limit 62: an equivalent path spelling walks around the self-mod gate

[githubscum]

WO (lotor-lane run 10): probe the self-mod matcher for spelling escapes, the way runs 6, 8 and 9 found their defects — by executing it, not reading it.

The finding

normalizePath() converts backslashes, lowercases, strips a trailing slash. That is all. The fragment list is then matched as a plain substring — cmdNorm.includes(frag) for commands, pathContainsFragment() for Edit. A doubled separator or a . segment defeats both and changes nothing about which file opens.

Fourteen spellings through the shipped matcher: five controls gated, seven misses.

Spelling	Gated	Opens the protected file
<repo>/src/policy/index.js	yes	yes
<repo>/src//policy/index.js	no	yes
<repo>/src/./policy/index.js	no	yes
<repo>/src/./chain/index.js	no	yes
<repo>/bin//charter.js	no	yes
<repo>/./bin/./charter.js	no	yes

The right column is measured, not argued: the test writes a canary file and reads it back through all three spellings.

The Edit half is the one that matters.src/policy, src/chain, src/store, src/grant and every script in bin/ stay at gate in every mode including loose. This walks around that with one extra character, through the tool an agent actually uses to change code.

Not a new class. Limit 22 was tilde/$HOME. LOTOR-C2 was brace expansion. This is the third spelling escape in the same matcher, and all three were found by executing it rather than reading it.

What this PR ships

• KNOWN-LIMITS 62 — the confession, with the measured table, the unverified case marked unverified (src/policy./index.js is ungated; Windows strips trailing dots, but existsSync refused that spelling here, so whether a real write lands is not proven), and a caution for whoever writes the fix: normalizePath is applied to whole command strings, so collapsing /+ globally also rewrites https://x and needs its blast radius checked across every caller.
• test/policy-selfmod-separator-spellings.test.js — a tripwire, 13 assertions. It asserts the current, defective behaviour, with the plain spellings beside it as controls so the block cannot pass by the matcher dying. When the matcher is fixed, this file fails. The repair is to invert the assertions and amend entry 62 in the same change, never to delete the block.

Tested

npm test on this branch: 954 pass / 0 fail (941 on main plus the 13 new). The new file alone: 13/13.

Not fixed here, and why

The fix is normalizePath in src/policy — non-delegable core. It was attempted first and the gate refused it unsigned. Correct behaviour, and worth stating plainly: the bypass proved in this PR was not used to land the fix for the bypass. Queued for a signing sitting alongside limits 35 and 36.

What a reviewer should doubt

1. A green suite now contains nine passing tests named "is FREE". Read cold that can look like the project blessing the gap. Same cost run 9 accepted for the limit-44 tripwire, and a reviewer may legitimately want these red instead. That call is not this lane's to make alone.
2. The tripwire is not proven to trip. Demonstrating it needs the core edit the gate blocks. The claim is structural, not demonstrated. Do not describe it as proven fail-first.
3. The command-side misses may be judged out of scope. Limit 34 concedes a shell command cannot be resolved, so the fragment list is arguably as correct as it gets there. The Edit-side misses have no such defence.
4. REPO in the test is derived from import.meta.url with a Windows drive-letter fixup. It only builds path strings for the matcher and never touches the repo, but it is the least portable line in the file.
5. Is one clause enough? The entry proposes collapsing /+ and dropping ./ segments. It does not claim that exhausts the spelling space: .. traversal is gated today only when the traversed-through directory happens to be protected too.

🤖 Generated with Claude Code

[githubscum]

WO (lotor-lane run 10): probe the self-mod matcher for spelling escapes, the way runs 6, 8 and 9 found their defects — by executing it, not reading it.

The finding

normalizePath() converts backslashes, lowercases, strips a trailing slash. That is all. The fragment list is then matched as a plain substring — cmdNorm.includes(frag) for commands, pathContainsFragment() for Edit. A doubled separator or a . segment defeats both and changes nothing about which file opens.

Fourteen spellings through the shipped matcher: five controls gated, seven misses.

Spelling	Gated	Opens the protected file
<repo>/src/policy/index.js	yes	yes
<repo>/src//policy/index.js	no	yes
<repo>/src/./policy/index.js	no	yes
<repo>/src/./chain/index.js	no	yes
<repo>/bin//charter.js	no	yes
<repo>/./bin/./charter.js	no	yes

The right column is measured, not argued: the test writes a canary file and reads it back through all three spellings.

The Edit half is the one that matters.src/policy, src/chain, src/store, src/grant and every script in bin/ stay at gate in every mode including loose. This walks around that with one extra character, through the tool an agent actually uses to change code.

Not a new class. Limit 22 was tilde/$HOME. LOTOR-C2 was brace expansion. This is the third spelling escape in the same matcher, and all three were found by executing it rather than reading it.

What this PR ships

• KNOWN-LIMITS 62 — the confession, with the measured table, the unverified case marked unverified (src/policy./index.js is ungated; Windows strips trailing dots, but existsSync refused that spelling here, so whether a real write lands is not proven), and a caution for whoever writes the fix: normalizePath is applied to whole command strings, so collapsing /+ globally also rewrites https://x and needs its blast radius checked across every caller.
• test/policy-selfmod-separator-spellings.test.js — a tripwire, 13 assertions. It asserts the current, defective behaviour, with the plain spellings beside it as controls so the block cannot pass by the matcher dying. When the matcher is fixed, this file fails. The repair is to invert the assertions and amend entry 62 in the same change, never to delete the block.

Tested

npm test on this branch: 954 pass / 0 fail (941 on main plus the 13 new). The new file alone: 13/13.

Not fixed here, and why

The fix is normalizePath in src/policy — non-delegable core. It was attempted first and the gate refused it unsigned. Correct behaviour, and worth stating plainly: the bypass proved in this PR was not used to land the fix for the bypass. Queued for a signing sitting alongside limits 35 and 36.

What a reviewer should doubt

1. A green suite now contains nine passing tests named "is FREE". Read cold that can look like the project blessing the gap. Same cost run 9 accepted for the limit-44 tripwire, and a reviewer may legitimately want these red instead. That call is not this lane's to make alone.
2. The tripwire is not proven to trip. Demonstrating it needs the core edit the gate blocks. The claim is structural, not demonstrated. Do not describe it as proven fail-first.
3. The command-side misses may be judged out of scope. Limit 34 concedes a shell command cannot be resolved, so the fragment list is arguably as correct as it gets there. The Edit-side misses have no such defence.
4. REPO in the test is derived from import.meta.url with a Windows drive-letter fixup. It only builds path strings for the matcher and never touches the repo, but it is the least portable line in the file.
5. Is one clause enough? The entry proposes collapsing /+ and dropping ./ segments. It does not claim that exhausts the spelling space: .. traversal is gated today only when the traversed-through directory happens to be protected too.

🤖 Generated with Claude Code

[githubscum]

WO (lotor-lane run 10): probe the self-mod matcher for spelling escapes, the way runs 6, 8 and 9 found their defects — by executing it, not reading it.

The finding

normalizePath() converts backslashes, lowercases, strips a trailing slash. That is all. The fragment list is then matched as a plain substring — cmdNorm.includes(frag) for commands, pathContainsFragment() for Edit. A doubled separator or a . segment defeats both and changes nothing about which file opens.

Fourteen spellings through the shipped matcher: five controls gated, seven misses.

Spelling	Gated	Opens the protected file
<repo>/src/policy/index.js	yes	yes
<repo>/src//policy/index.js	no	yes
<repo>/src/./policy/index.js	no	yes
<repo>/src/./chain/index.js	no	yes
<repo>/bin//charter.js	no	yes
<repo>/./bin/./charter.js	no	yes

The right column is measured, not argued: the test writes a canary file and reads it back through all three spellings.

The Edit half is the one that matters.src/policy, src/chain, src/store, src/grant and every script in bin/ stay at gate in every mode including loose. This walks around that with one extra character, through the tool an agent actually uses to change code.

Not a new class. Limit 22 was tilde/$HOME. LOTOR-C2 was brace expansion. This is the third spelling escape in the same matcher, and all three were found by executing it rather than reading it.

What this PR ships

• KNOWN-LIMITS 62 — the confession, with the measured table, the unverified case marked unverified (src/policy./index.js is ungated; Windows strips trailing dots, but existsSync refused that spelling here, so whether a real write lands is not proven), and a caution for whoever writes the fix: normalizePath is applied to whole command strings, so collapsing /+ globally also rewrites https://x and needs its blast radius checked across every caller.
• test/policy-selfmod-separator-spellings.test.js — a tripwire, 13 assertions. It asserts the current, defective behaviour, with the plain spellings beside it as controls so the block cannot pass by the matcher dying. When the matcher is fixed, this file fails. The repair is to invert the assertions and amend entry 62 in the same change, never to delete the block.

Tested

npm test on this branch: 954 pass / 0 fail (941 on main plus the 13 new). The new file alone: 13/13.

Not fixed here, and why

The fix is normalizePath in src/policy — non-delegable core. It was attempted first and the gate refused it unsigned. Correct behaviour, and worth stating plainly: the bypass proved in this PR was not used to land the fix for the bypass. Queued for a signing sitting alongside limits 35 and 36.

What a reviewer should doubt

1. A green suite now contains nine passing tests named "is FREE". Read cold that can look like the project blessing the gap. Same cost run 9 accepted for the limit-44 tripwire, and a reviewer may legitimately want these red instead. That call is not this lane's to make alone.
2. The tripwire is not proven to trip. Demonstrating it needs the core edit the gate blocks. The claim is structural, not demonstrated. Do not describe it as proven fail-first.
3. The command-side misses may be judged out of scope. Limit 34 concedes a shell command cannot be resolved, so the fragment list is arguably as correct as it gets there. The Edit-side misses have no such defence.
4. REPO in the test is derived from import.meta.url with a Windows drive-letter fixup. It only builds path strings for the matcher and never touches the repo, but it is the least portable line in the file.
5. Is one clause enough? The entry proposes collapsing /+ and dropping ./ segments. It does not claim that exhausts the spelling space: .. traversal is gated today only when the traversed-through directory happens to be protected too.

🤖 Generated with Claude Code

[githubscum]

WO (lotor-lane run 10): probe the self-mod matcher for spelling escapes, the way runs 6, 8 and 9 found their defects — by executing it, not reading it.

The finding

normalizePath() converts backslashes, lowercases, strips a trailing slash. That is all. The fragment list is then matched as a plain substring — cmdNorm.includes(frag) for commands, pathContainsFragment() for Edit. A doubled separator or a . segment defeats both and changes nothing about which file opens.

Fourteen spellings through the shipped matcher: five controls gated, seven misses.

Spelling	Gated	Opens the protected file
<repo>/src/policy/index.js	yes	yes
<repo>/src//policy/index.js	no	yes
<repo>/src/./policy/index.js	no	yes
<repo>/src/./chain/index.js	no	yes
<repo>/bin//charter.js	no	yes
<repo>/./bin/./charter.js	no	yes

The right column is measured, not argued: the test writes a canary file and reads it back through all three spellings.

The Edit half is the one that matters.src/policy, src/chain, src/store, src/grant and every script in bin/ stay at gate in every mode including loose. This walks around that with one extra character, through the tool an agent actually uses to change code.

Not a new class. Limit 22 was tilde/$HOME. LOTOR-C2 was brace expansion. This is the third spelling escape in the same matcher, and all three were found by executing it rather than reading it.

What this PR ships

• KNOWN-LIMITS 62 — the confession, with the measured table, the unverified case marked unverified (src/policy./index.js is ungated; Windows strips trailing dots, but existsSync refused that spelling here, so whether a real write lands is not proven), and a caution for whoever writes the fix: normalizePath is applied to whole command strings, so collapsing /+ globally also rewrites https://x and needs its blast radius checked across every caller.
• test/policy-selfmod-separator-spellings.test.js — a tripwire, 13 assertions. It asserts the current, defective behaviour, with the plain spellings beside it as controls so the block cannot pass by the matcher dying. When the matcher is fixed, this file fails. The repair is to invert the assertions and amend entry 62 in the same change, never to delete the block.

Tested

npm test on this branch: 954 pass / 0 fail (941 on main plus the 13 new). The new file alone: 13/13.

Not fixed here, and why

The fix is normalizePath in src/policy — non-delegable core. It was attempted first and the gate refused it unsigned. Correct behaviour, and worth stating plainly: the bypass proved in this PR was not used to land the fix for the bypass. Queued for a signing sitting alongside limits 35 and 36.

What a reviewer should doubt

1. A green suite now contains nine passing tests named "is FREE". Read cold that can look like the project blessing the gap. Same cost run 9 accepted for the limit-44 tripwire, and a reviewer may legitimately want these red instead. That call is not this lane's to make alone.
2. The tripwire is not proven to trip. Demonstrating it needs the core edit the gate blocks. The claim is structural, not demonstrated. Do not describe it as proven fail-first.
3. The command-side misses may be judged out of scope. Limit 34 concedes a shell command cannot be resolved, so the fragment list is arguably as correct as it gets there. The Edit-side misses have no such defence.
4. REPO in the test is derived from import.meta.url with a Windows drive-letter fixup. It only builds path strings for the matcher and never touches the repo, but it is the least portable line in the file.
5. Is one clause enough? The entry proposes collapsing /+ and dropping ./ segments. It does not claim that exhausts the spelling space: .. traversal is gated today only when the traversed-through directory happens to be protected too.

🤖 Generated with Claude Code

[githubscum]

WO (lotor-lane run 10): probe the self-mod matcher for spelling escapes, the way runs 6, 8 and 9 found their defects — by executing it, not reading it.

The finding

normalizePath() converts backslashes, lowercases, strips a trailing slash. That is all. The fragment list is then matched as a plain substring — cmdNorm.includes(frag) for commands, pathContainsFragment() for Edit. A doubled separator or a . segment defeats both and changes nothing about which file opens.

Fourteen spellings through the shipped matcher: five controls gated, seven misses.

Spelling	Gated	Opens the protected file
<repo>/src/policy/index.js	yes	yes
<repo>/src//policy/index.js	no	yes
<repo>/src/./policy/index.js	no	yes
<repo>/src/./chain/index.js	no	yes
<repo>/bin//charter.js	no	yes
<repo>/./bin/./charter.js	no	yes

The right column is measured, not argued: the test writes a canary file and reads it back through all three spellings.

The Edit half is the one that matters.src/policy, src/chain, src/store, src/grant and every script in bin/ stay at gate in every mode including loose. This walks around that with one extra character, through the tool an agent actually uses to change code.

Not a new class. Limit 22 was tilde/$HOME. LOTOR-C2 was brace expansion. This is the third spelling escape in the same matcher, and all three were found by executing it rather than reading it.

What this PR ships

• KNOWN-LIMITS 62 — the confession, with the measured table, the unverified case marked unverified (src/policy./index.js is ungated; Windows strips trailing dots, but existsSync refused that spelling here, so whether a real write lands is not proven), and a caution for whoever writes the fix: normalizePath is applied to whole command strings, so collapsing /+ globally also rewrites https://x and needs its blast radius checked across every caller.
• test/policy-selfmod-separator-spellings.test.js — a tripwire, 13 assertions. It asserts the current, defective behaviour, with the plain spellings beside it as controls so the block cannot pass by the matcher dying. When the matcher is fixed, this file fails. The repair is to invert the assertions and amend entry 62 in the same change, never to delete the block.

Tested

npm test on this branch: 954 pass / 0 fail (941 on main plus the 13 new). The new file alone: 13/13.

Not fixed here, and why

The fix is normalizePath in src/policy — non-delegable core. It was attempted first and the gate refused it unsigned. Correct behaviour, and worth stating plainly: the bypass proved in this PR was not used to land the fix for the bypass. Queued for a signing sitting alongside limits 35 and 36.

What a reviewer should doubt

1. A green suite now contains nine passing tests named "is FREE". Read cold that can look like the project blessing the gap. Same cost run 9 accepted for the limit-44 tripwire, and a reviewer may legitimately want these red instead. That call is not this lane's to make alone.
2. The tripwire is not proven to trip. Demonstrating it needs the core edit the gate blocks. The claim is structural, not demonstrated. Do not describe it as proven fail-first.
3. The command-side misses may be judged out of scope. Limit 34 concedes a shell command cannot be resolved, so the fragment list is arguably as correct as it gets there. The Edit-side misses have no such defence.
4. REPO in the test is derived from import.meta.url with a Windows drive-letter fixup. It only builds path strings for the matcher and never touches the repo, but it is the least portable line in the file.
5. Is one clause enough? The entry proposes collapsing /+ and dropping ./ segments. It does not claim that exhausts the spelling space: .. traversal is gated today only when the traversed-through directory happens to be protected too.

🤖 Generated with Claude Code

[githubscum]

WO (lotor-lane run 10): probe the self-mod matcher for spelling escapes, the way runs 6, 8 and 9 found their defects — by executing it, not reading it.

The finding

normalizePath() converts backslashes, lowercases, strips a trailing slash. That is all. The fragment list is then matched as a plain substring — cmdNorm.includes(frag) for commands, pathContainsFragment() for Edit. A doubled separator or a . segment defeats both and changes nothing about which file opens.

Fourteen spellings through the shipped matcher: five controls gated, seven misses.

Spelling	Gated	Opens the protected file
<repo>/src/policy/index.js	yes	yes
<repo>/src//policy/index.js	no	yes
<repo>/src/./policy/index.js	no	yes
<repo>/src/./chain/index.js	no	yes
<repo>/bin//charter.js	no	yes
<repo>/./bin/./charter.js	no	yes

The right column is measured, not argued: the test writes a canary file and reads it back through all three spellings.

The Edit half is the one that matters.src/policy, src/chain, src/store, src/grant and every script in bin/ stay at gate in every mode including loose. This walks around that with one extra character, through the tool an agent actually uses to change code.

Not a new class. Limit 22 was tilde/$HOME. LOTOR-C2 was brace expansion. This is the third spelling escape in the same matcher, and all three were found by executing it rather than reading it.

What this PR ships

• KNOWN-LIMITS 62 — the confession, with the measured table, the unverified case marked unverified (src/policy./index.js is ungated; Windows strips trailing dots, but existsSync refused that spelling here, so whether a real write lands is not proven), and a caution for whoever writes the fix: normalizePath is applied to whole command strings, so collapsing /+ globally also rewrites https://x and needs its blast radius checked across every caller.
• test/policy-selfmod-separator-spellings.test.js — a tripwire, 13 assertions. It asserts the current, defective behaviour, with the plain spellings beside it as controls so the block cannot pass by the matcher dying. When the matcher is fixed, this file fails. The repair is to invert the assertions and amend entry 62 in the same change, never to delete the block.

Tested

npm test on this branch: 954 pass / 0 fail (941 on main plus the 13 new). The new file alone: 13/13.

Not fixed here, and why

The fix is normalizePath in src/policy — non-delegable core. It was attempted first and the gate refused it unsigned. Correct behaviour, and worth stating plainly: the bypass proved in this PR was not used to land the fix for the bypass. Queued for a signing sitting alongside limits 35 and 36.

What a reviewer should doubt

1. A green suite now contains nine passing tests named "is FREE". Read cold that can look like the project blessing the gap. Same cost run 9 accepted for the limit-44 tripwire, and a reviewer may legitimately want these red instead. That call is not this lane's to make alone.
2. The tripwire is not proven to trip. Demonstrating it needs the core edit the gate blocks. The claim is structural, not demonstrated. Do not describe it as proven fail-first.
3. The command-side misses may be judged out of scope. Limit 34 concedes a shell command cannot be resolved, so the fragment list is arguably as correct as it gets there. The Edit-side misses have no such defence.
4. REPO in the test is derived from import.meta.url with a Windows drive-letter fixup. It only builds path strings for the matcher and never touches the repo, but it is the least portable line in the file.
5. Is one clause enough? The entry proposes collapsing /+ and dropping ./ segments. It does not claim that exhausts the spelling space: .. traversal is gated today only when the traversed-through directory happens to be protected too.

🤖 Generated with Claude Code

[githubscum]

WO (lotor-lane run 10): probe the self-mod matcher for spelling escapes, the way runs 6, 8 and 9 found their defects — by executing it, not reading it.

The finding

normalizePath() converts backslashes, lowercases, strips a trailing slash. That is all. The fragment list is then matched as a plain substring — cmdNorm.includes(frag) for commands, pathContainsFragment() for Edit. A doubled separator or a . segment defeats both and changes nothing about which file opens.

Fourteen spellings through the shipped matcher: five controls gated, seven misses.

Spelling	Gated	Opens the protected file
<repo>/src/policy/index.js	yes	yes
<repo>/src//policy/index.js	no	yes
<repo>/src/./policy/index.js	no	yes
<repo>/src/./chain/index.js	no	yes
<repo>/bin//charter.js	no	yes
<repo>/./bin/./charter.js	no	yes

The right column is measured, not argued: the test writes a canary file and reads it back through all three spellings.

The Edit half is the one that matters.src/policy, src/chain, src/store, src/grant and every script in bin/ stay at gate in every mode including loose. This walks around that with one extra character, through the tool an agent actually uses to change code.

Not a new class. Limit 22 was tilde/$HOME. LOTOR-C2 was brace expansion. This is the third spelling escape in the same matcher, and all three were found by executing it rather than reading it.

What this PR ships

• KNOWN-LIMITS 62 — the confession, with the measured table, the unverified case marked unverified (src/policy./index.js is ungated; Windows strips trailing dots, but existsSync refused that spelling here, so whether a real write lands is not proven), and a caution for whoever writes the fix: normalizePath is applied to whole command strings, so collapsing /+ globally also rewrites https://x and needs its blast radius checked across every caller.
• test/policy-selfmod-separator-spellings.test.js — a tripwire, 13 assertions. It asserts the current, defective behaviour, with the plain spellings beside it as controls so the block cannot pass by the matcher dying. When the matcher is fixed, this file fails. The repair is to invert the assertions and amend entry 62 in the same change, never to delete the block.

Tested

npm test on this branch: 954 pass / 0 fail (941 on main plus the 13 new). The new file alone: 13/13.

Not fixed here, and why

The fix is normalizePath in src/policy — non-delegable core. It was attempted first and the gate refused it unsigned. Correct behaviour, and worth stating plainly: the bypass proved in this PR was not used to land the fix for the bypass. Queued for a signing sitting alongside limits 35 and 36.

What a reviewer should doubt

1. A green suite now contains nine passing tests named "is FREE". Read cold that can look like the project blessing the gap. Same cost run 9 accepted for the limit-44 tripwire, and a reviewer may legitimately want these red instead. That call is not this lane's to make alone.
2. The tripwire is not proven to trip. Demonstrating it needs the core edit the gate blocks. The claim is structural, not demonstrated. Do not describe it as proven fail-first.
3. The command-side misses may be judged out of scope. Limit 34 concedes a shell command cannot be resolved, so the fragment list is arguably as correct as it gets there. The Edit-side misses have no such defence.
4. REPO in the test is derived from import.meta.url with a Windows drive-letter fixup. It only builds path strings for the matcher and never touches the repo, but it is the least portable line in the file.
5. Is one clause enough? The entry proposes collapsing /+ and dropping ./ segments. It does not claim that exhausts the spelling space: .. traversal is gated today only when the traversed-through directory happens to be protected too.

🤖 Generated with Claude Code

[githubscum]

WO (lotor-lane run 10): probe the self-mod matcher for spelling escapes, the way runs 6, 8 and 9 found their defects — by executing it, not reading it.

The finding

normalizePath() converts backslashes, lowercases, strips a trailing slash. That is all. The fragment list is then matched as a plain substring — cmdNorm.includes(frag) for commands, pathContainsFragment() for Edit. A doubled separator or a . segment defeats both and changes nothing about which file opens.

Fourteen spellings through the shipped matcher: five controls gated, seven misses.

Spelling	Gated	Opens the protected file
<repo>/src/policy/index.js	yes	yes
<repo>/src//policy/index.js	no	yes
<repo>/src/./policy/index.js	no	yes
<repo>/src/./chain/index.js	no	yes
<repo>/bin//charter.js	no	yes
<repo>/./bin/./charter.js	no	yes

The right column is measured, not argued: the test writes a canary file and reads it back through all three spellings.

The Edit half is the one that matters.src/policy, src/chain, src/store, src/grant and every script in bin/ stay at gate in every mode including loose. This walks around that with one extra character, through the tool an agent actually uses to change code.

Not a new class. Limit 22 was tilde/$HOME. LOTOR-C2 was brace expansion. This is the third spelling escape in the same matcher, and all three were found by executing it rather than reading it.

What this PR ships

• KNOWN-LIMITS 62 — the confession, with the measured table, the unverified case marked unverified (src/policy./index.js is ungated; Windows strips trailing dots, but existsSync refused that spelling here, so whether a real write lands is not proven), and a caution for whoever writes the fix: normalizePath is applied to whole command strings, so collapsing /+ globally also rewrites https://x and needs its blast radius checked across every caller.
• test/policy-selfmod-separator-spellings.test.js — a tripwire, 13 assertions. It asserts the current, defective behaviour, with the plain spellings beside it as controls so the block cannot pass by the matcher dying. When the matcher is fixed, this file fails. The repair is to invert the assertions and amend entry 62 in the same change, never to delete the block.

Tested

npm test on this branch: 954 pass / 0 fail (941 on main plus the 13 new). The new file alone: 13/13.

Not fixed here, and why

The fix is normalizePath in src/policy — non-delegable core. It was attempted first and the gate refused it unsigned. Correct behaviour, and worth stating plainly: the bypass proved in this PR was not used to land the fix for the bypass. Queued for a signing sitting alongside limits 35 and 36.

What a reviewer should doubt

1. A green suite now contains nine passing tests named "is FREE". Read cold that can look like the project blessing the gap. Same cost run 9 accepted for the limit-44 tripwire, and a reviewer may legitimately want these red instead. That call is not this lane's to make alone.
2. The tripwire is not proven to trip. Demonstrating it needs the core edit the gate blocks. The claim is structural, not demonstrated. Do not describe it as proven fail-first.
3. The command-side misses may be judged out of scope. Limit 34 concedes a shell command cannot be resolved, so the fragment list is arguably as correct as it gets there. The Edit-side misses have no such defence.
4. REPO in the test is derived from import.meta.url with a Windows drive-letter fixup. It only builds path strings for the matcher and never touches the repo, but it is the least portable line in the file.
5. Is one clause enough? The entry proposes collapsing /+ and dropping ./ segments. It does not claim that exhausts the spelling space: .. traversal is gated today only when the traversed-through directory happens to be protected too.

🤖 Generated with Claude Code