[acamarata]

Rows

D-1130 (ci authz): foldKey now NFC-normalizes (before and after the case fold), so é (U+00E9) and e+U+0301 collide as collision.fold on APFS/HFS+. Adds golang.org/x/text v0.42.0 (unicode/norm, transform) to free/ci and its vendor tree; hashes match the same version already in free/cdc/go.sum. Test TestExtractor_NormalizationCollisionRefused fails on the old path.go ("want collision.fold, got nil") and passes now.

D-1131 (ci cache manifest): EncodeManifest no longer HTML-escapes (& was 6 bytes) and refuses any document over the 8 MiB decode cap (a control byte still costs 6 bytes, so the cap check is needed as well). TestEncodeManifestStaysDecodable fails on the old encoder (25,481,575 bytes) and passes now.

D-1132 (ci store): Backend.CacheDrop now returns (dropped bool, err); the store reads RowsAffected and writes the cache.entry.dropped audit row only when a row was removed; Verify counts only real drops. Interface and callers updated (entries, specs, remote). New assertions in TestCacheEntriesDropOnlyRemovesTheRowThatWasRead (0 audit rows for a lost-race drop, 1 for a real one) and TestVerifyDoesNotCountADropThatRemovedNothing. Note: the signature change means these tests do not compile on the old code; the audit-row assertion is the behavioural check.

D-1180 (github-runner): with org scope, once the configured group passes, the guard lists the group's runners and, if the runner is not in it, the org's runners. A runner registered in another group is refused as runner_group_mismatch (409; start/status stop a running runner like runner_group_public); an unregistered runner passes. Registration/install set Registering/TRUST_REGISTERING=true so a re-install can move the runner. Done in both the Go service and actions/trust.sh (rc 4), with README update. New Go tests (mismatch, in-group, unregistered, registering, Start stops the runner) and 4 shell tests; the mismatch tests fail with the check disabled.

D-0632 (k8s): two parts.

• HumanDetail no longer echoes any text of the pg_restore error line (quoted masking missed unquoted values in custom exception text). It prints only fixed words for allowlisted categories, or "text withheld". The human line label is now [error category: ...]. Tests cover an unquoted secret in the unit and the cmd restore test.
• Fingerprint alias is now nself_fp_<oid>_<n>, the first n in 0..1600 not equal to a column name (max 1600 columns, alias < 30 bytes, so no 63-byte truncation collision). Not run against postgres: the machine has no postgres or docker. The unit test checks the SQL text; the docker integration test (NSELF_K8S_PG_TEST=1) gets a new shadow3 table with a 63-byte column named like the old alias. Please let CI or a docker host run that test.

Commands

• free/ci: go build ./..., go vet -mod=vendor ./..., go test -mod=vendor ./.... All packages pass except cmd/agent TestServeStdioExitsNonZeroWithE663OnAProdStackMarker and internal/legacy TestSecretsEnvLiveKeyGateTrackedValueOnly; both fail identically on a clean origin/main (environment: global gitignore / prod marker).
• free/github-runner: go vet -mod=vendor ./..., go test -mod=vendor ./... pass; bash tests/github-runner.test.sh 71/71 pass.
• free/k8s: go vet -mod=vendor ./..., go test -mod=vendor ./... pass (integration test skipped).

[acamarata]

Review fix 96d93c0: K8s wiki and codes.go now describe the category-only human error output (no masked line text); github-runner README states the real status cost (1 request for repo scope, 2 for org scope, plus one per extra 100-entry page). Doc-only; k8s go vet and tests pass with -mod=vendor.

[acamarata]

Review fix: the registered-group check now also verifies the registration persisted in the runner dir (.runner: agentId/agentName), in both the Go guard (trust.go) and the shell guard (actions/trust.sh). Changing GITHUB_RUNNER_NAME or the hostname no longer hides an installed runner that sits in another group. The configured name and the installed registration are each checked; an unreadable .runner fails closed; install (Registering) still skips the check. New Go tests and shell tests fail on the previous code and pass now (go test -mod=vendor ./... in free/github-runner, tests/github-runner.test.sh 76/76).