Site: the engineering log page renders a scrubbed copy of the bench log and the build fails on any private string (R4.6.1)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

site/.gitignore

@@ -1,2 +1,3 @@
 .vercel
 .env*
+.bench-scrubbed.md

site/build.mjs

@@ -3,6 +3,7 @@
 // is never rendered here.
 // Runs on every deploy (Vercel build command) and locally with `node build.mjs`.
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { execSync } from 'node:child_process';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -134,7 +135,11 @@ footer{border-top:1px solid var(--line);padding-block:32px 48px;font-size:13px;c
 
 let built = [];
 if (existsSync(join(docs, 'bench-log.md'))) {
-  const src = readFileSync(join(docs, 'bench-log.md'), 'utf8');
+  // the public /bench page renders a SCRUBBED copy (site/scrub-bench.sh: the public repository's export rules plus
+  // site-only ones); the build fails rather than publish a private name, host or address (review round 4, R4.6.1)
+  const scrubbed = join(here, '.bench-scrubbed.md');
+  execSync(`"${join(here, 'scrub-bench.sh')}" "${join(docs, 'bench-log.md')}" "${scrubbed}"`, { stdio: 'inherit' });
+  const src = readFileSync(scrubbed, 'utf8');
   const { html, toc } = md(src);
   writeFileSync(join(here, 'bench.html'), page('Igneum engineering log', 'Every Igneum benchmark and test, with the hardware and the commands that produced it. Prototype numbers are labelled as such.', html, toc,
     'Every measurement the project has made, newest at the bottom, written by the people and agents who ran it, with the commands and hardware. Prototype numbers are not mining numbers and say so.',

site/journey.json

@@ -50,6 +50,31 @@
     }
   ],
   "log": [
+    {
+      "date": "2026-10-04",
+      "text": "One-click Windows workers: what the Apple M5 Max could measure",
+      "short": "One-click Windows workers"
+    },
+    {
+      "date": "2026-10-04",
+      "text": "The gfx1036 worker fault and what the Apple M5 Max could and could not reproduce",
+      "short": "The gfx1036 worker fault and what the Apple M5 Max could and could…"
+    },
+    {
+      "date": "2026-10-04",
+      "text": "Difficulty rule v2: the live oscillation, its cause, the DAG replay, the fix behind a height switch",
+      "short": "Difficulty rule v2"
+    },
+    {
+      "date": "2026-10-04",
+      "text": "The observer stored nothing for 78 minutes, then 7,022 blocks in two minutes",
+      "short": "The observer stored nothing for 78 minutes, then 7,022 blocks in two…"
+    },
+    {
+      "date": "2026-10-04",
+      "text": "PC 2 at the 14:20 boundary: a worker stuck on the previous epoch",
+      "short": "PC 2 at the 14:20 boundary: a worker stuck on the previous epoch"
+    },
     {
       "date": "2026-10-04",
       "text": "The gfx1036 worker fault and what the Mac could and could not reproduce",
@@ -224,11 +249,6 @@
       "date": "2026-10-03",
       "text": "First prototype of the random-program lottery hash ran on an Apple M5 Max. GPU and CPU agreed bit for bit.",
       "short": "First prototype of the lottery hash on Apple silicon"
-    },
-    {
-      "date": "2026-10-03",
-      "text": "Igneum named. Litepaper, brand and wallet designs published.",
-      "short": "Igneum named. Litepaper, brand and wallet designs published"
     }
   ]
 }

site/scrub-bench.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Scrubs a copy of docs/bench-log.md for the public /bench page: the same rules the public repository export applies
+# (tools/sync.sh scrub + scrub_benchlog + the private sync.local.sed), plus the site-only rules below. Exits 1 if any
+# forbidden string survives, so build.mjs refuses to render a page that names private machines, hosts or people.
+#   site/scrub-bench.sh <in.md> <out.md>
+set -euo pipefail
+IN="$1"; OUT="$2"; PUB="${IGNEUM_PUBLIC_REPO:-$HOME/Projects/igneum-public}"
+cp "$IN" "$OUT"
+if [ -f "$PUB/tools/sync.sh" ]; then
+  FNS="$(mktemp)"; sed -n '/^scrub() {/,/^}/p; /^scrub_benchlog() {/,/^}/p' "$PUB/tools/sync.sh" > "$FNS"
+  # shellcheck disable=SC1090
+  source "$FNS"; rm -f "$FNS"
+  scrub "$OUT"; scrub_benchlog "$OUT"
+  [ -f "$PUB/tools/sync.local.sed" ] && perl -pi -f "$PUB/tools/sync.local.sed" "$OUT"
+else
+  echo "scrub-bench: public repository scrub rules not found at $PUB; refusing to render /bench" >&2; exit 1
+fi
+perl -pi -e '
+  s/\bJosh\x27s\b/the maintainers\x27/g; s/\bJosh\b/the maintainers/g;
+  s/igneum-seed-\d+/the seed node/g; s/\bHetzner\b/the cloud provider/g; s/\bhcloud\b/the cloud CLI/g;
+  s/DESKTOP-[A-Z0-9]{7}/<pc-hostname>/g; s#/root/[A-Za-z0-9_./-]*#<server path>#g; s#/opt/igneum[A-Za-z0-9_./-]*#<server path>#g;
+  s/dl\.igneum\.network[^ )`]*/the downloads host/g; s/,? ?log intake id \d+//g; s/\bintake id \d+\b/intake/g;
+  s/\bCLAUDE\.md\b/the design document/g; s/\(CLAUDE\.md, /(the design document, /g;
+  s/\b(\d{1,2}):(\d{2})(:\d{2})? BST\b/sprintf("%02d:%s%s UTC",($1+23)%24,$2,$3\/\/"")/ge; s/\(local time, UTC\+1\)/(UTC)/g; s/\bBST\b/UTC/g;
+  s/\b(\d+) (?:cloud provider|Hetzner) nodes\b/$1 cloud nodes/g;
+' "$OUT"
+PAT="$(dirname "$0")/../tools/ci/forbidden-strings.txt"
+EXTRA='Josh|Hetzner|igneum-seed|/root/|/opt/igneum|DESKTOP-[A-Z0-9]{7}|dl\.igneum|intake id|CLAUDE\.md|\bBST\b|192\.168\.|DESKTOP-KMCV'
+PATS="$(mktemp)"; [ -f "$PAT" ] && grep -vE '^\s*(#|$)' "$PAT" > "$PATS" || true; echo "$EXTRA" | tr '|' '\n' >> "$PATS"
+HITS=$(grep -nE -f "$PATS" "$OUT" || true); rm -f "$PATS"
+if [ -n "$HITS" ]; then echo "scrub-bench: forbidden strings remain:" >&2; echo "$HITS" | head -20 >&2; exit 1; fi
+echo "scrub-bench: clean ($(wc -l < "$OUT") lines)"