Task 8286a894, feature-level remediation on 7eed8fd. Resolves feature review finding NQ-ICON-01 (MEDIUM): Python validate_icon accepted emoji:\uFEFF while the JS resolveIcon rejected it (JS \s includes the BOM). Fix: reject U+FEFF in core/icons.py, mirroring JS \s; ZWJ U+200D remains valid. A shared verdict table tools/icons/emoji-payload-cases.json is checked from both tests/test_core_icons.py and admin Vitest, so future divergence fails one suite. The developer verified U+FEFF was the only Python/JS disagreement across all code points.
Evidence at 23d2197: TZ=UTC uv run pytest -q = 2100 passed; cd admin && npm test = 290 passed; node tools/icons/generate.mjs --check exit 0 (generated registry byte-identical).
Task 8286a894, feature-level remediation on 7eed8fd. Resolves feature review finding NQ-ICON-01 (MEDIUM): Python validate_icon accepted emoji:\uFEFF while the JS resolveIcon rejected it (JS \s includes the BOM). Fix: reject U+FEFF in core/icons.py, mirroring JS \s; ZWJ U+200D remains valid. A shared verdict table tools/icons/emoji-payload-cases.json is checked from both tests/test_core_icons.py and admin Vitest, so future divergence fails one suite. The developer verified U+FEFF was the only Python/JS disagreement across all code points.
Evidence at 23d2197: TZ=UTC uv run pytest -q = 2100 passed; cd admin && npm test = 290 passed; node tools/icons/generate.mjs --check exit 0 (generated registry byte-identical).
Python's validate_icon accepted emoji: (not str.isspace(), category
Cf) while the generated JS isEmojiPayload rejects it via \s, so the backend
could store a key the admin and panel silently fall back on. An exhaustive
code-point sweep shows U+FEFF is the only divergence; add it to the
forbidden set. ZWJ U+200D stays valid.
Add tools/icons/emoji-payload-cases.json, a shared verdict table asserted
by both tests/test_core_icons.py (validate_icon) and the admin Vitest
suite (resolveIcon), so any future divergence fails one of the suites.
Task: 8286a894-133f-4582-90fb-88f47eef6628 (review finding NQ-ICON-01)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Task 8286a894, feature-level remediation on
7eed8fd. Resolves feature review finding NQ-ICON-01 (MEDIUM): Python validate_icon accepted emoji:\uFEFF while the JS resolveIcon rejected it (JS \s includes the BOM). Fix: reject U+FEFF in core/icons.py, mirroring JS \s; ZWJ U+200D remains valid. A shared verdict table tools/icons/emoji-payload-cases.json is checked from both tests/test_core_icons.py and admin Vitest, so future divergence fails one suite. The developer verified U+FEFF was the only Python/JS disagreement across all code points.Evidence at
23d2197: TZ=UTC uv run pytest -q = 2100 passed; cd admin && npm test = 290 passed; node tools/icons/generate.mjs --check exit 0 (generated registry byte-identical).Independent Codex gpt-5.6-terra review completed for this exact commit.