From dcb3b26356ff92a15b7fa583963b9e688dc7a184 Mon Sep 17 00:00:00 2001
From: Miguel Branco <miguel@raw-labs.com>
Date: Mon, 19 Oct 2026 23:32:57 +0200
Subject: [PATCH] fix: qualify exact historical OCE model URL rejection
 fixtures

---
 changelog.d/oce-model-endpoint-fixture.md |  1 +
 src/agent-input-scan-fixtures.ts          | 13 ++++++++++++-
 test/agent-input-scan-fixtures.test.ts    | 22 ++++++++++++++++++++++
 3 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/oce-model-endpoint-fixture.md

diff --git a/changelog.d/oce-model-endpoint-fixture.md b/changelog.d/oce-model-endpoint-fixture.md
new file mode 100644
index 00000000000..9f19f238c17
--- /dev/null
+++ b/changelog.d/oce-model-endpoint-fixture.md
@@ -0,0 +1 @@
+- Qualify the synthetic OCE model-endpoint rejection URL only in the exact historical source blobs needed to review OCE #2518.
diff --git a/src/agent-input-scan-fixtures.ts b/src/agent-input-scan-fixtures.ts
index 43216dba04e..21f10d2fb13 100644
--- a/src/agent-input-scan-fixtures.ts
+++ b/src/agent-input-scan-fixtures.ts
@@ -279,6 +279,14 @@ const OCE_KUBERNETES_COMPUTE_SOURCE_SHA256S = [
   "fa7f7f34b57faf013f53bbd8824cf9a2263c02a42a481282ae3d7d8be29184a2",
 ] as const;
 
+// OCE #2518's original base/head and refreshed base retain this model-URL rejection fixture.
+// Its head now constructs the synthetic URL at runtime; qualify only these complete blobs.
+const OCE_MODEL_ENDPOINT_SOURCE_SHA256S = [
+  "74221411b5fa46a5be9c593dc5572eabe6983a9667830faaa0b00574631ca208",
+  "754f7089704228fcdfa8b3586752c4faecba734e45b8a1a65d4db5fe88445f62",
+  "d66caf0df7a586321da4c1077bbc3a51aa118f7fde343010fc1dbec28cecc8a8",
+] as const;
+
 // oxfmt-ignore
 const REVIEWED_ATTRIBUTIONS: readonly ReviewedAttribution[] = [
   // Ship #19: CLI-generated event_id; Privacy's keyword window crosses the reason field.
@@ -287,6 +295,8 @@ const REVIEWED_ATTRIBUTIONS: readonly ReviewedAttribution[] = [
   // Retain the removed OCE fixtures only in source blobs already held by open OCE PRs.
   [17, "URI", "PLAIN", "fde443718383531e2fc52a8324fc644f1c45c1c766afd11da028368831e0f457", "fde443718383531e2fc52a8324fc644f1c45c1c766afd11da028368831e0f457", "6c17481ec8ebdfc543923950c2959e58568b8ad6daddabf26ce870e7a5d69274", "tests/conformance/kubernetes-compute.test.mjs", "100644", OCE_KUBERNETES_COMPUTE_SOURCE_SHA256S],
   [17, "URI", "PLAIN", "18e186031a746783f43d3002e63b775b6e28acef5d60825a82c418ad3e603b5b", "18e186031a746783f43d3002e63b775b6e28acef5d60825a82c418ad3e603b5b", "fb50a8d4a7885dd59938f6421133018054740ef7a91dd01b62b9c109bb4c471c", "tests/conformance/kubernetes-compute.test.mjs", "100644", OCE_KUBERNETES_COMPUTE_SOURCE_SHA256S],
+  // Synthetic model-URL user-info rejection, observed with the pinned native URI detector.
+  [17, "URI", "PLAIN", "a03b652cf4bbbacf754187bc254e62291d6a24dcdd3d7eb65c18f7272a05e7d1", "4a53b24813c2f0d8a0a4c32e6225b379b956559c49fcbf57cd2a39edcdbda1a5", "0eeee59e6f534ec7f2ae070deec4d65bd70b5c81970a4e6b8ce05133193d54ad", "tests/integration/profile-renderer.test.mjs", "100644", OCE_MODEL_ENDPOINT_SOURCE_SHA256S],
   // OpenClaw catalog-icon rejection fixture: observed native prefixes bind the complete source line.
   [17, "URI", "PLAIN", "580f7a7c0ff4d88005bb0a7ad56ab18f84dc6ba38060fd35914e020e8b581a6a", "02fcb6434869afdf5b29773aad1295172012f6445975eba685b873c79e4567b9", "6c9cdafa1ff07a62a8ffc88c6b8d5d377becfb6fc09c3709d997dcc9ca890469", "src/plugins/catalog-icon-registry.test.ts", "100644"],
   [17, "URI", "HTML", "580f7a7c0ff4d88005bb0a7ad56ab18f84dc6ba38060fd35914e020e8b581a6a", "02fcb6434869afdf5b29773aad1295172012f6445975eba685b873c79e4567b9", "6c9cdafa1ff07a62a8ffc88c6b8d5d377becfb6fc09c3709d997dcc9ca890469", "src/plugins/catalog-icon-registry.test.ts", "100644"],
@@ -487,7 +497,8 @@ function validateReviewedAttributions(rows: readonly ReviewedAttribution[]): voi
           detectorType === 17 &&
           detectorName === "URI" &&
           decoder === "PLAIN") ||
-        (source === "tests/conformance/kubernetes-compute.test.mjs" &&
+        ((source === "tests/conformance/kubernetes-compute.test.mjs" ||
+          source === "tests/integration/profile-renderer.test.mjs") &&
           detectorType === 17 &&
           detectorName === "URI" &&
           decoder === "PLAIN" &&
diff --git a/test/agent-input-scan-fixtures.test.ts b/test/agent-input-scan-fixtures.test.ts
index 29e2d6e0eaa..e6e1ecd2c82 100644
--- a/test/agent-input-scan-fixtures.test.ts
+++ b/test/agent-input-scan-fixtures.test.ts
@@ -822,6 +822,28 @@ test("Historical OCE URI fixture admits only an exact reviewed source blob", (t)
   if (refused.kind === "refused") assert.equal(refused.diagnostic.reason, "source_not_reviewed");
 });
 
+test("OCE model endpoint fixture policy refuses unreviewed source copies", (t) => {
+  // Matching the synthetic URL, source line and path must not qualify a new complete blob.
+  const raw = ["https://", "user", ":", "pass", "@", "models.example.com"].join("");
+  const rawV2 = raw + "/v1";
+  const patch = fixturePatch(
+    t,
+    "tests/integration/profile-renderer.test.mjs",
+    [
+      {
+        raw,
+        rawV2,
+        line: '      "' + rawV2 + '",',
+        decoders: ["PLAIN"],
+      },
+    ],
+    "remove",
+  );
+  const result = patch.classify("PLAIN", {}, { blobOnly: true });
+  assert.equal(result.kind, "refused", JSON.stringify(result));
+  if (result.kind === "refused") assert.equal(result.diagnostic.reason, "source_not_reviewed");
+});
+
 function catalogIconUriFixture(): ReturnType<typeof autoreviewFixtures>[number] {
   const raw = ["https://", "user", ":", "password", "@", "cdn.example.com"].join("");
   const rawV2 = raw + "/icon";