A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live
I1023
Nothing private reaches a published page
Where it stands
devtask.issue- Readiness
- ready no dependency and no gate holds it; nobody has started it
- Status
- READY
- Can start
- startable
- Milestone
- Milestone status
- ACTIVE
- Wave
3- Waiting on
- none
- Holds back
- Behind it in all
2- Evidence
0of2
Moves
plan.transitionWhat it is
- Objective
- Scan the published graph, the static site and everything the client receives for credential material, private environment values and machine-absolute paths, and fail on a finding without printing it.
- Why
- This milestone publishes a description of everything the repository knows. That is exactly the artifact in which an accidental token or a developer's home directory would travel furthest.
- Now
- One definition, apps/majordomus-cli/src/quality/leak-patterns.tsv, is read by scripts/ci/no-machine-paths (every tracked file), scripts/site-check check 12 (the built site) and `majordomus quality rustdoc` (the crate's reference). Since 2026-10-15 site-check names the file and the kind of each finding and never its text, and case 3047 plants synthetic markers to prove it. Not yet detected: a credential written as a quoted JSON key (the closing quote stands between the name and the colon) and raw authorization material (an `Authorization:` header or a bearer value).
- Wanted
- One check inspects the generated data and the built site, reports findings by location and kind, and runs in CI.
- Done when
- unknown: the record declares no `completion`
- Risk
- A scan tuned to be quiet finds nothing forever. The synthetic marker is what keeps it honest.
Acceptance
- Known credential variable names, credential-shaped values, raw authorization material and machine-absolute paths are all detected
- A finding names the location and the kind and never the value
- A negative test plants a synthetic marker and proves the check finds it
- The check runs in CI on every change
- Validation
bash test/run.sh- Evidence required
public_scannegative_test- Evidence present
- unknown: the record carries no `evidence` entries
Scope
- Touches
test/cases- Not
Printing any secret value while scanningA general secret scanner competing with the repository's existing tooling- Depends on
- Priority
- p0
- Profile
- implementation
- Parallel safe
- true
- Owner
- unknown: the record declares no `owner`
The work so far
- Branches
- none
- Merged
- none
- Commits
0- Trunk
- master
- Sessions
- none
- Created
- 2026-09-06
- Updated
- 2026-10-15
- Started
- unknown: the record declares no `started_at`
- Verified
- unknown: the record declares no `verified_at`
- Completed
- unknown: the record declares no `completed_at`
Synchronisation
- Adapter
scripts/github-sync- Repository
- unknown: the derived plan's header carries no repository
- External issue
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
- State there
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
Findings
| Level | Code | Message | Reproduce |
|---|---|---|---|
| WARN | scope_conflict | shares test/cases with I2485; they may not run concurrently | majordomus plan validate |