autonomic-bot
8cf08fd834
Some checks failed
continuous-integration/drone/push Build is failing
Adversary finding F-redfix-2 (non-blocking): config.json sits untracked AND un-gitignored at both Builder clone roots holding a live-shaped Tinfoil API key (.provider.tinfoil.options.apiKey) -- one `git add -A` from being pushed to git.autonomic.zone. Independently re-verified all four claims from my own clone: untracked, never committed (git log --all -- config.json empty), not ignored, key live-shaped. Latent risk, NOT an existing leak. Remedy: add config.json to the "local secrets / env -- never commit" block. Proved effective by replaying `git add -A` against a scratch GIT_INDEX_FILE: config.json is no longer staged (only .gitignore, main.go). Did not delete/move config.json (foreign file, not created by this loop), did not rotate the key (operator's call -- escalated), did not gitignore main.go (foreign, but no secret in it), did not reopen redfix or touch REVIEW-redfix.md. Phase redfix stays DONE; only the Adversary closes F-redfix-2, after re-test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018nVVSxRnj3K5MxGGRJzvTe
21 lines
331 B
Plaintext
21 lines
331 B
Plaintext
# local secrets / env — never commit
|
|
.testenv
|
|
*.key
|
|
*.pem
|
|
!docs/**/*.pem
|
|
# holds a live provider API key at .provider.tinfoil.options.apiKey (F-redfix-2)
|
|
config.json
|
|
# python
|
|
__pycache__/
|
|
*.pyc
|
|
.venv/
|
|
.pytest_cache/
|
|
# run-scoped ephemeral state (per §4.4 sidecars)
|
|
runs/
|
|
# nix
|
|
result
|
|
result-*
|
|
|
|
# harness/loop artifacts
|
|
.claude/
|