op-rigor §2 + skill-vetting §2: visible identity confusability (homoglyph) - #231
Merged
Conversation
…lyph) Add a visible-identity-confusability limb to operational-rigor §2, immediately after the invisible-Unicode sweep, and a bare routing pointer to skill-vetting §2. The invisible-Unicode sweep catches characters you cannot see; this catches characters you can -- a homoglyph renders like a trusted token while being a different machine identity (a Cyrillic a for Latin a; a digit 1 for l; rn for m). Where a security decision turns on recognizing a name, identifier, command, path, host, tool, or configuration key as a particular trusted, reviewed, expected, or authorized identity, verify the token's actual machine identity under the relevant boundary rather than its rendered glyphs. A finding needs all three of a distinct machine identity, a plausible visual impersonation, and a security-relevant reference identity; ordinary non-ASCII, multilingual, accented, or mixed-script text is not a finding merely for being Unicode. Normalization is supporting evidence only and cross-script is not required. The invisible-Unicode rule stays independent, and the exfiltration, trust-grant, and fabricated-authority findings can co-fire without subsuming this one. GENUINE-DISTINCT-GAP: no existing rule carried a "verify identity, do not trust appearance" principle. Abstraction L2 (security-relevant identity confusability); an L3 Unicode/IDNA/identifier-security framework was discovered but not activated. Scanner architecture is SUPPORTING-ONLY: no checks.py change, no CI gate, no runtime scanner, no canonical confusables table. Mechanism and semantic discrimination first-hand verified on CPython 3.9.6 (unicodedata Unicode DB 13.0.0) by an H1-H11 battery: a visible homoglyph passes the shipped invisible sweep while the sweep catches invisible/bidi controls; cross-script is not necessary; multilingual/accented/mixed-script carve-outs hold. Only the rule's behavioral effectiveness is unprobed -> one canonical marker -> standing #115. Settled by a dual-blind two-variant review (round 1 PROCEED x2; two GPT-5.6 variants, both outside the author family, not cross-family). Full trail in reviews/2026-08-30-visible-identity-confusability/. skill-vetting §2 carries only a bare routing pointer (no criterion, no marker). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0132RthrKSsMkywcEwtkXhkx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Visible identity confusability / homoglyph (GENUINE-DISTINCT-GAP, L2)
Adds a visible-identity-confusability limb to operational-rigor §2 (the single
canonical statement, immediately after the invisible-Unicode sweep) and a bare
routing pointer to skill-vetting §2.
The gap
Visible identity impersonation is not invisible-Unicode concealment. The
invisible-Unicode sweep catches characters you cannot see (zero-width, bidi, Tag
Block). This catches characters you can see: a homoglyph renders like a trusted
token while being a different machine identity (
scоpewith a Cyrillicоforscope;rnform; a digit1forl). A reviewer can read every visiblecharacter and still mistake one identity for another. This is a
GENUINE-DISTINCT-GAP — no existing rule carried a "verify identity, don't trust
appearance" principle (the invisible rule is concealment; exfiltration needs a
secret in an address; fabricated-authority is a semantic claim; the full-source read
reads glyphs without comparing identity).
The rule
identity under the relevant boundary (parser / filesystem / case / normalization
may all take part) — raw code points are not a universal identity.
plausible visual impersonation + a security-relevant reference identity.
rn→m,1→lqualify when a referenceidentity exists).
or mixed-script text is not a finding for being Unicode. Normalization is
supporting evidence only. The invisible rule stays independent; exfiltration,
trust-grant, and fabricated-authority can co-fire without subsuming this.
Abstraction & architecture
Abstraction L2 (security-relevant identity confusability). An L3
Unicode/IDNA/identifier-security framework was discovered but not activated. The
scanner architecture is SUPPORTING-ONLY: no
.github/checks.pychange, no CIgate, no runtime scanner, no canonical confusables table — the canonical decision is
a review-time per-identity comparison.
Evidence (first-hand, CPython 3.9.6, unicodedata 13.0.0)
An H1–H11 battery: a visible homoglyph passes the shipped invisible sweep while
that sweep catches the invisible/bidi controls (H1–H4 vs H8); multilingual / accented
/ mixed-script carve-outs hold (H5/H6/H7); NFKC folds a compatibility ligature but not
a cross-script look-alike (H9); severity scales with the reference boundary (H10);
cross-script is not necessary and a no-reference typo is CLEAR (H11). Mechanism =
first-hand verified; the rule's behavioral effectiveness = unprobed → one canonical
marker → standing #115.
Review
Dual-blind two-variant review (two GPT-5.6 variants, both outside the author
family, NOT a cross-family gate — grok unavailable this window). R1 PROCEED × 2,
all eleven axes. Full trail, harness, packet, and both verdicts in
reviews/2026-08-30-visible-identity-confusability/.Scope
Only the two skill files and the evidence package change (pure insertions, no
renumber). security-architect,
.github/checks.py, and all other workstreams arezero-byte. ④ remains LOCKED.
.claude/is a gitignored live-install copy.🤖 Generated with Claude Code
https://claude.ai/code/session_0132RthrKSsMkywcEwtkXhkx