PIR-2026-0055 - While registering an incident about itself, PipeRoll's operating agent pushed a hold-until-launch draft to the public registry; the force-push recovery left an immutable public reference to the withdrawn commit

Disclosure: A PipeRoll self-incident, drafted by the same Claude agent that caused it, per constitutional rule 4. Third failure in a chain: the seismograph's harm probes ([[PIR-2026-0054]]), the stale-clone force-push during that cleanup (0054's second failure), and this confidentiality failure - caused by the act of documenting 0054.

id: PIR-2026-0055
title: An AI agent tasked with drafting-and-holding a sensitive incident record treated "hold until launch" as a status field on the document rather than a constraint on where it may live, and followed the repository's normal contribution flow (push a branch, open a pull request) to a PUBLIC repository, exposing a pre-release draft weeks before the intended disclosure; the branch-delete and force-push recovery could not fully remove the reference, because a pull-request head ref is retained by the host and the force-push itself leaves an immutable public timeline event
date_occurred: 2026-09-01
date_detected: 2026-09-01 (same session, by the human operator, within minutes)
date_disclosed: 2026-09-15 (published with the seismograph public launch, with 0054)
status: corroborated

The agent

agent_description: The Claude (Fable 5) agent operating the PipeRoll ops session as the registry's editor. It had just been asked to draft an incident record and HOLD it until a future launch date, so the disclosure would not land during an outreach window.
operator_type: individual (a single human operator directing the agent)
autonomy_level: human-on-the-loop (the human was present and caught it, but the agent selected and executed the publish action with no visibility check)
model_stack: Claude (Fable 5)
harness: an agentic CLI with shell + git + host-API tools; the repo's documented flow is branch -> push -> pull request

Authority

authority_scope: write access to a public repository and its pull requests via an authenticated host CLI (push branches, open/close/reopen PRs, force-push)
funds_at_risk_usd: 0
blast_radius: public (a public repository; anyone could in principle have read the exposed content)

The failure

root_cause: operator-error (the instruction "hold until launch" was modeled as a document attribute - a draft status - instead of a placement rule; the agent then applied the repo's normal public contribution flow without checking the target repository was public); contributing: plain-error (the recovery sequence deepened the trace before reducing it)
failure_locus: agent-reasoning (the category error about what "hold" constrains); harness contributing (the publish action had no guard requiring a visibility check for sensitive drafts)
exploitation_status: in-wild-malfunction (no adversary; a self-inflicted disclosure)
mechanism:
1. Asked to draft a sensitive record and hold it, the agent wrote it with status: draft and pushed it as a branch, then opened a pull request - the repo's standard flow - without registering that this repository is public, so the draft became world-readable immediately.
2. The human operator noticed within minutes and flagged the repository's visibility.
3. First recovery (close the PR, delete the branch) did not remove the content: the host retains a pull request's head commit on a managed ref that branch deletion does not touch.
4. Second recovery (restore the branch to the recorded head, reopen the PR, force-push to a harmless stub) moved the managed head ref onto the stub, cleaning the PR's default view and un-pinning the sensitive commit (making it garbage-collection-eligible rather than retained).
5. But that force-push created an immutable, publicly visible timeline event that references the withdrawn commit. Timeline events cannot be edited or deleted by the operator; only host support can purge them.
adversary_present: no

Impact

severity: near-miss (the exposed material contained no secrets and no harmful instructions - only a pre-release draft and category labels; the repository had zero forks and zero watchers; the content was never indexed or, as far as observable, retrieved by anyone)
direct_loss_usd: 0
indirect_loss_usd: 0 realized; the exposed asset was disclosure timing, not money
downtime: none (the operator declined the one instant full-removal lever - taking the repository private - because on the host's free tier that would have taken the public site offline)
data_exposure: a pre-release incident draft, briefly, to a zero-audience public repo; no secrets, no harmful content

Detection and recovery

detected_by: the human operator (within minutes, same session)
time_to_detect: minutes
time_to_recover: same session for the default-view cleanup; the immutable timeline reference persisted
remediation: PR closed and head ref moved to a harmless stub; the sensitive commit un-pinned and left GC-eligible. A host-support purge of the residual reference was drafted but is NO LONGER PURSUED: with 0054 now disclosed publicly under the managed-disclosure decision, the withdrawn draft is simply an early version of a record we are publishing - there is nothing left to protect, and disclosure resolves the residual.
structural_fix: "hold" is a PLACEMENT constraint, not a document-status field - held drafts live only in a private repo or a local file, never staged through a public repo's contribution flow. New doctrine: a visibility check precedes any publish of a sensitive draft; and prefer disclosure timelines that do not depend on suppressing an artifact, since suppression is unreliable on hosted platforms.
controls_that_worked: the human-on-the-loop caught it in minutes; the repo's zero-audience state meant no realized exposure

Evidence

telemetry_grade: operator-logs (the git/host history of the push, close, reopen, and force-push is visible to the operator; the public timeline event is externally observable)
sources:
- the public pull-request timeline on the registry repository (externally observable that a force-push occurred; the withdrawn diff is not linked here by design)
- https://github.com/piperoll/seismograph/blob/main/POSTMORTEM-2026-09.md (the operator's own post-mortem)
- independence: weak - operator-disclosed; the one externally-observable element is the public force-push timeline event
confidence: high (the operator has the full sequence and caused it)

Verification / schema notes

A "remediation caused a further incident" chain (0054's cleanup -> this) recurs; a first-class field for coupled failures may be warranted.
This record is the clearest argument for the managed-disclosure decision on 0054: once you commit to disclosing, the confidentiality residual this record is about stops being a liability. Suppression was the fragile path; disclosure is the durable one.
Companion: [[PIR-2026-0054]].

While registering an incident about itself, PipeRoll's operating agent pushed a…