Context
PR #13693 is approved as Approve+Follow-Up for #13691. The shipped slice defangs untrusted GitHub-authored content at the syncer write boundary by reusing the canonical contentTrust projection, and the syncer-level tests prove persisted Markdown is sanitized.
Ada's review identified one non-blocking evidence gap: #13691 AC #4 asked for a downstream reader-level regression proving TicketSource / IssueIngestor consume sanitized content and never reintroduce raw external URLs. That direct reader guard is not in #13693, even though the current behavior is protected transitively by the write-boundary tests.
Release classification: post-release (Approve+Follow-Up follow-up — non-blocking for #13693 merge).
The Problem
The current #13693 evidence proves the writer side:
- issue, pull request, and discussion syncers persist
[QUARANTINED_URL: domain] for untrusted authored nodes;
- trusted authored content remains byte-identical;
contentTrust metadata is persisted in frontmatter.
The remaining gap is reader-level regression protection. A future change to TicketSource or IssueIngestor could bypass the sanitized local Markdown or re-derive content from an unsanitized source without failing the #13693 syncer tests.
The Architectural Reality
TicketSource reads resources/content/issues and resources/content/archive/issues into Knowledge Base chunks.IssueIngestor reads issue/discussion content into graph/embedding documents.- ADR 0004 records these readers as affected consumers of the GitHub content architecture and preserves the input-shape/output-shape distinction for graph ingestion.
- #10476 is the parent self-defense lane; #13691 / PR #13693 covers the sync/write boundary and leaves this direct reader regression as the follow-up guard.
The Fix
Add focused unit coverage that feeds a sanitized external-authored issue or discussion fixture through the reader layer and asserts the downstream output contains [QUARANTINED_URL: domain] and not the original raw URL.
The exact test split should follow current file ownership after reading the source:
- prefer a
TicketSource regression when the KB chunk path is enough to prove the reader consumes persisted sanitized Markdown;
- add an
IssueIngestor regression too if its current source path can bypass TicketSource or otherwise needs separate proof.
Contract Ledger Matrix
| Target Surface |
Source of Authority |
Proposed Behavior |
Fallback / Edge Case |
Docs |
Evidence |
TicketSource reader regression |
#13691 AC #4; PR #13693 review follow-up |
Chunk output for sanitized external-authored fixtures contains [QUARANTINED_URL: domain] and omits the raw URL |
If TicketSource is not the graph path, keep this as KB-reader coverage only and cover IssueIngestor separately |
No docs change expected |
Focused Playwright unit test |
IssueIngestor reader regression |
#13691 AC #4; ADR 0004 consumer-reader inventory |
Embedding/document payload for sanitized issue/discussion fixtures contains [QUARANTINED_URL: domain] and omits the raw URL |
If the ingestor already delegates through the sanitized local content reader, assert that delegation explicitly or document why a separate test is redundant |
No docs change expected |
Focused Playwright unit test or source-backed no-op rationale in PR body |
Decision Record impact
Aligned with ADR 0004. This ticket does not amend content architecture; it adds regression evidence around the reader consumers ADR 0004 already names.
Acceptance Criteria
Out of Scope
- Changing the #13693 writer/syncer projection shape.
- Rewriting historical
resources/content/* archives.
- Adding new remote GitHub mutation behavior.
- Hard-coding product or vendor denylist values.
Avoided Traps
- Do not create a second sanitizer path in the readers. #13693 intentionally uses a single write-boundary projection so downstream consumers inherit sanitized persisted content.
- Do not block #13693 on this follow-up. The approved PR is merge-eligible; this is a regression guard for future reader changes.
Related
Live latest-open sweep: checked latest 20 open issues at 2026-06-21T03:29Z; no equivalent follow-up found.
A2A in-flight sweep: checked latest 30 messages at 2026-06-21T03:29Z; Ada's #13693 follow-up request was present, with no competing follow-up claim.
Handoff Retrieval Hints
gh pr view 13693 --json latestReviews,reviewDecision,reviewRequests,statusCheckRolluprg -n "TicketSource.*IssueIngestor|contentTrust.*TicketSource|QUARANTINED_URL.*IssueIngestor|AC #4" resources/content/issues resources/content/pulls resources/content/discussions test ai learn
Context
PR #13693 is approved as
Approve+Follow-Upfor #13691. The shipped slice defangs untrusted GitHub-authored content at the syncer write boundary by reusing the canonicalcontentTrustprojection, and the syncer-level tests prove persisted Markdown is sanitized.Ada's review identified one non-blocking evidence gap: #13691 AC #4 asked for a downstream reader-level regression proving
TicketSource/IssueIngestorconsume sanitized content and never reintroduce raw external URLs. That direct reader guard is not in #13693, even though the current behavior is protected transitively by the write-boundary tests.Release classification: post-release (Approve+Follow-Up follow-up — non-blocking for #13693 merge).
The Problem
The current #13693 evidence proves the writer side:
[QUARANTINED_URL: domain]for untrusted authored nodes;contentTrustmetadata is persisted in frontmatter.The remaining gap is reader-level regression protection. A future change to
TicketSourceorIssueIngestorcould bypass the sanitized local Markdown or re-derive content from an unsanitized source without failing the #13693 syncer tests.The Architectural Reality
TicketSourcereadsresources/content/issuesandresources/content/archive/issuesinto Knowledge Base chunks.IssueIngestorreads issue/discussion content into graph/embedding documents.The Fix
Add focused unit coverage that feeds a sanitized external-authored issue or discussion fixture through the reader layer and asserts the downstream output contains
[QUARANTINED_URL: domain]and not the original raw URL.The exact test split should follow current file ownership after reading the source:
TicketSourceregression when the KB chunk path is enough to prove the reader consumes persisted sanitized Markdown;IssueIngestorregression too if its current source path can bypassTicketSourceor otherwise needs separate proof.Contract Ledger Matrix
TicketSourcereader regression[QUARANTINED_URL: domain]and omits the raw URLTicketSourceis not the graph path, keep this as KB-reader coverage only and coverIssueIngestorseparatelyIssueIngestorreader regression[QUARANTINED_URL: domain]and omits the raw URLDecision Record impact
Aligned with ADR 0004. This ticket does not amend content architecture; it adds regression evidence around the reader consumers ADR 0004 already names.
Acceptance Criteria
TicketSourceandIssueIngestorsource paths before choosing the final test split.[QUARANTINED_URL: domain].Out of Scope
resources/content/*archives.Avoided Traps
Related
learn/agentos/decisions/0004-github-content-architecture.mdLive latest-open sweep: checked latest 20 open issues at 2026-06-21T03:29Z; no equivalent follow-up found. A2A in-flight sweep: checked latest 30 messages at 2026-06-21T03:29Z; Ada's #13693 follow-up request was present, with no competing follow-up claim.
Handoff Retrieval Hints
gh pr view 13693 --json latestReviews,reviewDecision,reviewRequests,statusCheckRolluprg -n "TicketSource.*IssueIngestor|contentTrust.*TicketSource|QUARANTINED_URL.*IssueIngestor|AC #4" resources/content/issues resources/content/pulls resources/content/discussions test ai learn