Skip to content

I0919 — Nothing secret and nothing local leaves in the image

Automate the verification that no credential material and no developer path appears in the image, its metadata, the generated artifacts, the site output, the API documents or the deployment report.

BLOCKED wave 4 · p0 · implementation profile · parallel safe

Part of fly-deployment — A deployment is a projection of the repository model, and a reachable URL is its evidence.

Blocked. This issue cannot start until I0909 is done. The status is derived from that, not declared.

Objective

Automate the verification that no credential material and no developer path appears in the image, its metadata, the generated artifacts, the site output, the API documents or the deployment report.

Why

Every one of those surfaces has published a secret for somebody at some point. A scan that runs in CI is the only version of this promise that stays true.

Current state

No image exists and no scan exists.

Desired state

A check inspects the image, its history and environment, the generated files and the published output, reports what it found by location and kind, and never prints a secret value.

Scope

  • test/cases
  • apps/majordomus-cli/src/deploy/scan.rs

Out of scope

  • Printing any secret value, in any output, for any reason
  • A general-purpose secret scanner competing with existing repository tooling

Dependencies

What waits on this

Acceptance criteria

  • The image, its layer history and its environment are inspected, and the extracted filesystem too where that is feasible
  • The generated artifacts, the site output, the API document and the deployment report are inspected
  • Known credential variable names and credential-shaped values are both detected
  • Absolute developer paths are detected as their own class of finding
  • A finding names the location and the kind and never the value, and the check runs in CI

Validation

  • bash test/run.sh
  • majordomus deploy doctor

Evidence required

  • image_scan
  • generated_scan
  • path_scan

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

A scan that never fires is indistinguishable from a scan that cannot fire. It needs a negative test that plants a synthetic marker and proves the check finds it.

Timeline

started
—
verified
—
completed
—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I0919.yaml. Read it back with majordomus plan show I0919.