Skip to content

security: lefthook + gitleaks secret gate (pre-commit, pre-push, CI); remove OSF token - #6433

Merged
gHashTag merged 6 commits into
masterfrom
security/secret-gate
Oct 19, 2026
Merged

security: lefthook + gitleaks secret gate (pre-commit, pre-push, CI); remove OSF token#6433
gHashTag merged 6 commits into
masterfrom
security/secret-gate

Conversation

@gHashTag

@gHashTag gHashTag commented Oct 5, 2026

Copy link
Copy Markdown
Collaborator

Closes #6432

What changed

  • lefthook.yml: pre-commit runs gitleaks on staged changes; pre-push runs it on every commit not yet on a remote. A missing gitleaks fails the hook rather than skipping it.
  • .gitleaks.toml: the default gitleaks rules plus hardcoded-password-literal, which catches the Wi-Fi passphrases the defaults miss (the trinity-fpga leak, Host health monitor (R-HS-41) #899 there). This is the canonical copy for the other gHashTag repos. The allowlists cover only verified non-secrets: the generated symbol inventory, a GF16 hex constant, one prose NOTE, and compiler flags.
  • secret-scan.yml: the existing job (Solana keys, test-ledger, home paths) is unchanged. A new gitleaks job scans the event's commit range, so --no-verify cannot land a credential.
  • OSF token removed from research/gamma-hypotheses/OSF-upload-summary.md.
  • SECURITY.md documents the three layers and the one-time setup (brew install gitleaks lefthook && lefthook install).

Verified

  • gitleaks dir . --config .gitleaks.toml reports 0 findings on this tree.
  • A staged fake wifi_password = "..." is blocked (exit 1); a clean index passes.
  • This commit went through the lefthook pre-commit hook, and the push went through pre-push (1 commit scanned, no leaks).

Not done here

The OSF token remains in history and has to be revoked at osf.io.

🤖 Generated with Claude Code

@gHashTag @claude
security: lefthook + gitleaks secret gate; remove OSF token
927484b 
Three layers keep credentials out of the repository:
- lefthook pre-commit scans staged changes with gitleaks
- lefthook pre-push scans commits not yet on any remote
- CI secret-scan scans the PR range, so --no-verify cannot skip it

.gitleaks.toml extends the default rules with hardcoded-password-literal,
which catches Wi-Fi passphrases the defaults miss. It is the canonical
copy for the other gHashTag repos.

The OSF OAuth token is removed from the research summary; it stays in
history and is being revoked at osf.io.

Closes #6432

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-10-05 14:06:34 UTC

Summary

Status Count
Total Open PRs 50
PRs with Failing Checks 41
PRs with All Checks Green 9
READY 8
FAILING 41
PENDING 0
NO CHECKS YET 0

These columns do not partition: 8 + 41 + 0 + 0 = 49, and there are 50 open PRs. A PR is being counted twice or not at all.

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=8597b6ded596 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

This was referenced Oct 5, 2026
Closed
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
@gHashTag gHashTag mentioned this pull request Oct 5, 2026
Closed
This was referenced Oct 5, 2026
Merged
Merged
Merged
gHashTag added a commit that referenced this pull request Oct 5, 2026
@gHashTag @claude
chore(hooks): lefthook own-language command (pre-commit + pre-push)
437c867 
Refs #6510

Added through the contents API, not a local commit: once this file exists
in a worktree, the gate it installs rejects every commit that adds a
protected gate file, including this one. --no-verify was not used.
Union-compatible with #6433 (secret-gate): merging is a union of commands.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@gHashTag

gHashTag commented Oct 5, 2026

Copy link
Copy Markdown
Collaborator Author

Coordination note: #6511 (Only t27 gate) also adds lefthook.yml, with an own-language command on pre-commit and pre-push. The two files merge as a union of the commands: maps; neither PR touches the other's command. Whichever lands second should rebase and keep both secret-gate and own-language.

This was referenced Oct 5, 2026
Merged
Merged
Merged
Closed
Closed
Merged
Merged
Merged
Closed
Merged
Closed
Merged
Merged
This was referenced Oct 6, 2026
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Closed
This was referenced Oct 6, 2026
Merged
Open
@claude
Merge master into security/secret-gate: lefthook.yml is the union of …
d6e640b 
…both command lists (Closes #6432)

master's lefthook.yml already named the resolution: "PR #6433 adds a
secret-gate command to both hooks; merging the two files is a union of
the command lists". pre-commit and pre-push now run secret-gate,
own-language and foreign-budget.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-10-18 17:20:43 UTC

Summary

Status Count
Total Open PRs 50
PRs with Failing Checks 49
PRs with All Checks Green 1
READY 0
FAILING 49
PENDING 0
NO CHECKS YET 0

These columns do not partition: 0 + 49 + 0 + 0 = 49, and there are 50 open PRs. A PR is being counted twice or not at all.

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=fad12492937a != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@gHashTag
gHashTag enabled auto-merge (squash) October 18, 2026 17:39
This was referenced Oct 18, 2026
Closed
Merged
@claude
census: pin the gitleaks job of secret-scan.yml (Closes #6432)
ffdff06 
tri census pin --bless on this branch. The new `gitleaks` job in
.github/workflows/secret-scan.yml is one more shell job with two run
steps: shell jobs 93 -> 94, run steps 325 -> 327, steps the runner runs
under bash -eo pipefail 304 -> 306, and quiet "named a path but not
quiet" 233 -> 235 (its gitleaks steps name paths and do not hide their
exit codes). fetches did not move.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-10-18 19:00:51 UTC

Summary

Status Count
Total Open PRs 50
PRs with Failing Checks 46
PRs with All Checks Green 4
READY 0
FAILING 46
PENDING 0
NO CHECKS YET 0

These columns do not partition: 0 + 46 + 0 + 0 = 46, and there are 50 open PRs. A PR is being counted twice or not at all.

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=fad12492937a != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

gHashTag added a commit that referenced this pull request Oct 18, 2026
@gHashTag @claude
security: remove the plaintext OSF token from the research summary (C…
016f1e5 
…loses #10581) (#10582)

The OSF OAuth token sat in research/gamma-hypotheses/OSF-upload-summary.md
in plain text. The line now says where the token is read from (OSF_TOKEN in
the environment). The token stays in history, so it still has to be revoked
at osf.io. Same replacement as #6433, without that PR's gate files, which
wait for the owner's owner-approved-foreign label.

Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@gHashTag gHashTag added the owner-approved-foreign Owner-approved exception to the only-t27 rule: hand-written foreign code allowed in this PR label Oct 19, 2026
@claude
Merge master into security/secret-gate: census re-pinned on the merge…
2f3f0a8 
…d tree (Closes #6432)

tools/census/quiet.txt conflicted (master moved it too). Took master's
census and ran tri census pin --bless on the merged tree: the gitleaks
job still adds one shell job with two run steps (jobs 93 -> 94, steps
325 -> 327, runner-run steps 304 -> 306, quiet "named a path but not
quiet" 237 -> 239). The OSF line merged clean: #10582 made the same
change on master.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-10-19 01:53:28 UTC

Summary

Status Count
Total Open PRs 50
PRs with Failing Checks 48
PRs with All Checks Green 2
READY 2
FAILING 48
PENDING 0
NO CHECKS YET 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=fad12492937a != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

claude and others added 2 commits October 19, 2026 10:43
@claude
secret gate: the gitleaks rules as specs/policy/secret_gate.t27, no h…
d6f26b5 
…and-written .gitleaks.toml (Closes #6432)

own-language refused this PR on the 2026-10-09 budget (no hand-written
code in any language but t27 may grow): .gitleaks.toml alone was 36
hand-written TOML lines. The owner chose (2026-10-19) to write the rules
in t27 instead of dropping the gate.

- specs/policy/secret_gate.t27 holds the same rules as data and
  gitleaks_toml() writes them; its bytes are identical to the old
  .gitleaks.toml body (diffed), pinned by TOML_LEN, 5 tests, 0 vacuous.
  The text helpers come from claw::text (put_str, buf_has), not a copy.
- gen/c/policy/secret_gate.c is its t27c gen-c output (L2); spec-guards
  regenerates it and diffs it with the claw gen/c files.
- lefthook.yml: one secret-gate command (YAML anchor, like own-language)
  builds the config from the gen-c output; SECRET_GATE_SCAN picks
  --staged (pre-commit) or the unpushed commits (pre-push). Checked:
  nothing staged exits 0, a staged wifi password exits 1, pre-push 0.
- secret-scan.yml: the gitleaks job is one run step over the same
  generated config. Checked locally on this PR's range: no leaks.
- scripts/repair/unscar_4639b38cd.py is deleted: a one-off repair of
  commit 4639b38, applied in #2722 (2026-08-27), referenced nowhere,
  its port kept under specs/port. With it the diff is +33 / -60
  hand-written foreign lines (check_budget passes; at most 17 per file).
- census: tri census pin --bless; the gitleaks job now has one run step
  instead of two, so run steps 327 -> 326 and runner-run steps 306 -> 305.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@gHashTag
Merge branch 'master' into security/secret-gate
bba01e8
@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-10-19 04:50:59 UTC

Summary

Status Count
Total Open PRs 50
PRs with Failing Checks 42
PRs with All Checks Green 8
READY 2
FAILING 42
PENDING 0
NO CHECKS YET 0

These columns do not partition: 2 + 42 + 0 + 0 = 44, and there are 50 open PRs. A PR is being counted twice or not at all.

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=03f3de4a3582 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@gHashTag
gHashTag merged commit 1d12620 into master Oct 19, 2026
32 of 36 checks passed
@gHashTag
gHashTag deleted the security/secret-gate branch October 26, 2026 07:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

owner-approved-foreign Owner-approved exception to the only-t27 rule: hand-written foreign code allowed in this PR

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

security: lefthook + gitleaks secret gate (pre-commit, pre-push, CI); remove OSF token

2 participants

@gHashTag @claude