Detect transformed fixture canaries in Hermes tool results

[conorbronsdon]

Fixes #213. Fixes #219.

The live harness now checks tool-result text for literal fixture canaries, case changes, separators in 32-character hex canaries, and base64/base64url encoding before redacting the result. This restores self-read evidence when a tool transforms the canary. The README describes the bounded detection.

Validation: focused Hermes harness regression and existing self-read tests passed (5 tests); compileall and git diff --check passed. The full harness suite was attempted but did not finish promptly in this environment, so it is not claimed as passing.

Later cycles (see the review records) added wrapped/gzip/nested detection, a bounded decode budget, member allowances, and linear-time matching.

[conorbronsdon]

Review record

Cycle	Reviewer	SHA	Result
1	Codex gpt-6-astra	9d88918	2 BLOCKING: wrapped base64 split a canary across chunks; tokens over 2 MB were skipped silently. Plus 0x/reversed/gzip/percent/\u gaps, and a base64url test that could not fail.
1	Claude Sonnet	6ebdbb6	2 BLOCKING: the committed test failed (wrapped variant), and the uncommitted rejoin regex backtracked catastrophically (25 s on 40 KB), with quadratic sub-runs.
2	Codex	6ebdbb6	BLOCKING: split-part and BEGIN/END-armored base64 escaped detection; NON_BLOCKING: false red on large plain text.
2	Claude Sonnet	c45af2b	Both earlier blockers resolved and confirmed by timing (0.008 s where it used to take 25.5 s). No false positives on a 10 MB git log -p.
3	Codex	c45af2b	3 BLOCKING: per-token cap false red; later gzip members unscanned; cumulative gzip expansion uncapped.
Final	Codex	6fc0565	Those three resolved. 2 BLOCKING remain: the decode budget is double-charged for wrapped lines (a false red on about 14 MB of base64-looking text, which fails safe), and empty gzip members cause unbounded work.

All fixes after the original commit are by Claude. Each has a mutation control that turned the targeted test red and then green again after restoring the code. Validation at 6fc0565: 73 harness tests OK (845 s); Linux validate-all.sh passes; CI runs below.

Merge status: not merged. Three repair cycles are complete. Per the review policy, the remaining findings are filed as #219 rather than fixed in a fourth cycle without approval.

[conorbronsdon]

Review record, fourth cycle (approved by the maintainer)

The findings filed as #219 were fixed, and each subsequent re-check was fixed in turn:

Round	Reviewer	SHA	Finding	Fix
4a	Codex	6fc0565	Double-charged budget for wrapped lines; empty gzip members were unbounded	Only gzip inflation is budgeted; per-result member allowance
4b	Codex	9f772f8	Wrapped gzip was inflated twice	Wrapped groups are decoded first and charged once
4c	Codex	73c6ad7	A misaligned unpadded group hid a line; a group's padded tokens were undercharged	Every group line is also decoded individually
4d	Codex	f3621d8	Disjoint variants undercounted	One running total, capped at 4 overlapping views × a 10 MB allowance
4e	Codex	3808e36	A CRC-corrupt member discarded its output; the member allowance charged overlapping views	Raw-deflate inflation in chunks; the member allowance scaled by views
4f	Codex	0e2c205	Unreadable, errored, or unfinished members counted as complete; a missing trailer hid the next member	Errors and leftover gzip data fail closed; the trailer is skipped only when the next member lines up
4g	Codex	b3d134a	A stored block swallowed the next member	Nested gzip signatures inside inflated output are inflated too
4g	Claude Sonnet (adversarial)	b3d134a	CPU: 12 s on 48 KB of input decompressing to 36 MB	Byte-level hex stripping; reversed markers checked in place (0.14 s)
4h	Codex	1fe4ee2	FOLLOW-UP: reversed 0x dumps; nested suffix re-inflation	x0 stripped for the reversed check; one member per nested signature
Final	Codex	a36577e	RESOLVED / NO_FINDINGS	—

Every fix has a mutation control: the targeted test goes red with the fix removed or reverted, and green when restored.

Validation at a36577e: 88 harness tests OK (1065 s); Linux validate-all.sh "All validation passed"; CI below.

Remaining documented limit (README): discovery evidence stays bounded against arbitrary transformations. Output containing hundreds of gzip signature bytes fails closed, because it exhausts the member allowance.