clawdie/colibri
Watch
1
0
Fork
You've already forked colibri
 0
Code Issues 1 Pull requests Projects Releases 1 Packages Activity Actions

feat(soul): add deterministic import-queue scan and self-test #236

Closed
clawdie wants to merge 1 commit from clawdie/feat/soul-import-scan into main AGit
pull from: clawdie/feat/soul-import-scan
merge into: clawdie:main
Conversation 0 Commits 1 Files changed 5 +316
clawdie commented 2026-10-29 21:55:13 +01:00
Owner
Copy link

Pre-promotion scan for a layered-soul review queue. Prints KIND path:line only, fails closed on uninspectable files, 51-check self-test wired into leak-guard, plus a short guide page. A clean result means no obvious leak, not approval to share. No private content was read; fixtures are synthetic.

Pre-promotion scan for a layered-soul review queue. Prints KIND path:line only, fails closed on uninspectable files, 51-check self-test wired into leak-guard, plus a short guide page. A clean result means no obvious leak, not approval to share. No private content was read; fixtures are synthetic.
feat(soul): add deterministic import-queue scan and self-test
All checks were successful
CI / markdown (pull_request) Successful in 10s
Details
CI / packaging (pull_request) Successful in 2s
Details
CI / python-tests (pull_request) Successful in 22s
Details
CI / mcp-cross-language (pull_request) Successful in 29s
Details
CI / go (pull_request) Successful in 47s
Details
leak-guard / guard (pull_request) Successful in 5s
Details
0e1e44baa8 
scripts/soul-import-scan.sh scans a layered-soul review queue before any file is
promoted from a private soul source: never-copy paths (template list in
scripts/soul-import-never-copy.txt), credential-shaped content, tailnet addresses
and names, and PII. It prints only KIND path:line, never the matched text, and
fails closed on symlinks, binary and oversized files. --allow accepts a reviewed
kind but still prints it. A clean result means no obvious leak, not approval.

scripts/soul-import-scan-selftest.sh (51 checks) builds fixtures from fragments at
runtime and runs in the leak-guard workflow. Two negative controls were run: a
scanner that echoes matches fails the nine value-not-printed checks, and a
disabled path rule fails the forbidden-path checks.

docs/guide/architecture/soul-import-review.md documents the scan and its limits.
layered-soul.md is left untouched, since its okf stamp is stale and was not
re-verified.
clawdie closed this pull request 2026-10-31 21:02:45 +01:00
All checks were successful
CI / markdown (pull_request) Successful in 10s
Details
CI / packaging (pull_request) Successful in 2s
Details
CI / python-tests (pull_request) Successful in 22s
Details
CI / mcp-cross-language (pull_request) Successful in 29s
Details
CI / go (pull_request) Successful in 47s
Details
leak-guard / guard (pull_request) Successful in 5s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawdie/colibri!236
No description provided.