`consensus/AgentAbrams.md`

29 lines

# Consensus — AgentAbrams
Generated 2026-04-30T23:48:03-07:00. Source: codex review/fix/rereview/round-2 artifacts (round-3 was quota-blocked).

## Codex pass-1 review (top risks)
## Top Risks (P0 — fix this week)
- `snippets/redact_lint.py:71-73`, `.github/workflows/ci.yml:34-40`: detected secrets are printed with surrounding snippet into CI logs. Fix by printing only pattern name + file/line, never matched content.
- `video/oauth_authorize.py:31-32`: refresh token is printed to stdout, making terminal logs/screen recordings a secret leak. Fix by writing only to a chmod-600 local file or clipboard prompt, not stdout.
- `video/upload_youtube.py:38`, `.github/workflows/youtube.yml:36-44`: uploads default to `privacy="public"` with no workflow privacy input; wrong artifact/path becomes public immediately. Default to `private`/`unlisted` and require explicit public promotion.

## Round-1 applied
## Applied
- None — no P0/P1 issue in `CODEX_REVIEW.md` matched the autonomous safe-fix categories 1-7.

## Still deferred for Steve
- P0 — `snippets/redact_lint.py:71`, `.github/workflows/ci.yml:34` — redaction lint can print matched secret snippets into CI logs — deferred because log redaction behavior is not one of the approved autonomous safe fixes.
- P0 — `video/oauth_authorize.py:31` — OAuth refresh token is printed to stdout after local authorization — deferred because changing token handling/storage is outside the approved safe list and may affect Steve's credential workflow.
- P0 — `video/upload_youtube.py:38`, `.github/workflows/youtube.yml:36` — YouTube uploads default to public with no workflow privacy input — deferred because release/privacy workflow changes are not on the approved safe list.
- P1 — `media/engine.py:67`, `media/engine.py:86`, `media/engine.py:103` — media generation errors are swallowed while the build reports complete — deferred because build failure policy changes are outside the approved safe list.
- P1 — `media/engine.py:75` — chapter data is generated but not written to `media/output/chapters.json` — deferred because this is a behavior/output change outside the approved safe list.
- P1 — `media/engine.py:28` — output path is cwd-relative and can write to the wrong directory — deferred because this is not a hardcoded absolute external path covered by safe fix 3.
- P1 — `README.md:47`, `media/md_to_blog.py:99` — docs reference missing dependency manifest/requirements flow — deferred because dependency manifest work is explicitly not safe to generate without testing.
- P1 — `podcast/rss_generator.py:42` — RSS items omit enclosure length, GUID, and dynamic escaped description content — deferred because feed contract changes are outside the approved safe list.
- P1 — `media/md_to_podcast.py:31` — podcast text truncates mid-word or mid-section — deferred because narration policy changes are outside the approved safe list.
- P1 — `media/social.py:21` — X post claims a 280-character limit but does not enforce it — deferred because social-copy behavior changes are outside the approved safe list.
- P1 — `snippets/precommit.sh:30` — `.env` protection only checks staged files and can pass without git metadata — deferred because pre-commit policy changes are outside the approved safe list.