john/tractatus
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
885 commits 1 branch 0 tags 125 MiB
Commit graph

3 commits

Author SHA1 Message Date
TheFlow
5afe5d9584 fix(deployment): handle YAML frontmatter confidential: false marker 
Enhanced confidential document scanner to parse YAML frontmatter:
- Detects YAML frontmatter blocks (--- ... ---)
- Checks for explicit "confidential: false" declaration
- Skips false positive on documents marked non-confidential

Previously blocked: docs with "confidential:" even when set to false
Now allows: docs with explicit "confidential: false" in frontmatter

Fixes deployment blocking of BI documentation which is marked
for public release with confidential: false metadata.

Related: inst_012, inst_015 (confidential document protection)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-10-27 10:44:54 +13:00
TheFlow
8021197bf0 fix(deployment): only block files with explicit confidential markers, not filename patterns 
- Removed filename pattern checks (session-handoff, draft, etc.)
- Now only blocks files with content markers: [INTERNAL], [CONFIDENTIAL], [DO NOT PUBLISH]
- Allows session handoff and internal documentation in docs/ directory
- Still blocks actual credentials and sensitive content

Rationale: Filename patterns were too broad and blocked legitimate internal documentation.
Session handoffs are fine in docs/ as long as they don't contain actual sensitive data.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-10-26 23:19:18 +13:00
TheFlow
e7efdc7810 feat(governance): second wave enforcement - 64% improvement (28% → 46%) 
Implements 7 additional architectural enforcement mechanisms:

✅ Prohibited Terms Detection (inst_016/017/018):
- scripts/check-prohibited-terms.js
- Scans for absolute assurance terms ("guarantee", "100% secure")
- Detects maturity claims without evidence ("production-ready", "battle-tested")
- Checks statistics require citation or [NEEDS VERIFICATION]
- Integrated into .git/hooks/pre-commit (Check 2)

✅ Credential Exposure Prevention (inst_069/070):
- scripts/check-credential-exposure.js
- Detects real API keys, secrets, passwords in documentation
- Validates example credentials use proper patterns (EXAMPLE/REDACTED)
- CRITICAL: Runs first in pre-commit (Check 0)

✅ Confidential Document Protection (inst_012/015):
- scripts/check-confidential-docs.js
- Prevents deployment of internal/session-handoff documents
- Scans filenames and content for [CONFIDENTIAL]/[INTERNAL] markers
- Integrated into scripts/deploy.sh pre-flight checks

✅ Enhanced Pre-Commit Hook:
Now runs 4 checks in order:
0. Credential exposure (CRITICAL)
1. CSP compliance
2. Prohibited terms
3. Test requirements

✅ Enhanced Deployment Script:
- Added confidential document check to deploy.sh
- Scans public/ and docs/ before deployment
- Blocks deployment if confidential markers found

✅ Updated Enforcement Map:
- Added all new mechanisms to audit-enforcement.js
- Updated inst_008_CONSOLIDATED mapping
- New mappings: inst_012, inst_015, inst_016, inst_017, inst_018, inst_069, inst_070

📊 Enforcement Progress:
- Wave 1: 11/39 imperative instructions enforced (28%)
- Wave 2: 18/39 imperative instructions enforced (46%)
- Improvement: +7 instructions = +64% increase
- Remaining gaps: 21/39 (54%)

🎯 Next Priority Gaps:
- inst_013/043/045: API security validation
- inst_019: Context pressure comprehensive accounting
- inst_025: Deployment file mapping
- inst_039/040: Batch operation verification
- inst_079/080/081: Values/principles (process-based)

🔒 Security Posture:
- CRITICAL security checks now run first (credential exposure)
- All text files scanned before commit
- All deployment candidates scanned before rsync

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-10-25 13:26:33 +13:00