FAQ

FAQ

The first run found 40 things. Where do I start?

lgit list -project=$PWD -severity=error. Errors are wrong by any reading and there are usually few. Warnings next, info last: info is the audit layer, which is why the extension hides it by default. See Adopting it.

A gate is flagging something that is deliberate

Use the inline directive with a reason. It keeps the exception next to the line and emits an override_accepted finding, so the exception stays visible instead of vanishing into a config file:

# l0git: ignore from_latest reason: dev base image, never released

The secrets gate fires on my test fixtures

Expected, and the fix is exclude_paths scoped to those fixtures. This project does the same thing to itself: its secrets gate fires on the source of the secrets gate, because that file contains the patterns it looks for. See When a gate is wrong.

Should I ignore the gate or downgrade its severity?

Ignore when the gate does not apply to this project at all. Downgrade to info when the finding is real but not urgent: it stays in the audit layer without competing with errors.

Why is history scanning off by default?

Because a secret still in .git is a real finding with a real remediation cost, and discovering it by surprise is worse than choosing to look. Turn it on deliberately with secrets_scan_history.enabled.

Does an ignore in my editor apply in CI?

The store is shared between front ends on the same machine, so yes locally. CI checks out fresh and has no store, which is correct: CI should judge the tree rather than inherit somebody's triage. Permanent decisions belong in .l0git.json, which is committed and reviewed.

Can the MCP server run commands on my repository?

No. It reports and persists triage. findings_remediate returns a recipe with a confidence of deterministic or guided, and executing is up to whoever is driving.

What does confidence: guided mean?

That the tool is offering a direction rather than an exact recipe. An agent should think before acting on it. deterministic is the case where applying the recipe is mechanical, and there are eight gates in that category.

Will it fix things for me?

lgit fix prints the exact commands for the eight deterministic gates. The VS Code extension goes one step further for presence-style gates, with quick fixes that write the missing file and clear the finding. Nothing is applied without you asking.

Does it need network access?

No. No model, no network, no rule engine. That is the point of the design constraint: the same tree gives the same findings on any machine.

Two clients are writing to the same database

Handled: WAL journal mode, a 15-second busy timeout, and the extension serialises its lgit invocations. The extension and an agent-managed MCP server sharing one store is the anticipated configuration.

Why are there no configurable custom gates?

Because the constraint that a gate must be a binary, unambiguous condition is what makes the findings reproducible. A rule engine or a YAML DSL would let you express conditions the tool cannot guarantee to evaluate the same way twice, and that is the property being protected.

Is it useful on a repository that is already tidy?

That is where it is most useful: a clean baseline means the next finding is signal. It is also the state the project holds itself to, since l0-git scans clean against itself with its bundled config.