feat(soul): add deterministic import-queue scan and self-test #240
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/soul-import-scan"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
scripts/soul-import-scan.sh scans a layered-soul review queue before any file is
promoted from a private soul source: never-copy paths (template list in
scripts/soul-import-never-copy.txt), credential-shaped content, tailnet addresses
and names, and PII. It prints only KIND path:line, never the matched text, and
fails closed on symlinks, binary and oversized files. --allow accepts a reviewed
kind but still prints it. A clean result means no obvious leak, not approval.
scripts/soul-import-scan-selftest.sh (51 checks) builds fixtures from fragments at
runtime and runs in the leak-guard workflow. Two negative controls were run: a
scanner that echoes matches fails the nine value-not-printed checks, and a
disabled path rule fails the forbidden-path checks.
docs/guide/architecture/soul-import-review.md documents the scan and its limits.
layered-soul.md is left untouched, since its okf stamp is stale and was not
re-verified.