAMWfz18_BjK2pBK-",
+    "AaCFANVkz18_BjK2pBOf",
+    "AaCFANUFz18_BjK2pBOc"
   ],
   "B3": [
     "AaB3XkkbIqdfylE4c2pQ",
@@ -565,7 +585,9 @@
     "AaB3XklBIqdfylE4c2pi",
     "AaB3XkkzIqdfylE4c2pZ",
     "AaB3XkkzIqdfylE4c2pa",
-    "AaB3XkkzIqdfylE4c2pb"
+    "AaB3XkkzIqdfylE4c2pb",
+    "AaCFAMXQz18_BjK2pBLA",
+    "AaCFANVEz18_BjK2pBOe"
   ],
   "C1": [
     "AaB3Xke6IqdfylE4c2oF",
@@ -738,18 +760,20 @@
     "e5c566331a7a4187809f6a4b25baaced",
     "925f06752f2e4d955e5cbd1226a388ba",
     "6c7d15e7863e4975dd4b61c93e5a93b1",
-    "16267458dd41ebb61fa3aec7549291cc"
+    "16267458dd41ebb61fa3aec7549291cc",
+    "48b2a00cb7eb3b5e6344415870d01661",
+    "f24df26860d01b16c092756092dba6ce"
   ],
   "counts": {
     "A": 302,
-    "E": 36,
-    "B1": 125,
-    "B2": 55,
-    "B3": 40,
+    "E": 46,
+    "B1": 131,
+    "B2": 59,
+    "B3": 42,
     "C1": 27,
     "C2": 39,
     "C3": 17,
     "C4": 62,
-    "D": 18
+    "D": 20
   }
 }

docs/evidence/quality-debt-2026-09/batch-d-analysis-followup.md

@@ -0,0 +1,46 @@
+# Batch D analysis follow-up
+
+PR #185 analysis of `ebe687dcf99103cf3965649b969bb0f2bb4d5d62` reported eleven Sonar issues
+on moved code, two Codacy file-length issues and two CodeQL filesystem-race alerts; Sonar's
+separately gated push-branch scan also reports the same eleven source findings with distinct
+native IDs. Each is compared with its source and its pre-extraction body at `d724d5df`; the
+branch-to-PR mapping matches rule, component, line, source hash and message. The Sonar/Codacy
+inventory gains twenty-four native IDs without dropping any, for 745 total (332 Sonar, 413
+Codacy). These are PR/push-branch observations, not another main baseline.
+
+| Finding group | Source-backed disposition |
+|---|---|
+| Sonar S8707, `mcp-report.mjs:99,100` | The operator explicitly chooses `--out`; the local harness writes fixed `report.json`/`report.md` names there. Agent output does not choose the path. Same writes as old `mcp-clients.mjs:845,846`; no less-trusted controller crosses a privilege boundary. |
+| Sonar S4036, `process.mjs:59,75`, `replay-report.ts:67` | Fixed `git`/`timeout` commands resolve through the operator's PATH with argv arrays. Fixture/agent output supplies neither PATH nor those executable names. Same calls as old `agents.mjs:189,209` and `replay.ts:520`; an actor able to replace PATH executables already has that user's code-execution authority. |
+| Sonar S3516, `childEnv` and `waitUntil` | Returning the same variable name does not mean the same value: credentials are selectively removed, and polling returns either the first truthy value or the final falsy value. Existing disposition reasons remain valid. |
+| Sonar S3516, capture and Pi injection CLI | Every successful and failed agent-facing path deliberately returns numeric zero; changing it would violate the CLI's quiet/fail-open contract. |
+| Sonar S7784, fixture coverage | The discarded JSON round trip checks serialization for the actual JSONL writer; `structuredClone` accepts values such as BigInt that JSON rejects. Existing disposition remains valid. |
+| Sonar S6551, Grok native session ID | String coercion preserves the existing numeric-key behavior; a string-only guard changes identity and resume lookup. Existing disposition remains valid. |
+| Codacy lifecycle source/test file length | 724/638 NLOC; the independently reviewed residual state machine and its execution tests are cohesive after preparation, evaluation and reporting moved out. Native IDs: `f24df26860d01b16c092756092dba6ce` / `48b2a00cb7eb3b5e6344415870d01661`. R7 records `AcceptedUse` reasons. |
+
+[CodeQL #158](https://github.com/ojungo69/oboete/security/code-scanning/158) points to
+`codex-mcp.mjs:47`, the unchanged check/write from old `probes/codex.mjs:412,413`.
+[CodeQL #159](https://github.com/ojungo69/oboete/security/code-scanning/159) points to
+`process.mjs:55`, the unchanged fresh-repository setup from old `agents.mjs:184,185`.
+Exploiting either race requires write access to the same operator-owned scratch home/repository;
+that access already permits arbitrary changes there. Neither is a product entrypoint or a
+cross-user operation. The review recommends `used in tests` for these two individual alerts.
+
+The old record classifier recognized only Sonar S8786 as security-related. Consequently the
+new S4036/S8707 rows would stay unallocated and could be recorded without their required verdict.
+The existing classifier now recognizes those two observed rules, and allocation reuses it.
+Three focused checks failed before the fix: two missing-verdict checks and allocation. After the
+fix all 158 record CLI tests pass on both Node 22.16.0 and Node 24.16.0; unknown rules remain
+unallocated and PL/SQL exclusion priority remains intact. ESLint passes. No new flag was added.
+
+The measured engine is unchanged: SHA-256
+`97bd89dd1771dadc77ca8052491f565c38131c123ef4c28b8ef981185d739761`.
+The record CLI changes are outside the packed engine. The current-PR and matching push-branch
+rows were resolved individually: 22 Sonar transition/comment calls per analysis context return
+HTTP 200; the two Codacy ignores returned HTTP 204 after account verification returned 200.
+Sonar's PR and branch issue searches return zero and both Quality Gates are OK. Codacy's next
+analysis at `c8fb5d7c` confirms new issues 0 and `isUpToStandards: true`. CodeQL #158/#159 are
+individually dismissed as `used in tests` with source-specific reasons. [HTTP receipts and
+branch-to-PR ID mapping](batch-d-pr-alert-responses.json) record these actions. Original Batch F
+bulk rows were not applied: main still reports Sonar 15 / Codacy 38, and the 745-row planned
+ledger has 56 unconfirmed rows. Actual runtime acceptance remains outstanding.