igneum-labs 3fae316607 CI gate: the feature-branch hook runs the never-push classes (no-secrets, identity grep) beside the structural checks; harness summaries write keys through a redacting writer with its own check ... The class (7 October 2026, 11:26 to 12:47 UK): three fork-gate summaries on ca3-v4-node carried the miners' vote-key hashes under "key" and eight CI runs went red on "no secret file names and no 64-hex secrets in the tree" while the pushing lanes saw nothing: the light gate ran only conflict markers and Windows paths. - tools/ci/pre-push.sh: never_push_checks() (identity grep, no-secrets) runs on every ref from --hook, and inside the full gate where the identity grep already sat; the self-test asserts the wiring; the light gate is about 20 s on the Mac. - infra/fast-time/lib/redact-keys.mjs: writeSummary() shortens every 64-hex value under a key-shaped field to 8 hex and an ellipsis and refuses a text the no-secrets rule would flag (line named); --self-test and --check; the gate runs the self-test. fork-gate.mjs adopts it on ca3-v4-node. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>		2026-10-07 13:09:06 +00:00
..
redact-keys.mjs	CI gate: the feature-branch hook runs the never-push classes (no-secrets, identity grep) beside the structural checks; harness summaries write keys through a redacting writer with its own check	2026-10-07 13:09:06 +00:00