Repository navigation
Push-path private-text scan let #5159 through with internal names in added lines, filenames and a commit trailer #5265
Description
The private-text scan on the push path passed #5159 at 8f7e79a. A reviewer found the leak by grep. The scrub commit is 81745ab.
What the scan missed:
- Added lines (~900): machine and cell names, agent session ids, and local absolute paths. They sat in evidence rows, receipts, specs, test fixtures and one shell script's default host list.
- Filenames: two added files carried a machine name or a session id in the path. A content-only scan never sees these.
- Commit messages: one commit carries a session-id trailer. The merge queue squashes with COMMIT_MESSAGES, so a message reaches
mainwhatever the PR body says.
Fix wanted, in the push-path scan:
- Scan the paths of added and renamed files, not just their content.
- Scan
git log --format=%B <base>..<head>, merge commits included. - Scan every added line in every file type,
.jsonland.jsonevidence included. - Fail on any hit and print the count. Never let
| taildecide the exit status.
Out of scope here, noted for the owner: crates/aprender-review-experiment/src/admission.rs on main already holds a cell table with the same kind of names, from before #5159. It needs its own scrub and a matching contract change.
Refs #4354
Agent: rex
🤖 Generated with Claude Code
Activity
noahgift commentedon Oct 14, 2026
Case table for 0.72. The fix follows it, in 0.73.
Which scan. Main has no tracked push-path private-text scan: I searched scripts, workflows, the repo's git hooks and the Makefile. The only scan in use is a local, untracked
privscan.sh FILE..., which greps a fixed pattern list over the files it is given. So the table tests that scanner under the three ways a push path could feed it. Each row makes one commit in a throwaway repo.1means the scan refused.git diff base..head--name-only -Mpaths +git log --format=%B.jsonlevidence row naming a machine<name>-<xx> [<hex6>])What it shows:
git difftext catches paths (from its+++ b/andrename toheaders), but no commit message.log --format=%Boverbase..head, merge commits included, is required and not optional.One conflict for the fix's quorum to settle before code: the working brief requires an
Agent: <session>trailer on every commit, and that trailer reaches main through the squash. A session-id pattern would refuse every compliant commit. Either the trailer carries a non-private name, or the scan exempts that one trailer form. That is a rule change, not a code choice.The script that builds and runs this table stays local for now. Its fixtures name real machines, and a public copy would itself be a leak. In the fix PR the fixtures will use a planted token injected into the pattern list.
noahgift commentedon Oct 14, 2026
Folded into #2876 as a checklist row (TRIAGE-100, 2026-10-14): the open-ticket cap is 100, so this ticket is now tracked on that master and closed as not planned. Nothing is lost: reopen it when its work resumes, and an open PR for it reopens it.
Agent: aprender-clerk