3 people c8bad9b26b fix(posting-guard): remove, count and flag Unicode tag characters (#702) ...

* fix(posting-guard): remove, count and flag Unicode tag characters

The invisible-character set covered zero-width, bidi, soft hyphen and
BOM but not U+E0000-U+E007F, the "tags" block: one invisible code point
per ASCII character, which renders as nothing and is read by a model as
the ASCII it mirrors. A posting carrying "Ignore all previous
instructions" written in that block got the clean verdict through the
documented --text --json call, and the characters survived into the
cleaned text the agent reads; a single tag character inside "ignore"
also split the word past every instruction pattern.

Strip the block with the other invisibles, count it under
invisible_chars.tag, and always raise the warning, because no legitimate
posting contains one. Two new cases; both fail on master.

* changelog: place the #702 entry under [Unreleased]

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Mads Lorentzen <madslorentzen_17@hotmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-21 07:16:17 +02:00

..

__init__.py

fix: Fix salary Excel column detection for index headers (#64)

2026-07-08 17:11:03 +02:00

_bash.py

test(reset): select a working Bash instead of an unusable WSL launcher (#671)

2026-10-20 17:26:53 +02:00

_upstream.py

Fix fork-skip guards for local test runs (#524 rebased, ssh:// origin form folded in) (#563)

2026-10-15 11:59:57 +02:00

test_add_portal_command.py

fix(add-portal): include .agents prefix in generated SKILL.md allowed-tools (#545) (#548)

2026-10-15 11:50:57 +02:00

test_add_template_build_dir.py

feat(add-template): keep a registered template's intermediates in build/ (#473) (#474)

2026-09-21 08:20:10 +02:00

test_apply_host_check.py

fix(freehire-search): drop the github.com URL from the User-Agent (#689)

2026-10-20 08:30:42 +02:00

test_apply_page_count.py

fix(specs): settle every workflow spec on python3, one Windows note at first use (#678)

2026-10-20 08:27:21 +02:00

test_apply_records_application.py

fix(outcome,interview): glob the full <company>_<role> stem in the CV fallback (#444)

2026-09-10 20:32:37 +02:00

test_bash.py

test(reset): select a working Bash instead of an unusable WSL launcher (#671)

2026-10-20 17:26:53 +02:00

test_changelog_structure.py

chore(release): cut v1.7.1 (#434)

2026-09-06 20:19:17 +02:00

test_check_framework_version.py

fix(framework-version): distinguish marker changes from YAML formatting (#578)

2026-10-18 07:36:13 +02:00

test_check_upstream_updates.py

fix(upstream): avoid all-clear after a failed fetch (#681)

2026-10-19 21:45:13 +02:00

test_company_research_cache.py

fix(cache): address PR #349 follow-up feedback (#359)

2026-08-23 09:00:13 +02:00

test_convert_salary_excel_integration.py

test(salary): exercise real workbook conversion through the CLI (#489)

2026-09-21 08:20:50 +02:00

test_convert_salary_excel.py

fix(salary): never take a qualified salary header as the company column (#700)

2026-10-21 07:12:41 +02:00

test_expand_command.py

fix(expand,setup): append behavioral findings to sections 02-behavioral-profile.md actually has (#520)

2026-10-08 21:18:08 +02:00

test_fetch_page.py

fix(fetch-page): check robots policy before each redirect (#680)

2026-10-21 07:06:40 +02:00

test_gmail_sync_command.py

fix(gmail-sync): replace in:inbox with -in:sent -in:drafts

2026-08-19 19:55:48 +02:00

test_html_report_command.py

fix(html-report): funnel from stage history, rejection rate from true rejections

2026-08-19 20:54:46 +02:00

test_install_portal_clis.py

feat(tools): install every discovered portal CLI with one command (#540) (#541)

2026-10-15 11:32:17 +02:00

test_job_key.py

fix(job-key): report a non-string url in --audit instead of a traceback (#634)

2026-10-19 19:30:01 +02:00

test_latex_guidance.py

fix(cv-templates): align geometry scale in 05-cv-templates.md with main_example.tex (#553) (#554)

2026-10-15 11:45:14 +02:00

test_lint_skills.py

test(lint-skills): cover check_skill and check_command, not just settings

2026-08-19 19:59:22 +02:00

test_notion_sync_command.py

fix(notion-sync): keep expired-only jobs update-only (#666)

2026-10-19 20:09:23 +02:00

test_onboarding_privacy.py

fix(onboarding): warn about public forks at the point of decision (#345) (#348)

2026-08-19 21:33:32 +02:00

test_outcome_followup.py

feat(outcome): add follow-up branch to chase quiet applications (#198)

2026-07-20 20:37:22 +02:00

test_outcome_stale.py

feat(outcome): add stale sweep branch for batch-resolving quiet applications (#439)

2026-09-07 18:41:16 +02:00

test_page_decode.py

fix(tools): decode saved non-UTF-8 pages by their declared charset (#690)

2026-10-20 08:28:58 +02:00

test_placeholder_integrity.py

Fix fork-skip guards for local test runs (#524 rebased, ssh:// origin form folded in) (#563)

2026-10-15 11:59:57 +02:00

test_posting_gate_wiring.py

fix(fetch-page): check robots policy before each redirect (#680)

2026-10-21 07:06:40 +02:00

test_posting_guard.py

fix(posting-guard): remove, count and flag Unicode tag characters (#702)

2026-10-21 07:16:17 +02:00

test_python_command_specs.py

fix(specs): settle every workflow spec on python3, one Windows note at first use (#678)

2026-10-20 08:27:21 +02:00

test_rank_command.py

security: posting integrity gate and least-privilege fetch/score/review agents (stacked on #642) (#654)

2026-10-19 17:20:10 +02:00

test_rank_state.py

fix(rank): keep every --exclude key out of the sweep when the list has spaces (#641)

2026-10-19 19:49:24 +02:00

test_readme_assets.py

brand: meet Pip, the courier bird (#132)

2026-07-12 10:21:36 +02:00

test_reset_command.py

test(reset): select a working Bash instead of an unusable WSL launcher (#671)

2026-10-20 17:26:53 +02:00

test_reset_documents.py

fix(reset): make the documents reset block POSIX so it runs under zsh (#699)

2026-10-21 07:10:50 +02:00

test_robots_check.py

fix(robots-check): unquote query strings and restrict '$' anchor to pattern end (#543) (#546)

2026-10-15 11:48:21 +02:00

test_salary_baseline_cli.py

fix(salary): reject non-finite converter baselines (#665)

2026-10-19 19:53:55 +02:00

test_salary_chartsheet_cli.py

fix(salary): skip chart-only workbook tabs (#590)

2026-10-18 07:11:57 +02:00

test_salary_company_header_cli.py

fix(salary): prefer exact workbook identity headers (#571)

2026-10-18 07:14:26 +02:00

test_salary_count_only_cli.py

fix(salary): distinguish absent indexes from suppression (#584)

2026-10-18 07:09:27 +02:00

test_salary_empty_company_cli.py

fix(salary): skip whitespace-only workbook company rows (#576)

2026-10-18 07:07:18 +02:00

test_salary_grouping_cli.py

fix(salary): parse Unicode whitespace grouping (#592)

2026-10-18 07:16:55 +02:00

test_salary_lookup.py

fix(salary): accept BOM-prefixed UTF-8 data files (#602)

2026-10-17 20:06:36 +02:00

test_salary_metadata_cli.py

fix(salary): validate metadata before rendering lookups (#575)

2026-10-18 07:05:10 +02:00

test_salary_nonfinite_cli.py

fix(salary): reject non-finite workbook numbers (#572)

2026-10-18 07:19:24 +02:00

test_salary_notes_sheet_cli.py

fix(salary): skip prose notes tabs instead of listing sentences as companies (#644)

2026-10-19 19:52:23 +02:00

test_salary_unicode_cli.py

fix(salary): preserve Unicode company identity in lookups (#570)

2026-10-18 07:28:42 +02:00

test_salary_wrapped_header_cli.py

fix(salary): collapse line breaks in wrapped workbook headers (#643)

2026-10-19 19:50:53 +02:00

test_scrape_contract.py

fix(scrape): use the full job_scraper/seen_jobs.json path in every step of the spec (#608)

2026-10-17 20:10:20 +02:00

test_scrape_provenance.py

fix(scrape): add a client-side recency fallback for flagless portals

2026-08-19 20:56:15 +02:00

test_scrape_seen_jobs_path.py

fix(specs): qualify seen_jobs.json as job_scraper/seen_jobs.json in /rank, /notion-sync and /upskill (#617)

2026-10-18 08:09:09 +02:00

test_security_guards.py

security: posting integrity gate and least-privilege fetch/score/review agents (stacked on #642) (#654)

2026-10-19 17:20:10 +02:00

test_setup_command.py

Fix fork-skip guards for local test runs (#524 rebased, ssh:// origin form folded in) (#563)

2026-10-15 11:59:57 +02:00

test_tools_utf8_output.py

fix(tools): force UTF-8 output on fetch_page & robots_check (closes #685) (#686)

2026-10-19 21:46:48 +02:00

test_tracker_notes_csv_safe.py

fix(gmail-sync,outcome): keep free-form tracker notes free of CSV-breaking characters (#454) (#455)

2026-09-16 06:45:55 +02:00

test_tracker_status_vocab.py

fix(workflow): define tracker status enum once in /outcome, normalise readers (#299)

2026-08-07 20:47:24 +02:00

test_upskill_skill.py

fix(upskill,notion-sync): join tracker rows to ranked entries on title, the field entries carry (#614)

2026-10-17 20:01:34 +02:00

test_upstream_checkout.py

Fix fork-skip guards for local test runs (#524 rebased, ssh:// origin form folded in) (#563)

2026-10-15 11:59:57 +02:00

test_upstream_crossrefs.py

fix(upstream): preserve selected refs in companion commands (#591)

2026-10-18 07:26:10 +02:00

test_upstream_triage.py

fix(upstream-triage): skip new upstream files inside a directory the fork removed (#656)

2026-10-19 20:04:43 +02:00

test_verify_layout.py

fix(verify-layout): walk PATH candidates for pdftotext supporting -bbox (#655) (#668)

2026-10-19 20:07:50 +02:00

test_verify_pdf.py

fix(verify_pdf): --ascii-dates catches the 2016–17 form again (regression in #533) (#698)

2026-10-20 21:00:46 +02:00

test_workflow_hardening.py

fix(ci): drop persisted checkout credentials and pass matrix.tool through env (#658)

2026-10-19 20:12:29 +02:00