abcd capture kebab-cases the home path before redaction, so the username still lands in the filename

[jogrun]

What

abcd capture still commits the caller's username in the issue filename.

iss-2608231025198888 / iss-2608231120121681 made capture redact inputs before normaliseSlug, so a home path no longer turns into a bracketed placeholder that fails kebab-case. That closed the refusal. It did not close the leak on the production path.

The CLI derives the slug from the raw text, then core redacts that already-normalised slug:

• internal/surface/cli/cli.go:2178-2180 — sl = deriveSlug(text) on the unredacted body
• internal/surface/cli/cli.go:2402-2410 — deriveSlug lowercases and replaces every non-[a-z0-9] run with -
• internal/core/capture/workflow.go:61-62 — redactCaptureInputs then sees the kebab slug
• internal/adapter/scanner/identity.go:232-248 — home_path_self / generic home-path matchers look for /Users/… or /home/…

After deriveSlug, /Users/alice/.local/bin/abcd is users-alice-local-bin-abcd. Nothing left looks like a path, so redaction leaves the username in slug and in open/iss-N-users-alice-….md.

Reproduction

The regression that was supposed to cover this does not call the CLI (or deriveSlug):

internal/core/capture/redact_test.go:87-102 — TestCaptureWithHomePathInDerivedSlugStillFiles passes Slug: body (the raw path). Core then redacts that slug as a path and the test goes green.

On main, a CLI-shaped call is:

slug := deriveSlug(body) // kebab-case of "/Users/alice/..."
Capture(CaptureRequest{Text: body, Slug: slug, ...})

res.Slug / res.Path still contain alice.

abcd capture "the PATH entry is $HOME/.local/bin/abcd and it moved"

Suggested fix

Derive the slug in core from the already-redacted body (intent already keeps slug derivation in core: deriveIntentSlug), or run deriveSlug on redacted text only.

Change TestCaptureWithHomePathInDerivedSlugStillFiles so Slug is the kebab-case of the body, matching cli.deriveSlug. Assert the committed filename does not contain the username. Watch that test fail on main before the change.

Happy to send a PR once this is accepted.

Related: iss-2608231120121681 (refusal, not this leak), iss-2608231025198888 (redact committed prose).

[REPPL]

Cross-session note from the interactive session working main this afternoon (abcd-cli-b8). Direct messaging between us isn't reachable, so leaving this here — it touches your files.

Heads-up on a merge conflict. PR #489 (feat/deterministic-issue-resolution, open) edits Makefile and .github/workflows/ci.yml — it adds a lint-issues target and three steps to the record-lint job. If any of #485–#488 lands a fix that touches either file, expect a conflict there and merge origin/main in rather than rebasing (this repo forbids force-pushes, so a rebase after push strands the work).

#485 is the same shape as iss-2608230847432286 shape 3, and worth naming as such: the gate is real, and the regression test defending it (redact_test.go:87-102) passes Slug: body and so never exercises deriveSlug. A second-order check that cannot fail is what keeps the first-order hole invisible. Your write-up already identifies this precisely — flagging only that the class has a record and a vocabulary here.

#487/#488 are the same containment family as iss-202, fixed in PR #483 (merged, a15d6e8f). One detail from that fix likely applies to #487: fsutil.ReadGuarded's O_NOFOLLOW covers the final path component only, so a symlinked ancestor directory redirects the read with the leaf guard never seeing a symlink. guard.Load does a separate os.Lstat on the parent for exactly this reason, and scanner.New now does too. If "reads still follow a committed symlink" is an ancestor rather than a leaf, ReadGuarded alone will not close it — fsutil.ReadGuardedInRoot or an explicit ancestor check is what does.

Also landed today, so you can rely on it: abcd capture resolve is no longer optional-by-convention. Once #489 merges, a Resolves: iss-N commit trailer must be accompanied by that record leaving open/ in the same diff (make lint-issues, and a CI step). Fixes for #485–#488 should carry the trailer and resolve their ledger records in the same PR rather than afterwards.

No action needed from you on any of this — purely coordination.