fix: SPECIAL:autonomy_log parses live bytes and can leak the whole ledger

[Jammy2211]

Overview

autonomy_log_body() in scripts/spawn.py reads the live autonomy_log.md and copies lines until one starts with |---. That is the same "trust the live file's shape" pattern that made empty_body() stamp live registry entries into the public templates (#118) — it just has not fired yet.

Pre-existing; surfaced by the independent Codex review of #118. Sibling half of #121.

for line in lines:
    kept.append(line)
    if line.startswith("|---"):
        break

Both failure modes reproduced against the real ledger

hazard	result
a task row inserted above the separator	that row is copied into the template
separator reformatted to | --- | (a cosmetic edit any markdown formatter makes)	the break never fires — 231 live task records copied

And the canary scan does not save us. A leaked row containing no dataset or person token returns zero hits — verified. The full-ledger case happens to be caught today only because some rows mention slacs1430 / B1938 / cosmos_web_ring. That is luck, not a guarantee, and it is precisely the reasoning that made the #118 leak invisible.

Fix

Same shape as #118: generate the schema header as a constant asset instead of parsing it out of the live ledger. No source bytes, no shape assumptions — the file is never opened.

The header is entirely generic (title, the prose explaining the log, the Outcome ∈ … legend, the table header and separator) and references only PyAutoBrain/AUTONOMY.md, which a fresh org has. The constant reproduces the currently-published bytes exactly, so this introduces no gratuitous template drift.

Detailed implementation plan

Affected Repositories

• PyAutoMind (primary)

Branch Survey

Repository	Current Branch	Dirty?
./PyAutoMind	main	clean

Suggested branch: feature/spawn-autonomy-log-generated

Implementation Steps

1. docs/pyautobrain/spawn_spec.md — state that the autonomy_log skeleton is GENERATED, not parsed, with the same wording discipline as rule 5 (edit spec first).
2. scripts/spawn.py — add AUTONOMY_LOG_TEMPLATE beside the other generated assets; replace autonomy_log_body()'s parse loop so it never reads src.
3. tests/test_spawn_privacy.py — extend test_generated_tree_contains_no_live_content fixtures with (a) a row above the separator and (b) a | --- | separator; both must still yield a clean template. Add a direct test that the function does not open the source.

Key Files

• scripts/spawn.py — autonomy_log_body() (~line 535), generated-assets block
• docs/pyautobrain/spawn_spec.md — Mind table rule 5
• tests/test_spawn_privacy.py

Original Prompt

Click to expand starting prompt

draft/bug/pyautomind/spawn_autonomy_log_parses_live_bytes.md — split from the bundled instance-state prompt filed during the #118 review.

[Jammy2211]

Shipped

PR #124 merged (3cdc755). Template published: PyAutoMind-template 9459a4c (Memory already current).
Completion record: complete/2026/08/spawn-autonomy-log-generated.md.

Verified

• autonomy_log.md is unchanged in the publish diff — the constant is byte-identical to what the parse produced, exactly as predicted.
• The generated ledger contains 0 live task rows.
• spawn --check against freshly cloned published repos: exit 0, both OK, canary clean.
• 81 tests pass locally and on GitHub runners; 7 fail against the old implementation.
• The published template's own copy of the suite passes when run from the template (81 tests) — spec rule 1b working as intended: the privacy guards travel with the generator they guard.

The trade-off, stated

Generating instead of parsing removes the leak, but it also removes the feedback that kept the header current — nothing else would notice if the live ledger grew a column and the template kept shipping the old table. One test now reads the real file and asserts the live ledger still starts with the constant. If the schema moves, it fails and says to update the constant, explicitly not to re-add parsing.

Codex caught that this guard was missing: the original tests compared the helper with what the helper returns, so a stale or malformed constant would have left every test and --check green. Control-tested both ways after fixing. It also caught that spec rule 5 claimed the ledger used EMPTY_TITLES, which it never did — now split into rules 5 and 5b.

Closes the #118 review arc

All three follow-ups from the original spawn-drift investigation are shipped: #120 (self-heal drift loop), #121/#122 (.github instance automation), and this. spawn.py no longer parses live bytes with shape assumptions anywhere.

Still pending, not closed by this

• The scheduled Spawn Drift leg (Monday 06:17 UTC) has still never passed on its own — see draft/maintenance/pyautomind/spawn_drift_has_no_generator.md.
• Tomorrow morning is the observable proof for fix: spawn's blanket .github/** rule ships broken instance automation #121: no pyauto-morning-health / pyauto-update-digest / pyauto-arxiv-papers runs should appear on the template.