[ajianaz]

What

Follow-ups from an independent audit (a security review and a code review run as separate agents) of the 7 merged PRs #650–#656. Every item below was reproduced or confirmed in code first; each has a regression test.

Security (two were fail-open, one also affects plain cora review in CI)

• Hostile diff hid findings. parse_diff treated ---/+++ lines inside a hunk as file headers, so a removed SQL/Lua comment (-- x) dropped the rest of the hunk, and an added line ++ b/tests/y.py re-filed it under an excluded path: a hardcoded secret reported as 0 findings, exit 0. Headers are now only accepted when the hunk's counts are used up (diff --git also closes a hunk). valid_files comes from the same parser, and file names are escaped in the prompt.
• A judge could downgrade/absorb a scanner finding. An "info" judge issue on the same line/topic replaced a CRITICAL scanner finding. The surviving issue now takes the stronger severity and the scanner's rule_id.
• Symlinks: cora scan / cora.scan_prepare followed symlinks out of the project (a hostile repo's id -> ~/.ssh/id_rsa ended up in the agent's context). Symlinks are skipped. Enclosing-scope reads (+++ b/../../x) are confined to the project root.
• cora install --remove no longer deletes a customized skill without --force.

Agent-mode correctness

• should_block and the quality gate now look at all findings (the caller's min_severity only trims the list; also fixes cora.review_diff).
• dropped_by_validation reported; severity accepted in any case and shown lowercase; files_fingerprint guards scan_finalize against a changed project; admit fixes lines for deleted files and the old path of a renamed file; --no-llm and review_finalize skip building the LLM prompt (no cargo clippy run); cora install --agents X no longer writes the skill when X is not detected.

Docs / skill: tool count 18 → 22 (README, docs, AGENT.md); README and getting-started say a key is optional; Claude Code needs claude mcp add cora -- cora mcp (install only adds the skill there); skill text corrected; CHANGELOG corrected and extended.

Why

The agent-mode feature trusts a diff written by the PR author. The audit showed that the parser, not the new code, was the weakest link, and that "a judge can add but never remove" did not hold. Not fixed here (low, noted): the SARIF no-judge marker is a text sentinel; block_on assumes the multi-thread runtime the server uses.

Testing

• cargo fmt --check, cargo clippy --all-targets --features tree-sitter -- -D warnings, cargo test --features tree-sitter (1208 passed; 21 new regression tests).
• Re-ran the auditor's repros with the built binary: removed-comment attack and fake-header attack now report the secret/MD5 findings; symlinked file no longer appears in scan_prepare.
• Real agent (claude -p, cora with no key/HOME, skill in the project): reviewing the previously fail-open diff now returns the CRITICAL secret and ignores the injected comment.