feat(privacy): fail-closed Git identity/secret/host-path gate over all objects

Merged
UN
2mo ago
+1146-82

Implements the forward gate required by pm-github-zqad.

Stacks on #48 — merge #48 first; this branch contains it plus the privacy gate.

What

  • scripts/privacy-gate.ts: enumerates every object in the local store (git cat-file --batch-all-objects, reachable and unreachable), fails closed on unapproved commit author/committer/tagger identities, high-confidence credentials, and absolute personal host paths. Never prints matched values.
  • .github/approved-git-identities.txt: checked-in, per-entry-justified allowlist. Records the maintainer's 2026-07-21 decision to retain stefan@preu.at as public authoring identity; codex@local is deliberately absent following the maintainer-approved history rewrite executed 2026-08-21.
  • Synthetic review fixtures exempted via content-addressed manifest (exact blob OIDs + justification).
  • 18 behavioral tests using real throwaway git repos: each secret rule, host-path detection, identity roles, exemption precision, negative controls, fail-closed paths.

pm items

Summary by Sourcery

Enforce fail-closed privacy checks across Git history and standardize complete-workspace reads on the current pm CLI contract.

New Features:

  • Add a fail-closed privacy gate that audits all local Git objects for unapproved identities, high-confidence credentials, and personal host paths without exposing matched values.
  • Add reviewed, content-addressed exemptions for synthetic privacy fixtures and an approved Git identity allowlist.

Bug Fixes:

  • Prevent privacy violations in reachable or unreachable Git history from passing release validation.

Enhancements:

  • Adopt the canonical pm --pm-path ... list --all full-workspace read contract and remove reliance on the deprecated list-all alias.
  • Raise the supported pm CLI version floor to 2026.8.20 and document the compatibility change.

CI:

  • Run the privacy audit in CI and release checks.

Documentation:

  • Document the canonical complete-workspace pm CLI invocation and updated compatibility requirements.

Tests:

  • Add behavioral coverage using throwaway Git repositories for identity, credential, host-path, exemption, and fail-closed scenarios.
  • Extend acceptance and compatibility tests for the canonical pm CLI contract.

Chores:

  • Record the privacy gate rollout and related project-management history.

Summary by cubic

Adds a fail-closed Git privacy gate that audits every local object for unapproved identities, high-confidence credentials, and absolute personal host paths. Previously there was no forward gate; now CI and release fail on violations, findings never print matched values, headers without a parseable email or with nonstandard separators fail, and exemptions bind only to reviewed fixture blobs.

  • Review and rollout
    • Gate: scripts/privacy-gate.ts walks git cat-file --batch-all-objects (reachable and unreachable), validates commit author/committer/tagger emails against .github/approved-git-identities.txt using header-only scanning and bare role keyword matching, scans blobs for secrets and absolute host paths, and allows exemptions only via a content-addressed blob-OID manifest intersected with fixture blobs present at HEAD.
    • CI and release: .github/workflows/ci.yml runs npm run privacy. CI audits refs/tags; the local release check additionally covers unreachable objects.
    • CLI contract: replace deprecated pm list-all with pm list --all and explicit unbounded output controls; raise floors to @unbrained/pm-cli >=2026.8.20 (manifest and peer), and update docs.
    • Required actions: when adding a new author/committer/tagger, add their email with justification to .github/approved-git-identities.txt; ensure local environments use @unbrained/pm-cli 2026.8.20 or newer.