[efraespada]

Fixes #847.

A source/session-bound nonpersonal document can intentionally load before human verification. Bugbot now receives one shared resource/authority instruction to inspect emitted content, mandatory source controls, protected API effects and intended availability before calling a missing proof step an authentication bypass.

The instruction reaches ordinary/framed source review, the benchmark and existing Python candidate verification. It preserves actual source-access, protected disclosure, effective-authority and privileged-write defects while respecting permitted nonpersonal bookkeeping. No finding filter, permission, schema, public setting, capacity or historical-resolution rule changes.

The companion SDD, owner/catalog and detection/quality docs are aligned. Eighteen new regressions cover a separate twelve-case fixture group plus six composition/privacy/identity contracts. Explicit LF attributes preserve the probe's exact recorded bytes on Windows; the existing 174-case corpus and 200-case invocation bound are unchanged.

Actual qualification evidence retains all planned trials, earlier candidates, fixture corrections and original scores. The final three-trial sample passes unchanged aggregate thresholds: precision 1, recall 17/18, exact locations 17/17 and correct severity 16/17. All 18 safe observations have no alerts. Trial 1 misses one protected write and overrates one source-access fault; trials 2/3 pass individually. The historical false positive was not reproduced by the current baseline, and its internal cause remains unknown. These are controlled authored Python/SQLite and real SDK/model observations, with no fresh consumer ASGI/browser execution or statistical/general-accuracy claim. Private reference corrections change no reviewer prompt.

Local validation: 880 Jest suites / 17,166 tests pass (35 existing skips), including all 18 new cases; 267 extension tests retain 100% of all coverage metrics. Full-suite LCOV covers 4/4 modified coverable lines, with zero misses/partials versus 2b4a3e7. The pure instruction has one executable statement and no functions/branches, all measured at 100%; no exclusions added. The unchanged setup ledger retains its 14 preexisting human acceptances.

Types, lint, specifications/catalog, documentation/navigation/agent docs, workflow contracts and Graphify pass. Generated bundles and the 96-file package validate; CLI, typed Bugbot API and isolated local web smoke pass. Normal full hooks pass, rerunning build, all 880 suites / 17,166 tests and lint. All 19 prepared input hashes remain identical to the measured source/bundles.

Remote acceptance verified for a1aa1807ddc22267017b7f45645b91723ec548b8 against 2b4a3e7537c83141c0e1724f83c75dc3eac9b7c7: CI, Commit, Branch Sync, complete review and Linux/macOS/Windows pass. All three analysis partitions completed, with all context surfaces complete and no omitted/truncated entries, findings or native review threads. Official Codecov confirms 4/4 modified coverable lines, zero misses and zero partials (100%) versus that exact base. Linux/macOS pass 880 suites / 17,166 tests; Windows passes 879 suites / 17,062 tests with platform-specific existing skips. Each native checkout has the exact base/head parents, the candidate tree and one successful deferred-cleanup footer. The Linux artifact records 19 unique actual Firefox ESR extension assertions for that same test merge and exact extension input hash. The advisory protected-path recommendation remains neutral; native develop rules require CI and zero human approvals, and the standing user authorization covers this ordinary merge. No native approval is fabricated or protection bypassed.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~876

Documentation is deployed and generated using docs.page

[vypbot]

Bugbot: review complete

Current status: No active findings on a1aa180.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: A protected workflow, policy, or trust-boundary file changed.
Completed: 1/1 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: a1aa1807ddc2; base: 2b4a3e7537c8; reason: protected-path.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.40%. Comparing base (2b4a3e7) to head (a1aa180).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #876   +/-   ##
========================================
  Coverage    95.40%   95.40%           
========================================
  Files         1147     1148    +1     
  Lines        37985    37989    +4     
  Branches     11309    11309           
========================================
+ Hits         36239    36243    +4     
  Misses         672      672           
  Partials      1074     1074           

Files with missing lines	Coverage Δ
...commit/bugbot/verify_generated_literal_findings.ts	100.00% <100.00%> (ø)
src/prompts/bugbot.ts	100.00% <100.00%> (ø)
src/prompts/bugbot_resource_authority.ts	100.00% <100.00%> (ø)
src/tooling/bugbot_benchmark_runner.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.