fix(guardrails): an unspaced assignment no longer hides a PowerShell dynamic invocation or launcher from the fail-closed sink - #2992

Merged

kyle-sexton merged 6 commits into

mainfrom

fix/2984-sink-trigger-eq-lane-e

Aug 21, 2026

Commits on Aug 21, 2026

fix(guardrails): an unspaced assignment no longer hides a PowerShell dynamic invocation or launcher from the fail-closed sink

authored and
cursoragent
committed
6842a1d
test(guardrails): pin the =-glued launcher collision at its measured rc

authored and
cursoragent
committed
f800acd
fix(guardrails): treat sink-trigger `=` as a PowerShell assignment, not a generic separator

cursoragent
and
kyle-sexton
committed
e2f60ca
test(guardrails): silence SC2016 on intentional PowerShell payload literals

cursoragent
and
kyle-sexton
committed
80739f9
test(guardrails): pin quoted \$a=& so dynamic-invocation quote-blanking is exercised

cursoragent
and
kyle-sexton
committed
adfd2d9
test(guardrails): pin quoted `; \$a=&` so the blanking confirmation actually runs

cursoragent
and
kyle-sexton
committed
06d0164