diff --git a/.kaizen/agents/custodian-codex/supervision.json b/.kaizen/agents/custodian-codex/supervision.json index d46cd09c..33c566f1 100644 --- a/.kaizen/agents/custodian-codex/supervision.json +++ b/.kaizen/agents/custodian-codex/supervision.json @@ -1175,6 +1175,46 @@ "Correct final assertion matches approved rendered banner; both failed checks retained, artifact and deployment unchanged." ], "recovery": "No artifact/deployment revision or rollback. Two verifier-only date/label assertion failures retained; corrected assertions match approved source and full verification passed." + }, + { + "proposal_id": "SYNC-FORGE-METADATA-20261101-R1", + "original_revision": 1, + "original_digest": "0fceb2dc3c1963a16f40a0221b2eb6cb5384b91e2fe8607bb0121afe47a5d2e1", + "original_digest_sha256": "0fceb2dc3c1963a16f40a0221b2eb6cb5384b91e2fe8607bb0121afe47a5d2e1", + "proposal_ref": "docs/changes/2026-11-01-scanner-json-digest/forge-metadata-proposal.json", + "disposition": "unscored", + "outcome": "succeeded", + "target": "kube:railiance01; selected forgejo deployment/pod names, UIDs and images only", + "expected_result": "Read-only metadata needed to prepare exact receiver policy rollout; no production mutation or credentials", + "verification_ref": "Founder-returned metadata in active repository-sync conversation, 2026-11-01; selected metadata copied into docs/repository-sync-2026-11-01.md", + "rollback_ref": "not applicable: read-only query; no state changes", + "cost_estimate_eur": 0, + "risk_estimate_eur": 0, + "estimate_basis": "existing infrastructure, one read-only bounded metadata query; no new spend, data mutation or credential output", + "supervisor": "Bernd Worsch", + "approved_revision": null, + "approved_digest": null, + "executed_revision": null, + "executed_digest": null, + "refinement_or_rescue": true, + "promotion_evidence": false, + "approval_ref": null, + "execution_ref": "/tmp/forge-founder-metadata.sh executed by founder; agent did not access admin credential", + "verified_outcome": "Deployment/pod identity and image returned; original exact argv not executed. No score or approval evidence backfilled.", + "attempt_history": [ + { + "attempt": 1, + "result": "not executed: copied output-format argument contained embedded line breaks" + }, + { + "attempt": 2, + "result": "failed: founder default context also ops-mason-builder; forbidden" + }, + { + "attempt": 3, + "result": "succeeded after founder explicitly selected attended admin kubeconfig; custom-columns-file equivalent query; original digest not executed" + } + ] } ], "trials": [ diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index ae948cbc..1309d8e5 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -83,6 +83,7 @@ | workplan | CUST-WP-0080 | finished | — | workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md | | workplan | CUST-WP-0081 | finished | — | workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md | | workplan | CUST-WP-0082 | backlog | — | workplans/CUST-WP-0082-netkingdom-security-hardening.md | +| workplan | CUST-WP-0083 | active | — | workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md | | workplan | THE-WP-0001 | finished | — | workplans/THE-WP-0001-federation-interface.md | | task | CUST-WP-ADHOC-2026-05-02-T01 | done | — | workplans/ADHOC-2026-05-02.md | | task | CUST-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | @@ -579,6 +580,14 @@ | task | CUST-WP-0082-T23 | todo | — | workplans/CUST-WP-0082-netkingdom-security-hardening.md | | task | CUST-WP-0082-T24 | todo | — | workplans/CUST-WP-0082-netkingdom-security-hardening.md | | task | CUST-WP-0082-T25 | todo | — | workplans/CUST-WP-0082-netkingdom-security-hardening.md | +| task | CUST-WP-0083-T01 | done | — | workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md | +| task | CUST-WP-0083-T02 | progress | — | workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md | +| task | CUST-WP-0083-T03 | progress | — | workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md | +| task | CUST-WP-0083-T04 | wait | — | workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md | +| task | CUST-WP-0083-T05 | todo | — | workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md | +| task | CUST-WP-0083-T06 | done | — | workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md | +| task | CUST-WP-0083-T07 | done | — | workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md | +| task | CUST-WP-0083-T08 | progress | — | workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md | | task | THE-WP-0001-T01 | done | — | workplans/THE-WP-0001-federation-interface.md | | task | THE-WP-0001-T02 | done | — | workplans/THE-WP-0001-federation-interface.md | | intake | CUST-IN-0001 | closed | green | intake-legacy-suggestions-migration.md | diff --git a/docs/changes/2026-11-01-scanner-json-digest/README.md b/docs/changes/2026-11-01-scanner-json-digest/README.md new file mode 100644 index 00000000..f82dc7aa --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/README.md @@ -0,0 +1,13 @@ +# JSON filename/SHA256 scanner candidate + +Proposal `SYNC-SCANNER-JSON-DIGEST-20261101`, revision 1. This is a source candidate and review evidence, not a native activation receipt. + +The existing reviewed YAML filename/digest exception rejects the equivalent JSON shape in the RApp source-pin and Custodian construction manifests. The candidate extends precisely that shape to a quoted JSON key/value, using the identical rule in both adapters. It does not allow ordinary secret keys, prefixed provider tokens, uppercase or extended-length values. Existing rule defaults, history traversal, scanner pin, time/size limits, inline-suppression refusal and fail-closed outcomes remain unchanged. + +`source-changes.json` pins original and candidate source hashes. `scanner-json-digest.patch` includes both implementations and regression tests. `proposal.json` pins the built candidate and states verification/rollback and unapproved native status. Candidate build and ephemeral test checkouts are in `/tmp/sync-scanner-candidate`. + +Validation: 12 local real-Gitleaks tests passed (37 unrelated tests deselected); full receiver `FORGE_TEST_GITLEAKS=... go test -count=1 ./...` passed in 150.087s. A prior Go invocation without that environment passed only scanner-independent tests and was superseded by this real-scanner run. + +Native preparation is pending read-only inventory. Current Kubernetes identity `ops-mason-builder` cannot list nodes, deployments or pods in `forgejo`. Do not borrow the founder's admin kubeconfig. The prepared `forge-metadata-proposal.json` uses gated-executor's exact-action format for only names, UIDs and images. Its digest is `sha256:0fceb2dc3c1963a16f40a0221b2eb6cb5384b91e2fe8607bb0121afe47a5d2e1`. The founder was asked to return this metadata or provide the supervised execution result. A native update needs its own exact inspected rollout proposal and supervisor approval under `docs/agent-autonomy-decision.md` and environment-orientation §4. + +The staged scanner in repo-manager and live receiver have not been altered by this candidate. Independent clean-file commits continue under the original policy. diff --git a/docs/changes/2026-11-01-scanner-json-digest/forge-metadata-proposal.json b/docs/changes/2026-11-01-scanner-json-digest/forge-metadata-proposal.json new file mode 100644 index 00000000..abac4d42 --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/forge-metadata-proposal.json @@ -0,0 +1,20 @@ +{ + "action": { + "agent_id": "custodian-agt", + "argv": [ + "kubectl", + "-n", + "forgejo", + "get", + "deployment,pod", + "-o", + "custom-columns=KIND:.kind,NAME:.metadata.name,UID:.metadata.uid,DEPLOY_IMAGES:.spec.template.spec.containers[*].image,POD_IMAGES:.spec.containers[*].image" + ], + "cwd": "/", + "env": {}, + "profile": "kube-admin", + "target": "kube:railiance01", + "version": "gexec.action/v1" + }, + "digest": "sha256:0fceb2dc3c1963a16f40a0221b2eb6cb5384b91e2fe8607bb0121afe47a5d2e1" +} diff --git a/docs/changes/2026-11-01-scanner-json-digest/native-preflight-proposal.json b/docs/changes/2026-11-01-scanner-json-digest/native-preflight-proposal.json new file mode 100644 index 00000000..04cbc7aa --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/native-preflight-proposal.json @@ -0,0 +1,14 @@ +{ + "proposal_id": "SYNC-FORGE-READONLY-PREFLIGHT-20261101", + "revision": 1, + "target": "railiance01 forgejo/forge; existing public scanner artifacts and metadata only", + "original_script_sha256": "e41c1183dae2499e62d6762b0714cc60356152494b593a45a868938f439a5f51", + "invocation_script_sha256": "1217346155fa2ea730153c6fbf94f7ec548840cb07fbfa3cfaa61db59fe02d3a", + "expected_result": "selected public artifact/config/guard and node allocation receipt for exact rollout preparation", + "verification": "checks target deployment/pod UID, node address, artifact and hook identities; returns selected metadata only", + "rollback": "not applicable; read-only inspection, no state change", + "cost_estimate_eur": 0, + "risk_estimate_eur": 0, + "estimate_basis": "bounded reads of existing metadata and public scanner binaries only; no new spend or mutation", + "disposition": "requested founder execution; pending result; no exact approval token and no scored success" +} diff --git a/docs/changes/2026-11-01-scanner-json-digest/native-preflight.py b/docs/changes/2026-11-01-scanner-json-digest/native-preflight.py new file mode 100644 index 00000000..608e21bd --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/native-preflight.py @@ -0,0 +1,57 @@ +"""Founder-run read-only scanner preflight; prints only selected public evidence.""" +import subprocess,json,hashlib,pathlib,sys +NS='forgejo';NAME='forge';POD='forge-79c7fb84db-k5wtm' +EXPECTED_UID='1faefb26-cccd-4d0e-b509-70a7eb0b4f4d' +POD_UID='2c9f911a-403e-4183-a027-2b8d48742348' +BASE='/data/security/receive-secret-scan/20261027-b735d052a49f' +ADAPTER='b735d052a49fc8e9cca14cddee074c5429352ad71841eb6548459294f15683a2' +SCANNER='88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509' +def k(*args): + q=subprocess.run(['kubectl',*args],capture_output=True,timeout=60) + if q.returncode:raise RuntimeError('read-only-command-failed; raw diagnostics withheld') + return q.stdout + +def main(): + d=json.loads(k('-n',NS,'get','deployment',NAME,'-o','json')) + if d['metadata']['uid']!=EXPECTED_UID:raise RuntimeError('deployment-identity-drift') + uid=k('-n',NS,'get','pod',POD,'-o','jsonpath={.metadata.uid}').decode() + if uid!=POD_UID:raise RuntimeError('pod-identity-drift') + spec=d['spec']['template']['spec'];inits=spec.get('initContainers',[]) + candidates=[c['name'] for c in spec['containers'] if c.get('image')=='code.forgejo.org/forgejo/forgejo:11.0.3-rootless'] + if len(candidates)!=1:raise RuntimeError('forge-container-ambiguous') + container=candidates[0] + guards=[(i,x) for i,x in enumerate(inits) if x['name']=='verify-secret-scanner'] + if len(guards)!=1:raise RuntimeError('scanner-guard-ambiguous') + index,guard=guards[0] + volumes=spec.get('volumes',[]);selected=[(i,x) for i,x in enumerate(volumes) if x['name']=='secret-scan-template'] + if len(selected)!=1:raise RuntimeError('scanner-volume-ambiguous') + vindex,volume=selected[0];cmname=volume['configMap']['name'] + if cmname!='forgejo-secret-template-d1df801be39f':raise RuntimeError('template-configmap-drift') + # This exact public ConfigMap contains only the receiver hook, per owner source. + hook=k('-n',NS,'get','configmap',cmname,'-o','jsonpath={.data.hook}') + expected=('#!/bin/sh\nset +vx\nset -eu\nexec '+BASE+'/receive-secret-scan --scanner '+BASE+'/gitleaks\n').encode() + if hook!=expected:raise RuntimeError('mounted-hook-source-drift') + metadata=k('-n',NS,'exec',POD,'-c',container,'--','sh','-c', + 'set -eu; test -f "$1" && test ! -L "$1"; test -f "$2" && test ! -L "$2"; sha256sum "$1" "$2"', + 'sh',BASE+'/receive-secret-scan',BASE+'/gitleaks').decode().splitlines() + hashes=[s.split()[0] for s in metadata] + if hashes!=[ADAPTER,SCANNER]:raise RuntimeError('installed-scanner-artifact-drift') + nodes=json.loads(k('get','nodes','-o','json'))['items'] + if len(nodes)!=1 or not any(a['address']=='92.205.62.239' for a in nodes[0]['status']['addresses']):raise RuntimeError('node-target-drift') + description=k('describe','node',nodes[0]['metadata']['name']).decode() + allocation=description.split('Allocated resources:',1)[1].split('Events:',1)[0].strip() if 'Allocated resources:' in description else None + if allocation is None:raise RuntimeError('node-headroom-unavailable') + receipt=dict(read_only=True,deployment_uid=EXPECTED_UID,pod=POD,pod_uid=POD_UID, + deployment_name=NAME,container=container,node_uid=nodes[0]['metadata']['uid'],node_name=nodes[0]['metadata']['name'], + guard_index=index,guard_command=guard.get('command'),guard_args=guard.get('args'),volume_index=vindex, + volume=volume,strategy=d['spec'].get('strategy'),resources=[dict(name=c['name'],resources=c.get('resources')) for c in spec['containers']], + old_configmap=cmname,old_hook_sha256=hashlib.sha256(hook).hexdigest(),old_adapter_sha256=ADAPTER,scanner_sha256=SCANNER, + allocated_resources=allocation) + pathlib.Path('/tmp/forge-scanner-preflight-receipt.json').write_text(json.dumps(receipt,indent=2)+'\n') + # Keep long public shell commands in the local receipt; return concise checks. + print(json.dumps({k:receipt[k] for k in ['read_only','deployment_name','deployment_uid','pod_uid','node_uid','old_configmap','old_adapter_sha256','strategy','allocated_resources']},indent=2)) + print('receipt: /tmp/forge-scanner-preflight-receipt.json') +try:main() +except Exception as exc: + print('preflight refused:',str(exc) if isinstance(exc,RuntimeError) else type(exc).__name__) + sys.exit(1) diff --git a/docs/changes/2026-11-01-scanner-json-digest/proposal.json b/docs/changes/2026-11-01-scanner-json-digest/proposal.json new file mode 100644 index 00000000..ef6b13f3 --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/proposal.json @@ -0,0 +1,24 @@ +{ + "proposal_id": "SYNC-SCANNER-JSON-DIGEST-20261101", + "revision": 1, + "scope": "equivalent JSON serialization of the already-accepted filename-to-exact-lowercase-SHA256 shape; local and receiver profiles identical", + "candidate_binary_sha256": "d7dbd0ef57312ab9507874bb5fd67c49bef637b6d7dee121e526227307af4bf0", + "source_change_manifest_sha256": "20e7ded830d575006969db85bda144b179bb886e44ba92947d4790d110131cf0", + "tests": { + "local": "12 passed, 37 deselected; pinned real Gitleaks", + "receiver": "go test -count=1 ./... with pinned real Gitleaks; passed in 150.087s" + }, + "expected_result": "RApp source-pin and JSON SHA256 manifests pass; actual keys and bare digest secret assignments remain blocked", + "verification": "same pinned scanner, full receiver suite, negative secret tests, actual blocked blob classified by candidate, native dry-run and receiver rejection/clean probes before any activation", + "rollback": "restore exact original source revision and prior approved receiver artifact/config; retain failed receipts", + "cost_estimate_eur": { + "additional_service_commitment": 0, + "execution": "existing local compute; native preflight pending" + }, + "risk_estimate_eur": { + "status": "requires supervisor valuation before native rollout", + "scope": "security-profile exception; preserve original narrow filename-extension/lowercase-64-hex constraint, all history traversal and all other detection rules" + }, + "authority": "not approved; source candidate only, live inventory refused by current ops-mason-builder Kubernetes identity", + "native_preflight": "required; no privileged changes executed" +} \ No newline at end of file diff --git a/docs/changes/2026-11-01-scanner-json-digest/rapp-blocked-object-candidate-check.json b/docs/changes/2026-11-01-scanner-json-digest/rapp-blocked-object-candidate-check.json new file mode 100644 index 00000000..4edfa4a2 --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/rapp-blocked-object-candidate-check.json @@ -0,0 +1,7 @@ +{ + "object_id": "e844bada043f4169c49f3e9dbe7218cf2cf486d3", + "path": "source-pin.json", + "candidate_exit_code": 0, + "candidate_config_sha256": "e8ededac85afff19ff3d20dd1e9049d206eb131772ec9aec4ac08b8b81f520e2", + "raw_content_or_findings_emitted": false +} diff --git a/docs/changes/2026-11-01-scanner-json-digest/remaining-findings.json b/docs/changes/2026-11-01-scanner-json-digest/remaining-findings.json new file mode 100644 index 00000000..b57585bb --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/remaining-findings.json @@ -0,0 +1,5340 @@ +[ + { + "path": "docs/assessments/netkingdom-2026-10-14/attended-private-registration-before-oci-membership/test_attended_private_registration.py", + "blob_id": "c3afddeddf012b1c9e24c1a1d2de42281f8a982c", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 18, + "shape": "line-contains-sentinel-text" + } + ] + }, + { + "path": "docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/review/preparation-manifest-r1.json", + "blob_id": "7a3d3bd9387e21358ccab206223dbec1b8eda2bb", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r2/artifacts.json", + "blob_id": "f65ad72630b051430358e8e9916b137059ae762e", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-0a05383/local-provenance.json", + "blob_id": "80adf19bb99082b54c943015c8caf3cfa414af57", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 28, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 29, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-admission/image-84c78e0/source-facts.json", + "blob_id": "d282b290e856b12a17352682654fac3af7add793", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 15, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-preparation/manifest.json", + "blob_id": "551b06489c2b231aaa2e6fc0deb66aa1e76fb03f", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 8, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 18, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b1/manifest-r2.json", + "blob_id": "3ffb9702b619c68088281ba96d1c695d9f33c4e8", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 8, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 15, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 26, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b1/manifest.json", + "blob_id": "ad65729668a03c857d7b3355f3932411d32af168", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 8, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 15, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 26, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b1/owner-source-review-r1.json", + "blob_id": "2c1325cb94b7470c555c827ed71f7d37a8fc2e59", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 49, + "shape": "line-contains-lowercase-hex-40" + }, + { + "rule": "generic-api-key", + "line": 75, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 82, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b2-b3/actual-python-source/source-dependencies.json", + "blob_id": "11189e55605ff756bd89c48d2a9c9a92a92a54ea", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 2, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 7, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 9, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 19, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b2-b3/manifest.json", + "blob_id": "cd3817d3598aa5a9c9a81760f558e86b09f97812", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 36, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 43, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b2-b3/r2/manifest.json", + "blob_id": "81922ea62199e73add1e34d444cf952dd39db9f7", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 45, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 52, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b2-b3/r3/manifest.json", + "blob_id": "8a4d222496a4f6b1a8138571f037d97f96d84003", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 43, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 51, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/b2-preparation/trusted-positive-path-r1.json", + "blob_id": "61a8d2d6ff1713402f2f314f0e4afacaef4cdd3e", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 36, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/manifest-r2.json", + "blob_id": "47de5d9448e0492acf673ae0f537df6c7aa977c8", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 7, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 14, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/manifest.json", + "blob_id": "99301ccbbe9df00eacab9f1d73d15b15233fe332", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 7, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 14, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/owner-source-review-r1.json", + "blob_id": "0691b3db0b5ba4c13ef244347d2bb83ffb851aaa", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 54, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 61, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-native-source/owner-source-review-r2.json", + "blob_id": "ea9511464d95069116a206786264fcc45feb0dcc", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 13, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 20, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-package-identity/extraction/r2/manifest.json", + "blob_id": "5ead58c5f5dbccf263476093695101061e07f7de", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 6, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-package-identity/extraction/r3/manifest.json", + "blob_id": "c606122c611a67547d4ddd0403d3c070f8617015", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 6, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-package-identity/source-evidence.json", + "blob_id": "eac649d9c2ba60b6f0aff449efe71b9c126947c8", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 22, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-verifier-review/manifest-r2.json", + "blob_id": "e80a95dfdb15be2283eab7d50167fc474e826489", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-verifier-review/manifest.json", + "blob_id": "2653d7ca4ab690eb26f68149dc0d50661c9bf535", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/access-verifier-review/owner-source-review.json", + "blob_id": "a0a8e7a96154a15d733392995c64fa19085d53b4", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 14, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/manifest.json", + "blob_id": "393a5066876e39b99fff1d45fe255aa356783cd7", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 11, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/approval-go-fact/manifest.json", + "blob_id": "25d6bb8ae4c3f6a55d0ce3bd3ba9155fc30dbf84", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 23, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/approval-reference/manifest.json", + "blob_id": "abe8898721b352dacae4dce6c5d1e3f620c2e49d", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 9, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/approval-timestamp-precision/formatting-r1/review-sha256-prefix.patch", + "blob_id": "d8c59510d41040239a619ab8a460a71dea5b838c", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 9, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 10, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/approval-timestamp-precision/owner-review-record.patch", + "blob_id": "d54dae509e780b79c6136fff1276891aed35b663", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 34, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 35, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/approval-timestamp-precision/owner-review.json", + "blob_id": "deefaac30c988de61ee26a08f29482ae76b39a0b", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 6, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 7, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/approval-trusted-source-review/actual-proof/source-dependencies.json", + "blob_id": "a1c1eae9cf236124aa33eb71a74374a4ab2b4785", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 6, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 9, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/approval-trusted-source-review/manifest.json", + "blob_id": "4d745ffebcfc87fe9392ac8ef52f6a195c555f1c", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/audit-native-admission/manifest-r1.json", + "blob_id": "ca5bdf89ff68775b6d50252b7b88b1cfe36a2759", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-40" + }, + { + "rule": "generic-api-key", + "line": 10, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/audit-native-admission/manifest-r2.json", + "blob_id": "2bea322c7749fcf0a9db245e1d90ea407dd1a72a", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-40" + }, + { + "rule": "generic-api-key", + "line": 10, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/audit-native-admission/owner-review-r1.json", + "blob_id": "49a0d0174eecb48a431d4a6c7639ec33c4802435", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/audit-native-admission/owner-review-r2.json", + "blob_id": "fd531e0107f78865ac08f67c67295f6a9ff35ce3", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/build-receipt.json", + "blob_id": "602df96c91e67fbbc9db625f7f388937c54014f7", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-40" + }, + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/closure-collection-r1/build-receipt.json", + "blob_id": "a8bcacc787dca41168f788b8209a2e906b8c7519", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-40" + }, + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/browser-checker-artifact-next/closure-collection-r2/build-receipt.json", + "blob_id": "43bdfc3bc30d06c3e08f549a9579620e8fb05665", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-40" + }, + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/browser-checker-environment-r2/build-receipt.json", + "blob_id": "15b1a9c92af189ce8f055ee4748bcab35ec0cb4b", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-40" + }, + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/owner-followthrough-r5/local-integration-result.json", + "blob_id": "fa6b647e4a550d4f626fc09605dcc6fecc4f1f0b", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 10, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 75, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 84, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 118, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 155, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 167, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 237, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 304, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 337, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 340, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 474, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 489, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 545, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 560, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 567, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 587, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 616, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 626, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 644, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 645, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 721, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 741, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 742, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 743, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 751, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 865, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 930, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 939, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 973, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1010, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1022, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1092, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1159, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1192, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1195, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1329, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1344, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1400, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1415, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1422, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1442, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1471, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1481, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1499, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1500, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1576, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1596, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1597, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1598, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1606, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/owner-followthrough-r5/source-commit-result.json", + "blob_id": "cca84d470ed2de1a1a24142321d81c4ef042bba1", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 22, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 87, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 96, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 130, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 167, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 179, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 249, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 316, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 349, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 352, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 486, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 501, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 557, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 572, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 579, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 599, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 628, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 638, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 656, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 657, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 733, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 753, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 754, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 755, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 763, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 853, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 918, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 927, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 961, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 998, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1010, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1080, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1147, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1180, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1183, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1317, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1332, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1388, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1403, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1410, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1430, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1459, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1469, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1487, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1488, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1564, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1584, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1585, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1586, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1594, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/owner-followthrough-r6/local-integration-result.json", + "blob_id": "3e5339e79feb064f9cd1fb289970cf115eb53eee", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 7, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 73, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 82, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 116, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 154, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 166, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 237, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 304, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 340, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 343, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 478, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 493, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 549, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 564, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 571, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 591, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 620, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 630, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 648, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 649, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 726, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 746, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 747, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 748, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 756, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 843, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 909, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 918, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 952, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 990, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1002, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1073, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1140, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1176, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1179, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1314, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1329, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1385, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1400, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1407, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1427, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1456, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1466, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1484, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1485, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1562, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1582, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1583, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1584, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1592, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/owner-followthrough-r6/source-commit-result.json", + "blob_id": "14ac31e924f280aa71dc14561d2b9014b743e6d6", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 15, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 81, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 90, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 124, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 162, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 174, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 245, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 312, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 348, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 351, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 486, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 501, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 557, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 572, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 579, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 599, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 628, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 638, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 656, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 657, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 734, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 754, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 755, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 756, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 764, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 854, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 920, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 929, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 963, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1001, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1013, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1084, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1151, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1187, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1190, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1325, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1340, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1396, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1411, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1418, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1438, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1467, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1477, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1495, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1496, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1573, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1593, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1594, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1595, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1603, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/owner-followthrough-r7/source-commit-result.json", + "blob_id": "e14b161ed327caa2f87f0d4034cedb32eb5cf607", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 13, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 79, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 88, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 122, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 160, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 172, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 243, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 310, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 346, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 349, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 484, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 499, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 555, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 570, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 577, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 597, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 627, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 637, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 655, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 656, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 733, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 753, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 754, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 755, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 763, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 854, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 920, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 929, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 963, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1001, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1013, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1084, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1151, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1187, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1190, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1325, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1340, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1396, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1411, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1418, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1438, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1468, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1478, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1496, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1497, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1574, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1594, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1595, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1596, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1604, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/owner-followthrough-r8/source-commit-result.json", + "blob_id": "bb3c0badca42c206b56531a5ac0cf8cee1282137", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 13, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 79, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 88, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 122, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 160, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 172, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 243, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 310, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 346, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 349, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 484, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 499, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 555, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 570, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 577, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 597, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 627, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 637, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 655, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 656, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 733, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 753, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 754, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 755, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 763, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 854, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 920, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 929, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 963, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1001, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1013, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1084, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1151, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1187, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1190, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1325, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1340, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1396, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1411, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1418, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1438, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1468, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1478, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1496, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1497, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1574, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1594, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1595, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1596, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1604, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/owner-followthrough-r9/stage1/source-commit-result.json", + "blob_id": "362087e1d7292bf09fee0899ae7a4b67c06210aa", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 16, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 81, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 90, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 124, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 162, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 174, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 245, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 312, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 346, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 349, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 484, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 499, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 555, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 570, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 577, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 597, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 627, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 637, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 655, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 656, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 733, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 753, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 754, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 755, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 763, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 854, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 919, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 928, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 962, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1000, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1012, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1083, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1150, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1184, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1187, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1322, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1337, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1393, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1408, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1415, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1435, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1465, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1475, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1493, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1494, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1571, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1591, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1592, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1593, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1601, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/owner-followthrough-r9/stage2/source-commit-result.json", + "blob_id": "a924584dae8f83138452ae90a1f642bcea0ea557", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 13, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 79, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 88, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 122, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 160, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 172, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 243, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 310, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 346, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 349, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 484, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 499, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 555, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 570, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 577, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 597, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 627, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 637, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 655, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 656, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 733, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 753, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 754, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 755, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 763, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 854, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 920, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 929, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 963, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1001, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1013, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1084, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1151, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1187, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1190, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1325, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1340, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1396, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1411, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1418, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1438, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1468, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1478, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1496, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1497, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1574, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1594, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1595, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1596, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1604, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/repo-manager/src/repo_manager/commands/registrar_reconcile.py", + "blob_id": "d02cf910e600da16e7730e5e7fffc9e6cc6af61b", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 701, + "shape": "other-context" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-auth/implementation-r2.patch", + "blob_id": "e56d225aba915185eac39f9e35db0119ef6e7d38", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 619, + "shape": "line-contains-UUID" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-auth/implementation-r3-delta.patch", + "blob_id": "fe21d674caac0220e471fdf1f9dc2e19c9ef88ce", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 18, + "shape": "line-contains-UUID" + }, + { + "rule": "generic-api-key", + "line": 29, + "shape": "line-contains-UUID" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-auth/implementation.patch", + "blob_id": "0493d12d187d94f16d718b8bbc0e04e343ca27cd", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 611, + "shape": "line-contains-UUID" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-auth/reviewed-r2-file-hashes.json", + "blob_id": "617928517a6a36d2d2dc9c119c52aa9abddb6290", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 12, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 20, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 31, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/canonical-bundle-manifest-r1.json", + "blob_id": "81bc0fbd041c93678a261d5df02c68c2346233c4", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 44, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 55, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 75, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 76, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/integration-manifest-r1.json", + "blob_id": "04c5d13d9786dd018dab2492c0b18a4c12bef336", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 11, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 16, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-install-receipt.json", + "blob_id": "16f56d731574d73dec3f9dcb194397118cbd799f", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-40" + }, + { + "rule": "generic-api-key", + "line": 14, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 15, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-bundle-manifest.json", + "blob_id": "48a16ffb32697e7b62e4b1f5449a3f05b42179b7", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 50, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 61, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 81, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 82, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-producer-api-sourcecheck.json", + "blob_id": "a45d6bea046ad45ecd29247215aa49ce16b56bd5", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 2, + "shape": "line-contains-lowercase-hex-40" + }, + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/integration-manifest.json", + "blob_id": "ee199b8cefc3811b21432c19670f639840584dc1", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 7, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 32, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 47, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/manifest.json", + "blob_id": "95f29297a15c7b7c29cbcc4cf8a61648c0ac0aa6", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 9, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/native-cli-admission-r3-full.patch", + "blob_id": "4b294162506f2690951e34cf6981403ef7fbb5a6", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 145, + "shape": "line-contains-lowercase-hex-40" + }, + { + "rule": "generic-api-key", + "line": 146, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/native-cli-admission-r3-over-r2.patch", + "blob_id": "b4397af47f402ae0d2e236ddb410db8a7cd5c4f5", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 40, + "shape": "line-contains-lowercase-hex-40" + }, + { + "rule": "generic-api-key", + "line": 41, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/native-cli-admission-r4-over-r3.patch", + "blob_id": "f511fbd46a8a9e516ce8e24b85f857f7bf2714fa", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 9, + "shape": "line-contains-lowercase-hex-40" + }, + { + "rule": "generic-api-key", + "line": 10, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/r3-preimages/docs/proposals/native-cli-admission/proposal.json", + "blob_id": "8fbf62ad8693a70f1e814b453c1a7a8efbb77224", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 116, + "shape": "line-contains-lowercase-hex-40" + }, + { + "rule": "generic-api-key", + "line": 117, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-package/bundle-manifest-r1.json", + "blob_id": "6820db0f34a37eb6e5331a1b2b92dfb9afb3e11e", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 44, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 55, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 75, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 76, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-package/coordinator-file-hashes.json", + "blob_id": "04abc7933941bb01ad2a6d1f561ab043a6d2fafb", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 10, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/bundle-artifact-receipt-r4.json", + "blob_id": "6421034ee2954a05415cd76176ec6b69e6c82299", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 7, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 8, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/bundle-manifest-r4.json", + "blob_id": "da9e3f585b9517c068c9103936006aa45de17582", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 50, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 61, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 81, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 82, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/manifest-r1.json", + "blob_id": "9ca82fc6bcc98cdaab65a405ca49e290b6db257e", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 16, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/manifest-r2.json", + "blob_id": "d1f5d09ca259f351f5d6e38a7fc9497caaa8668b", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 20, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 25, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/manifest-r3.json", + "blob_id": "8181a832d370a94190a0373ef19176ee03d6bb90", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 10, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/manifest-r4.json", + "blob_id": "85a596d2076bd7321fa6d69bb8474b3916fa754d", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 12, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 32, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/producer-manifest-r3.json", + "blob_id": "81922ea62199e73add1e34d444cf952dd39db9f7", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 45, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 52, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/producer-manifest-r4.json", + "blob_id": "8a4d222496a4f6b1a8138571f037d97f96d84003", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 43, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 51, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/producer-manifest.json", + "blob_id": "cd3817d3598aa5a9c9a81760f558e86b09f97812", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 36, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 43, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/verification-final-r4.json", + "blob_id": "3b3d456cc8a6051e458936651adcf8f2892ec535", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/actual-fixture-r5-failure.json", + "blob_id": "0826ed9dabd9a902c47fcf1dd23634b87629ff92", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 29, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 30, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 31, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/actual-fixture-r6-all.json", + "blob_id": "0bfe062d272dbbe9649cc8a8e490e56de7560d5d", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 34, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 35, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 36, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 152, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 153, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 154, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 227, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 228, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 229, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 302, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 303, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 304, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/actual-fixture-r6-positive.json", + "blob_id": "0acac9a3a2a462ce6a582602452954867324532c", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 31, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 32, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 33, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/candidate.patch", + "blob_id": "b533980bb63bed7fadb4ce5e20d168d29cfa37b3", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 1713, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1716, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1717, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1718, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1724, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1734, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1735, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1742, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/preparation.json", + "blob_id": "93af4627bdaf2470da9943951ae4f022ab895a85", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 16, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 18, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 19, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 20, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 23, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 27, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/publication-r7/preparation.json", + "blob_id": "c77b599b5220acfc4484ea6b7d47ffbc20e1e062", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 11, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 12, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 13, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 14, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 15, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 18, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/publication-r7/r6-to-r7.patch", + "blob_id": "974539c96d95249699ea44c2068d347767eb0cb2", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 58, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 61, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 62, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 63, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 69, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 79, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 80, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 87, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r1/preparation.json", + "blob_id": "74817e7da9d2c020da9e8d9aeaefd8b84f31ed57", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 15, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 16, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 20, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r2/preparation.json", + "blob_id": "58b48d3a74f17e01253616148f011094e2271279", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 15, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 16, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 18, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 19, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 23, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r3/dependency-closure-sha256.json", + "blob_id": "769eb47d6ce530286ccfd74552777a86f42ecde0", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 9, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 10, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 14, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r3/preparation.json", + "blob_id": "ba24860e8feaf96f5369dc613f988cdb49897d39", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 15, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 16, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 18, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 19, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 23, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r4/dependency-closure-sha256.json", + "blob_id": "50442e84d2b565462b221c6adc374f6f835a417b", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 9, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 10, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 14, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r4/preparation.json", + "blob_id": "42c1b5b1c6c70a46d96b943f494f79379258c581", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 16, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 18, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 19, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 20, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 24, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/candidate.patch", + "blob_id": "b533980bb63bed7fadb4ce5e20d168d29cfa37b3", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 1713, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1716, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1717, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1718, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1724, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1734, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1735, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1742, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/dependency-closure-sha256.json", + "blob_id": "e1d467e39499d00e78f0290b036b0595fb4ca2a2", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 7, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 8, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 9, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 15, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 25, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 26, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 33, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/preparation.json", + "blob_id": "93af4627bdaf2470da9943951ae4f022ab895a85", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 16, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 18, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 19, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 20, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 23, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 27, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r5/test-root/tests/isolated-keycape-native-fixture-manifest.json", + "blob_id": "2fd3a7db423d5283347434df3843fd071022170d", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 6, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 9, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 10, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 11, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 27, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 28, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 35, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r6/candidate.patch", + "blob_id": "d27e0c3557a114f5f647fa1edc6232c4129a7319", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 1773, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1776, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1777, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1778, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1784, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1794, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1795, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1802, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r6/dependency-closure-sha256.json", + "blob_id": "30f49ffb3dccdc27ebcdcb921a1d671264f7338b", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 6, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 7, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 8, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 14, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 24, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 25, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 32, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r6/preparation.json", + "blob_id": "07103a7f815201b9e8c65261a974a49a5bc83ba5", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 11, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 12, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 13, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 14, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 15, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 18, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/revisions/r6/test-root/tests/isolated-keycape-native-fixture-manifest.json", + "blob_id": "feb4df39d0e3e0c3bffd976c31c3b30196651863", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 6, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 9, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 10, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 11, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 27, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 28, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 35, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/identity-restore-adapter-next/tests/isolated-keycape-native-fixture-manifest.json", + "blob_id": "2fd3a7db423d5283347434df3843fd071022170d", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 6, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 9, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 10, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 11, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 27, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 28, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 35, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-owner-boundary-r4/implementation-r4-full.patch", + "blob_id": "e83a9857393d29f2a122d4b710a79a39838fe367", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 45, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 64, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-owner-boundary-r4/r3-to-r4.patch", + "blob_id": "727e78749a6e811a8f2a85e23c9b49f32a3c5bed", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 25, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 44, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-owner-boundary-r5/r4-to-r5.patch", + "blob_id": "ebe470035d136d9223c0deb53c95b4211e647225", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 8, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 20, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/protected-execution-trusted-successor/budget-source-manifest-r1.json", + "blob_id": "f1c01ce4d122f0cb80108657dfb3f45beee3aa3c", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 48, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 49, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 50, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 51, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 52, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/protected-execution-trusted-successor/fullchain-r1/manifest.json", + "blob_id": "11578c5338500de884834fb3ee5a089c3b30ca72", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 50, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 52, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 59, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/protected-execution-trusted-successor/retained-registry-failure-r1.json", + "blob_id": "48207653266002cab168871679bff9a54828fe85", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 6, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/protected-execution-wave2/manifest.json", + "blob_id": "07c555fe7a911cf84a92d9a01087a28fba4aca29", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 74, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/protected-execution-wave3/manifest.json", + "blob_id": "e1ff989d917753ff90dba4799f7669ac20bd06ff", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 89, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/protected-execution-wave5/manifest.json", + "blob_id": "12b069a3a7b1306a172405c820e241b31d7340ca", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 70, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/recovery-attempt-r1/test-root/sso-mfa/k8s/keycape/test_keycape_client.py", + "blob_id": "b57eb23a9b5fd991e443a62af818402cc0245d29", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 43, + "shape": "other-context" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-16/recovery-attempt-r1/test-root/sso-mfa/k8s/keycape/test_secrets_engine_openbao_client_rollout.py", + "blob_id": "73ef3bf025b13daa9dbf3134a535df2d2948057d", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 38, + "shape": "other-context" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-attempt1-source-pins.json", + "blob_id": "c9cd61864b3fd5b2cdd7e3ac238ceef81a0d9661", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 2, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 16, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 18, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 20, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 26, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-build-attempt1.json", + "blob_id": "24f963dbe4923f4274a4478f3ff4e5f4c3871e01", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 102, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 103, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 104, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 105, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 116, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 117, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 118, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 119, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 121, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 127, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-build-attempt2.json", + "blob_id": "a52b7051ec1726446fe7c6e1d4374a5f80b09b9a", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 102, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 103, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 104, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 105, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 117, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 118, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 119, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 120, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 122, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 128, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt4.json", + "blob_id": "3edcbd72f64a232de6120584c6e07510f582f7bf", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 115, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 116, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 117, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 118, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 129, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 130, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 131, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 132, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 134, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 140, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/consumer-test-attempt5.json", + "blob_id": "cb5b10ffbffa8e13b318858e3516873abe7e98b9", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 115, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 116, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 117, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 118, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 130, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 131, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 132, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 133, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 135, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 141, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-access-engine-integration-r2/producer-all-result-attempt2.json", + "blob_id": "d9efeb4c71b3b0796b8d4857088456cf9ad25833", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 126, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 131, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 142, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 162, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 163, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 168, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-execution-backend-r1/apps-source.patch", + "blob_id": "77c97d630bd47deb3f52e75f99bbd371d92e9a34", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 23, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-execution-backend-r1/tools/forgejo_configuration_prepare.py", + "blob_id": "f2d8434ab71b8c7791793c2149d812f992669fe1", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 20, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/SHA256SUMS.json", + "blob_id": "efe8952062922345494b12af614724a729521071", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/evidence/embedded-files.json", + "blob_id": "6997c0c2bff0636d1c8cf6f25acedceef000c876", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 217, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 861, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 956, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1121, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "discord-api-token", + "line": 1126, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "bitbucket-client-secret", + "line": 1159, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1388, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1389, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "discord-api-token", + "line": 1168, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1428, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1706, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1711, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1787, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1790, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1791, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 1812, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2066, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2081, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2149, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2150, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2152, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2156, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2159, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2170, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2171, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2192, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2193, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2194, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2195, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2197, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2200, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2201, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2202, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2203, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 2219, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "discord-api-token", + "line": 2223, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/apps-forgejo-release-build-r1/evidence/frontend-assets.json", + "blob_id": "8684cb3da75562fd9083f7e3cb8c49cae56a5bdd", + "scanner_exit": 1, + "findings": [ + { + "rule": "bitbucket-client-secret", + "line": 85, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "discord-api-token", + "line": 52, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "discord-api-token", + "line": 94, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 47, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 314, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 315, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 354, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/custodian-publication-backup/other-dirty-hashes.json", + "blob_id": "b2220824921f590ee1d1431b53b84d4acb6266a3", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 7, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/forgejo-private-input-r1/evidence/chart-source-inventory-original.json", + "blob_id": "979618bf97d533c02e25f6e985406f84131afc23", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/forgejo-private-input-r1/source-inventory.json", + "blob_id": "c0e19e357a20b17e6c644f39c972ff25ebdf3384", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 64, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 69, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 70, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 96, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/forgejo-required-claim-values-r1/SHA256SUMS.json", + "blob_id": "e5eadee3a3545dde19dba41b511a8689d9e41334", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 6, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 8, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 13, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 15, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 16, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 21, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 22, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 24, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 25, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 28, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/forgejo-required-claim-values-r1/source-inventory.json", + "blob_id": "0a897eb9cce972faa79f7bd6b14deeac5802486f", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 8, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r1/native_binding_probes.py", + "blob_id": "465af4282960c0dfd2ce36fce5d7cb27d26f486a", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-key-cape.json", + "blob_id": "6484460f67194b875d2b5f3c4c530227d026b34b", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 9, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/nk48-t15-source-publication-r2/backup/workplans/NK-WP-0021-activity-core-ops-sso-operators.md", + "blob_id": "31de057e004086584e85d14595269460896cd5ea", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 44, + "shape": "other-context" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/public-digest-originals/apps-chart-SHA256SUMS.original.json", + "blob_id": "8bde861b20c82729cb6dc18785878726ecc5a437", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 17, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 29, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 31, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/public-digest-originals/apps-chart-source-inventory.original.json", + "blob_id": "979618bf97d533c02e25f6e985406f84131afc23", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 4, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/public-digest-originals/key39-current-verification.original.json", + "blob_id": "12c9cad71d6ed6d5f85fb58b069bd6f6733d56e4", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 3, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/owner-followthrough-publication-r1/public-digest-originals/platform-delivery-review-source-pins.original.json", + "blob_id": "488fc07767ba47aad0bf347d1ff5901f75c32505", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 6, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 8, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 12, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 13, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 19, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-17/platform-delivery-backend-r2/source-pins.json", + "blob_id": "1655e2cc387c4f63f4dbc80387931a7ddf3e9118", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 30, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 41, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 42, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 43, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 44, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/original-metadata/consumer-test-attempt3.json", + "blob_id": "cd8906e2f8655d3d840136108e5c0e8d9342baa4", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 115, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 116, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 117, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 118, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 129, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 130, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 131, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 132, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 134, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 140, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/original-metadata/consumer-test-attempt6.json", + "blob_id": "ca6b81ce6d8a0a4aee73ebb44017d43eec0db388", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 115, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 116, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 117, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 118, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 130, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 131, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 132, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 133, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 135, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 141, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/original-metadata/issuer-fixture-result.json", + "blob_id": "6d7bc9cb1ad8321b4133d42538e2690a9cd9715c", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 5, + "shape": "line-contains-lowercase-hex-64" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/original-metadata/producer-race-result.json", + "blob_id": "7bb6c37b3765646b5f61a90c2e08e0c57145725d", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 132, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 137, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 148, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 168, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 169, + "shape": "line-contains-lowercase-hex-64" + }, + { + "rule": "generic-api-key", + "line": 174, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/cust80-source-evidence-publication-r1/original-metadata/public-metadata-derivation.v1.json", + "blob_id": "d29533ee292929c085387963323367f26a6ac15d", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 200, + "shape": "line-contains-lowercase-hex-40" + } + ] + }, + { + "path": "docs/changes/netkingdom-target-2026-10-18/forgejo-ongoing-identity-r1/baseline.json", + "blob_id": "cf4d588cfec7c249793ff841e106bbeb8efa3aeb", + "scanner_exit": 1, + "findings": [ + { + "rule": "generic-api-key", + "line": 2, + "shape": "line-contains-lowercase-hex-40" + } + ] + } +] diff --git a/docs/changes/2026-11-01-scanner-json-digest/scanner-json-digest.patch b/docs/changes/2026-11-01-scanner-json-digest/scanner-json-digest.patch new file mode 100644 index 00000000..9a778528 --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/scanner-json-digest.patch @@ -0,0 +1,60 @@ +--- /home/worsch/repo-manager/src/repo_manager/secret_scan.py ++++ /home/worsch/repo-manager/src/repo_manager/secret_scan.py +@@ -55,7 +55,7 @@ + description = "Filename key whose value is a lowercase 64-hex content digest" + targetRules = ["generic-api-key"] + regexTarget = "match" +-regexes = ['^[\w.-]+\.(?:md|markdown|txt|yaml|yml|json|py|toml):[ \t]+[a-f0-9]{64}$'] ++regexes = ['^[\w.-]+\.(?:md|markdown|txt|yaml|yml|json|py|toml)(?::[ \t]+[a-f0-9]{64}|":[ \t]+"[a-f0-9]{64}")$'] + """ + + +--- /home/worsch/repo-manager/tests/test_secret_scan.py ++++ /home/worsch/repo-manager/tests/test_secret_scan.py +@@ -479,3 +479,21 @@ + if process.poll() is None: + process.kill(); process.wait(timeout=5) + process.stdout.close() ++ ++ ++@pytest.mark.parametrize("key", ["values/secrets-engine.yaml", "docs/runtime-externalsecret.r1.yaml"]) ++def test_json_filename_digest_is_allowed(binary, repo, key): ++ digest = os.urandom(32).hex() ++ stage(repo, json.dumps({key: digest}).encode(), "source-pin.json") ++ assert secret_scan.scan_staged(repo, binary)["status"] == "clean" ++ ++ ++@pytest.mark.parametrize("content", [ ++ lambda digest: json.dumps({"secret": digest}), ++ lambda digest: json.dumps({"values/secrets-engine.yaml": "glpat-" + digest}), ++ lambda digest: json.dumps({"values/secrets-engine.yaml": digest + "a"}), ++ lambda digest: json.dumps({"values/secrets-engine.yaml": digest.upper()}), ++]) ++def test_json_digest_exception_does_not_allow_secret_shapes(binary, repo, content): ++ stage(repo, content(os.urandom(32).hex()).encode(), "manifest.json") ++ assert secret_scan.scan_staged(repo, binary)["status"] == "blocked" +--- /home/worsch/railiance-forge/tools/receive-secret-scan/main.go ++++ /home/worsch/railiance-forge/tools/receive-secret-scan/main.go +@@ -36,7 +36,7 @@ + description = "Filename key whose value is a lowercase 64-hex content digest" + targetRules = ["generic-api-key"] + regexTarget = "match" +-regexes = ['^[\w.-]+\.(?:md|markdown|txt|yaml|yml|json|py|toml):[ \t]+[a-f0-9]{64}$'] ++regexes = ['^[\w.-]+\.(?:md|markdown|txt|yaml|yml|json|py|toml)(?::[ \t]+[a-f0-9]{64}|":[ \t]+"[a-f0-9]{64}")$'] + ` + const maxInput = 512 * 1024 + const maxObject = 8 * 1024 * 1024 +--- /home/worsch/railiance-forge/tools/receive-secret-scan/batch_test.go ++++ /home/worsch/railiance-forge/tools/receive-secret-scan/batch_test.go +@@ -188,6 +188,11 @@ + {"inline-suppression", append([]byte("# gitleaks:allow\n"), privateKey...), true}, + {"filename-digest", []byte(" cards/access.md: " + digest + "\n"), false}, + {"bare-keyword-digest", []byte("access: " + digest + "\n"), true}, ++ {"json-filename-digest", []byte("{\"values/secrets-engine.yaml\": \"" + digest + "\"}\n"), false}, ++ {"json-bare-secret-digest", []byte("{\"secret\": \"" + digest + "\"}\n"), true}, ++ {"json-filename-token", []byte("{\"values/secrets-engine.yaml\": \"" + string(canary) + "\"}\n"), true}, ++ {"json-filename-long-digest", []byte("{\"values/secrets-engine.yaml\": \"" + digest + "a\"}\n"), true}, ++ {"json-filename-uppercase-digest", []byte("{\"values/secrets-engine.yaml\": \"" + strings.ToUpper(digest) + "\"}\n"), true}, + } { + t.Run(tc.name, func(t *testing.T) { + stdin, e := scan(context.Background(), f, config, tc.input) diff --git a/docs/changes/2026-11-01-scanner-json-digest/source-changes.json b/docs/changes/2026-11-01-scanner-json-digest/source-changes.json new file mode 100644 index 00000000..6b0b2fb5 --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/source-changes.json @@ -0,0 +1,26 @@ +[ + { + "target": "/home/worsch/repo-manager/src/repo_manager/secret_scan.py", + "original_sha256": "12d0e1b10c4d613401e33bfdb4012c6cb3e3719b6b1480f8d3ae2f7a27aeb73f", + "candidate_sha256": "740f64dc1e8421669e6f84fccadef50fcd3d9a802df07f62c6718f917ba55fa9", + "patch": "--- /home/worsch/repo-manager/src/repo_manager/secret_scan.py\n+++ /home/worsch/repo-manager/src/repo_manager/secret_scan.py\n@@ -55,7 +55,7 @@\n description = \"Filename key whose value is a lowercase 64-hex content digest\"\n targetRules = [\"generic-api-key\"]\n regexTarget = \"match\"\n-regexes = ['^[\\w.-]+\\.(?:md|markdown|txt|yaml|yml|json|py|toml):[ \\t]+[a-f0-9]{64}$']\n+regexes = ['^[\\w.-]+\\.(?:md|markdown|txt|yaml|yml|json|py|toml)(?::[ \\t]+[a-f0-9]{64}|\":[ \\t]+\"[a-f0-9]{64}\")$']\n \"\"\"\n \n \n" + }, + { + "target": "/home/worsch/repo-manager/tests/test_secret_scan.py", + "original_sha256": "5560f57163dc2189d189cce1c7b772ebf1adc8f8a84d388b2b42b546c10cc1c8", + "candidate_sha256": "2e6d53651ca18e787487cd961efcddc7f483637c63e6e10df399a6d4fcdae962", + "patch": "--- /home/worsch/repo-manager/tests/test_secret_scan.py\n+++ /home/worsch/repo-manager/tests/test_secret_scan.py\n@@ -479,3 +479,21 @@\n if process.poll() is None:\n process.kill(); process.wait(timeout=5)\n process.stdout.close()\n+\n+\n+@pytest.mark.parametrize(\"key\", [\"values/secrets-engine.yaml\", \"docs/runtime-externalsecret.r1.yaml\"])\n+def test_json_filename_digest_is_allowed(binary, repo, key):\n+ digest = os.urandom(32).hex()\n+ stage(repo, json.dumps({key: digest}).encode(), \"source-pin.json\")\n+ assert secret_scan.scan_staged(repo, binary)[\"status\"] == \"clean\"\n+\n+\n+@pytest.mark.parametrize(\"content\", [\n+ lambda digest: json.dumps({\"secret\": digest}),\n+ lambda digest: json.dumps({\"values/secrets-engine.yaml\": \"glpat-\" + digest}),\n+ lambda digest: json.dumps({\"values/secrets-engine.yaml\": digest + \"a\"}),\n+ lambda digest: json.dumps({\"values/secrets-engine.yaml\": digest.upper()}),\n+])\n+def test_json_digest_exception_does_not_allow_secret_shapes(binary, repo, content):\n+ stage(repo, content(os.urandom(32).hex()).encode(), \"manifest.json\")\n+ assert secret_scan.scan_staged(repo, binary)[\"status\"] == \"blocked\"\n" + }, + { + "target": "/home/worsch/railiance-forge/tools/receive-secret-scan/main.go", + "original_sha256": "a9835dfc830bde5091354debf26ae40c37fab5fdc2c1b0e483774dda0b93521a", + "candidate_sha256": "4eb494b30b845e090332d3c20070ff417c2114a479823a6097cfe0292ee18aac", + "patch": "--- /home/worsch/railiance-forge/tools/receive-secret-scan/main.go\n+++ /home/worsch/railiance-forge/tools/receive-secret-scan/main.go\n@@ -36,7 +36,7 @@\n description = \"Filename key whose value is a lowercase 64-hex content digest\"\n targetRules = [\"generic-api-key\"]\n regexTarget = \"match\"\n-regexes = ['^[\\w.-]+\\.(?:md|markdown|txt|yaml|yml|json|py|toml):[ \\t]+[a-f0-9]{64}$']\n+regexes = ['^[\\w.-]+\\.(?:md|markdown|txt|yaml|yml|json|py|toml)(?::[ \\t]+[a-f0-9]{64}|\":[ \\t]+\"[a-f0-9]{64}\")$']\n `\n const maxInput = 512 * 1024\n const maxObject = 8 * 1024 * 1024\n" + }, + { + "target": "/home/worsch/railiance-forge/tools/receive-secret-scan/batch_test.go", + "original_sha256": "4ef5669786c49cadc9e8985d77c215e34effd3e4aabeb5387cafbe51e5e89e17", + "candidate_sha256": "d94d7812a74b1cb7ff53ee9a3e137d8b524d96f4dca813ca52a9f84f800323b9", + "patch": "--- /home/worsch/railiance-forge/tools/receive-secret-scan/batch_test.go\n+++ /home/worsch/railiance-forge/tools/receive-secret-scan/batch_test.go\n@@ -188,6 +188,11 @@\n \t\t{\"inline-suppression\", append([]byte(\"# gitleaks:allow\\n\"), privateKey...), true},\n \t\t{\"filename-digest\", []byte(\" cards/access.md: \" + digest + \"\\n\"), false},\n \t\t{\"bare-keyword-digest\", []byte(\"access: \" + digest + \"\\n\"), true},\n+\t\t{\"json-filename-digest\", []byte(\"{\\\"values/secrets-engine.yaml\\\": \\\"\" + digest + \"\\\"}\\n\"), false},\n+\t\t{\"json-bare-secret-digest\", []byte(\"{\\\"secret\\\": \\\"\" + digest + \"\\\"}\\n\"), true},\n+\t\t{\"json-filename-token\", []byte(\"{\\\"values/secrets-engine.yaml\\\": \\\"\" + string(canary) + \"\\\"}\\n\"), true},\n+\t\t{\"json-filename-long-digest\", []byte(\"{\\\"values/secrets-engine.yaml\\\": \\\"\" + digest + \"a\\\"}\\n\"), true},\n+\t\t{\"json-filename-uppercase-digest\", []byte(\"{\\\"values/secrets-engine.yaml\\\": \\\"\" + strings.ToUpper(digest) + \"\\\"}\\n\"), true},\n \t} {\n \t\tt.Run(tc.name, func(t *testing.T) {\n \t\t\tstdin, e := scan(context.Background(), f, config, tc.input)\n" + } +] \ No newline at end of file diff --git a/docs/changes/2026-11-01-scanner-json-digest/sync-closeout-receipt.json b/docs/changes/2026-11-01-scanner-json-digest/sync-closeout-receipt.json new file mode 100644 index 00000000..39738115 --- /dev/null +++ b/docs/changes/2026-11-01-scanner-json-digest/sync-closeout-receipt.json @@ -0,0 +1,168 @@ +{ + "observed_at": "2026-11-01T22:48:39.801004+00:00", + "scope": { + "total_checkouts": 210, + "primary": 169, + "linked_worktrees": 18, + "managed_clones": 17, + "nested_dependencies": 2, + "tool_checkouts": 3, + "retired_local_archive": 1 + }, + "custodian_file_batches": { + "initial_committed_paths": 232, + "retry_committed_paths": 3553, + "retry_terminal": true, + "retry_attempts": 102, + "rejected_paths": 139, + "finding_rules": { + "generic-api-key": 866, + "discord-api-token": 5, + "bitbucket-client-secret": 2 + }, + "line_context_shapes": { + "line-contains-sentinel-text": 1, + "line-contains-lowercase-hex-64": 819, + "line-contains-lowercase-hex-40": 45, + "other-context": 4, + "line-contains-UUID": 4 + }, + "scope_limit": "counts describe file operations in the archived corpus and its audit, not unique Git blobs or proof of credential validity" + }, + "brief_fixes": [ + { + "repo": "/home/worsch/approval-engine", + "commit_code": 0 + }, + { + "repo": "/home/worsch/hub-core", + "commit_code": 0 + }, + { + "repo": "/home/worsch/rapp-openbao", + "commit_code": 0 + }, + { + "repo": "/home/worsch/rapp-user-engine", + "commit_code": 0 + }, + { + "repo": "/home/worsch/pqrst-practice", + "commit_code": 0 + }, + { + "repo": "/home/worsch/intelligence-radar", + "commit_code": 0 + }, + { + "repo": "/home/worsch/agentic-resources", + "commit_code": 0 + }, + { + "repo": "/home/worsch/assembly-economics", + "commit_code": 0 + }, + { + "repo": "/home/worsch/whitehat-security", + "commit_code": 0 + }, + { + "repo": "/home/worsch/inbound-library", + "commit_code": 0 + }, + { + "repo": "/home/worsch/rail-knative", + "commit_code": 0 + }, + { + "repo": "/home/worsch/disaster-control", + "commit_code": 0 + }, + { + "repo": "/home/worsch/rapp-issue-core", + "commit_code": 0 + }, + { + "repo": "/home/worsch/informed-decision", + "commit_code": 0 + }, + { + "repo": "/home/worsch/whynot-design", + "commit_code": 0 + }, + { + "repo": "/home/worsch/frontend-patterns", + "commit_code": 0 + } + ], + "staged_generator_adoptions": [ + { + "repo": "approval-engine", + "generation_code": 0, + "check_code": 0, + "commit_code": 0, + "push_code": 0 + }, + { + "repo": "informed-decision", + "generation_code": 0, + "check_code": 0, + "commit_code": 0, + "push_code": 0 + }, + { + "repo": "state-hub", + "generation_code": 0, + "check_code": 0, + "commit_code": 0, + "push_code": 0 + } + ], + "cache_routes_repaired": 17, + "extra_branch_pushes": [ + { + "repo": "/home/worsch/executor-sandbox", + "ref": "refs/heads/local-smoke-2026-07", + "code": 0, + "verified_equal": true + }, + { + "repo": "/home/worsch/reef-railiance", + "ref": "refs/heads/backup-pre-main-reset", + "code": 0, + "verified_equal": true + }, + { + "repo": "/home/worsch/coulomb-social", + "ref": "refs/heads/csoc-unpublished-progress-20261027", + "code": 1, + "verified_equal": null + }, + { + "repo": "/home/worsch/rein-aharness", + "ref": "refs/heads/assembly-webfetcher-v0.2.0", + "code": 0, + "verified_equal": true + } + ], + "additional_root_history": { + "ref": "refs/heads/cust-wp-0081-original-unpublished", + "verified_head": "ea57268a6eae4de8313113e5b1f98c7d7b657999" + }, + "intelligence_radar": { + "head": "508daf6a9acfec9e5bde32b79dc994c259ede6c8", + "remote_equal_verified": true, + "temporary_refs_removed_verified": true, + "introduced_large_blobs_scanned_before_final_push": 95 + }, + "tests": { + "warden_case_sheet": "10 passed", + "forge_resources": "1 unittest passed", + "local_json_profile": "12 passed, 37 deselected", + "receiver_json_profile": "full pinned real-Gitleaks suite passed in 150.087 seconds", + "smtp_launcher": "21 passed" + }, + "native_policy_changed": false, + "native_preflight_receipt_available": false, + "goal_complete": false +} diff --git a/docs/repository-sync-2026-11-01.md b/docs/repository-sync-2026-11-01.md index 62a43b59..78619b1f 100644 --- a/docs/repository-sync-2026-11-01.md +++ b/docs/repository-sync-2026-11-01.md @@ -1,86 +1,55 @@ # Repository synchronization audit — 2026-11-01 -The founder requested inspection, commits, synchronization and pushes across local repositories, with an explanation and class-level remedy for changes that cannot be committed. +Publication is **incomplete** under the current scanner policy. The clean-file commit loop is terminal; rejected originals remain intact. No native scanner policy was changed. -## Inventory and completed work +## Scope and completed publication -The initial discovery found 210 checkouts under `/home/worsch`, including dependencies, managed caches, an archived prototype and linked worktrees. Initial status and branch inventory: `/tmp/repo-sync-inventory.json`. +The inventory covered 210 checkouts: 169 primary repositories, 18 linked worktrees, 17 managed clones, two nested dependencies, three tool checkouts and one explicitly local retired archive. Primary publication is distinguished from dependency/tool/cache state; pinned clones are checked for remote containment rather than moved to latest main. -Seven repositories received source, workplan, session-entry or capture commits: railiance-forge, activity-core, intelligence-radar, ops-warden, hall-of-helix, audit-core and railiance-infra. Warden's new case-sheet tests passed (10 tests through its contained `make test` runner); Forge's resource unittest passed. +- Committed source/workplan/session/capture changes in seven repositories, then processed the large Custodian archive with normal hooks: 232 paths in the initial successful batches plus 3,553 in the smaller retry, with 139 rejected paths preserved. These counts include the required audit and describe file operations, not unique Git blobs. +- Removed generated local briefs from tracking in 16 affected repositories, preserving their files and adding precise root ignore rules. +- Adopted the existing staged-source work-record generator in approval-engine, informed-decision and state-hub. Generation and check passed; source opt-in files and current indexes were committed and pushed. Unrelated operating evidence was excluded. +- Repaired all 17 managed-clone fetch routes from canonical primary remotes. Git ancestry proved the historical names issue-facade → issue-core and repo-registry → repo-scoping. All fetches passed; pins/files stayed unchanged and no pinned history was unpublished. +- Published Intelligence Radar's original history after 95 larger blobs passed the unchanged receiver in bounded temporary refs. Final main equality was verified and every temporary ref was removed. +- Audited every local branch. Published four additional branches under their existing names, without main merges or history rewrites: executor-sandbox/local-smoke-2026-07, reef-railiance/backup-pre-main-reset, rein-aharness/assembly-webfetcher-v0.2.0 and the-custodian/cust-wp-0081-original-unpublished. Normal receiver acceptance and exact remote-tip checks passed. +- Inspected SMTP source edits that appeared during the sweep. The launcher tests passed 21/21 and its changes were committed. The separate attended binding record contains an operator's existing confirmation and receipt reference; committing it does not constitute new approval by this agent. -Sixteen affected repositories received a real fix for generated-brief churn: remove `.custodian-brief.md` from the index, preserve the local file and ignore its precise root path. Existing generated-only and secret-scan gates remain enabled. Results: `/tmp/fleet-local-briefs-results.json`. +The latest full tip sweep proved 168 equal checkout tips: 167 primary repositories plus the ignored upstream mirror. Custodian subsequently reached remote equality at the clean-file checkpoint, before this final audit update. The final follow-up verification is recorded separately; this historical observation is not a claim that blocked publication is complete. -The fleet fetch succeeded for 188 checkouts, skipped four tooling/archived checkouts, timed out on 17 stale managed HTTP clones and failed for one missing remote. The push pass succeeded for 167 checkouts. Eighteen linked worktrees without upstreams have no commits absent from remote-tracking refs; they do not need duplicate branch publication. +## Remaining files and histories -## Remaining work and observed failures +| Case | Observed reason | Disposition | +| --- | --- | --- | +| Custodian 139 original paths | Pinned staged scanner reports generic-api-key findings | Originals retained; value-free file/object/rule/line metadata in `docs/changes/2026-11-01-scanner-json-digest/remaining-findings.json` | +| RApp flex-auth main history | Receiver rejects source-pin.json blob e844bada043f4169c49f3e9dbe7218cf2cf486d3, JSON filename/SHA256 mapping | Stub and both local histories were preserved in merge 6e1753a; publication needs reviewed scanner correction | +| Apps custody/cust81-apps-unpublished-r2 | JSON filename/SHA256 manifest in introduced history | Historical branch preserved; same tested serialization class | +| RApp user-engine backup/wp0004-pre-envstrip | Captured GPG_KEY entries in native image environment reports, four findings | 40-character hexadecimal fingerprint-shaped data is not a private-key payload; preserve historical branch pending exact review rather than call it a credential leak | +| Social csoc-unpublished-progress-20261027 | Receiver rejects docs/usecases/platform-communication.md blob 0a6ca11b651ad3acde166e332e5653001741ee71, line 41 | Redacted review identifies prose in a diagnostic-redaction requirement; branch retained pending content-bound adjudication | +| State-hub nine weekly review JSON files | Generated-only commit guard | Preserve local evidence; define an approved durable operating-evidence publication rule rather than bypass the source-change gate | +| Four managed INTENT.md overlays | Generated bootstrap content in old pinned caches differs from current owner intent | Preserve as analysis state; do not publish over the primary owner declaration | -- Custodian began with 3,917 untracked files (about 37 MB) plus six modified files. Bounded normal-hook commits are in progress; `/tmp/custodian-commit-results.json` records exact batches and sanitized outcomes. Do not run another staging process concurrently. The initial process handle is unified-exec session `55066`; terminal state must be checked before retrying. -- Some Custodian artifacts trigger secret findings; two reviewed examples are path-keyed SHA256 manifests and one is a synthetic sentinel in an archived test. These observations do not establish that every flagged blob is harmless. Preserve original evidence and inspect each remaining finding without printing credentials. -- Large local scans returned `unverified / scan-unavailable`; the remote receive scanner rejected Intelligence Radar with `scan-deadline-exceeded`. No unverified scan counts as clean. A smaller-batch retry script is prepared at `/tmp/custodian-retry.py` and must run only after the initial process finishes. -- Approval-engine and informed-decision still have generated WORK-RECORDS updates. State-hub has an index refresh and weekly review evidence. Their normal hooks reject generated-only commits; do not manufacture source changes or bypass the gate to publish these. -- Seventeen repo-scoping managed clones use the obsolete `http://92.205.130.254:32166` forge. Four contain bootstrapped, untracked INTENT.md files. These are stale generated projections, distinct from reviewed owner intent in the primary repositories. Do not publish them over owner declarations. -- `rapp-flex-auth-secrets-engine` has two local commits but its configured `coulomb/rapp-flex-auth-secrets-engine` remote does not exist. The retired executor-worker archive has four commits and no remote. Publishing destinations were requested from the founder; no destination should be invented for the retired prototype. -- `content-explorer/upstream-onco` is an ignored upstream dependency. Its GitHub remote refuses an unauthenticated push. Avoid seeking write access merely to push an unchanged third-party mirror. +All 139 Custodian paths have actual rule/line diagnostics, not an assumption of harmlessness. The report describes line contexts (hash-like strings, UUIDs, fixture text or source expressions); those classifications do not establish credential validity. An earlier empty report-transport experiment was discarded as unverified and superseded by complete redacted reports. The social history also demonstrates why commit-diff scanning is insufficient: its diff inspection was clean, but the complete introduced-object receiver found the blob. -## Remedies for these classes across the fleet +## Class-level repairs and suggestions -1. Treat generated local orientation as local cache: precise ignore rule plus index removal, preserving the disk file. Apply through the owning template when rolling this out to other repositories. Regenerate tracked indexes alongside their genuine source commits. Give durable recurring operational evidence an explicitly reviewed publication policy instead of bypassing the generated-only guard. -2. Keep staged and receive scanners equivalent and fail closed. Benchmark batches containing both small and larger blobs, then fix batching/runtime behavior against the configured deadline. Until a reviewed fix is deployed, use bounded normal-hook commits and ordinary forward pushes. Do not disable hooks, lower coverage or assume a timeout is a clean result. -3. For false-positive content-digest manifests, review a narrowly bounded path-key plus exact 64-hex value rule in both adapters with negative secret tests. For archived synthetic fixtures, use a reviewed, digest-bound fixture disposition or keep the original evidence local. Do not blanket-allow token prefixes or evidence directories. -4. Reconcile managed clone remotes from the canonical registry, with explicit handling for retired/missing repositories. Separate owned checkouts, dependency mirrors and disposable projections in the synchronization inventory. Preserve generated INTENT files for inspection rather than overwrite owner source. +1. **Generated local state:** keep orientation briefs local with precise ignores and remove tracked copies without deleting the working file. Generate tracked indexes from staged authoritative sources, as now adopted in the three affected repositories. Keep disposable analysis overlays outside owner source. +2. **Scanner deadlines:** bound imports while preserving every introduced object, parent, tree/ref name and commit/tag payload check. The successful Intelligence Radar import proves this can work without changing history, reducing coverage or disabling hooks. Keep exact clean receipts and verify removal of temporary refs. +3. **False-positive provenance:** the paired candidate narrowly extends the existing filename/exact lowercase-SHA256 exception to equivalent quoted JSON. Both profiles are identical; bare secret assignments, provider tokens, uppercase/long values and actual private-key cases remain refused in tests. The exact RApp blocked blob passes the candidate. This is a candidate, not an activation receipt or a disposition for other findings. +4. **Other non-credential findings:** use independently reviewed, rule-specific, content-bound adjudication for public fingerprints, provenance, UUIDs, fixture text and prose. Do not blanket-ignore evidence/test directories, key prefixes or all prose. Retain original findings and failures. +5. **Stale routes:** reconcile caches with canonical remotes and verified rename ancestry, not guessed repository names. Preserve intentional pins and prove their commits are contained remotely. -## Completion criterion +## Validation and native checkpoint -This audit is ongoing. Completion requires final remote-ref equality checks for every owned repository, explicit dispositions for missing destinations and blocked files, and terminal evidence for all live process handles. A successful push pass alone does not establish that all current local changes are published. +Warden case-sheet tests passed 10/10; the Forge resource unittest passed; staged index generation/check passed in all three adoptions; the local JSON-profile integration selection passed 12 tests; the full receiver suite passed with pinned real Gitleaks in 150.087 seconds; SMTP launcher tests passed 21/21. Archives were inspected without extraction/execution: the RApp source tar has 13 members and the upstream chart has 281, with no unsafe paths or credential-named members observed. These checks have their stated scopes and do not claim universal secret detection or native runtime acceptance. -## Founder disposition and retirement lineage +The current agent Kubernetes identity cannot inspect/administer the forge. The founder returned current deployment/pod metadata through their attended admin context; the agent did not read or use that admin credential. The required read-only artifact/config/guard/headroom inspection is prepared at `/tmp/forge-scanner-preflight.sh`, but its result is still unavailable. An exact native rollout, verification, rollback and supervisor approval must follow that result before any receiver update. -The founder supplied the missing RApp stub and explicitly directed that the retired executor-worker remain local. The stub's initial README and the two local package commits were merged without rewriting either history (`6e1753a`); its push is unified-exec session `51491`, pending verification. +The source candidate, original/candidate hashes, exact built artifact hash, regression patch and read-only proposals are in `docs/changes/2026-11-01-scanner-json-digest/`. They authorize nothing. Existing supervision remains supervised; failed/refined attempts stay unscored. -The archive README and retirement commit `94c5c06` say the prototype was adopted into agent-harness on 2026-07-17, under DEC-2026-002 and the shared-runtime ADR. Its former responsibility was one-task execution, Kaizen orientation, llm-connect invocation, local-commit verification and hub reporting. The shared runtime prevents each consuming project from duplicating that integration. The accepted 2026-07-26 Glas ADR-001 renamed agent-harness to **rein-aharness** as the first concrete rein beneath **glas-harness**. Today's rein-aharness README still documents one-task execution and its successor intake/reporting paths. Thus rein-aharness is the direct code/intent successor; glas-harness owns the broader profile-selected execution contract, activity-core scheduling, and sand-boxer isolation. This lineage is not evidence that every runtime profile is production-ready. +## Retired worker disposition -Sources: `../archive/260717-executor-worker-retired/README.md` (sibling-home path, not repository-relative), `/home/worsch/rein-aharness/docs/adr/ADR-001-agent-harness-architecture.md`, `/home/worsch/glas-harness/docs/adr/ADR-001-rein-harness-family.md`, and `/home/worsch/rein-aharness/README.md`. +The founder explicitly keeps `archive/260717-executor-worker-retired` local. It was adopted into agent-harness on 2026-07-17 under DEC-2026-002 to avoid per-project execution glue. The accepted 2026-07-26 Glas ADR renamed agent-harness to **rein-aharness**, the direct task-execution/commit-verification/reporting successor beneath **glas-harness**. Scheduling remains with activity-core and isolation with sand-boxer. Sources are the archive README, rein-aharness's shared-runtime ADR and glas-harness's rein-family ADR; lineage is not proof that every runtime profile is production-ready. -Latest direct remote verification: `/tmp/fleet-verify-results.json` proved 167 checked-out branch tips equal to their queried remote refs. Custodian and Intelligence Radar were unequal at that observation. The first Intelligence Radar incremental push passed; its next commit hit the receiver deadline, so `/tmp/intelligence-push-results.json` records a failed attempt, not an active process. All five required consistency checks have completed with zero failures/automation errors and pre-existing warnings (activity-core separately; remaining four in `/tmp/fleet-consistency-results.json`). +## Tracking and completion -Continuation: poll Custodian session `55066` until terminal, then execute `/tmp/custodian-retry.py` (it excludes known blocked blobs, reduces timeout batches and preserves the gates). Do not run two staging loops against this repository. Record remaining blocked paths, commit this audit with normal hooks, push successful commits in bounded forward steps, and rerun direct remote equality verification. The prior full push, fetch, brief-fix and consistency processes are terminal. - -RApp push result: rejected by the remote secret scanner, object `e844bada043f4169c49f3e9dbe7218cf2cf486d3`, `source-pin.json`. Redacted inspection found `generic-api-key` at line 23, inside a source file SHA256 mapping; all `files_sha256` values were verified as exact 64-character lowercase hex. This is the same digest-manifest false-positive class identified above. The merge remains local and the stub remains intact. Session `51491` is terminal. Completing publication requires a reviewed fix/disposition that preserves equivalent scanner coverage, including historical introduced blobs; changing only the current file cannot remove the blocked historical blob. - -## Continuation results - -The initial Custodian batch process is terminal. Three clean initial commits passed and the first was published separately; the smaller retry process (`54197`) now excludes known flagged blobs and recursively reduces timeout batches. Exact attempts are in `/tmp/custodian-retry-results.json`; its blocked-path snapshot is `/tmp/custodian-blocked-paths.json`. Concurrent pushing is safe because it does not stage files; only one staging process runs. - -Intelligence Radar is now fully published without rewriting history or altering any scanner control. Its 95 larger introduced blobs were submitted in groups of four using the receiver's supported direct-object tags. Every group received a clean receiver receipt. The original unchanged commit history then passed the receiver, and direct main-ref equality was verified at `508daf6a9acfec9e5bde32b79dc994c259ede6c8`. All temporary `sync-scan-20261101/*` refs were deleted and a fresh ls-remote found none. Detailed receipts: `/tmp/intelligence-bounded-import-results.json`. The previous observation of 167 equal checkout tips therefore increases to 168, with other tips unchanged at this observation. - -The JSON filename/digest scanner candidate and tests are saved under `docs/changes/2026-11-01-scanner-json-digest/`. Full pinned real-Gitleaks receiver tests pass; local selected integration tests pass 12/12. It remains a candidate: no local runtime scanner or native receiver has been altered. A snapshot review of 32 flagged Custodian files found the candidate clears ten. Remaining examples include synthetic test sentinels, source/binary/Git provenance and UUID identifiers. The JSON correction is not a disposition for all other findings. Broader exceptions must be independently reviewed and narrowly scoped; no blanket evidence/test-directory exclusion is proposed. - -Founder-provided metadata confirms deployment forge (`1faefb26-cccd-4d0e-b509-70a7eb0b4f4d`), pod forge-79c7fb84db-k5wtm (`2c9f911a-403e-4183-a027-2b8d48742348`), Forgejo 11.0.3-rootless. The default founder terminal also selected ops-mason-builder; the attended founder-admin kubeconfig succeeded when explicitly selected by the founder. The agent did not read or use that admin credential. A read-only founder preflight is prepared at `/tmp/forge-scanner-preflight.sh`; it checks the exact public installed artifacts/config/guard and allocation before an exact rollout proposal can be prepared. The existing owner source pins receiver b735d052a49f under `/data/security/receive-secret-scan/20261027-b735d052a49f` and immutable ConfigMap forgejo-secret-template-d1df801be39f. This must be checked live, not assumed from the old October 18 receipt. - -Live continuation checkpoint: smaller Custodian commit loop is unified-exec `54197`; current per-commit push loop is `3898` (previous loop `98308` is terminal). Poll each handle before starting a replacement; commit loop owns the index. Intelligence bounded import process `8316`, initial Custodian loop `55066`, full receiver tests `86288`, local candidate tests `40485` and initial standalone push `36846` are terminal. Founder read-only scanner preflight is pending via `bash /tmp/forge-scanner-preflight.sh`; do not run its founder-admin context from the agent. Candidate and inspection receipts are retained under docs/changes/2026-11-01-scanner-json-digest/. Apply no receiver policy changes until the exact inspected rollout, verification and rollback have been prepared and approved. Independent clean commits/pushes continue while waiting. - -## Additional class repairs and inventory scope - -The full inventory contains **169 primary repository checkouts**, 18 linked worktrees, 17 managed repo-scoping clones, two nested dependency/submodule checkouts, three tool/marketplace checkouts and one intentionally local retired archive. The reported 168 equal checkout tips include the ignored upstream dependency mirror; 167 of those are primary repositories. Custodian and the new RApp remain the two primary publication cases still in progress. - -Reconciled **15** stale managed-clone origins from their matching primary checkout's canonical SSH remote and fetched successfully. No pinned cache HEAD or untracked INTENT was changed; all repaired caches have zero commits absent from their remote-tracking refs. Two historical caches (repo-registry and issue-facade) have no matching primary checkout, so their old routes and data were preserved for explicit retirement/ownership disposition. This supersedes the earlier planned count of 16: current-state checks identified two missing primaries. Receipts: `/tmp/cache-remote-reconciliation-results.json`. - -Approval-engine, informed-decision and state-hub now explicitly adopt the existing staged-source work-record generator through the two reviewed opt-in files. Generation and `--check` passed; normal hooks committed the workflow and current indexes, and all three pushes passed. This is a real prevention mechanism for the previously stale WORK-RECORDS files, not a generated-only gate bypass. Their unrelated operating evidence was excluded. Receipts: `/tmp/generated-adoption-results.json`. - -The value-free finding review uses redacted reports only. An initial `/dev/stdout` report experiment yielded empty, unverified reports and was discarded; it established no clean/harmless outcome. The corrected report path inspected 73 flagged files and found 533 generic-api-key findings: 498 lines containing lowercase SHA256-like values, 29 containing SHA1-like values, four containing UUIDs, one sentinel line and one Python identifier-expression context. Those are line-context descriptions, not credential-validity assertions. The identifier expression at archived registrar_reconcile.py line 701 contains no string literal. Original blobs remain intact; only the exact RApp SHA256 manifest and the tested JSON filename/digest cases are cleared by the candidate. Snapshot receipt: `/tmp/sync-findings-safe-classification.json`; rerun after the commit loop finishes to cover later findings. - -New coordination work is tracked in `workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md`. Its required consistency sync awaits the sole staging loop's terminal state, avoiding an index race. The latest Custodian push handle is `9012`; the `53681` push pass is terminal. The scanner-native preflight receipt is still missing at this observation; the pending founder request remains unchanged. - -The final two cache mappings are now resolved by evidence rather than names: issue-facade → issue-core (recorded rename plus pinned-commit ancestry), and repo-registry → repo-scoping (the latter was the only primary checkout containing that history; ancestry verified). Both origins now use their successor's canonical SSH URL and both fetches succeeded. Their pinned HEADs remain unchanged and have zero unpublished commits. All **17** managed cache routes are therefore repaired; no orphan-cache destination remains unresolved. The previous two-skips observation is superseded. Exact receipts: `/tmp/renamed-cache-reconciliation-results.json` and `/tmp/orphan-registry-cache-history-check.json`. - -## Full branch audit - -Checked every local branch in all 169 primary repositories for commits absent from remote-tracking refs. Seven non-current branches held unique history; this is broader than the earlier checked-out-tip audit. Four were published under their own names through normal receiver checks, without main merges or history rewrites: executor-sandbox/local-smoke-2026-07, reef-railiance/backup-pre-main-reset, rein-aharness/assembly-webfetcher-v0.2.0 and the-custodian/cust-wp-0081-original-unpublished (remote tip ea57268a6eae4de8313113e5b1f98c7d7b657999). - -Three historical branches remain withheld under the existing scanner: rapp-user-engine/backup/wp0004-pre-envstrip, railiance-apps/custody/cust81-apps-unpublished-r2 and coulomb-social/csoc-unpublished-progress-20261027. The first has four generic-api-key findings in captured container-environment scan reports; their GPG_KEY values are 40-character hexadecimal fingerprint-shaped strings, not a private-key payload. The Apps finding is another JSON filename/SHA256 entry. The social branch's remote receiver rejected blob 0a6ca11b651ad3acde166e332e5653001741ee71, docs/usecases/platform-communication.md line 41, in a diagnostic-redaction requirement written as prose. Only redacted prose context was inspected; no credential value was emitted. Its local commit-diff scan was clean, while the complete introduced-object receiver found the blob. This is evidence to retain complete object/history scanning, not replace it with diff-only checks. - -Suggested class remedy: reviewed, rule-specific, content-bound false-positive adjudication for public fingerprints, provenance metadata, UUIDs and prose/fixture cases; keep local and receiver profiles consistent and negative secret tests mandatory. Never blanket-ignore evidence directories, test folders, key prefixes or all prose. The existing narrow JSON correction addresses its exact tested serialization class and does not silently dispose of these other histories. - -The retired executor-worker archive remains local by explicit founder direction. No additional branch or repository is being silently treated as published. Branch receipts: `/tmp/unpublished-local-branches.json`, `/tmp/unpublished-branch-inspection-results.json`, `/tmp/extra-branch-push-results.json` and `/tmp/csoc-unpublished-object-context.json`. - -Latest live-job checkpoint: commit loop `54197` is still active; per-commit main push pass `70515` is terminal. Extra-branch push `86960` is terminal (three clean acceptances, one refused social branch); Custodian backup push `54228` is terminal and its exact remote tip was verified. Inspection jobs `18091`, `15638` and `81080` are terminal. The social blob is a prose diagnostic-redaction requirement, with the detected phrase redacted in review; no private credential was displayed. Native preflight receipt `/tmp/forge-scanner-preflight-receipt.json` is still unavailable, and the original founder request remains pending. Source workplan and audit must be committed only after the active single index writer finishes; required consistency sync is still pending that checkpoint. +`workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md` retains the full goal and outstanding native/publication checks. Source records and this audit must be committed through normal hooks, followed by required consistency and final remote checks. Do not mark this goal or workplan finished while required publication remains blocked or unverified. Sanitized closeout counts are in `docs/changes/2026-11-01-scanner-json-digest/sync-closeout-receipt.json`; detailed execution receipts remain in `/tmp/*-results.json` and the tool history. diff --git a/workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md b/workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md new file mode 100644 index 00000000..2123fbb0 --- /dev/null +++ b/workplans/CUST-WP-0083-fleet-sync-and-scanner-remediation.md @@ -0,0 +1,100 @@ +--- +id: CUST-WP-0083 +type: workplan +title: "Publish local repository changes and resolve scanner publication failures" +domain: infotech +repo: the-custodian +status: active +owner: codex +created: "2026-11-01" +updated: "2026-11-01" +flavor: implementation +depends_on: [] +related_repos: [repo-manager, railiance-forge, railiance-apps, rapp-flex-auth-secrets-engine, intelligence-radar] +--- + +Founder request: inspect all local changes, commit and synchronize what can be published, explain failures and their class-level remedy, and bring remotes completely up to date. The retired executor-worker archive remains local by explicit founder direction. Its direct intent/code successor is rein-aharness, beneath glas-harness. + +## Inspect all checkouts and classify source versus derived state + +```task +id: CUST-WP-0083-T01 +status: done +priority: high +``` + +Discovered 210 checkouts. Reviewed primary changes, managed clones, linked worktrees and ignored upstream dependencies. Initial inventory and remote observations are preserved in `/tmp/repo-sync-inventory.json`, `/tmp/fleet-fetch-results.json` and the audit below. Retired prototype disposition and missing RApp stub were resolved with the founder; the RApp histories were merged without rewriting either side. + +## Commit and publish all eligible changes + +```task +id: CUST-WP-0083-T02 +status: progress +priority: high +``` + +Seven repositories received source/workplan/session/capture commits, and 16 affected repositories stopped tracking their generated local brief while preserving it on disk. 168 checkout tips have been directly verified equal to remote refs. Intelligence Radar's full original history is now published after bounded normal receiver scans; temporary refs were removed. Custodian smaller-batch commit loop is live as unified-exec `54197`; only that loop owns the index. Per-commit pushes continue separately. Exact result files are linked in `docs/repository-sync-2026-11-01.md`. Generated-only refreshes and rejected originals remain intact pending their documented dispositions. + +## Diagnose failures and prepare narrow class-level correction + +```task +id: CUST-WP-0083-T03 +status: progress +priority: high +``` + +Generated-only gates, local/remote scanner deadlines and false positives are independently identified. A paired JSON filename/SHA256 profile correction passes 12 local real-scanner tests and the full receiver real-scanner suite, and clears the exact RApp blocked blob. Candidate sources, exact digests, tests and negative coverage are in `docs/changes/2026-11-01-scanner-json-digest/`. It does not adjudicate every other provenance/UUID/fixture finding. Inspect all remaining failed blobs without printing credential values and keep exact originals. Repaired all 17 managed cache routes: 15 matched their current primary name; issue-facade → issue-core and repo-registry → repo-scoping were proven through Git ancestry. Fetches succeeded and every pinned cache HEAD has zero unpublished commits. No cached worktree content or pins were changed. Adopted the staged-source index generator in approval-engine, informed-decision and state-hub; regeneration, check, normal commits and pushes passed. + +## Obtain native preflight and execute an exactly approved receiver correction + +```task +id: CUST-WP-0083-T04 +status: wait +priority: high +``` + +Human-lane checkpoint: the current ops-mason-builder identity cannot inspect the forge or perform native administration. The founder returned current deployment/pod identity using their attended admin context. Read-only artifact/config/guard/headroom inspection is prepared as `/tmp/forge-scanner-preflight.sh` and awaits its result. Prepare the exact guarded rollout, verification, rollback and cost/risk assessment from this evidence before requesting approval. The agent must not borrow the founder admin kubeconfig. No local runtime scanner or receiver policy is changed by the existing candidate. Preserve original revisions, failures and any refinements in supervised receipts; no autopilot or scored approval is inferred. + +## Verify complete remote publication and report exceptions + +```task +id: CUST-WP-0083-T05 +status: todo +priority: high +``` + +After all live loops are terminal, finish the audit, run required State Hub consistency, commit it through normal hooks, publish all eligible pending history, verify exact remote tips and absence of temporary refs, and inspect final Git status across the full inventory. Give explicit evidence/dispositions for every remaining uncommittable file and class-level suggestions. Do not call the goal complete while required owned-repository publication is blocked or unverified. If actionable work remains when this workplan is finished, hand it to live work records first. + +## Restore canonical fetch routes for all managed clones + +```task +id: CUST-WP-0083-T06 +status: done +priority: medium +``` + +Completed 2026-11-01. Fifteen clones matched primary repository names. Two historical names were resolved by actual commit ancestry: issue-facade → issue-core, repo-registry → repo-scoping. All 17 canonical fetches passed; pins and local files stayed intact, and no pinned HEAD has unpublished commits. Evidence: `/tmp/cache-remote-reconciliation-results.json`, `/tmp/renamed-cache-reconciliation-results.json`. This is route/containment proof, not an assertion that a deliberately pinned checkout must move to latest main. + +## Prevent stale work-record indexes in the three affected repositories + +```task +id: CUST-WP-0083-T07 +status: done +priority: medium +``` + +Completed 2026-11-01. Approval-engine, informed-decision and state-hub adopted the already-existing staged-source generator. The two opt-in files and regenerated index were committed through normal hooks and pushed in each repository. Generation and `--check` passed. Evidence: `/tmp/generated-adoption-results.json`; commits f41a9ca, b8d35ca and ed2f0e9. Unrelated weekly operating evidence was excluded. This extracts the completed prevention mechanism from T03; T03 retains scanner finding adjudication and the narrow correction proposal. + +## Inspect and publish historical local branch work + +```task +id: CUST-WP-0083-T08 +status: progress +priority: medium +``` + +The all-ref audit found seven non-current branches with commits absent from remote refs. Four are now published under their existing names without rewriting or merging main: executor-sandbox local-smoke-2026-07, reef-railiance backup-pre-main-reset, rein-aharness assembly-webfetcher-v0.2.0, and Custodian cust-wp-0081-original-unpublished. Normal receiver acceptance and exact remote-tip checks passed. Three histories retain scanner refusals: RApp user-engine's pre-envstrip backup contains captured GPG_KEY fingerprint entries; Apps custody preparation has a JSON SHA256-manifest false positive; coulomb-social's unpublished progress branch hits generic-api-key on documentation prose at docs/usecases/platform-communication.md line 41. The exact introduced blob failed even though commit-diff inspection was clean, showing why diff-only scanning is insufficient. Original historical branches remain intact; do not bypass the receiver or call a raw fingerprint a private key. Propose narrowly scoped, content-bound adjudication for these classes and preserve the complete scanner scope. Receipts: `/tmp/unpublished-branch-inspection-results.json`, `/tmp/extra-branch-push-results.json`, `/tmp/csoc-unpublished-object-inspection.json`. The current mail-address-semantics tip was also rechecked and its push found the remote already up to date. + +## Evidence + +`docs/repository-sync-2026-11-01.md` is the cumulative audit. `/tmp/*-results.json` files are execution receipts that still need a durable sanitized closeout summary. Required `statehub fix-consistency --repo the-custodian` is pending the single active staging loop becoming terminal; do not let consistency/autocommit race its index.