/claim #12

Summary

• Adds collab-clipboard-import-guard/, a focused issue #12 slice for the real-time collaborative research editor.
• Gates pasted or imported editor payloads before shared manuscript insertion using import channel recognition, source trust, signed attestation, top-level payload-shape validation, malformed block-list/entry validation, malformed table cell/row handling, malformed existing-anchor metadata review, missing-ID duplicate-anchor handling, source-origin redaction, hidden instruction text, spreadsheet formula cells, local/private paths in content and table cells, lowercase-drive and forward-slash Windows user paths, stale or malformed review metadata, duplicate-anchor checks, and existing shared-document anchor collision checks.
• Emits sanitized blocks, deterministic insertion-lane decisions, reviewer actions, SHA-256 audit digests, JSON packets, Markdown/SVG reports, and a short MP4 demo built from synthetic data.

Latest Hardening

• 265a64a: duplicate imported anchors now regenerate unique sanitized anchors even when the source blocks arrive without block IDs.
• Adds a regression for two missing-ID blocks sharing shared-anchor; before the fix both sanitized blocks still emitted the same regenerated anchor (shared-anchor-80705c05).
• Uses a stable internal per-block identity for collision tracking and reviewer-facing fallback references such as unidentified-block-1, so remediation actions no longer leak regenerate_anchor:undefined.
• Adds reports/missing-block-ids-anchor-collision-packet.json and includes it in generated Markdown/SVG/MP4 reviewer evidence.

Prior Hardening Coverage

• Malformed top-level import batches stage before collaborative insertion evidence generation can crash.
• Malformed table cell metadata stages before collaborative insertion and normalizes sanitized cells to [].
• Malformed existing-anchor metadata stages before collision checks and routes remediation to curator anchor review.
• Malformed table rows stage before collaborative insertion, normalize to empty rows in sanitized reviewer output, and route remediation to curator payload review.
• Malformed block entries inside otherwise valid block lists are staged instead of crashing or creating malformed sanitized reviewer output.
• Malformed block-list payloads are staged for curator payload review without throwing before reviewer packet generation.
• Duplicate anchor collisions now flag and regenerate every colliding block, not just the later duplicate.
• Imported anchors that collide with existing shared-document anchors are quarantined and regenerated before insertion.
• Private-reference markers such as private-lab and patient-export are redacted even outside literal filesystem paths when the import is quarantined.
• Imported table cells are included in the local/private path scan and redaction path, including formula cells that reference local paths.
• Source-origin metadata is scanned for local/private paths, quarantined when risky, and redacted before reviewer packets are emitted.
• Missing or unrecognized source trust metadata now stages otherwise clean imports for curator review before collaborative insertion.
• Missing, blank, placeholder, or malformed trusted and partner signed-attestation values now stage imports for curator review before collaborative insertion.
• Signed source attestations must use a sha256: prefix followed by a 64-hex digest before sanitized source metadata reports attested: true.
• Unsupported or missing import channels now stage otherwise clean, trusted, attested imports for curator review before collaborative insertion.
• Malformed review metadata expiry evidence is treated as stale/unverifiable, dropped from sanitized imported comments, and quarantined before shared insertion.
• Lowercase-drive Windows user paths such as c:\Users\... are fully redacted from sanitized reviewer output after quarantine.
• Forward-slash Windows user paths such as C:/Users/... are fully redacted from sanitized reviewer output after quarantine.

Non-overlap

This is scoped to clipboard/file-import provenance before collaborative insertion. It does not duplicate the broad editor foundation, operation replay, offline conflict, notebook/kernel lease, reference formatting/merge, authorship governance, freeze/recovery, discussion sidebar, autosave/local-cache privacy, round-trip fidelity, review decision, task dependency, equation/figure anchor, presence privacy/liveness, accessibility, evidence binding, embargo release, notification visibility, data availability, LaTeX macro safety, suggestion provenance, section-lock arbitration, journal-style conformance, undo/redo provenance, private-comment export, table-formula integrity, glossary acronym, alt-text export, scientific terminology unit, or data availability statement slices.

Validation

• Latest missing-ID duplicate-anchor regression first failed with identical sanitized anchors (shared-anchor-80705c05) and then failed on [undefined, undefined] duplicate-finding block references before the final fix.
• npm test from collab-clipboard-import-guard/ -> collaborative clipboard import guard tests passed (23).
• npm run check from collab-clipboard-import-guard/ -> JS syntax checks passed for index, sample-data, test, and demo.
• npm run demo from collab-clipboard-import-guard/ -> generated 16 JSON packets, including missing-block-ids-anchor-collision-packet.json, with expected statuses.
• npm run video from collab-clipboard-import-guard/ -> regenerated reports/demo.mp4.
• ffprobe verified collab-clipboard-import-guard/reports/demo.mp4 as H.264, 1280x720, 24 fps, 7.5s, 116,590 bytes.
• All 16 generated JSON packets parsed successfully.
• Packet sanity check confirmed distinct sanitized anchors and no regenerate_anchor:undefined action.
• git diff --check and git diff --cached --check passed; only Windows line-ending normalization warnings appeared before staging.
• Staged allowlist check confirmed only collab-clipboard-import-guard/ files were staged.
• Focused restricted-string scan returned no payout, credential, or token strings.
• Pushed verified fork head 265a64a to clipboard-import-provenance-12.

Demo Artifacts

• collab-clipboard-import-guard/reports/clean-packet.json
• collab-clipboard-import-guard/reports/forward-slash-windows-path-packet.json
• collab-clipboard-import-guard/reports/import-provenance-report.md
• collab-clipboard-import-guard/reports/lowercase-windows-path-packet.json
• collab-clipboard-import-guard/reports/malformed-import-batch-packet.json
• collab-clipboard-import-guard/reports/malformed-block-list-packet.json
• collab-clipboard-import-guard/reports/malformed-block-entry-packet.json
• collab-clipboard-import-guard/reports/malformed-table-row-packet.json
• collab-clipboard-import-guard/reports/malformed-table-cells-packet.json
• collab-clipboard-import-guard/reports/malformed-existing-anchors-packet.json
• collab-clipboard-import-guard/reports/missing-block-ids-anchor-collision-packet.json
• collab-clipboard-import-guard/reports/partner-review-packet.json
• collab-clipboard-import-guard/reports/placeholder-attestation-packet.json
• collab-clipboard-import-guard/reports/source-origin-packet.json
• collab-clipboard-import-guard/reports/summary.svg
• collab-clipboard-import-guard/reports/trusted-attestation-packet.json
• collab-clipboard-import-guard/reports/unsafe-packet.json
• collab-clipboard-import-guard/reports/unsupported-channel-packet.json
• collab-clipboard-import-guard/reports/demo.mp4

No external services, credentials, private manuscripts, live collaborator data, or payout data are used.

AI-assisted with OpenAI Codex; I reviewed and locally verified the diff before submitting.