I1023 — Nothing private reaches a published page

✓DONE wave 3 · p0 · implementation profile · parallel safe

Part of capability-graph — One capability graph, two projections, and no second inventory of what this repository can do.

Objective

Scan the published graph, the static site and everything the client receives for credential material, private environment values and machine-absolute paths, and fail on a finding without printing it.

Why

This milestone publishes a description of everything the repository knows. That is exactly the artifact in which an accidental token or a developer's home directory would travel furthest.

Current state

One definition, apps/majordomus-cli/src/quality/leak-patterns.tsv, is read by scripts/ci/no-machine-paths (every tracked file), scripts/site-check check 12 (the built site) and `majordomus quality rustdoc` (the crate's reference). Since 2026-10-15 site-check names the file and the kind of each finding and never its text, and case 3047 plants synthetic markers to prove it. Not yet detected: a credential written as a quoted JSON key (the closing quote stands between the name and the colon) and raw authorization material (an `Authorization:` header or a bearer value).

Desired state

One check inspects the generated data and the built site, reports findings by location and kind, and runs in CI.

Scope

• test/cases

Out of scope

• Printing any secret value while scanning
• A general secret scanner competing with the repository's existing tooling

Dependencies

• I1005✓DONE The graph is a generated artifact with a schema and no unsafe field

What waits on this

• I1029✕BLOCKED The gate refuses what would silently break the interface

Acceptance criteria

• Known credential variable names, credential-shaped values, raw authorization material and machine-absolute paths are all detected
• A finding names the location and the kind and never the value
• A negative test plants a synthetic marker and proves the check finds it
• The check runs in CI on every change

Validation

• bash test/run.sh

Evidence required

• public_scan
• negative_test

Evidence

Risk

A scan tuned to be quiet finds nothing forever. The synthetic marker is what keeps it honest.

Timeline

started

2026-10-19T13:52:20Z

verified

—

completed

2026-10-19T13:52:54Z

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I1023.yaml. Read it back with majordomus plan show I1023.