fix(gate): quoting a config key erased it before the disarm regex ran (BACKLOG #1069)

[wshallwshall]

Built by Builder 1. Landed by the Lander. Three files, +137/-1.

A live fail-open in the gate that governs every worktree

Rule 3c matched the danger key against $seg.Scan, and Remove-QuotedSpans blanks every closed quoted span. So quoting the key erased it before the disarm regex ever ran. Quoting an argument is ordinary.

All five spellings the row lists were ALLOWED before and DENY now:

git -c "core.hooksPath=/dev/null" commit -m x
git -c 'core.hooksPath=/dev/null' commit -m x
git config "core.hooksPath" /dev/null
git config 'core.hooksPath' '/dev/null'
git config --add "core.hooksPath" /dev/null

Remove-QuotedSpans now unmasks a quoted span holding a single bare word -- no whitespace, quote, $, bracket, brace, semicolon, ampersand, pipe or backtick. Prose keeps its spaces and stays masked; a config key has none and becomes visible.

The number that matters here is the regression count

631 passed, 0 failed across all eight worktree-gate suites. An earlier attempt at this item acquired five new fail-opens and carries a standing do-not-ship order; that patch is untouched and unshipped.

Mutation-tested, and the discrimination is the point: disabling the unmask reds exactly the five deny rows and leaves the control, the three prose rows and the by-design gap green. A mutation that redded everything would have meant the test file was coupled to something broader than the fix.

Three things a reviewer should know, all from the author

Their first probe reported the UNQUOTED control as ALLOW -- which would have read as a far bigger finding than the real one. It was a broken harness, and only the known-answer case separated "the gate is blind" from "my probe never reached a governed repo". The control is now the first test in the file (test_the_unquoted_key_is_denied, line 50, ahead of the five deny rows).

They deliberately did NOT build the length-preserving mask the row prescribes, and the reason is a measurement rather than a preference. Its stated rationale is "the same offsets read paths back out of the raw text afterwards" -- and no rule does that. Every path site re-runs [regex]::Match($seg.Raw, ...) and computes offsets inside Raw from scratch. It would change what every other rule sees for zero benefit, and widening scope past the defect is exactly how the previous attempt got its five fail-opens.

One spelling stays open by design -- a quoted multi-word alias value, whose space puts it out of reach of a bare-word carve-out without re-admitting the prose false-deny. It is pinned as an ALLOW test whose docstring says it is an open hole rather than a passing property, and says a later tokeniser should make it FAIL and be inverted alongside the banner rather than deleted.

Lander verification

ahead of origin/main    1        behind    1
merge-tree vs main      exit 0 (clean)
diff                    3 files changed, 137 insertions(+), 1 deletion(-)
control test first      test_the_unquoted_key_is_denied at line 50

## 1069 already exists on main, so this adds a body stamp rather than a heading -- my +## 1069 check correctly returns 0 and that is not a missing ledger row.

Before the push, git branch -r --contains 071d28ca6 named only the private rescue ref. Sixth branch tonight where a count-based check would have read "already pushed".

Not armed

Required approvals are 0, and this is a security gate.

Generated with Claude Code