Skip to content

Protect spreadsheet exports and retain exact format 2/3 replay - #7

Merged
dev-belly merged 1 commit into
mainfrom
codex/csv-policy-v4
Oct 24, 2026
Merged

dev-belly merged 1 commit into
mainfrom
codex/csv-policy-v4

Conversation

@dev-belly

Copy link
Copy Markdown
Owner

A fullwidth formula prefix such as =1+1 currently passes through review/source CSV unchanged; the apostrophe policy also depends on spreadsheet import and re-save behavior. New CSV values and headers use a visible, collision-safe text: prefix for formula-shaped strings, fullwidth variants and leading control/BOM characters. Numeric values and original source/review JSON remain unchanged.

Bump to 0.2.9 and bundle format 4 so the changed CSV bytes have an explicit replay boundary. Formats 2/0.2.7 and 3/0.2.8 retain their original serializer and evidence-binding semantics. A retained, actually exported 0.2.8 ZIP (synthetic records/test review only) locks down backward replay rather than regenerating old bytes with the new exporter. Update the lockfile, CSV policy and migration documentation.

Validation: 108 tests pass (18 new cases), Ruff and git diff checks pass, uv lock --check --offline passes. New format-4 exports replay with raw review JSON intact; the unmodified 0.2.8 archive also replays, checking 28 source files and the selected finding. Spreadsheet behavior still depends on the application; CSV is a review copy, JSON is the original evidence.

@dev-belly
dev-belly merged commit 20c0bcf into main Oct 24, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant