Queue the rule against agent text carrying the maintainer's own data - #530
Merged
Conversation
An agent illustrating a review finding quoted real paths from the maintainer's filesystem, carrying family members' names, into a comment on a public repository. The finding needed none of them. The entry records what the rule has to say rather than only that one is owed. Synthetic evidence is the better evidence and not a concession, since a constructed filename demonstrates a filename defect and a reader can re-run it. The exposure is one-way, so an edit afterwards mitigates rather than fixes, and that call is the maintainer's. And no checker closes it, because the data that leaked was name-shaped: a path pattern finds nothing on the offending comment while the names sit in plain sight, so a gate over paths is a floor rather than an answer. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the project backlog to queue a fleet-wide governance rule about avoiding maintainer-environment data (e.g., real local filesystem paths that may embed personal names) in any agent-authored text on public surfaces.
Changes:
- Adds a TODO item to draft a
GOVERNANCE.mdrule requiring synthetic/representative example data instead of observed maintainer-environment data, and outlines key points the eventual wording must cover.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Queues a rule the fleet does not currently state. An agent illustrating a review finding on a downstream pull request quoted real paths from the maintainer's own filesystem, which carried family members' names, into a comment on a public repository. Nothing about the finding required them.
The entry records what the rule has to say, not merely that one is owed, because three things about it are easy to get wrong.
Synthetic evidence is the better evidence. It reads like a concession and is not one. A filename constructed to contain a newline demonstrates a newline defect exactly, and any reader can re-run it. A real photo library proves the same thing and can never be re-run by anyone, so the substitution costs nothing and gains reproducibility.
The exposure is one-way. A comment on a public repository is fetched, cached, and indexed the moment it posts, so editing it afterwards is mitigation rather than a fix. What to do about one that has already landed is the maintainer's call, not the agent's.
No checker closes this. A pattern finds an absolute home path or a drive letter, and that subset is worth gating as a floor. The data that leaked here was name-shaped, and a name is not pattern-detectable: a grep over the offending pull request for path-shaped strings returns nothing while the names sit in plain sight. A gate written for this must be understood as catching the easy half, or it becomes the reassurance that stops anyone looking.
Scoped fleet-wide rather than to the hub, since every repo in the fleet is public and each is worked by agents reading the same carried rules.
This pull request queues the work. It does not write the rule, which belongs in a carried
GOVERNANCE.mdsection and re-vendors across the fleet when it lands.🤖 Generated with Claude Code