Attribute boundary findings to the correct open item

[jim80net]

Summary

The open-item boundary scan now evaluates each issue and pull request as an independent JSON object and reports that object's own type and number when its title or body matches. It no longer flattens serialized JSON into an adjacency stream, so field ordering cannot attribute a finding to a neighboring item.

API/list and malformed-payload errors fail closed; a host without the GitHub CLI retains the existing explicit skip behavior. Advisory warning matches use the same object-local attribution. The built-in secret-token pattern now requires a valid token boundary, avoiding matches where the prefix is embedded inside a longer identifier.

The scanner reports carrier identities without echoing matching secret material.

Test plan

• bash scripts/check-private-boundary_test.sh
• shellcheck scripts/check-private-boundary.sh scripts/check-private-boundary_test.sh
• go test ./...
• go test -race ./cmd/flotilla
• go vet ./...
• git diff --check
• bash scripts/check-private-boundary.sh

---

Summary by cubic

Fixes boundary scan attribution so each finding is tied to the correct issue or PR. Tightens the sk- token pattern and fails closed on malformed payloads and per-object field errors while keeping the gh-absent skip.

• Bug Fixes
  • Scan each issue/PR JSON object independently and report its own number; no flattened stream.
  • Fail closed on payload/list errors and malformed objects (missing/invalid number, title, or body); keep gh-not-found skip.
  • Require token boundaries for the built-in sk- pattern to avoid embedded false positives.
  • Apply the same per-object attribution to advisory warnings; only report carrier IDs, not secret text.
  • Add scripts/check-private-boundary_test.sh to cover attribution, malformed objects, warnings, token-boundary, and gh-absent cases.

^{Written for commit d85f1de. Summary will update on new commits.}

[jim80net]

BLOCK for exact head 9719352287859b8d7d4ef724e65c21eddea83ad6.

P1 — The new per-object path is not fail-closed for malformed title/body fields. At scripts/check-private-boundary.sh:187, map(strings) silently removes any non-string field; jq -e still succeeds and the object can be reported clean. Firing control with a numeric body ([{"number":7,"title":"clean","body":12345}]) returned exit 0 and open issues/PRs clean. The promised invalid-field branch is therefore unreachable for this malformed carrier. Validate each field as string-or-null before scanning, and add a negative control that proves malformed fields fail.

P2 — git diff-tree --check fails at scripts/check-private-boundary_test.sh:31 due trailing whitespace. The committed regression script itself passes, but the exact head does not satisfy its claimed diff gate.

The positive object-attribution matrix otherwise passes: own-number attribution, first object, title, multiple carriers, anchored prefix negative, clean payload, and gh-missing path (bash scripts/check-private-boundary_test.sh; full go test ./... also passes).

Code verdict is independent of the known repo-wide private-boundary check noise. No merge performed.

[jim80net]

Independent revision verdict: PASS for exact head d85f1de63d8bbd37e5668df12066e44535da83e4.

No findings.

The round-1 fail-open is closed: each object now requires numeric number and string title+body; malformed fields set the gate failure and cannot reach the clean report. I re-ran the exact former firing control with numeric body 12345; it exits non-zero, names the invalid issue object, and does not print open issues/PRs clean. The committed nested-object malformed control also fires.

All seven original arms remain correct: descending-object own-number attribution, first-object carrier, title carrier, multiple independent issue/PR carriers, prefix-substring negative, clean/empty payloads, and gh-missing skip. Advisory attribution also remains object-local. Exact diff-check is whitespace-clean.

Independent gates: shell regression suite PASS; exact numeric negative control PASS; go test ./..., race, vet, shellcheck, and diff-check PASS.

Code verdict is separate from the known repository-wide private-boundary failure. This PASS expires if the head moves.