From 1cc4ccd258bcc855c3161affb2b843c4d0295a47 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Tue, 11 Aug 2026 05:54:41 -0400 Subject: [PATCH] docs(playbook): scan commit content too, and record which repos lack a .claude/ ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A filename audit finds the wrong-file problem; it cannot find a credential pasted into a legitimately-tracked doc. Both checks are cheap and catch disjoint failures. Verified: .claude/ is gitignored in OtOpcUa and HistorianGateway, NOT in mxgw or ScadaBridge — in those two, enumerate-first discipline is the only guard. --- admin_ui_cleanup.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/admin_ui_cleanup.md b/admin_ui_cleanup.md index 7c4b3ef..95ff8ed 100644 --- a/admin_ui_cleanup.md +++ b/admin_ui_cleanup.md @@ -398,6 +398,23 @@ that had to be made deliberately (`.claude/`, and a `docker-compose.yml` carryin `DisableLogin` override) — in both cases the exclusion was agreed before the commit existed, which is the only point at which it is cheap. + **Audit the commit's CONTENT, not just its file list — they catch disjoint failures.** A filename + audit finds the wrong-file problem (`.claude/`, a stray `.db`, a `.pfx`). It cannot find the + right-file-wrong-content problem: a sweep whose live gate mints an API key, a token or a connection + string can paste it into a *legitimately tracked* plan doc, where a `--name-only` check sees a file + that is supposed to be there. So run both: + + ```bash + git diff --name-only .. # wrong-file + git show .. | grep -inE '(api[_-]?key|password|secret|token|bearer|connectionstring)[\"'"'"' :=]+[A-Za-z0-9+/_-]{12,}' + ``` + + Verified 2026-08-11 across this family: **`.claude/` is gitignored in OtOpcUa (`.gitignore:32`) and + HistorianGateway (`.gitignore:51`), but NOT in MxAccessGateway or ScadaBridge.** In those two the + enumerate-first discipline is the *only* thing between a "commit the sweep" instruction and local + permission config in a production commit — and ScadaBridge is exactly the repo where it nearly + happened. Adding the ignore line to the two that lack it converts a discipline into a guarantee. + **When every hypothesis is falsified, test the SHARED PREMISE before adding a new one.** Two investigations into a 0-byte log file eliminated, between them, config levels, env vars in five scopes, ACLs, stale files and a two-stage bootstrap — and deadlocked. The unexamined premise both