Public mirror: history secrets audit and rewrite plan

kayg commented

2026-10-15 07:29:34 +00:00

Owner

Audit all refs, with detailed findings for dev and main, for secret exposure and non-public infrastructure details. Inventory committed artifacts that belong on Forgejo issues under D262, estimate history pack reduction, and prepare an exact rewrite and branch cut-over plan. No rewrite, force-push, or remote changes are authorized by this issue.

Status: audit not yet run. The full redacted report and receipts will be attached here when complete.

Audit all refs, with detailed findings for dev and main, for secret exposure and non-public infrastructure details. Inventory committed artifacts that belong on Forgejo issues under D262, estimate history pack reduction, and prepare an exact rewrite and branch cut-over plan. No rewrite, force-push, or remote changes are authorized by this issue. Status: audit not yet run. The full redacted report and receipts will be attached here when complete.

verify-iterate-final.log

315 KiB

verify-fast.log

284 KiB

report.md

685 KiB

commit-map.txt

226 KiB

kayg commented

2026-10-15 07:31:27 +00:00

Author

Owner

Started the read-only audit from worktree mesh-issue-survey (detached HEAD 5abc64bb8f96f531b74ddb65c86517bbba61271f). Audit base origin/dev: 4911b5911f7c9e7e8b49524dab088ad4158a98b7; origin/main: 5a0ec9ee7d278ddd2ed8a16bffd1ba6ad2f904c5. The mirror contains 219 refs; dev has 2,826 commits and main has 196; packed object store is 559.11 MiB.

Started the read-only audit from worktree `mesh-issue-survey` (detached HEAD `5abc64bb8f96f531b74ddb65c86517bbba61271f`). Audit base `origin/dev`: `4911b5911f7c9e7e8b49524dab088ad4158a98b7`; `origin/main`: `5a0ec9ee7d278ddd2ed8a16bffd1ba6ad2f904c5`. The mirror contains 219 refs; dev has 2,826 commits and main has 196; packed object store is 559.11 MiB.

kayg commented

2026-10-15 07:37:32 +00:00

Author

Owner

Finding: gitleaks 8.30.1 detect --log-opts=--all reported 373 generic-api-key matches across refs (exit 1). Review found 369 matches in source/provenance JSON manifests as 64-character hexadecimal content digests, not credentials. The remaining three are generic-string false positives: evidence/addhost-round2/reviewer-checklist.md:9 (redacted prefix CLI/…), apps/tracer/test/mock-server.ts:43 (infr…), and apps/tracer/src/auth.ts:6 (infr…). Example digest location: 7d70353f4667c9da6e8e797e97e9498b5d0a3689, evidence/.../perf-provenance.json:123, prefix c51f…. No live credential identified in these findings; no credential verification was performed. Offline TruffleHog scan remains pending.

Finding: gitleaks 8.30.1 `detect --log-opts=--all` reported 373 `generic-api-key` matches across refs (exit 1). Review found 369 matches in source/provenance JSON manifests as 64-character hexadecimal content digests, not credentials. The remaining three are generic-string false positives: `evidence/addhost-round2/reviewer-checklist.md:9` (redacted prefix `CLI/…`), `apps/tracer/test/mock-server.ts:43` (`infr…`), and `apps/tracer/src/auth.ts:6` (`infr…`). Example digest location: `7d70353f4667c9da6e8e797e97e9498b5d0a3689`, `evidence/.../perf-provenance.json:123`, prefix `c51f…`. No live credential identified in these findings; no credential verification was performed. Offline TruffleHog scan remains pending.

kayg commented

2026-10-15 07:45:54 +00:00

Author

Owner

Finding: TruffleHog 3.97.9 completed an all-ref bare-mirror scan with --no-verification (exit 0; verification was not attempted). It reported 15 unverified candidates: two URI matches in test code (scripts/verify-session-labels.py:141, crates/infraternal-shim/src/process_label.rs:273, each prefix http…); 12 WIT-pattern matches in browser/performance receipts, each a 32-character uppercase hexadecimal run/state identifier (examples evidence/perf-vm-browser/.../playwright.json:860, prefix 450C…, and evidence/dev-backmerge/playwright-scoped.log:2191, prefix BEB3…); and one Box-pattern match in the minified vendored terminal bundle, prefix A3EN…, with no adjacent Box label or standalone string context. The URI cases sit in test contexts and target loopback/example hosts. These are classified as test/evidence identifiers or pattern false positives, not confirmed credentials. No candidate was tested. The Nix wrapper injects --no-update; invoking its underlying binary once with that flag avoided a duplicate-flag error.

Finding: TruffleHog 3.97.9 completed an all-ref bare-mirror scan with `--no-verification` (exit 0; verification was not attempted). It reported 15 unverified candidates: two URI matches in test code (`scripts/verify-session-labels.py:141`, `crates/infraternal-shim/src/process_label.rs:273`, each prefix `http…`); 12 WIT-pattern matches in browser/performance receipts, each a 32-character uppercase hexadecimal run/state identifier (examples `evidence/perf-vm-browser/.../playwright.json:860`, prefix `450C…`, and `evidence/dev-backmerge/playwright-scoped.log:2191`, prefix `BEB3…`); and one Box-pattern match in the minified vendored terminal bundle, prefix `A3EN…`, with no adjacent Box label or standalone string context. The URI cases sit in test contexts and target loopback/example hosts. These are classified as test/evidence identifiers or pattern false positives, not confirmed credentials. No candidate was tested. The Nix wrapper injects `--no-update`; invoking its underlying binary once with that flag avoided a duplicate-flag error.

kayg commented

2026-10-15 07:50:39 +00:00

Author

Owner

Finding: the all-ref object inventory contains 23,255 unique blobs (1,006,431,977 uncompressed bytes; pack 559.11 MiB). Receipt paths under evidence/, apps/tracer/captures/, and docs/verification/ account for 10,349 unique blobs and 717,338,929 uncompressed bytes: 245,982,224, 423,914,260, and 47,442,445 bytes respectively. Largest receipt blob: evidence/mesh-cutoff-fast/raw-samples.tar.gz, 43,963,034 bytes, added in 802c3cf3bebbe0f8d9f960d6b4c682799062ae8c. Build inputs to retain include apps/tracer/test/fixtures/binary.bin.gz (20,003,073 bytes), the other tracer test fixtures, vendored JS, and parser sample corpora. The full report maps receipt groups to their originating Forgejo issues using commit references; unmapped capture groups will be routed to #218.

Finding: the all-ref object inventory contains 23,255 unique blobs (1,006,431,977 uncompressed bytes; pack 559.11 MiB). Receipt paths under `evidence/`, `apps/tracer/captures/`, and `docs/verification/` account for 10,349 unique blobs and 717,338,929 uncompressed bytes: 245,982,224, 423,914,260, and 47,442,445 bytes respectively. Largest receipt blob: `evidence/mesh-cutoff-fast/raw-samples.tar.gz`, 43,963,034 bytes, added in `802c3cf3bebbe0f8d9f960d6b4c682799062ae8c`. Build inputs to retain include `apps/tracer/test/fixtures/binary.bin.gz` (20,003,073 bytes), the other tracer test fixtures, vendored JS, and parser sample corpora. The full report maps receipt groups to their originating Forgejo issues using commit references; unmapped capture groups will be routed to #218.

kayg commented

2026-10-15 08:36:45 +00:00

Author

Owner

Correction to my earlier count: line-level review classifies 370 (not 369) of the 373 generic-api-key matches as 64-character hexadecimal content digests in provenance/source manifests. The three remaining matches are the same code/documentation false positives already listed. No live credential was identified; values were not tested.

Correction to my earlier count: line-level review classifies 370 (not 369) of the 373 `generic-api-key` matches as 64-character hexadecimal content digests in provenance/source manifests. The three remaining matches are the same code/documentation false positives already listed. No live credential was identified; values were not tested.

kayg commented

2026-10-15 08:55:05 +00:00

Author

Owner

Security stop: a manual history scan found OpenAI-format token-shaped values in evidence/addhost-netbird-connect/trace.txt at lines 26 and 78. Each line contains redacted-prefix candidates sk-s… (23 characters) and sk-e… (31 characters). The lines contain no test or redaction marker. I did not verify, use, or print either value. Treat them as potentially live and rotate/revoke them if they are yours. I stopped the remaining audit and rewrite simulation pending owner review. The source mirror and worktree remain unchanged.

Security stop: a manual history scan found OpenAI-format token-shaped values in `evidence/addhost-netbird-connect/trace.txt` at lines 26 and 78. Each line contains redacted-prefix candidates `sk-s…` (23 characters) and `sk-e…` (31 characters). The lines contain no test or redaction marker. I did not verify, use, or print either value. Treat them as potentially live and rotate/revoke them if they are yours. I stopped the remaining audit and rewrite simulation pending owner review. The source mirror and worktree remain unchanged.

kayg commented

2026-10-15 08:56:45 +00:00

Author

Owner

Orchestrator: checked the potentially live credential. It is not a credential, it is a false positive. In evidence/addhost-netbird-connect/trace.txt (added e29845a2, removed 902be333), lines 26 and 78 are OpenSSH debug2: host key algorithms: lists. The matched sk-s… and sk-e… values are the FIDO security-key algorithm names sk-ssh-ed25519…@openssh.com and sk-ecdsa-sha2-nistp256…@openssh.com. Nothing to rotate. The audit resumes with these marked as known false positives.

Orchestrator: checked the potentially live credential. It is **not a credential, it is a false positive.** In `evidence/addhost-netbird-connect/trace.txt` (added e29845a2, removed 902be333), lines 26 and 78 are OpenSSH `debug2: host key algorithms:` lists. The matched `sk-s…` and `sk-e…` values are the FIDO security-key algorithm names `sk-ssh-ed25519…@openssh.com` and `sk-ecdsa-sha2-nistp256…@openssh.com`. Nothing to rotate. The audit resumes with these marked as known false positives.

kayg commented

2026-10-15 09:18:41 +00:00

Author

Owner

Resumed security finding: Gitleaks 8.30.1 detect --log-opts=--all with the exact OpenSSH host-key algorithm allowlist completed across all 219 refs (exit 1, 373 generic-api-key matches). Review classifies 370 as 64-character source-content digests in evidence source/provenance manifests and 3 as noncredential text: evidence/addhost-round2/reviewer-checklist.md:9 (CLI/… shorthand), apps/tracer/test/mock-server.ts:43 (test key-context constant, infr…), and apps/tracer/src/auth.ts:6 (key-context label, infr…). Redacted example: 802c3cf3bebbe0f8d9f960d6b4c682799062ae8c, evidence/mesh-cutoff-fast/source-manifest.json:5, "[REDACTED 54ba…]". No real credential was identified or tested. The only exact match present at a branch tip is the harmless apps/tracer/src/auth.ts label at dev; none of the 370 digests remains at either dev or main tip.

Commit metadata review covers 6,173 reachable commits. The author/committer identity is kayg <mail@kayg.org>; this is private identity data, not a credential. Messages contain private infrastructure references including 10.69.69.125, 10.69.69.208, infraternal-dev, monitor01, perf-test-69-63, infraternal.kayg.org, and MacBook/Mac VM/Mac Studio names. No credential-shaped match was found in commit metadata.

Resumed security finding: Gitleaks 8.30.1 `detect --log-opts=--all` with the exact OpenSSH host-key algorithm allowlist completed across all 219 refs (exit 1, 373 `generic-api-key` matches). Review classifies 370 as 64-character source-content digests in evidence source/provenance manifests and 3 as noncredential text: `evidence/addhost-round2/reviewer-checklist.md:9` (`CLI/…` shorthand), `apps/tracer/test/mock-server.ts:43` (test key-context constant, `infr…`), and `apps/tracer/src/auth.ts:6` (key-context label, `infr…`). Redacted example: `802c3cf3bebbe0f8d9f960d6b4c682799062ae8c`, `evidence/mesh-cutoff-fast/source-manifest.json:5`, `"[REDACTED 54ba…]"`. No real credential was identified or tested. The only exact match present at a branch tip is the harmless `apps/tracer/src/auth.ts` label at dev; none of the 370 digests remains at either dev or main tip. Commit metadata review covers 6,173 reachable commits. The author/committer identity is `kayg <mail@kayg.org>`; this is private identity data, not a credential. Messages contain private infrastructure references including `10.69.69.125`, `10.69.69.208`, `infraternal-dev`, `monitor01`, `perf-test-69-63`, `infraternal.kayg.org`, and MacBook/Mac VM/Mac Studio names. No credential-shaped match was found in commit metadata.

kayg commented

2026-10-15 09:42:32 +00:00

Author

Owner

Additional security review: the broad indicator scan yielded 1,849 line-level matches across 632 blobs. Review classified 1,455 as test/example text, 286 as protocol/source identifiers, 80 as PEM parser expressions or placeholders, 16 as issue receipts, 8 as release environment-variable names, and 4 as OpenSSH algorithm names. The remaining 0 rows need context review. No complete private-key material was present in any matched blob; .env-style and kubeconfig paths were absent. Redacted source examples include apps/tracer/real/server.ts:128 (PEM parser expression, no key data) and scripts/release/publish:7 (environment-variable name, no literal token).

TruffleHog 3.97.9 scanned the bare mirror’s refs with --no-update --no-verification (exit 0, verification disabled): 15 unverified candidates. Two URI patterns occur in test code and target loopback/example endpoints; 12 are 32-character uppercase run/context IDs in browser receipts; one is a Base64 pattern in apps/tracer/vendor/ghostty-web/dist/ghostty-web.js:17 inside the embedded WebAssembly data URI, with no service label or standalone context. All 15 are absent from dev and main tips. No candidate was verified or used, and no real credential was identified.

Additional security review: the broad indicator scan yielded 1,849 line-level matches across 632 blobs. Review classified 1,455 as test/example text, 286 as protocol/source identifiers, 80 as PEM parser expressions or placeholders, 16 as issue receipts, 8 as release environment-variable names, and 4 as OpenSSH algorithm names. The remaining 0 rows need context review. No complete private-key material was present in any matched blob; `.env`-style and kubeconfig paths were absent. Redacted source examples include `apps/tracer/real/server.ts:128` (PEM parser expression, no key data) and `scripts/release/publish:7` (environment-variable name, no literal token). TruffleHog 3.97.9 scanned the bare mirror’s refs with `--no-update --no-verification` (exit 0, verification disabled): 15 unverified candidates. Two URI patterns occur in test code and target loopback/example endpoints; 12 are 32-character uppercase run/context IDs in browser receipts; one is a Base64 pattern in `apps/tracer/vendor/ghostty-web/dist/ghostty-web.js:17` inside the embedded WebAssembly data URI, with no service label or standalone context. All 15 are absent from dev and main tips. No candidate was verified or used, and no real credential was identified.

kayg commented

2026-10-15 09:46:39 +00:00

Author

Owner

Rewrite simulation completed in the second scratch clone only; the source mirror and all remotes remain untouched.

Command run:
nix run nixpkgs#git-filter-repo -- --force --invert-paths --path evidence/ --path apps/tracer/captures/ --path docs/verification/

All-ref input pack: 559.11 MiB / 57,836 objects. Simulated pack: 36.17 MiB / 21,919 objects, a 522.94 MiB (93.53%) reduction. dev went from 2,826 to 2,679 commits because 147 commits became empty; main stayed at 196 commits. Simulated tips: dev 2902ab0477910b8a622a8dd63a8672ca9cee9d4c, main 421fc84ca5db8b45e602ec3aeb3c34591e9d9d45. The three receipt roots have 10,349 unique blobs and 717,338,929 uncompressed bytes: evidence/ 245,982,224; apps/tracer/captures/ 423,914,260; docs/verification/ 47,442,445. No paths from those roots remain in simulated dev.

No live credential was found, so no --replace-text rule is warranted. I did not use --strip-blobs-bigger-than: the largest matching build fixture is apps/tracer/test/fixtures/binary.bin.gz (20,003,073 bytes) and should remain. Of 192 receipt groups, 181 map to existing issue references; 11 groups have no issue reference and should be attached to #218. This is a proposed destination inventory, not a claim that attachments have already been made.

Old-to-new commit map: $HOME/.cache/codex-scratch/history-audit/rewrite.git/filter-repo/commit-map. Rewritten-tip scripts/verify iterate is running through the build-slot wrapper; its result will follow.

Rewrite simulation completed in the second scratch clone only; the source mirror and all remotes remain untouched. Command run: `nix run nixpkgs#git-filter-repo -- --force --invert-paths --path evidence/ --path apps/tracer/captures/ --path docs/verification/` All-ref input pack: 559.11 MiB / 57,836 objects. Simulated pack: 36.17 MiB / 21,919 objects, a 522.94 MiB (93.53%) reduction. `dev` went from 2,826 to 2,679 commits because 147 commits became empty; `main` stayed at 196 commits. Simulated tips: `dev` 2902ab0477910b8a622a8dd63a8672ca9cee9d4c, `main` 421fc84ca5db8b45e602ec3aeb3c34591e9d9d45. The three receipt roots have 10,349 unique blobs and 717,338,929 uncompressed bytes: `evidence/` 245,982,224; `apps/tracer/captures/` 423,914,260; `docs/verification/` 47,442,445. No paths from those roots remain in simulated `dev`. No live credential was found, so no `--replace-text` rule is warranted. I did not use `--strip-blobs-bigger-than`: the largest matching build fixture is `apps/tracer/test/fixtures/binary.bin.gz` (20,003,073 bytes) and should remain. Of 192 receipt groups, 181 map to existing issue references; 11 groups have no issue reference and should be attached to #218. This is a proposed destination inventory, not a claim that attachments have already been made. Old-to-new commit map: `$HOME/.cache/codex-scratch/history-audit/rewrite.git/filter-repo/commit-map`. Rewritten-tip `scripts/verify iterate` is running through the build-slot wrapper; its result will follow.

kayg commented

2026-10-15 09:49:13 +00:00

Author

Owner

Correction to the pack-size comparison: the prior 559.11 MiB input measurement included objects from work branches, while the public mirror is limited to dev and main. I measured both proposed public refs with the same fresh-pack recipe (git rev-list --objects refs/heads/dev refs/heads/main | awk '{print $1}' | git pack-objects --stdout --no-reuse-delta --no-reuse-object | wc -c): source history 301,686,843 bytes (287.71 MiB); simulated rewritten history 53,996,950 bytes (51.50 MiB). Estimated reduction is 247,689,893 bytes (236.22 MiB; 82.10%). The all-ref 559.11 MiB figure is only useful as context, not as the public baseline.

Correction to the pack-size comparison: the prior 559.11 MiB input measurement included objects from work branches, while the public mirror is limited to `dev` and `main`. I measured both proposed public refs with the same fresh-pack recipe (`git rev-list --objects refs/heads/dev refs/heads/main | awk '{print $1}' | git pack-objects --stdout --no-reuse-delta --no-reuse-object | wc -c`): source history 301,686,843 bytes (287.71 MiB); simulated rewritten history 53,996,950 bytes (51.50 MiB). Estimated reduction is 247,689,893 bytes (236.22 MiB; 82.10%). The all-ref 559.11 MiB figure is only useful as context, not as the public baseline.

kayg commented

2026-10-15 10:04:10 +00:00

Author

Owner

Status correction: scripts/verify iterate is queued in the host-wide build-slot wrapper and has not started compiling yet (the target directory does not exist). I am keeping the command in that queue and will post its exact result when it runs.

Status correction: `scripts/verify iterate` is queued in the host-wide `build-slot` wrapper and has not started compiling yet (the target directory does not exist). I am keeping the command in that queue and will post its exact result when it runs.

kayg commented

2026-10-15 10:20:24 +00:00

Author

Owner

The rewritten-tip scripts/verify iterate gate remains queued in build-slot (about 35 minutes; all four slots are held by active runs). The wrapper process is active and the target directory is still empty. I am continuing to wait; no slot was cleared or interrupted.

The rewritten-tip `scripts/verify iterate` gate remains queued in `build-slot` (about 35 minutes; all four slots are held by active runs). The wrapper process is active and the target directory is still empty. I am continuing to wait; no slot was cleared or interrupted.

kayg commented

2026-10-15 10:31:50 +00:00

Author

Owner

Update: scripts/verify iterate has waited 45+ minutes in the shared build-slot queue. The four recorded slot holders are still active; the audit command remains queued and I have not interrupted any process. I will continue waiting for a slot.

Update: `scripts/verify iterate` has waited 45+ minutes in the shared build-slot queue. The four recorded slot holders are still active; the audit command remains queued and I have not interrupted any process. I will continue waiting for a slot.

kayg commented

2026-10-15 10:44:18 +00:00

Author

Owner

The first scripts/verify iterate invocation acquired a slot and produced target artifacts, but its session ended before the result could be saved; the exit status and transcript were not retained. I am rerunning it through build-slot with output tee’d to scratch so the gate result is durable. No checkout files changed.

The first `scripts/verify iterate` invocation acquired a slot and produced target artifacts, but its session ended before the result could be saved; the exit status and transcript were not retained. I am rerunning it through `build-slot` with output tee’d to scratch so the gate result is durable. No checkout files changed.

kayg commented

2026-10-15 12:01:43 +00:00

Author

Owner

The first transcript-backed scripts/verify iterate attempt exited 1 at the repository artifact size gate because git-filter-repo removed the scratch clone’s origin remote, leaving origin/dev unresolved. Exact output:


==> Repository artifact size gate
fatal: Not a valid object name origin/dev
repository artifact gate: could not inspect merge base with origin/dev: Command '['git', 'merge-base', 'HEAD', 'origin/dev']' returned non-zero exit status 128.

I will add remote-tracking refs for the simulated rewritten dev and main tips in the scratch clone and rerun. No repository files changed.

The first transcript-backed `scripts/verify iterate` attempt exited 1 at the repository artifact size gate because `git-filter-repo` removed the scratch clone’s `origin` remote, leaving `origin/dev` unresolved. Exact output: ```text ==> Repository artifact size gate fatal: Not a valid object name origin/dev repository artifact gate: could not inspect merge base with origin/dev: Command '['git', 'merge-base', 'HEAD', 'origin/dev']' returned non-zero exit status 128. ``` I will add remote-tracking refs for the simulated rewritten `dev` and `main` tips in the scratch clone and rerun. No repository files changed.

kayg commented

2026-10-15 13:13:03 +00:00

Author

Owner

Corrected rewritten-tip scripts/verify iterate passed at 2902ab0477910b8a622a8dd63a8672ca9cee9d4c (exit 0). The initial failure and its origin/dev cause are documented above. Full transcript: verify-iterate-final.log.

Verbatim final output:

 37 pass
 0 fail
 34463 expect() calls
Ran 37 tests across 10 files. [5.11s]

ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done.

Corrected rewritten-tip `scripts/verify iterate` passed at `2902ab0477910b8a622a8dd63a8672ca9cee9d4c` (exit 0). The initial failure and its `origin/dev` cause are documented above. Full transcript: [verify-iterate-final.log](https://git.kayg.org/attachments/de5962df-f37c-4a66-9437-2ea1da145d12). Verbatim final output: ```text 37 pass 0 fail 34463 expect() calls Ran 37 tests across 10 files. [5.11s] ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done. ```

kayg commented

2026-10-15 14:32:13 +00:00

Author

Owner

scripts/verify fast exited 1. All rows passed except static builds (full transcript: verify-fast.log). The static outputs were:

PT_INTERP: absent; size: 19705112 bytes; cap: 19638744 bytes; delta: +66368 bytes
binary exceeds the 19638744-byte size budget: 19705112 bytes

PT_INTERP: absent; size: 22277392 bytes; cap: 22204304 bytes; delta: +73088 bytes
binary exceeds the 22204304-byte size budget: 22277392 bytes

server subcommand: exit 2, versioned JSON unavailable result
agent subcommand: exit 2, versioned JSON unavailable result
(static builds: 1577s)

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

The arm64 size is +66,368 bytes and x86_64 is +73,088 bytes over their caps, both above the owner’s 64 KiB threshold. The original and rewritten dev trees match for all 1,543 paths outside the three removed receipt roots (0 mode/object differences), so I infer this is a pre-existing source-tree size issue. I did not run the full static gate on the original history. No source or size budget was changed; owner review is needed.

`scripts/verify fast` exited 1. All rows passed except `static builds` (full transcript: [verify-fast.log](https://git.kayg.org/attachments/fdf3a815-2f41-46d3-a040-e681f1b27495)). The static outputs were: ```text PT_INTERP: absent; size: 19705112 bytes; cap: 19638744 bytes; delta: +66368 bytes binary exceeds the 19638744-byte size budget: 19705112 bytes PT_INTERP: absent; size: 22277392 bytes; cap: 22204304 bytes; delta: +73088 bytes binary exceeds the 22204304-byte size budget: 22277392 bytes server subcommand: exit 2, versioned JSON unavailable result agent subcommand: exit 2, versioned JSON unavailable result (static builds: 1577s) +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ``` The arm64 size is +66,368 bytes and x86_64 is +73,088 bytes over their caps, both above the owner’s 64 KiB threshold. The original and rewritten `dev` trees match for all 1,543 paths outside the three removed receipt roots (0 mode/object differences), so I infer this is a pre-existing source-tree size issue. I did not run the full static gate on the original history. No source or size budget was changed; owner review is needed.

kayg commented

2026-10-15 14:35:53 +00:00

Author

Owner

Audit complete. This stayed read-only on the real repository: checkout mesh-issue-survey is clean at 5abc64bb8f96f531b74ddb65c86517bbba61271f; no Forgejo refs or GitHub refs were changed. Simulated rewritten dev is 2902ab0477910b8a622a8dd63a8672ca9cee9d4c.

Credential scan: no real live credential was confirmed. The all-ref scan covered 219 refs and 6,173 commit metadata rows. Gitleaks reported 373 contextual matches: 370 content digests and three harmless source/test labels or constants. The broad sweep classified 1,849 candidates as test/example identifiers, protocol/source identifiers, parser expressions/placeholders, receipt text, environment-variable names, or OpenSSH algorithm names. TruffleHog reported 15 unverified patterns, all receipt IDs, examples, or vendored data. No candidate was tested. The redacted report gives each match’s commit, path, line, short prefix and tip status.

Private, not secret: internal addresses 10.69.69.125, .50, .208, .9, .21, .71, .72, .73, .51, .101, .99, .52, .0, .74, .75, .76, .254, .41, .60, .81, .82, .83; vpn.kayg.org, pve01.vpn.kayg.org; host identifiers infraternal-dev, monitor01, perf-test-69-63, infraternal.kayg.org, MacBook, Mac VM and Mac Studio; author/committer identity kayg <mail@kayg.org>; product mailboxes release@infraternal.com, security@infraternal.com; and local paths containing /home/kayg/Developer/... or /home/kayg/.cache/codex-scratch/.... The report includes exact occurrences and commit metadata details.

Artifact and rewrite estimate: the three receipt roots (evidence/, apps/tracer/captures/, docs/verification/) contain 10,349 unique blobs / 717,338,929 uncompressed bytes. They are receipts; build and test inputs remain. The same fresh-pack recipe for public dev + main gives 301,686,843 bytes (287.71 MiB) before and 53,996,950 bytes (51.50 MiB) after, saving 247,689,893 bytes (82.10%). Simulated dev goes from 2,826 to 2,679 commits; main stays at 196. All 192 receipt groups have proposed issue destinations listed in the report; those attachments must be confirmed before a real removal.

Exact simulated removal command:

/nix/var/nix/profiles/default/bin/nix run nixpkgs#git-filter-repo -- --force --invert-paths \\
  --path evidence/ \\
  --path apps/tracer/captures/ \\
  --path docs/verification/

No --replace-text rule is needed because no real credential was confirmed. The simulation removed receipt paths only. Full report: report.md. Old-to-new commit map: commit-map.txt. Full gate transcripts were attached earlier in this issue: iterate, fast.

Gates at simulated dev: corrected scripts/verify iterate exited 0:

src/mesh-vectors.test.ts:
(pass) every shared Mesh action vector passes through the typed client unchanged [3.78ms]
(pass) shared Mesh event vectors drive the typed watch adapter [6.37ms]

 37 pass
 0 fail
 34463 expect() calls
Ran 37 tests across 10 files. [5.11s]

ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done.

Required scripts/verify fast exited 1. Every row passed except static builds; arm64 exceeded its cap by 66,368 bytes and x86_64 by 73,088 bytes. These are above the 64 KiB owner threshold and need owner review. The source/build tree outside the removed receipt roots is identical (1,543 paths, zero mode/object differences); I did not build the old tip separately, so pre-existing status is not independently measured. Exact gate output:

PT_INTERP: absent; size: 19705112 bytes; cap: 19638744 bytes; delta: +66368 bytes
binary exceeds the 19638744-byte size budget: 19705112 bytes

PT_INTERP: absent; size: 22277392 bytes; cap: 22204304 bytes; delta: +73088 bytes
binary exceeds the 22204304-byte size budget: 22277392 bytes

server subcommand: exit 2, versioned JSON unavailable result
agent subcommand: exit 2, versioned JSON unavailable result
(static builds: 1577s)

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

Cut-over proposal: schedule a push/merge pause; snapshot all refs and make a restorable bundle; confirm/attach each receipt group to its listed issue; rewrite all Forgejo refs together so open work branches remain connected; rescan and run gates; then have the owner update Forgejo refs and configure the public mirror with only dev and main. Preserve the SHA map on #218. Worktree owners fetch rewritten remote branches; rebase private local-only commits onto rewritten dev using the map and rerun their gates. Keep historical SHA references in DECISIONS understandable through the map. Freeze the exact active refs immediately before cut-over. No rewrite or push was performed in this audit.

Audit complete. This stayed read-only on the real repository: checkout `mesh-issue-survey` is clean at `5abc64bb8f96f531b74ddb65c86517bbba61271f`; no Forgejo refs or GitHub refs were changed. Simulated rewritten `dev` is `2902ab0477910b8a622a8dd63a8672ca9cee9d4c`. **Credential scan:** no real live credential was confirmed. The all-ref scan covered 219 refs and 6,173 commit metadata rows. Gitleaks reported 373 contextual matches: 370 content digests and three harmless source/test labels or constants. The broad sweep classified 1,849 candidates as test/example identifiers, protocol/source identifiers, parser expressions/placeholders, receipt text, environment-variable names, or OpenSSH algorithm names. TruffleHog reported 15 unverified patterns, all receipt IDs, examples, or vendored data. No candidate was tested. The redacted report gives each match’s commit, path, line, short prefix and tip status. **Private, not secret:** internal addresses `10.69.69.125`, `.50`, `.208`, `.9`, `.21`, `.71`, `.72`, `.73`, `.51`, `.101`, `.99`, `.52`, `.0`, `.74`, `.75`, `.76`, `.254`, `.41`, `.60`, `.81`, `.82`, `.83`; `vpn.kayg.org`, `pve01.vpn.kayg.org`; host identifiers `infraternal-dev`, `monitor01`, `perf-test-69-63`, `infraternal.kayg.org`, MacBook, Mac VM and Mac Studio; author/committer identity `kayg <mail@kayg.org>`; product mailboxes `release@infraternal.com`, `security@infraternal.com`; and local paths containing `/home/kayg/Developer/...` or `/home/kayg/.cache/codex-scratch/...`. The report includes exact occurrences and commit metadata details. **Artifact and rewrite estimate:** the three receipt roots (`evidence/`, `apps/tracer/captures/`, `docs/verification/`) contain 10,349 unique blobs / 717,338,929 uncompressed bytes. They are receipts; build and test inputs remain. The same fresh-pack recipe for public `dev` + `main` gives 301,686,843 bytes (287.71 MiB) before and 53,996,950 bytes (51.50 MiB) after, saving 247,689,893 bytes (82.10%). Simulated `dev` goes from 2,826 to 2,679 commits; `main` stays at 196. All 192 receipt groups have proposed issue destinations listed in the report; those attachments must be confirmed before a real removal. Exact simulated removal command: ```sh /nix/var/nix/profiles/default/bin/nix run nixpkgs#git-filter-repo -- --force --invert-paths \\ --path evidence/ \\ --path apps/tracer/captures/ \\ --path docs/verification/ ``` No `--replace-text` rule is needed because no real credential was confirmed. The simulation removed receipt paths only. Full report: [report.md](https://git.kayg.org/attachments/619ce7d8-1208-404e-9389-09359cb92e6d). Old-to-new commit map: [commit-map.txt](https://git.kayg.org/attachments/d5f6b65e-2b21-4edd-9045-8018de693f23). Full gate transcripts were attached earlier in this issue: [iterate](https://git.kayg.org/attachments/de5962df-f37c-4a66-9437-2ea1da145d12), [fast](https://git.kayg.org/attachments/fdf3a815-2f41-46d3-a040-e681f1b27495). **Gates at simulated `dev`:** corrected `scripts/verify iterate` exited 0: ```text src/mesh-vectors.test.ts: (pass) every shared Mesh action vector passes through the typed client unchanged [3.78ms] (pass) shared Mesh event vectors drive the typed watch adapter [6.37ms] 37 pass 0 fail 34463 expect() calls Ran 37 tests across 10 files. [5.11s] ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done. ``` Required `scripts/verify fast` exited 1. Every row passed except static builds; arm64 exceeded its cap by 66,368 bytes and x86_64 by 73,088 bytes. These are above the 64 KiB owner threshold and need owner review. The source/build tree outside the removed receipt roots is identical (1,543 paths, zero mode/object differences); I did not build the old tip separately, so pre-existing status is not independently measured. Exact gate output: ```text PT_INTERP: absent; size: 19705112 bytes; cap: 19638744 bytes; delta: +66368 bytes binary exceeds the 19638744-byte size budget: 19705112 bytes PT_INTERP: absent; size: 22277392 bytes; cap: 22204304 bytes; delta: +73088 bytes binary exceeds the 22204304-byte size budget: 22277392 bytes server subcommand: exit 2, versioned JSON unavailable result agent subcommand: exit 2, versioned JSON unavailable result (static builds: 1577s) +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ``` **Cut-over proposal:** schedule a push/merge pause; snapshot all refs and make a restorable bundle; confirm/attach each receipt group to its listed issue; rewrite all Forgejo refs together so open work branches remain connected; rescan and run gates; then have the owner update Forgejo refs and configure the public mirror with only `dev` and `main`. Preserve the SHA map on #218. Worktree owners fetch rewritten remote branches; rebase private local-only commits onto rewritten `dev` using the map and rerun their gates. Keep historical SHA references in DECISIONS understandable through the map. Freeze the exact active refs immediately before cut-over. No rewrite or push was performed in this audit.

kayg commented

2026-10-15 14:36:15 +00:00

Author

Owner

Correction: the code block in my previous comment showed doubled continuation backslashes. The exact simulated removal command, with no shell continuation characters, is:

/nix/var/nix/profiles/default/bin/nix run nixpkgs#git-filter-repo -- --force --invert-paths --path evidence/ --path apps/tracer/captures/ --path docs/verification/

The attached report.md has the same command split across lines with one trailing backslash per continuation.

Correction: the code block in my previous comment showed doubled continuation backslashes. The exact simulated removal command, with no shell continuation characters, is: ```sh /nix/var/nix/profiles/default/bin/nix run nixpkgs#git-filter-repo -- --force --invert-paths --path evidence/ --path apps/tracer/captures/ --path docs/verification/ ``` The attached report.md has the same command split across lines with one trailing backslash per continuation.

kayg referenced this issue

2026-10-28 17:50:46 +00:00

Orchestrator handover 2026-10-28: moving to a new machine #254

~~kayg referenced this issue 2026-10-28 17:53:56 +00:00~~

Orchestrator handover 2026-10-28: moving to a new machine #254

kayg commented

2026-10-28 18:24:04 +00:00

Author

Owner

Secrets scan of the whole repo, 2026-10-29 ~00:50 IST (orchestrator). It covers every ref and tag (--all, incl. the archive/2026-10-28/* tags): 10,257 commits, 29,146 unique text blobs, plus 188 .log.gz files decompressed.

Result: no live secret found. gitleaks 8.30.1 (gitleaks git --log-opts=--all, default rules) reported 404 hits, all false positives:

360+ were generic-api-key matches on per-file SHA-256 checksums in evidence/*provenance.json / frozen-source.json / source-manifest.json.
26 private-key hits were upstream test keys inside #[cfg(test)] in vendor/russh/src/keys/* and helpers.rs.
The rest were a deliberately fake hex token in crates/infraternal/tests/cli_review_r2.rs, the constant KEY_CONTEXT = "infraternal/keywrap/v1", and a "Secrets:" checklist line.

Extra regex pass (emails, public IPv4, PEM key bodies, auth headers, session cookies, 1Password/OpenAI/GitHub/JWT patterns, password and token assignments):

No PEM private-key body outside vendor/. The -----BEGIN PRIVATE KEY----- hits in apps/release-signer are parser error strings.
Session cookies __Host-infraternal=… appear in 4 old evidence logs (evidence/dev-backmerge/*.log, evidence/release-prod-3/browser-head-corrected.log; removed from the tree in 902be3330, still in history). They belong to throwaway local test servers (localhost:4637, localhost:4935), not production, so they are worthless.
Emails: mail@kayg.org is the git author email of every commit (public anyway). All others are test data (*.example, *.lab, *.test) or SSH algorithm names.
Public IPs: 144.24.150.105 (o1.kayg.org, public DNS) in research/data-path/REPORT.md. The rest are documentation, test values or version strings (8.8.8.8, 1.1.1.1, 1.2.3.4, SVG path digits). Production's 37.157.255.66 does not appear.
Token/password assignments are code identifiers and named fixtures (public-recovery-fixture, fixture-only…).

Images were checked by sampling only (2,336 in history; no OCR available): production screenshots under docs/verification/remote-agents/run9-merged-production, app-windows-transport/live-production-relay and evidence/prod-perf-176 show test output and fixtures only.

Not covered by this scan: Forgejo issue bodies, comments and attachments (the repo and its issues are public).

Secrets scan of the whole repo, 2026-10-29 ~00:50 IST (orchestrator). It covers every ref and tag (`--all`, incl. the `archive/2026-10-28/*` tags): 10,257 commits, 29,146 unique text blobs, plus 188 `.log.gz` files decompressed. **Result: no live secret found.** gitleaks 8.30.1 (`gitleaks git --log-opts=--all`, default rules) reported 404 hits, all false positives: - 360+ were `generic-api-key` matches on per-file SHA-256 checksums in `evidence/*provenance.json` / `frozen-source.json` / `source-manifest.json`. - 26 `private-key` hits were upstream test keys inside `#[cfg(test)]` in `vendor/russh/src/keys/*` and `helpers.rs`. - The rest were a deliberately fake hex token in `crates/infraternal/tests/cli_review_r2.rs`, the constant `KEY_CONTEXT = "infraternal/keywrap/v1"`, and a "Secrets:" checklist line. **Extra regex pass** (emails, public IPv4, PEM key bodies, auth headers, session cookies, 1Password/OpenAI/GitHub/JWT patterns, password and token assignments): - No PEM private-key body outside `vendor/`. The `-----BEGIN PRIVATE KEY-----` hits in `apps/release-signer` are parser error strings. - Session cookies `__Host-infraternal=…` appear in 4 old evidence logs (`evidence/dev-backmerge/*.log`, `evidence/release-prod-3/browser-head-corrected.log`; removed from the tree in 902be3330, still in history). They belong to throwaway local test servers (`localhost:4637`, `localhost:4935`), not production, so they are worthless. - Emails: `mail@kayg.org` is the git author email of every commit (public anyway). All others are test data (`*.example`, `*.lab`, `*.test`) or SSH algorithm names. - Public IPs: `144.24.150.105` (`o1.kayg.org`, public DNS) in `research/data-path/REPORT.md`. The rest are documentation, test values or version strings (`8.8.8.8`, `1.1.1.1`, `1.2.3.4`, SVG path digits). Production's `37.157.255.66` does not appear. - Token/password assignments are code identifiers and named fixtures (`public-recovery-fixture`, `fixture-only…`). **Images were checked by sampling only** (2,336 in history; no OCR available): production screenshots under `docs/verification/remote-agents/run9-merged-production`, `app-windows-transport/live-production-relay` and `evidence/prod-perf-176` show test output and fixtures only. Not covered by this scan: Forgejo issue bodies, comments and attachments (the repo and its issues are public).

Rows
Columns

Public mirror: history secrets audit and rewrite plan #218