[bug] idd-issue multi-finding: run_id second-precision collision + symlink overwrite hardening

[kiki830621]

Problem

From verification of #48:
Logic P1.2 + Security F3: run_id uses ISO-8601 second-precision timestamp as jsonl filename. Same-second invocations produce identical filename → silent audit trail overwrite, violating D2 contract ("per-invocation 一檔").
— Source: team:logic + team:security + team:devils-advocate (upgraded HIGH), Verify comment

Collision (P1 / HIGH)

Two invocations within the same second (parallel /loop, CI batch, two terminals) produce run_id = "2026-05-10T17:00:00" — second invocation silently overwrites the first's jsonl. The audit trail is permanently lost with no error or warning. IDD's audit trail is a core promise; silent loss is worse than a secret leak (secrets can be rotated; audit trail cannot be reconstructed).

TOCTOU symlink overwrite (MEDIUM)

Predictable filename at a known path: an attacker with local FS write access can pre-create a symlink at .claude/.idd/issue-runs/2026-05-12T10:00:00.jsonl pointing to ~/.ssh/authorized_keys. The skill's jq -n ... > $JSONL_PATH truncates-and-writes without checking for symlinks.

Type

bug

Expected

1. run_id format changed to sub-second or adds random suffix: 2026-05-10T17:00:00.123Z or 2026-05-10T17:00:00-a3f9
2. Jsonl write uses collision-detect semantics: set -C (noclobber) + retry with suffix, or mktemp-style
3. Symlink check before write: [ -L "$JSONL_PATH" ] && abort
4. Footer body updated to use new run_id format (jsonl ↔ footer ↔ comment_url alignment)

Related: #48

---

Current Status

• Phase: closed
• Complexity: Plan
• Diagnosed at: 2026-05-20

[kiki830621]

Diagnosis

Type

bug (audit trail data-loss + TOCTOU symlink — both irreversible side effects)

Root Cause / Analysis

run_id was specified at ISO-8601 second precision (2026-05-10T17:00:00) under D2 "per-invocation 一檔" assumption. The assumption breaks for any caller with sub-second concurrency: parallel /loop, CI batch matrix, two terminals + same-second invocation. Second invocation's jq -n ... > $JSONL_PATH truncate-writes — first invocation's audit trail is permanently lost with no error or warning (D2 contract silently violated). Per #48 Devil's Advocate finding upgrade: IDD's audit trail is a core promise — silent loss is worse than a secret leak (secrets can be rotated; audit trail cannot be reconstructed from a destroyed file).

TOCTOU symlink overwrite is the second consequence of the predictable-filename design: an attacker with local FS write access can pre-create .claude/.idd/issue-runs/2026-05-12T10:00:00.jsonl as a symlink to ~/.ssh/authorized_keys. The skill's truncate-write follows the symlink and clobbers the target. Different threat (local FS write access) but same root cause: predictable name + unchecked write.

Impact

• plugins/issue-driven-dev/skills/idd-issue/SKILL.md — Stage 4.5 jsonl write block changes run_id formatter + adds collision-detect + symlink check
• Footer template (> **Run**: <run_id>) updates to new format (jsonl ↔ footer ↔ comment_url alignment)
• 0 backward compat impact — old run_id format hasn't shipped (multi-finding mode is v2.55.0+, low adoption); new format additive

Strategy

• run_id format: append millisecond suffix (2026-05-10T17:00:00.123Z) — sortable, ISO-8601 conformant, sub-second-collision-resistant for typical workload
• Jsonl write uses noclobber semantics: set -C; cmd > $JSONL_PATH || retry with suffix; or mktemp -p .claude/.idd/issue-runs/ "${run_id}.XXXXXX.jsonl" (atomic-create-or-fail pattern)
• Symlink check before write: [ -L "$JSONL_PATH" ] && { echo "ABORT: symlink at audit path"; exit 1; } — fail-closed
• Footer template updates to use new run_id format consistently (verify with grep over composition paths)
• Add Stage 4.5 test fixture (or smoke step in spec) covering: same-second invocation collision detection, symlink pre-existence rejection

Complexity

Plan (risk-sensitive boundary — irreversible side effects)

Layer P triggers:

• Risk-sensitive boundary — audit trail data-loss + symlink-following truncate-write are both irreversible side effects (v2.64.0 IDD human-in-the-loop should conform to the NSQL confirmation protocol (v4.1.0) #103 F4 added irreversible side effects to Layer P's enumerated vocabulary specifically for this category). Silent overwrite of audit data and unintentional authorized_keys truncation are the canonical irreversible-side-effect failure modes
• Decision-heavy — collision-detect has multiple valid implementations (millisecond suffix vs random nonce vs noclobber retry vs mktemp); each has trade-offs (millisecond still collides under bash for-loops, nonce is unsortable, noclobber requires explicit retry handler, mktemp changes the predictable-path contract)

Layer 2 check: no new published API — internal jsonl format. Not Spectra.

Risks

• Millisecond suffix may still collide under very tight parallel invocation (bash for-loop within same ms) → noclobber retry needed regardless
• Symlink fail-closed breaks legitimate use of symlinked .claude/.idd/issue-runs/ (e.g., mounting it to a different filesystem) — spec should document that symlinking the directory is fine but symlinking the individual jsonl files is not
• Format change vs backward compat — pre-existing v2.55.0+ jsonl files (if any) still use old format; readers should accept both during transition window (or rely on multi-finding mode being new enough that no v2.55.0+ jsonl exists in the wild)

Residue

(none) — Failure modes (silent data loss + symlink TOCTOU) are concrete + reproducible. Strategy bullets cover both root cause (predictable filename) + symptom (truncate-write).

Vagueness Pre-check

• V1: 2 — Strategy bullets enumerate concrete spec changes with line references; deliverables are clear
• V4: 2 — Issue body's "## Expected" section gives explicit completion criteria
• Triggered: no — both axes ≤ 3

[kiki830621]

Implementation Complete

Checklist

• Strategy bullets shipped
• Commit: 8c9ce5e (cluster branch idd/chain-multi-ab027c23-security-idd-issue-multi-finding-dual-tr)
• PR opened: chain (multi-root): 5 issues — idd-issue multi-finding spec hardening family from #48 verify #113 (cluster, all 5 sister issues)
• CHANGELOG v2.67.0 entry + plugin.json version bump

Scope shipped

run_id format ms-precision + UTC Z suffix; TOCTOU symlink check; JSONL_WRITE_GUARD nonce-retry; footer template updated. Closes the irreversible-side-effect failure mode (#103 F4 vocabulary).

Notes

• All changes additive — pre-v2.67.0 multi-finding invocations retain semantics
• Per cluster discipline: per-issue verify findings will be partitioned in the 6-AI ensemble report at PR chain (multi-root): 5 issues — idd-issue multi-finding spec hardening family from #48 verify #113

[kiki830621]

Verify (PR mode, cluster) — verify-gated PASS for this issue's portion of PR #113. 4 HIGH blocking findings dispatched in-PR per feedback_verify_fix_same_pr (commit 0fe06ed); cluster ready to merge. See master report for per-issue verdict.

[kiki830621]

Closing Summary

Problem

idd-issue multi-finding mode's audit jsonl filename used ISO-8601 second precision (run_id = "2026-05-10T17:00:00"). #48 verify Logic + Security findings (P1.2 + F3, upgraded to HIGH by Devil's Advocate) exposed:

• P1 HIGH — Silent audit-trail overwrite under parallel /loop / CI batch / concurrent terminals (same-second jq -n ... > $JSONL_PATH truncate-writes); D2 contract ("per-invocation 一檔") silently violated. Audit trail cannot be reconstructed once overwritten — this is the irreversible-side-effect failure mode added to Layer P vocabulary in v2.64.0 IDD human-in-the-loop should conform to the NSQL confirmation protocol (v4.1.0) #103 F4
• MEDIUM — TOCTOU symlink overwrite — predictable filename at known path means an attacker with local FS write access can pre-create .claude/.idd/issue-runs/2026-05-12T10:00:00.jsonl as a symlink at ~/.ssh/authorized_keys. jq truncate-write follows symlinks → silent target clobber

Root Cause

Predictable filename design (P2-friendly for debugging, sortable lexically) combined with truncate-write semantics. Solution requires (a) sub-second precision to bound collision frequency, (b) collision-detect with retry for residual race conditions, (c) symlink check before write to defend against TOCTOU.

Solution

skills/idd-issue/SKILL.md Stage 4.5 jsonl write block hardened (commits 8c9ce5e + 0fe06ed):

• run_id format — ISO-8601 millisecond precision + UTC Z suffix (2026-05-10T17:00:00.123Z). Implementation uses dispatch chain to handle the BSD-date hazard (verify finding F76-1): GNU date %3N → output shape regex validation; failed → Python datetime stdlib fallback; failed → .000Z last-resort with warn (collision resistance reduced but operational)
• TOCTOU symlink check — [ -L "$JSONL_PATH" ] && abort before any write, fail-closed. Documents that symlinking the issue-runs/ directory itself is fine (legitimate use case: mount on different FS); only the per-run jsonl FILE must not pre-exist as a symlink
• JSONL_WRITE_GUARD() noclobber helper with RANDOM % 32768 15-bit nonce-retry (bash $RANDOM is 15-bit, not 16-bit — fix commit 0fe06ed corrected the comment-code drift). Second-collision abort defends against birthday-paradox at ~181 concurrent invocations
• Critical ordering — WRITE_GUARD invoked at run-start (right after RUN_ID set), NOT at materialize phase. Mutating path at materialize would invalidate footer URLs already written to GitHub bodies by Stage 4 dispatch ([enhancement] idd-issue multi-finding: audit trail completeness (stale footer links, action type in footer, source_type enum) #79 Gap 1 depends on footer URL stability for abort-path validity)

Verification

5/6-AI verify ensemble (PR #113 cluster mode) — verify-gated PASS post-fix. Master: #113 (comment)

Verify caught 3 HIGH blockers in this issue's scope, all dispatched in-PR per feedback_verify_fix_same_pr:

• F76-1 BSD date %3N silent literal output (RUN_ID became ...3NZ malformed on macOS) → dispatch chain with Python fallback
• F76-2 JSONL_WRITE_GUARD() defined but never called → explicit run-start invocation
• DA-3 WRITE_GUARD ordering would invalidate footer URLs if called at materialize → ordering pinned at run-start with rationale comment

Changes

• Squash merge: 14bc930 (PR chain (multi-root): 5 issues — idd-issue multi-finding spec hardening family from #48 verify #113)
• skills/idd-issue/SKILL.md Stage 4.5 detection bash (run_id dispatch chain + symlink check + WRITE_GUARD definition + ordered invocation) + footer template format
• Shared CHANGELOG.md v2.67.0 + plugin.json 2.66.0 → 2.67.0

Residue

(none) — Both failure modes (silent audit overwrite + TOCTOU symlink) operationalized with concrete fail-closed bash. The O_NOFOLLOW-via-Python option (DA mentioned for fully closing the microsecond TOCTOU window) is a defensible future hardening but not in scope for v2.67.0 — the current [ -L ] check + run-start WRITE_GUARD locks the typical-workload + reasonable-adversarial range.