The secret-scan gate goes green by fixing what it found - #2757
Merged
Conversation
233 tracked files carried one developer's home directory, and the gate that
rejects it had been red for months because it is paths-filtered and had not run.
Editing the root Cargo.toml for the release work woke it.
60 load-bearing, fixed in the previous change: seal spec_path fields, which
the seal gate RESOLVES, and scripts whose repository root could only ever
be one person's
208 committed Coq build artifacts -- .vo/.vok/.vos/.glob/.aux, six megabytes
of them, each recording the absolute path of the machine that produced
it. Nothing reads them: coq-proofs.yml builds from source with
`coqc -R . Trinity <file>.v`, and no tool or workflow references one.
Untracked here and covered by .gitignore.
98 markdown -- research notes and setup docs quoting a path. Now
repository-relative, which is what a reader of this repository can act on.
3 a benchmark and a test writing to an absolute output directory, and a
usage example naming one machine. Fixed.
Four remain, and they are NAMED INDIVIDUALLY in the gate rather than swept under
a count: .mcp.json, .codex/config.toml, .codex/hooks.json and
.claude/gitbutler-hooks.json each configure LOCAL TOOLING and must give an
absolute path at run time, so there is no portable literal to substitute. If
they move to an expanded variable, the line in the gate goes with the change.
The allowlist tolerates an optional `./` prefix: GNU grep on the runner prints
it and BSD grep on a Mac does not, and a filter anchored to one of them means
different things in the two places it is run.
tracked files carrying the path: 233 -> 0 outside those four
gate on this tree: 0 violations
Confirmed still able to fail: a planted file is caught immediately.
Two files were found to be committed Python that does not parse --
clara-bridge/benchmarks/vsa_performance.py and
clara-bridge/tests/ta2/test_redteam.py, both broken before this change. Five of
the first four hundred tracked .py files do not parse. Left to #2754.
Refs #2754
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
|
📓 NotebookLM Notebook linked to this PR
This notebook contains session context, decisions, and artifacts for this work. |
Contributor
PR DashboardGenerated at: 2026-08-28 16:17:57 UTC
Summary
Seal Status
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #2754
233 tracked files carried one developer's home directory, and the gate that rejects it had been red for months — it is
paths:-filtered and had not run. Editing the rootCargo.tomlfor the release work woke it.spec_pathfields the seal gate resolves, and scripts whose repository root could only ever be one person's.vo/.vok/.vos/.glob/.aux, six megabytes, each recording the absolute path of the machine that produced itNothing reads the artifacts:
coq-proofs.ymlbuilds from source withcoqc -R . Trinity <file>.v, and no tool or workflow references a.vo.Four remain, and they are named
.mcp.json,.codex/config.toml,.codex/hooks.json,.claude/gitbutler-hooks.jsoneach configure local tooling and must give an absolute path at run time, so there is no portable literal to substitute. They are excluded individually and with a reason in the gate, not hidden behind a count — if they move to an expanded variable, the line in the gate goes with the change.The allowlist tolerates an optional
./prefix: GNU grep on the runner prints it, BSD grep on a Mac does not, and a filter anchored to one of them means different things in the two places it is run.Confirmed still able to fail: a planted file is caught immediately.
Found on the way, not fixed here
Two of the files touched are committed Python that does not parse —
clara-bridge/benchmarks/vsa_performance.py(_ = 0 1) andclara-bridge/tests/ta2/test_redteam.py— both broken before this change. Five of the first four hundred tracked.pyfiles do not parse. Left to #2754 rather than mixed in here.Suite 2424 passed / 0 failed; seal gate and
check_gate_preconditions.pyboth exit 0.🤖 Generated with Claude Code