cleanup#141
Closed
mikepsinn wants to merge 5 commits into
Closed
Conversation
Removes private data that GitHub secret scanning does not catch: - docs/archive/EXPECTED_VALUE_DATABASE.md: strip 12 private Notion workspace links (root CLAUDE.md forbids copying Notion links into the repo) and a collaborator's first name. - nonprofit-identity.ts: remove bank name + account last-4 and a private vendor rejection from a code comment. - .env.example: replace a real cloud account ID with a placeholder. Adds scripts/leak-scan.mjs + a CI job that fails PRs containing private Notion links, bank-account references, or non-placeholder cloud account IDs. Structural patterns only, so the denylist itself carries no secrets. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: eddaf0bd35
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
📝 WalkthroughWalkthroughAdds a tracked-file private-information scanner and CI job, updates exposed reference text, adds a canonical argument document, and changes canonical-document lookup to use non-archived documentation paths. Archived documentation references are removed. ChangesLeak prevention
Canonical documentation
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant CI as GitHub Actions
participant Scanner as scripts/leak-scan.mjs
participant Git as git ls-files
participant Files as Tracked files
CI->>Scanner: Execute leak scan
Scanner->>Git: Request tracked paths
Git-->>Scanner: Return paths
Scanner->>Files: Read and scan contents
Files-->>Scanner: Return matching lines
Scanner-->>CI: Report clean status or fail
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 87-88: Update the `Checkout` step using `actions/checkout@v6` to
set `persist-credentials` to false. Keep the existing checkout behavior
unchanged while ensuring credentials are not retained for subsequent steps.
In `@scripts/leak-scan.mjs`:
- Around line 48-51: Update tracked() to invoke git ls-files with NUL-delimited
output using the -z option, then split the result with the existing NULL_CHAR
symbol instead of a newline. Preserve the existing filtering of empty entries so
filenames containing newlines are scanned correctly.
- Around line 27-44: Update the leak patterns in the scanner rules to detect
Notion title-slug URLs preceding the hexadecimal page ID and bank references
using “account number:” in addition to existing formats. Remove
scripts/leak-scan.mjs from PATH_ALLOW so the scanner also evaluates its own
tracked content, while preserving the documented placeholder exception.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 783cbbb2-62a1-4e03-87ed-b91ca6f0dd87
📒 Files selected for processing (5)
.env.example.github/workflows/ci.ymldocs/archive/EXPECTED_VALUE_DATABASE.mdpackages/web/src/lib/nonprofit-identity.tsscripts/leak-scan.mjs
Contributor
PR review packetStart here
Review checklistChanged files considered
Updated automatically when this PR's preview or visual review reruns. |
Per Mike: deleting the archived planning docs is cleaner than leaving redaction breadcrumbs, and archived planning docs belong in Notion (repo policy), not a public repo. Removes all of docs/archive/ (including the Notion-link-leaking EXPECTED_VALUE_DATABASE.md). The fix-ai canonical-argument transcript is read at runtime, so it is relocated to docs/ (the loader already had a docs/ fallback path); trimmed the now-dead archive candidate paths and the docs/README entry. fix-ai-content test passes against the new location. Keeps the nonprofit-identity.ts + .env.example redactions and the CI leak-scan gate from the first commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- notion-private-link rule: match slug-prefixed notion.so URLs (notion.so/<workspace>/<Title>-<hex>, the default Notion "copy link" format) and *.notion.site hosts, not just a bare hex segment immediately after notion.so/. Verified the old regex missed both real-world formats; verified the new one still ignores the notion.so/mercury-style test fixtures. - bank-account-ref rule: add "account number:", "account no.", and "account no 1234" phrasing as an additional alternative alongside the existing checking/savings/account #NNNN pattern. - tracked(): use `git ls-files -z` and split on the NUL byte instead of newline-splitting, so a tracked filename containing a newline can't produce a bogus path and skip scanning. - ci.yml leak-scan job: set persist-credentials: false on the checkout step. This job checks out untrusted PR content (a fork PR could modify scripts/leak-scan.mjs itself) and never needs to push afterward, matching the same pattern already used at ci.yml:895 for the fork-head checkout in sync-preview-managed-data. node scripts/leak-scan.mjs stays clean (3828 files). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/canonical-argument-2026-05-20.md`:
- Around line 47-64: Correct the “Millions of times less” derived mapping in the
parameter table and downstream copy to use
DFDA_TRIAL_CAPACITY_PLUS_EFFICACY_LAG_ECONOMIC_VALUE as the numerator with
UNIVERSAL_SHIRT_DISTRIBUTION_COST_USD, and update the calculation to
approximately 1.75 million×. Remove references to EXPECTED_TREATY_VALUE_USD for
this $84Q-to-$48B comparison while preserving the existing parameter names.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 8f59e922-40c2-4721-8ca5-e7a45a616cf6
📒 Files selected for processing (16)
.github/workflows/ci.ymldocs/README.mddocs/archive/EXPECTED_VALUE_DATABASE.mddocs/archive/README.mddocs/archive/REFERENCES.mddocs/archive/TODO-history-2026-07.mddocs/archive/ai-challenge-eod-2026-05-20.mddocs/archive/earth-optimization-date-2026-05-20.mddocs/archive/joke-handout-draft.mddocs/archive/mcp-tasks-improvements-2026-05-24.mddocs/archive/mockup.mddocs/archive/one-percent-treaty-song.mddocs/archive/shirt-distribution-thesis-2026-05-20.mddocs/canonical-argument-2026-05-20.mdpackages/web/src/app/fix-ai/corpus.server.tsscripts/leak-scan.mjs
💤 Files with no reviewable changes (12)
- docs/archive/mcp-tasks-improvements-2026-05-24.md
- docs/archive/joke-handout-draft.md
- docs/archive/mockup.md
- docs/archive/one-percent-treaty-song.md
- docs/archive/earth-optimization-date-2026-05-20.md
- docs/archive/ai-challenge-eod-2026-05-20.md
- docs/archive/shirt-distribution-thesis-2026-05-20.md
- docs/archive/README.md
- docs/archive/REFERENCES.md
- docs/archive/TODO-history-2026-07.md
- docs/README.md
- docs/archive/EXPECTED_VALUE_DATABASE.md
🚧 Files skipped from review as they are similar to previous changes (1)
- scripts/leak-scan.mjs
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/canonical-argument-2026-05-20.md`:
- Around line 47-64: Correct the “Millions of times less” derived mapping in the
parameter table and downstream copy to use
DFDA_TRIAL_CAPACITY_PLUS_EFFICACY_LAG_ECONOMIC_VALUE as the numerator with
UNIVERSAL_SHIRT_DISTRIBUTION_COST_USD, and update the calculation to
approximately 1.75 million×. Remove references to EXPECTED_TREATY_VALUE_USD for
this $84Q-to-$48B comparison while preserving the existing parameter names.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 8f59e922-40c2-4721-8ca5-e7a45a616cf6
📒 Files selected for processing (16)
.github/workflows/ci.ymldocs/README.mddocs/archive/EXPECTED_VALUE_DATABASE.mddocs/archive/README.mddocs/archive/REFERENCES.mddocs/archive/TODO-history-2026-07.mddocs/archive/ai-challenge-eod-2026-05-20.mddocs/archive/earth-optimization-date-2026-05-20.mddocs/archive/joke-handout-draft.mddocs/archive/mcp-tasks-improvements-2026-05-24.mddocs/archive/mockup.mddocs/archive/one-percent-treaty-song.mddocs/archive/shirt-distribution-thesis-2026-05-20.mddocs/canonical-argument-2026-05-20.mdpackages/web/src/app/fix-ai/corpus.server.tsscripts/leak-scan.mjs
💤 Files with no reviewable changes (12)
- docs/archive/mcp-tasks-improvements-2026-05-24.md
- docs/archive/joke-handout-draft.md
- docs/archive/mockup.md
- docs/archive/one-percent-treaty-song.md
- docs/archive/earth-optimization-date-2026-05-20.md
- docs/archive/ai-challenge-eod-2026-05-20.md
- docs/archive/shirt-distribution-thesis-2026-05-20.md
- docs/archive/README.md
- docs/archive/REFERENCES.md
- docs/archive/TODO-history-2026-07.md
- docs/README.md
- docs/archive/EXPECTED_VALUE_DATABASE.md
🚧 Files skipped from review as they are similar to previous changes (1)
- scripts/leak-scan.mjs
🛑 Comments failed to post (1)
docs/canonical-argument-2026-05-20.md (1)
47-64: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash rg -n 'DFDA_TRIAL_CAPACITY_PLUS_EFFICACY_LAG_ECONOMIC_VALUE|EXPECTED_TREATY_VALUE_USD|8.?b|UNIVERSAL_SHIRT_DISTRIBUTION_COST_USD' .Repository: mikepsinn/optimitron
Length of output: 50377
🏁 Script executed:
#!/bin/bash set -euo pipefail echo "== candidate files ==" git ls-files | rg '(^|/)(AGENTS\.md|docs/SYSTEM_MAP\.md|docs/canonical-argument-2026-05-20\.md)$' || true echo " echo "== docs/canonical-argument-2026-05-20.md relevant lines ==" sed -n '1,110p' docs/canonical-argument-2026-05-20.md | nl -ba echo " echo "== exact canonical symbol search ==" rg -n --fixed-strings 'DFDA_TRIAL_CAPACITY_PLUS_EFFICACY_LAG_ECONOMIC_VALUE' . \ --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' \ | head -50 rg -n --fixed-strings 'EXPECTED_TREATY_VALUE_USD' . \ --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' \ | head -80 rg -n --fixed-strings 'UNIVERSAL_SHIRT_DISTRIBUTION_COST_USD' . \ --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' \ $'\n' | head -80 || true echo " echo "== numeric literals containing 84Q/48B/8B in canonical doc (context) ==" rg -n -C 2 '(?:84Q|48B|8B|1\.7[75]|million)' docs/canonical-argument-2026-05-20.md || true echo " echo "== focused search with word boundaries for 8B and cost/value identifiers ==" rg -n -E '\b8B\b|8[+-]?B\b|8.*B\b|DFDA_TRIAL_CAPACITY|EXPECTED_TREATY_VALUE|UNIVERSAL_SHIRT_DISTRIBUTION_COST' docs/canonical-argument-2026-05-20.md . \ --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' \ | grep -E 'docs/canonical-argument|DFDA_TRIAL_CAPACITY|EXPECTED_TREATY_VALUE|UNIVERSAL_SHIRT_DISTRIBUTION|8(?:(?:[^\s0-9]|s|q|b)|\b)|8[0-9]?[BQ]' | head -120Repository: mikepsinn/optimitron
Length of output: 13919
🏁 Script executed:
#!/bin/bash set -euo pipefail python3 - <<'PY' from fractions import Fraction q = 10**15 b = 10**9 vals = { "84Q": 84*q, "48B": 48*b, } print(vals["84Q"] / vals["48B"], "million", (vals["84Q"] / vals["48B"])/1_000_000) print(Fraction(vals["84Q"], vals["48B"]), '=', float(Fraction(vals["84Q"], vals["48B"]))) PYRepository: mikepsinn/optimitron
Length of output: 201
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '== candidate files ==\n' git ls-files | rg '(^|/)(AGENTS\.md|docs/SYSTEM_MAP\.md|docs/canonical-argument-2026-05-20\.md)$' || true printf '\n== docs/canonical-argument-2026-05-20.md lines 1-110 ==\n' sed -n '1,110p' docs/canonical-argument-2026-05-20.md | nl -ba printf '\n== exact parameter searches, focused output ==\n' rg -n --fixed-strings 'DFDA_TRIAL_CAPACITY_PLUS_EFFICACY_LAG_ECONOMIC_VALUE' . \ --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' \ | head -80 printf '\n' rg -n --fixed-strings 'EXPECTED_TREATY_VALUE_USD' . \ --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' \ | head -120 printf '\n' rg -n --fixed-strings 'UNIVERSAL_SHIRT_DISTRIBUTION_COST_USD' . \ --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' \ | head -120 printf '\n== canonical doc numeric context ==\n' rg -n -C 2 '(?:84Q|48B|8B|1\.7[75]|millions|million)' docs/canonical-argument-2026-05-20.md || true printf '\n== arithmetic for displayed values (read-only) ==\n' python3 - <<'PY' q = 10**15 b = 10**9 values = {"84Q": 84*q, "48B": 48*b} ratio = values["84Q"] / values["48B"] print(values["84Q"], "/", values["48B"], "=", ratio, "million =", ratio/1_000_000) PYRepository: mikepsinn/optimitron
Length of output: 712
Fix the treaty-vs-shirt ratio mapping and math.
EXPECTED_TREATY_VALUE_USDis not the $84Q contract; the catalog contract usesDFDA_TRIAL_CAPACITY_PLUS_EFFICACY_LAG_ECONOMIC_VALUE. Also, $84Q ÷ $48B is 1.75 million×, not 1.77 million×. Update line 64 and any downstream copy to use the same numerator.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/canonical-argument-2026-05-20.md` around lines 47 - 64, Correct the “Millions of times less” derived mapping in the parameter table and downstream copy to use DFDA_TRIAL_CAPACITY_PLUS_EFFICACY_LAG_ECONOMIC_VALUE as the numerator with UNIVERSAL_SHIRT_DISTRIBUTION_COST_USD, and update the calculation to approximately 1.75 million×. Remove references to EXPECTED_TREATY_VALUE_USD for this $84Q-to-$48B comparison while preserving the existing parameter names.
mikepsinn
changed the title
mikepsinn
enabled auto-merge
July 25, 2026 03:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A multi-agent audit of the public repo tip found private information that GitHub secret scanning does not catch. All verified directly against tracked files. None was a live credential; the value is context an attacker could use for social engineering, plus a repo-policy violation.
What
CLAUDE.mdexplicitly forbids copying Notion page links into the repo) and one collaborator first name. Schema documentation retained.Prevention
scripts/leak-scan.mjs+ aleak-scanCI job that fails any PR containing private Notion links, bank/account-number references, or non-placeholder cloud account IDs.leak-scan-okcomment.Not included (separate deliberate decision)
Git history still contains these values in older commits. Rewriting public history means a force-push that breaks every clone and open PR, for low-value residue (an account last-4 and inert private-page IDs, no live secrets). Recommend accepting the residue and gating the tip, not rewriting — but flagged here for the owner's call.
Summary by CodeRabbit
Security
Documentation