fix(security): normalize concealed instruction text

[Spectorian]

Summary

• normalize security-analysis text with version-pinned default-ignorable handling
• reconstruct bounded inter-character separator runs with exact gap signatures and raw source-offset attribution
• add a scored analysis-evasion signal for security-relevant condensed terms that cannot be reconstructed safely
• treat confirmed inter-character obfuscation as a nonfatal interpretation limit so strict CLI and MCP consumers fail closed
• preserve benign multilingual text, emoji, punctuation, notation, URLs, e-mail addresses, tables, and code through negative controls

Validation

• sanitized static-only coverage for ASCII whitespace, punctuation, symbols, middle dot, and bullet separators
• analyzer, SARIF location, cross-window, resource-limit, and false-positive regressions
• completeness parity across reports, default and strict CLI modes, and MCP install verdicts
• branch-wide non-integration/non-provider suite
• Ruff lint, format, targeted mypy, and git diff --check

[rng1995]

Requesting changes because the normalizer still has two fail-open concealed-instruction paths. Each current-head repro yields only the raw view, no P1/AE6 finding, risk 0, SAFE, complete analysis, and safe_to_install=True.

[rng1995]

[P1] Normalize default-ignorables at token boundaries too. Requiring word characters on both sides misses ignore\u034f previous instructions. (and the inverse boundary form), so the concealed directive reaches a SAFE install verdict with no normalized view. Remove contextual default-ignorables when they adjoin a word boundary while preserving source-offset mapping and emoji-sensitive cases.

[rng1995]

[P1] The fail-closed AE6 path reuses an exact recognizer that rejects common adversarial spacing. i g n o r eall previous instructions. stops here because the next character is alphabetic; i.-g.-n.-o.-r.-e previous instructions. is rejected by the single-marker signature, and per-letter line breaks are excluded earlier. These inputs all receive a complete SAFE verdict. Use a broader, separately bounded detector for AE6/partial coverage instead of treating exact-compaction rejection as proof that no concealed run exists.

[mohgupta-ship-it]

Powered by Codex: PR council review result.

This is a triage signal, not a maintainer approval.

• Rating: critical fix
• Confidence: medium-high
• Status read: Changes requested, green checks
• Review method: fresh GitHub metadata/body/files/reviews/checks plus selected diffs; council lenses were spec fit, dead-code/reachability, YAGNI/scope, design/coupling, and code standards/tests.
• Council assessment: Addresses concealed-instruction normalization misses that could yield SAFE verdicts, but review remains unresolved.
• Recommended action: Request fresh reviewer clearance before merge.