# Guarded wiki privacy validation

Run from the wiki checkout with PowerShell 7 and the official Gitleaks 8.30.1 binary:

```powershell
pwsh -NoProfile -File scripts/Invoke-WikiPrivacyCheck.ps1 -RepositoryRoot . -Mode All -GitleaksPath gitleaks -ReportDirectory ../wiki-privacy-output
```

Set `-ExpectedGitleaksSha256` to the verified checksum of your platform binary when enforcing its exact build. The guard records the actual version and checksum, inspects every reachable commit tree to verify every historical version of the correction receipt and its current working copy against two immutable full SHA-256 identities, and checks the published configuration's complete checksum before scanning.

The published `.gitleaks.toml` permits only independently verified full digest values in the two structured token-digest fields at the exact correction-receipt path. Four observed native fragment findings do not include an entire digest. Their narrowly matched temporary exceptions are generated only after the full receipt and configuration checks pass. Each temporary exception is anchored to the exact repository-relative Git receipt path or the exact validated absolute Directory projection path. Nested paths and archive members cannot inherit that exception. This temporary configuration is written outside the checkout and is never the published default. Running the published configuration directly remains fail-closed for those four benign fragments.

`-Mode All` runs native Git history and an isolated projection of every tracked working file. Native defaults and all private-context rules remain active. JSON reports and redacted native logs are written outside the checkout. `-Mode Preflight` checks immutable identities without generating exceptions or starting a native scan.

Unknown receipt content, an unknown historical version, or any byte change to the configuration fails before temporary exceptions are generated. Tests include changing an unseen digest suffix while preserving the observed fragment, restoring a recognized current receipt after an unknown historical version, wrong fields and paths, injected synthetic tokens, and a private marker in an allowed-looking field.

Keep the receipt, configuration, guard and this page marked `-text` in `.gitattributes`. This preserves the tested bytes when `core.autocrlf` is enabled. A legitimate future receipt change requires fresh digest classification, independent byte-window evidence, reviewed full-file identities and renewed negative controls; do not simply add a checksum to bypass the guard.