From b0a320304c91e6257bf2beb27b0eb230b3b039da Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:00 +0000
Subject: [PATCH 01/22] seed .github/workflows/agent-shield.yml


From 0ccde9bbd13728f6e710058f8d87387d4d413ba2 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:02 +0000
Subject: [PATCH 02/22] seed .github/workflows/auto-rebase.yml


From 238d1eff0c89e839b9641960002ac77563ecd866 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:03 +0000
Subject: [PATCH 03/22] seed .github/workflows/ci.yml

---
 .github/workflows/ci.yml | 77 +++++++++++-----------------------------
 1 file changed, 21 insertions(+), 56 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 60b9c17a..f7ccd9ec 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,9 +18,7 @@
 # CONVENTIONS (enforced by the standard):
 #   • permissions: {} at top, least-privilege per job (CI needs contents: read)
 #   • triggers: push + pull_request to main
-#   • concurrency keyed by ref+sha to give each commit its own slot (issue #208):
-#     a per-ref-only group races the synchronize event and can leave HEAD with no
-#     CI results; scoping to github.sha ensures CI always runs to completion on HEAD
+#   • concurrency keyed by ref+sha so a new push cancels the stale run
 #   • SHA-pin every third-party action (never a tag/branch)
 # ─────────────────────────────────────────────────────────────────────────────
 name: CI
@@ -41,44 +39,22 @@ jobs:
   build-and-test:
     name: build-and-test
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     permissions:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Install tools (with retry)
-        run: |
-          for attempt in 1 2 3; do
-            sudo timeout 60 apt-get update -qq && \
-            sudo timeout 90 apt-get install -y -qq bats shellcheck && break
-            [ "$attempt" -lt 3 ] && sleep 5
-          done
-          command -v bats || { echo "bats install failed after 3 attempts"; exit 1; }
-          command -v shellcheck || { echo "shellcheck install failed after 3 attempts"; exit 1; }
-
-      - name: Lint shell scripts
-        run: |
-          shopt -s globstar nullglob
-          shell_files=(*.sh)
-          if [ ${#shell_files[@]} -eq 0 ]; then
-            echo "No shell scripts found — skipping lint."
-          else
-            shellcheck "${shell_files[@]}"
-          fi
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Run bats tests
-        run: |
-          shopt -s globstar nullglob
-          bats_files=(tests/**/*.bats)
-          if [ ${#bats_files[@]} -eq 0 ]; then
-            echo "No bats tests found — skipping."
-            exit 0
-          fi
-          bats "${bats_files[@]}"
+      # ── Replace the step below with your stack's checks ───────────────────────
+      # Standard CI stages: lint, format check, type check, unit tests, coverage
+      # (plus integration / e2e / build where applicable). For example, a Node repo:
+      #   - uses: actions/setup-node@<sha> # vX   (with node-version + cache)
+      #   - run: npm ci
+      #   - run: npm run lint && npm run typecheck && npm test
+      # See BOOTSTRAP.md and the CI standard. Until you add real steps, the
+      # placeholder below keeps the required `build-and-test` check green.
+      - name: Placeholder — replace with real build/test steps
+        run: echo "CI stub — add your stack's lint/format/typecheck/test/coverage steps; see BOOTSTRAP.md."
 
   # Canonical secret-scan job — copied verbatim from push-protection.md#required-ci-job.
   # Produces the `Secret scan (gitleaks)` required check. Uses the gitleaks CLI (not
@@ -87,15 +63,13 @@ jobs:
   secret-scan:
     name: Secret scan (gitleaks)
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     permissions:
       contents: read
     steps:
       - name: Checkout (full history)
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-          persist-credentials: false
 
       - name: Install gitleaks
         env:
@@ -106,11 +80,7 @@ jobs:
         run: |
           tarball="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
           url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${tarball}"
-          for attempt in 1 2 3; do
-            curl -fsSL --connect-timeout 30 --max-time 150 --proto '=https' --proto-redir '=https' "${url}" -o /tmp/gitleaks.tar.gz && break
-            [ "$attempt" -lt 3 ] && sleep 5
-          done
-          [ -s /tmp/gitleaks.tar.gz ] || { echo "gitleaks download failed after 3 attempts"; exit 1; }
+          wget -q "${url}" -O /tmp/gitleaks.tar.gz
           echo "${GITLEAKS_CHECKSUM}  /tmp/gitleaks.tar.gz" | sha256sum -c
           tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
           sudo mv /tmp/gitleaks /usr/local/bin
@@ -127,16 +97,13 @@ jobs:
   coverage:
     name: coverage
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     permissions:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Coverage (shell/bats)
+      - name: Coverage (shell/bats via kcov)
         run: |
           shopt -s globstar nullglob
           bats_files=(tests/**/*.bats)
@@ -144,13 +111,11 @@ jobs:
             echo "No bats tests found — coverage is green until tests exist."
             exit 0
           fi
-          for attempt in 1 2 3; do
-            sudo timeout 60 apt-get update -qq && \
-            sudo timeout 90 apt-get install -y -qq bats && break
-            [ "$attempt" -lt 3 ] && sleep 5
-          done
-          command -v bats || { echo "bats install failed after 3 attempts"; exit 1; }
-          bats "${bats_files[@]}"
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq bats kcov
+          mkdir -p coverage
+          kcov --include-path=. --exclude-path=tests,coverage coverage bats "${bats_files[@]}"
+          echo "Coverage report written to ./coverage"
 
       # ── Per-stack expansion — replace/augment the shell block above for your stack.
       #    Keep the job id and `name:` as `coverage` so the required check is unchanged.

From e30be301a3932899a7e8c79906c87a00207c2b55 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:04 +0000
Subject: [PATCH 04/22] seed .github/workflows/copilot-setup-steps.yml

---
 .github/workflows/copilot-setup-steps.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 9c8f93e7..77c99a42 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -89,7 +89,7 @@ jobs:
       # Note: fetch-depth is always overridden by the agent — set it here only if
       # your install steps need history (rare).
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

From af6ae22b05de78190575c65e5b7413e5774cda16 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:06 +0000
Subject: [PATCH 05/22] seed .github/workflows/dependabot-automerge.yml


From 82eca2e08d46d72361945fc8675fee33b7436f97 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:07 +0000
Subject: [PATCH 06/22] seed .github/workflows/dependabot-rebase.yml


From 22247d2a23b4c85ce2576d1b335c0a3ffce1c5bb Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:08 +0000
Subject: [PATCH 07/22] seed .github/workflows/dependency-audit.yml


From d71d8b35fb2da3dd817579875068f3d099ba843c Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:09 +0000
Subject: [PATCH 08/22] seed .github/workflows/dev-lead.yml


From 16fcc0bcc3f76a00e4da453e099013281eb04281 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:11 +0000
Subject: [PATCH 09/22] seed .github/workflows/pr-review-mention.yml

---
 .github/workflows/pr-review-mention.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pr-review-mention.yml b/.github/workflows/pr-review-mention.yml
index cab04561..289a9900 100644
--- a/.github/workflows/pr-review-mention.yml
+++ b/.github/workflows/pr-review-mention.yml
@@ -44,4 +44,4 @@ jobs:
     uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@pr-review-mention/v2-stable  # NOSONAR(githubactions:S7637) first-party channel ref
     secrets:
       GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS }}
-      DON_PETRY_BOT_GH_PAT: ${{ secrets.DON_PETRY_BOT_GH_PAT }}
+      DON_PETRY_BOT_GH_PAT: ${{ secrets.DON_PETRY_BOT_GH_PAT }}
\ No newline at end of file

From d5140f7c4ef1d9d0a30bb65fce47d8b95af7e714 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:12 +0000
Subject: [PATCH 10/22] seed .github/workflows/sonarcloud.yml

---
 .github/workflows/sonarcloud.yml | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index 9cc159cb..d7aa265f 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -38,24 +38,20 @@ jobs:
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Set up JDK 21
         id: setup_java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
           java-version: '21'
       - name: SonarCloud Scan
         id: sonar
         if: env.SONAR_TOKEN != ''
-        uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8.2.2
+        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
         continue-on-error: true
-      - name: Wait before SonarCloud retry
-        if: env.SONAR_TOKEN != '' && steps.sonar.outcome == 'failure'
-        run: sleep 30
       - name: SonarCloud Scan (retry)
         if: env.SONAR_TOKEN != '' && steps.sonar.outcome == 'failure'
-        uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8.2.2
-
+        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
\ No newline at end of file

From 49214670ceb10ed444d4f3c2c43527773c747f21 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:13 +0000
Subject: [PATCH 11/22] seed AGENTS.md


From 5db428d5a947e1dfcd44840955aa53bc1a4f6746 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:14 +0000
Subject: [PATCH 12/22] seed CLAUDE.md


From 9e83ba10aa51df2892f84eb07ab790c03f622604 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:15 +0000
Subject: [PATCH 13/22] seed .github/CODEOWNERS


From b4a36486ad25ee7c8bd9cee45343943bef1e2ebc Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:16 +0000
Subject: [PATCH 14/22] seed .github/dependabot.yml

---
 .github/dependabot.yml | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3e9a946b..3e2daee1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,16 +5,6 @@
 # Dependabot security updates bypass this limit, so security PRs still open.
 version: 2
 updates:
-  # GitHub Actions — version updates (SHA-pinned; CI catches breaking changes)
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 10
-    labels:
-      - "security"
-      - "dependencies"
-
   # npm — security updates only (limit 0 suppresses version updates)
   - package-ecosystem: "npm"
     directory: "/"
@@ -23,4 +13,4 @@ updates:
     open-pull-requests-limit: 0
     labels:
       - "security"
-      - "dependencies"
+      - "dependencies"
\ No newline at end of file

From fe71aaa75acf9f84efdec38c89deb155f5f8fd25 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:17 +0000
Subject: [PATCH 15/22] seed .gitleaks.toml


From a38018745d28eed48fb68ad74f663a82c1ecd661 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:18 +0000
Subject: [PATCH 16/22] seed sonar-project.properties


From cfc14d8ed4d747bf3bb6fb79e7b640e0cafb03c5 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:19 +0000
Subject: [PATCH 17/22] seed .gitignore

---
 .gitignore | 409 +----------------------------------------------------
 1 file changed, 3 insertions(+), 406 deletions(-)

diff --git a/.gitignore b/.gitignore
index e73822a6..acf1a86b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,408 +1,3 @@
-# >>> BEGIN petry-projects secrets baseline (managed by .github — do not edit) >>>
-# ============================================================================
-# petry-projects baseline .gitignore — SECRETS ONLY
-# ----------------------------------------------------------------------------
-# First layer of defense in the Push Protection Standard
-# (standards/push-protection.md). Complements GitHub secret scanning + push
-# protection, gitleaks pre-commit hooks, and the CI gitleaks job.
-#
-# Scope: SECRETS ONLY. This file is intentionally language-agnostic. Put
-# build artifacts, OS cruft, and editor swap files in per-repo .gitignores or
-# the matching language template from https://github.com/github/gitignore.
-#
-# Ordering note: keep `!` negations IMMEDIATELY AFTER the broad pattern they
-# carve out of. Git evaluates rules top-to-bottom; a later ignore can re-hide
-# a previously-negated file. A negation inside an already-ignored directory
-# does NOT re-include it — always negate by file, never by directory.
-# ============================================================================
-
-
-# ---------------------------------------------------------------------------
-# 1. Dotenv family
-# ---------------------------------------------------------------------------
-# .env files are the single most common source of leaked credentials on GitHub.
-.env
-.env.*
-.envrc
-.env.local
-.env.*.local
-# Keep committed templates so contributors know which vars to set.
-!.env.example
-!.env.sample
-!.env.template
-!.env.*.example
-!.env.*.sample
-!.env.*.template
-# direnv and dotenv-vault artifacts that can contain plaintext values
-.direnv/
-.envrc.local
-.env.vault.keys
-
-
-# ---------------------------------------------------------------------------
-# 2. Cloud provider credential files
-# ---------------------------------------------------------------------------
-# AWS shared credentials & SSO/CLI token caches (live AccessKey / SessionToken)
-.aws/
-aws.credentials
-aws_credentials
-credentials.csv
-# GCP service-account JSON keys and Application Default Credentials
-gcp-key.json
-gcp-service-account*.json
-service-account*.json
-service_account*.json
-application_default_credentials.json
-gha-creds-*.json
-# Azure CLI profile / MSAL token cache
-.azure/
-azureProfile.json
-azureAuth.json
-msal_token_cache.*
-# DigitalOcean, Linode, Hetzner, Fly, Vercel, Netlify, Cloudflare
-.doctl/
-.linode-cli
-.hcloud/
-.fly/
-fly.toml.local
-.vercel/
-.netlify/
-.wrangler/
-.cloudflared/
-
-
-# ---------------------------------------------------------------------------
-# 3. Kubernetes / container / Helm secrets
-# ---------------------------------------------------------------------------
-# kubeconfigs embed bearer tokens and client certs
-kubeconfig
-kubeconfig.*
-*.kubeconfig
-.kube/
-# Docker registry auth (base64 basic auth for registries)
-.docker/config.json
-docker-config.json
-.dockercfg
-# Helm values files that conventionally hold secrets
-secrets.yaml
-secrets.yml
-values.secret.yaml
-values.secret.yml
-values-secrets.yaml
-values-secrets.yml
-*.secrets.yaml
-*.secrets.yml
-# helm-secrets / sops-encrypted values are SAFE to commit — re-allow:
-!*.enc.yaml
-!*.enc.yml
-!secrets.enc.yaml
-!secrets.enc.yml
-# Skaffold / Tilt local overrides
-skaffold.local.yaml
-tilt_config.json
-
-
-# ---------------------------------------------------------------------------
-# 4. SSH / TLS / GPG key material
-# ---------------------------------------------------------------------------
-# Private keys — any common format
-*.pem
-*.key
-*.cer
-*.der
-*.p12
-*.pfx
-*.jks
-*.keystore
-*.truststore
-id_rsa
-id_rsa.*
-id_dsa
-id_dsa.*
-id_ecdsa
-id_ecdsa.*
-id_ed25519
-id_ed25519.*
-*_rsa
-*_dsa
-*_ecdsa
-*_ed25519
-known_hosts
-authorized_keys
-# GPG / PGP
-*.gpg
-*.pgp
-*.asc
-secring.*
-# Re-allow common PUBLIC artifacts that legitimately live in repos
-!*.pub
-!*.pub.pem
-!public.pem
-!public_key.pem
-!*.crt
-!ca.crt
-!*.cert
-# NOTE: *.pem / *.key have HIGH false-positive rates (TLS test fixtures, JWT
-# libraries, webpack dev certs). Per-repo .gitignores should `!` specific
-# fixture FILES — never negate a whole directory.
-
-
-# ---------------------------------------------------------------------------
-# 5. Terraform / IaC state and variables
-# ---------------------------------------------------------------------------
-# State files contain plaintext secrets resolved at apply-time
-*.tfstate
-*.tfstate.*
-*.tfstate.backup
-crash.log
-crash.*.log
-# .tfvars routinely hold secrets — block all, allow only examples
-*.tfvars
-*.tfvars.json
-!*.tfvars.example
-!*.tfvars.sample
-!example.tfvars
-# Local .terraform cache
-.terraform/
-.terraform.lock.hcl.bak
-# Pulumi stack configs (often hold encrypted + plaintext values)
-Pulumi.*.yaml
-!Pulumi.yaml
-# Ansible vault password files
-vault-password
-vault_password
-.vault_pass
-.vault-password-file
-
-
-# ---------------------------------------------------------------------------
-# 6. Secret manager local caches & key material
-# ---------------------------------------------------------------------------
-# SOPS / age — private keys are plaintext files
-.sops/
-sops.agekey
-age.key
-age-key.txt
-keys.txt
-# HashiCorp Vault token files
-.vault-token
-.vault_token
-vault-token
-# Doppler CLI config (contains service tokens)
-.doppler.yaml
-.doppler/
-doppler.yaml
-# 1Password CLI session tokens / service-account tokens
-.op/
-op-session-*
-.1password/
-# Infisical, Bitwarden CLI, chamber, envchain, teller
-.infisical.json
-.bw-session
-.chamber
-.teller.yml
-
-
-# ---------------------------------------------------------------------------
-# 7. Database dumps and DB client dotfiles
-# ---------------------------------------------------------------------------
-# Raw dumps frequently contain PII + embedded credentials in CREATE USER stmts
-*.sql.gz
-*.sql.bz2
-*.sql.xz
-*.sql.zst
-*.dump
-*.bak
-dump.rdb
-mongodump/
-# Client config dotfiles that store passwords in plaintext
-.pgpass
-.my.cnf
-.mylogin.cnf
-.mongorc.js
-.mongoshrc.js
-.psqlrc.local
-.pg_service.conf
-
-
-# ---------------------------------------------------------------------------
-# 8. Package registry / tooling credential dotfiles
-# ---------------------------------------------------------------------------
-# Recent supply-chain attacks specifically targeted these files.
-.npmrc
-.yarnrc
-.yarnrc.yml
-.pypirc
-.gem/credentials
-.gem/
-.cargo/credentials
-.cargo/credentials.toml
-.nuget/
-nuget.config
-NuGet.Config
-.m2/settings.xml
-.gradle/gradle.properties
-gradle-local.properties
-.netrc
-_netrc
-.curlrc
-.wgetrc
-# GH CLI / Git Credential Manager
-.gh-token
-gh_token
-.git-credentials
-.config/gh/hosts.yml
-# NOTE: .npmrc / .yarnrc.yml / nuget.config / gradle.properties also hold
-# legitimate non-secret config. The safer pattern is to commit a `.npmrc.example`
-# and keep the real file ignored. A per-repo override may re-allow a scrubbed
-# root file via `!/.npmrc` if absolutely needed.
-
-
-# ---------------------------------------------------------------------------
-# 9. Cloud CLI session / token caches
-# ---------------------------------------------------------------------------
-# These rarely end up in repos, but when they do they grant live access —
-# usually inside a Dockerfile COPY context that swept in a home dir.
-.aws/sso/cache/
-.aws/cli/cache/
-.config/gcloud/
-.config/gcloud/application_default_credentials.json
-.config/gcloud/legacy_credentials/
-.config/gcloud/access_tokens.db
-.boto
-.s3cfg
-.rclone.conf
-rclone.conf
-.oci/
-.ibmcloud/
-.snowflake/
-.snowsql/config
-.databricks/
-.databrickscfg
-
-
-# ---------------------------------------------------------------------------
-# 10. IDE files known to cache credentials
-# ---------------------------------------------------------------------------
-# JetBrains: workspace.xml can cache DB passwords; dataSources.local.xml
-# holds per-user DB state. dataSources.xml (no .local) is intended for
-# sharing and should not hold passwords — but review before committing.
-.idea/workspace.xml
-.idea/tasks.xml
-.idea/usage.statistics.xml
-.idea/shelf/
-.idea/dataSources.local.xml
-.idea/dataSources/
-.idea/sqlDataSources.xml
-.idea/dynamic.xml
-.idea/**/aws.xml
-# VS Code: sftp.json from the popular SFTP extension embeds passwords.
-# Block local-variant settings; the shared settings.json stays committable.
-.vscode/sftp.json
-.vscode/ftp-sync.json
-.vscode/settings.local.json
-.vscode-server/
-# Eclipse secure storage
-.metadata/.plugins/org.eclipse.core.runtime/.settings/org.eclipse.equinox.security*
-# Cursor / Windsurf / Zed AI assistant caches (2025+)
-.cursor/mcp.json
-.cursor-server/
-.windsurf/
-.zed/settings.json
-# NOTE: do NOT blanket-ignore .idea/ or .vscode/ here — that's a per-repo
-# editor-cruft decision, not a secrets decision.
-
-
-# ---------------------------------------------------------------------------
-# 11. Generic "secret" / "credential" / "private" filename conventions
-# ---------------------------------------------------------------------------
-secrets.json
-secrets.toml
-secrets.env
-secret.yaml
-secret.yml
-secret.json
-credentials
-credentials.yaml
-credentials.yml
-credentials.json
-credentials.toml
-private.json
-private.yaml
-private.yml
-*.secret
-*.secret.*
-*.secrets
-*.private
-*.private.*
-# Re-allow obviously-public template variants
-!*.secret.example
-!*.secrets.example
-!secrets.example.*
-!credentials.example.*
-# Re-allow SOPS/age-encrypted variants (safe to commit)
-!*.enc.yaml
-!*.enc.yml
-!*.enc.json
-!*.sops.yaml
-!*.sops.yml
-!*.sops.json
-
-
-# ---------------------------------------------------------------------------
-# 12. Modern (2024-2026) credential-leak hotspots
-# ---------------------------------------------------------------------------
-# LLM / AI tooling config files where users paste API keys
-.anthropic/
-.openai/
-.ollama/id_ed25519
-.continue/config.json
-.aider.conf.yml
-.aider.model.settings.yml
-# GitHub Copilot local state
-.github-copilot/
-# Supabase / PlanetScale / Neon / Turso CLI auth
-.supabase/
-.pscale/
-.neon/
-.turso/
-# Railway / Render / Fly machine tokens
-.railway/
-.render/
-# Stripe CLI, Twilio CLI, SendGrid
-.stripe/
-.twilio-cli/
-# Temporal, Dagger, Earthly auth
-.temporalio/
-.dagger/
-.earthly/config.yml
-
-# ---------------------------------------------------------------------------
-# 13. Agent / local worktrees and CI-generated tool artifacts (org coding policy)
-# ---------------------------------------------------------------------------
-# Temporary worktrees created by Claude Code and other agents. Not strictly
-# secret material, but the petry-projects coding guidelines require these
-# paths to be ignored in every repo so an agent's scratch worktree cannot
-# be committed accidentally.
-.claude/worktrees/
-.worktrees/
-.dev-lead/
-# CI downloads actionlint into the repo root during linting; ignore the
-# generated binary so local lint runs cannot accidentally commit it.
-actionlint
-actionlint.tar.gz
-
-# ============================================================================
-# End of petry-projects secrets baseline
-# ============================================================================
-# <<< END petry-projects secrets baseline <<<
-#
-# L2 — ecosystem/OS extension (per-repo, free to edit): append language,
-# framework, and OS entries BELOW this line from the matching template at
-# https://github.com/github/gitignore. Never edit inside the markers above,
-# and never re-ignore a path the L1 block negates. See
-# standards/gitignore-standard.md.
-
 # OS / editor
 .DS_Store
 *.swp
@@ -415,5 +10,7 @@ dist/
 build/
 coverage/
 
-# Logs
+# Logs / env
 *.log
+.env
+.env.*
\ No newline at end of file

From 0bbef4751a264c950e18003da72bfbac0c60569b Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:20 +0000
Subject: [PATCH 18/22] seed LICENSE


From 49ca5a341237e7fc39499999b8911eb515c93484 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:21 +0000
Subject: [PATCH 19/22] seed SECURITY.md


From 84cbe4b1347cdf00699a5d09f3f01339ed1fb3e8 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:22 +0000
Subject: [PATCH 20/22] seed README.md

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 98e30aae..6c05ec2a 100644
--- a/README.md
+++ b/README.md
@@ -9,4 +9,4 @@ one-time, per-stack setup (Dependabot + `ci.yml`).
 
 The workflow stubs and baseline files here are a distribution artifact of the org
 standards in [`petry-projects/.github`](https://github.com/petry-projects/.github)
-(`standards/`) and are regenerated from it — edit the standards, not this copy.
+(`standards/`) and are regenerated from it — edit the standards, not this copy.
\ No newline at end of file

From f1b33d43b93f816f3693fe6c304bebd19f7ae85b Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:04:23 +0000
Subject: [PATCH 21/22] seed BOOTSTRAP.md


From 289d2e583f70371bf050366bafa72dbaf5036947 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:12:23 +0000
Subject: [PATCH 22/22] chore: dev-lead update (review-changes) [skip ci-relay]

---
 .github/dependabot.yml                  |  12 +-
 .github/workflows/ci.yml                |  77 +++--
 .github/workflows/pr-review-mention.yml |   2 +-
 .github/workflows/sonarcloud.yml        |  12 +-
 .gitignore                              | 409 +++++++++++++++++++++++-
 5 files changed, 482 insertions(+), 30 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3e2daee1..3e9a946b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,6 +5,16 @@
 # Dependabot security updates bypass this limit, so security PRs still open.
 version: 2
 updates:
+  # GitHub Actions — version updates (SHA-pinned; CI catches breaking changes)
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"
+
   # npm — security updates only (limit 0 suppresses version updates)
   - package-ecosystem: "npm"
     directory: "/"
@@ -13,4 +23,4 @@ updates:
     open-pull-requests-limit: 0
     labels:
       - "security"
-      - "dependencies"
\ No newline at end of file
+      - "dependencies"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f7ccd9ec..60b9c17a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,9 @@
 # CONVENTIONS (enforced by the standard):
 #   • permissions: {} at top, least-privilege per job (CI needs contents: read)
 #   • triggers: push + pull_request to main
-#   • concurrency keyed by ref+sha so a new push cancels the stale run
+#   • concurrency keyed by ref+sha to give each commit its own slot (issue #208):
+#     a per-ref-only group races the synchronize event and can leave HEAD with no
+#     CI results; scoping to github.sha ensures CI always runs to completion on HEAD
 #   • SHA-pin every third-party action (never a tag/branch)
 # ─────────────────────────────────────────────────────────────────────────────
 name: CI
@@ -39,22 +41,44 @@ jobs:
   build-and-test:
     name: build-and-test
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install tools (with retry)
+        run: |
+          for attempt in 1 2 3; do
+            sudo timeout 60 apt-get update -qq && \
+            sudo timeout 90 apt-get install -y -qq bats shellcheck && break
+            [ "$attempt" -lt 3 ] && sleep 5
+          done
+          command -v bats || { echo "bats install failed after 3 attempts"; exit 1; }
+          command -v shellcheck || { echo "shellcheck install failed after 3 attempts"; exit 1; }
+
+      - name: Lint shell scripts
+        run: |
+          shopt -s globstar nullglob
+          shell_files=(*.sh)
+          if [ ${#shell_files[@]} -eq 0 ]; then
+            echo "No shell scripts found — skipping lint."
+          else
+            shellcheck "${shell_files[@]}"
+          fi
 
-      # ── Replace the step below with your stack's checks ───────────────────────
-      # Standard CI stages: lint, format check, type check, unit tests, coverage
-      # (plus integration / e2e / build where applicable). For example, a Node repo:
-      #   - uses: actions/setup-node@<sha> # vX   (with node-version + cache)
-      #   - run: npm ci
-      #   - run: npm run lint && npm run typecheck && npm test
-      # See BOOTSTRAP.md and the CI standard. Until you add real steps, the
-      # placeholder below keeps the required `build-and-test` check green.
-      - name: Placeholder — replace with real build/test steps
-        run: echo "CI stub — add your stack's lint/format/typecheck/test/coverage steps; see BOOTSTRAP.md."
+      - name: Run bats tests
+        run: |
+          shopt -s globstar nullglob
+          bats_files=(tests/**/*.bats)
+          if [ ${#bats_files[@]} -eq 0 ]; then
+            echo "No bats tests found — skipping."
+            exit 0
+          fi
+          bats "${bats_files[@]}"
 
   # Canonical secret-scan job — copied verbatim from push-protection.md#required-ci-job.
   # Produces the `Secret scan (gitleaks)` required check. Uses the gitleaks CLI (not
@@ -63,13 +87,15 @@ jobs:
   secret-scan:
     name: Secret scan (gitleaks)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
       - name: Checkout (full history)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Install gitleaks
         env:
@@ -80,7 +106,11 @@ jobs:
         run: |
           tarball="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
           url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${tarball}"
-          wget -q "${url}" -O /tmp/gitleaks.tar.gz
+          for attempt in 1 2 3; do
+            curl -fsSL --connect-timeout 30 --max-time 150 --proto '=https' --proto-redir '=https' "${url}" -o /tmp/gitleaks.tar.gz && break
+            [ "$attempt" -lt 3 ] && sleep 5
+          done
+          [ -s /tmp/gitleaks.tar.gz ] || { echo "gitleaks download failed after 3 attempts"; exit 1; }
           echo "${GITLEAKS_CHECKSUM}  /tmp/gitleaks.tar.gz" | sha256sum -c
           tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
           sudo mv /tmp/gitleaks /usr/local/bin
@@ -97,13 +127,16 @@ jobs:
   coverage:
     name: coverage
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
-      - name: Coverage (shell/bats via kcov)
+      - name: Coverage (shell/bats)
         run: |
           shopt -s globstar nullglob
           bats_files=(tests/**/*.bats)
@@ -111,11 +144,13 @@ jobs:
             echo "No bats tests found — coverage is green until tests exist."
             exit 0
           fi
-          sudo apt-get update -qq
-          sudo apt-get install -y -qq bats kcov
-          mkdir -p coverage
-          kcov --include-path=. --exclude-path=tests,coverage coverage bats "${bats_files[@]}"
-          echo "Coverage report written to ./coverage"
+          for attempt in 1 2 3; do
+            sudo timeout 60 apt-get update -qq && \
+            sudo timeout 90 apt-get install -y -qq bats && break
+            [ "$attempt" -lt 3 ] && sleep 5
+          done
+          command -v bats || { echo "bats install failed after 3 attempts"; exit 1; }
+          bats "${bats_files[@]}"
 
       # ── Per-stack expansion — replace/augment the shell block above for your stack.
       #    Keep the job id and `name:` as `coverage` so the required check is unchanged.
diff --git a/.github/workflows/pr-review-mention.yml b/.github/workflows/pr-review-mention.yml
index 289a9900..cab04561 100644
--- a/.github/workflows/pr-review-mention.yml
+++ b/.github/workflows/pr-review-mention.yml
@@ -44,4 +44,4 @@ jobs:
     uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@pr-review-mention/v2-stable  # NOSONAR(githubactions:S7637) first-party channel ref
     secrets:
       GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS }}
-      DON_PETRY_BOT_GH_PAT: ${{ secrets.DON_PETRY_BOT_GH_PAT }}
\ No newline at end of file
+      DON_PETRY_BOT_GH_PAT: ${{ secrets.DON_PETRY_BOT_GH_PAT }}
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index d7aa265f..9cc159cb 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -38,20 +38,24 @@ jobs:
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Set up JDK 21
         id: setup_java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '21'
       - name: SonarCloud Scan
         id: sonar
         if: env.SONAR_TOKEN != ''
-        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
+        uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8.2.2
         continue-on-error: true
+      - name: Wait before SonarCloud retry
+        if: env.SONAR_TOKEN != '' && steps.sonar.outcome == 'failure'
+        run: sleep 30
       - name: SonarCloud Scan (retry)
         if: env.SONAR_TOKEN != '' && steps.sonar.outcome == 'failure'
-        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
\ No newline at end of file
+        uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8.2.2
+
diff --git a/.gitignore b/.gitignore
index acf1a86b..e73822a6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,408 @@
+# >>> BEGIN petry-projects secrets baseline (managed by .github — do not edit) >>>
+# ============================================================================
+# petry-projects baseline .gitignore — SECRETS ONLY
+# ----------------------------------------------------------------------------
+# First layer of defense in the Push Protection Standard
+# (standards/push-protection.md). Complements GitHub secret scanning + push
+# protection, gitleaks pre-commit hooks, and the CI gitleaks job.
+#
+# Scope: SECRETS ONLY. This file is intentionally language-agnostic. Put
+# build artifacts, OS cruft, and editor swap files in per-repo .gitignores or
+# the matching language template from https://github.com/github/gitignore.
+#
+# Ordering note: keep `!` negations IMMEDIATELY AFTER the broad pattern they
+# carve out of. Git evaluates rules top-to-bottom; a later ignore can re-hide
+# a previously-negated file. A negation inside an already-ignored directory
+# does NOT re-include it — always negate by file, never by directory.
+# ============================================================================
+
+
+# ---------------------------------------------------------------------------
+# 1. Dotenv family
+# ---------------------------------------------------------------------------
+# .env files are the single most common source of leaked credentials on GitHub.
+.env
+.env.*
+.envrc
+.env.local
+.env.*.local
+# Keep committed templates so contributors know which vars to set.
+!.env.example
+!.env.sample
+!.env.template
+!.env.*.example
+!.env.*.sample
+!.env.*.template
+# direnv and dotenv-vault artifacts that can contain plaintext values
+.direnv/
+.envrc.local
+.env.vault.keys
+
+
+# ---------------------------------------------------------------------------
+# 2. Cloud provider credential files
+# ---------------------------------------------------------------------------
+# AWS shared credentials & SSO/CLI token caches (live AccessKey / SessionToken)
+.aws/
+aws.credentials
+aws_credentials
+credentials.csv
+# GCP service-account JSON keys and Application Default Credentials
+gcp-key.json
+gcp-service-account*.json
+service-account*.json
+service_account*.json
+application_default_credentials.json
+gha-creds-*.json
+# Azure CLI profile / MSAL token cache
+.azure/
+azureProfile.json
+azureAuth.json
+msal_token_cache.*
+# DigitalOcean, Linode, Hetzner, Fly, Vercel, Netlify, Cloudflare
+.doctl/
+.linode-cli
+.hcloud/
+.fly/
+fly.toml.local
+.vercel/
+.netlify/
+.wrangler/
+.cloudflared/
+
+
+# ---------------------------------------------------------------------------
+# 3. Kubernetes / container / Helm secrets
+# ---------------------------------------------------------------------------
+# kubeconfigs embed bearer tokens and client certs
+kubeconfig
+kubeconfig.*
+*.kubeconfig
+.kube/
+# Docker registry auth (base64 basic auth for registries)
+.docker/config.json
+docker-config.json
+.dockercfg
+# Helm values files that conventionally hold secrets
+secrets.yaml
+secrets.yml
+values.secret.yaml
+values.secret.yml
+values-secrets.yaml
+values-secrets.yml
+*.secrets.yaml
+*.secrets.yml
+# helm-secrets / sops-encrypted values are SAFE to commit — re-allow:
+!*.enc.yaml
+!*.enc.yml
+!secrets.enc.yaml
+!secrets.enc.yml
+# Skaffold / Tilt local overrides
+skaffold.local.yaml
+tilt_config.json
+
+
+# ---------------------------------------------------------------------------
+# 4. SSH / TLS / GPG key material
+# ---------------------------------------------------------------------------
+# Private keys — any common format
+*.pem
+*.key
+*.cer
+*.der
+*.p12
+*.pfx
+*.jks
+*.keystore
+*.truststore
+id_rsa
+id_rsa.*
+id_dsa
+id_dsa.*
+id_ecdsa
+id_ecdsa.*
+id_ed25519
+id_ed25519.*
+*_rsa
+*_dsa
+*_ecdsa
+*_ed25519
+known_hosts
+authorized_keys
+# GPG / PGP
+*.gpg
+*.pgp
+*.asc
+secring.*
+# Re-allow common PUBLIC artifacts that legitimately live in repos
+!*.pub
+!*.pub.pem
+!public.pem
+!public_key.pem
+!*.crt
+!ca.crt
+!*.cert
+# NOTE: *.pem / *.key have HIGH false-positive rates (TLS test fixtures, JWT
+# libraries, webpack dev certs). Per-repo .gitignores should `!` specific
+# fixture FILES — never negate a whole directory.
+
+
+# ---------------------------------------------------------------------------
+# 5. Terraform / IaC state and variables
+# ---------------------------------------------------------------------------
+# State files contain plaintext secrets resolved at apply-time
+*.tfstate
+*.tfstate.*
+*.tfstate.backup
+crash.log
+crash.*.log
+# .tfvars routinely hold secrets — block all, allow only examples
+*.tfvars
+*.tfvars.json
+!*.tfvars.example
+!*.tfvars.sample
+!example.tfvars
+# Local .terraform cache
+.terraform/
+.terraform.lock.hcl.bak
+# Pulumi stack configs (often hold encrypted + plaintext values)
+Pulumi.*.yaml
+!Pulumi.yaml
+# Ansible vault password files
+vault-password
+vault_password
+.vault_pass
+.vault-password-file
+
+
+# ---------------------------------------------------------------------------
+# 6. Secret manager local caches & key material
+# ---------------------------------------------------------------------------
+# SOPS / age — private keys are plaintext files
+.sops/
+sops.agekey
+age.key
+age-key.txt
+keys.txt
+# HashiCorp Vault token files
+.vault-token
+.vault_token
+vault-token
+# Doppler CLI config (contains service tokens)
+.doppler.yaml
+.doppler/
+doppler.yaml
+# 1Password CLI session tokens / service-account tokens
+.op/
+op-session-*
+.1password/
+# Infisical, Bitwarden CLI, chamber, envchain, teller
+.infisical.json
+.bw-session
+.chamber
+.teller.yml
+
+
+# ---------------------------------------------------------------------------
+# 7. Database dumps and DB client dotfiles
+# ---------------------------------------------------------------------------
+# Raw dumps frequently contain PII + embedded credentials in CREATE USER stmts
+*.sql.gz
+*.sql.bz2
+*.sql.xz
+*.sql.zst
+*.dump
+*.bak
+dump.rdb
+mongodump/
+# Client config dotfiles that store passwords in plaintext
+.pgpass
+.my.cnf
+.mylogin.cnf
+.mongorc.js
+.mongoshrc.js
+.psqlrc.local
+.pg_service.conf
+
+
+# ---------------------------------------------------------------------------
+# 8. Package registry / tooling credential dotfiles
+# ---------------------------------------------------------------------------
+# Recent supply-chain attacks specifically targeted these files.
+.npmrc
+.yarnrc
+.yarnrc.yml
+.pypirc
+.gem/credentials
+.gem/
+.cargo/credentials
+.cargo/credentials.toml
+.nuget/
+nuget.config
+NuGet.Config
+.m2/settings.xml
+.gradle/gradle.properties
+gradle-local.properties
+.netrc
+_netrc
+.curlrc
+.wgetrc
+# GH CLI / Git Credential Manager
+.gh-token
+gh_token
+.git-credentials
+.config/gh/hosts.yml
+# NOTE: .npmrc / .yarnrc.yml / nuget.config / gradle.properties also hold
+# legitimate non-secret config. The safer pattern is to commit a `.npmrc.example`
+# and keep the real file ignored. A per-repo override may re-allow a scrubbed
+# root file via `!/.npmrc` if absolutely needed.
+
+
+# ---------------------------------------------------------------------------
+# 9. Cloud CLI session / token caches
+# ---------------------------------------------------------------------------
+# These rarely end up in repos, but when they do they grant live access —
+# usually inside a Dockerfile COPY context that swept in a home dir.
+.aws/sso/cache/
+.aws/cli/cache/
+.config/gcloud/
+.config/gcloud/application_default_credentials.json
+.config/gcloud/legacy_credentials/
+.config/gcloud/access_tokens.db
+.boto
+.s3cfg
+.rclone.conf
+rclone.conf
+.oci/
+.ibmcloud/
+.snowflake/
+.snowsql/config
+.databricks/
+.databrickscfg
+
+
+# ---------------------------------------------------------------------------
+# 10. IDE files known to cache credentials
+# ---------------------------------------------------------------------------
+# JetBrains: workspace.xml can cache DB passwords; dataSources.local.xml
+# holds per-user DB state. dataSources.xml (no .local) is intended for
+# sharing and should not hold passwords — but review before committing.
+.idea/workspace.xml
+.idea/tasks.xml
+.idea/usage.statistics.xml
+.idea/shelf/
+.idea/dataSources.local.xml
+.idea/dataSources/
+.idea/sqlDataSources.xml
+.idea/dynamic.xml
+.idea/**/aws.xml
+# VS Code: sftp.json from the popular SFTP extension embeds passwords.
+# Block local-variant settings; the shared settings.json stays committable.
+.vscode/sftp.json
+.vscode/ftp-sync.json
+.vscode/settings.local.json
+.vscode-server/
+# Eclipse secure storage
+.metadata/.plugins/org.eclipse.core.runtime/.settings/org.eclipse.equinox.security*
+# Cursor / Windsurf / Zed AI assistant caches (2025+)
+.cursor/mcp.json
+.cursor-server/
+.windsurf/
+.zed/settings.json
+# NOTE: do NOT blanket-ignore .idea/ or .vscode/ here — that's a per-repo
+# editor-cruft decision, not a secrets decision.
+
+
+# ---------------------------------------------------------------------------
+# 11. Generic "secret" / "credential" / "private" filename conventions
+# ---------------------------------------------------------------------------
+secrets.json
+secrets.toml
+secrets.env
+secret.yaml
+secret.yml
+secret.json
+credentials
+credentials.yaml
+credentials.yml
+credentials.json
+credentials.toml
+private.json
+private.yaml
+private.yml
+*.secret
+*.secret.*
+*.secrets
+*.private
+*.private.*
+# Re-allow obviously-public template variants
+!*.secret.example
+!*.secrets.example
+!secrets.example.*
+!credentials.example.*
+# Re-allow SOPS/age-encrypted variants (safe to commit)
+!*.enc.yaml
+!*.enc.yml
+!*.enc.json
+!*.sops.yaml
+!*.sops.yml
+!*.sops.json
+
+
+# ---------------------------------------------------------------------------
+# 12. Modern (2024-2026) credential-leak hotspots
+# ---------------------------------------------------------------------------
+# LLM / AI tooling config files where users paste API keys
+.anthropic/
+.openai/
+.ollama/id_ed25519
+.continue/config.json
+.aider.conf.yml
+.aider.model.settings.yml
+# GitHub Copilot local state
+.github-copilot/
+# Supabase / PlanetScale / Neon / Turso CLI auth
+.supabase/
+.pscale/
+.neon/
+.turso/
+# Railway / Render / Fly machine tokens
+.railway/
+.render/
+# Stripe CLI, Twilio CLI, SendGrid
+.stripe/
+.twilio-cli/
+# Temporal, Dagger, Earthly auth
+.temporalio/
+.dagger/
+.earthly/config.yml
+
+# ---------------------------------------------------------------------------
+# 13. Agent / local worktrees and CI-generated tool artifacts (org coding policy)
+# ---------------------------------------------------------------------------
+# Temporary worktrees created by Claude Code and other agents. Not strictly
+# secret material, but the petry-projects coding guidelines require these
+# paths to be ignored in every repo so an agent's scratch worktree cannot
+# be committed accidentally.
+.claude/worktrees/
+.worktrees/
+.dev-lead/
+# CI downloads actionlint into the repo root during linting; ignore the
+# generated binary so local lint runs cannot accidentally commit it.
+actionlint
+actionlint.tar.gz
+
+# ============================================================================
+# End of petry-projects secrets baseline
+# ============================================================================
+# <<< END petry-projects secrets baseline <<<
+#
+# L2 — ecosystem/OS extension (per-repo, free to edit): append language,
+# framework, and OS entries BELOW this line from the matching template at
+# https://github.com/github/gitignore. Never edit inside the markers above,
+# and never re-ignore a path the L1 block negates. See
+# standards/gitignore-standard.md.
+
 # OS / editor
 .DS_Store
 *.swp
@@ -10,7 +415,5 @@ dist/
 build/
 coverage/
 
-# Logs / env
+# Logs
 *.log
-.env
-.env.*
\ No newline at end of file