Fix critical SCP safety regressions

[cursor]

Bug and impact

• inspect() auto-logged injection/reversal content by default, which could persist secrets or PII from blocked tool output into docs/encounter_bestiary.
• URL/HTML decoding could introduce zero-width/null/entity-obfuscated injection phrases after cleanup, letting scp_validate_output and run_pipeline classify malicious content as safe.
• Structured registry contributions preserved unknown top-level fields, allowing raw prompts or sensitive metadata to be staged/published inside registry snapshots.
• Nostr maintainer secret generation wrote the secret file with default permissions before chmod, creating a local read race.

Root cause

• New encounter logging defaulted on (SCP_ENCOUNTER_AUTO_LOG absent meant enabled).
• Sanitizer canonicalization stripped hidden/null characters before URL/HTML decoding and did not repeat cleanup afterward.
• Contribution validation used permissive pattern validation and did not close the outbound structured record schema.
• Secret file creation used Path.write_text() followed by chmod instead of creating with private mode from the first write.

Fix

• Make encounter auto logging explicit opt-in via SCP_ENCOUNTER_AUTO_LOG=1.
• Run sanitizer canonicalization as a bounded cleanup/decode loop before phrase scans.
• Reject unknown structured contribution fields while preserving schema-valid source_ref metadata.
• Create Nostr secret files with 0600 mode from the initial os.open; use private temp + replace for forced rotation.

Validation

• RED tests confirmed each bug before the fix.
• PYTHONPATH=src python3 -m pytest -q tests/test_registry_contribute_r3.py::test_structured_patterns_accepts_source_ref_metadata -> 1 passed.
• PYTHONPATH=src python3 -m pytest -q tests/test_encounter_auto_log.py tests/test_sanitize_encoding_evasion.py tests/test_registry_contribute_r3.py tests/test_setup_mycelium_nostr_key.py tests/test_scp_registry_mcp_r5.py tests/test_mcp_contract_v1.py -> 101 passed.
• git diff --check passed.
• Full PYTHONPATH=src python3 -m pytest -q ran 269 passed / 3 skipped / 3 failed; failures are existing vendored contract hash mismatches in tests/test_contract_document_hash.py with no local docs/contracts diffs.

  

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: eda013bd84

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Constrain metadata before allowing structured records

In a structured contribution, this allow-list accepts registry_bucket and source_ref, but neither _validate_contribute_abstraction() nor validate_pattern_record() constrains their values (or even requires source_ref to be an object), and _build_snapshot() later emits records verbatim. So patterns_json can move a raw customer prompt into source_ref or registry_bucket and still be staged/published, which leaves the metadata leak this gate is intended to block.

Useful? React with 👍 / 👎.