Skip to content
Cockpit0.29.0
A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live

I0919

Nothing secret and nothing local leaves in the image

Where it stands

devtask.issue
Readiness
blocked 1 of its dependencies is not DONE
Status
BLOCKED
Can start
not now
Milestone
fly-deployment
Milestone status
ACTIVE
Wave
4
Waiting on
I0909
Holds back
I0928
Behind it in all
2
Evidence
0 of 3
In the waySubjectDetail
issueI0909I0909 is not DONE

Moves

plan.transition
A move writes the repository: it stamps one field of this issue's record and appends one event to the ledger, and a commit will carry both.
The same moves from a terminal

majordomus plan start I0919

majordomus plan verify I0919

majordomus plan done I0919

What it is

Objective
Automate the verification that no credential material and no developer path appears in the image, its metadata, the generated artifacts, the site output, the API documents or the deployment report.
Why
Every one of those surfaces has published a secret for somebody at some point. A scan that runs in CI is the only version of this promise that stays true.
Now
No image exists and no scan exists.
Wanted
A check inspects the image, its history and environment, the generated files and the published output, reports what it found by location and kind, and never prints a secret value.
Done when
unknown: the record declares no `completion`
Risk
A scan that never fires is indistinguishable from a scan that cannot fire. It needs a negative test that plants a synthetic marker and proves the check finds it.

Acceptance

  • The image, its layer history and its environment are inspected, and the extracted filesystem too where that is feasible
  • The generated artifacts, the site output, the API document and the deployment report are inspected
  • Known credential variable names and credential-shaped values are both detected
  • Absolute developer paths are detected as their own class of finding
  • A finding names the location and the kind and never the value, and the check runs in CI
Validation
bash test/run.shmajordomus deploy doctor
Evidence required
image_scangenerated_scanpath_scan
Evidence present
unknown: the record carries no `evidence` entries

Scope

Touches
test/casesapps/majordomus-cli/src/deploy/scan.rs
Not
Printing any secret value, in any output, for any reasonA general-purpose secret scanner competing with existing repository tooling
Depends on
I0909
Priority
p0
Profile
implementation
Parallel safe
true
Owner
unknown: the record declares no `owner`

The work so far

Branches
none
Merged
none
Commits
0
Trunk
master
Sessions
none
Created
2026-09-06
Updated
2026-09-06
Started
unknown: the record declares no `started_at`
Verified
unknown: the record declares no `verified_at`
Completed
unknown: the record declares no `completed_at`

Synchronisation

Adapter
scripts/github-sync
Repository
unknown: the derived plan's header carries no repository
External issue
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
State there
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.