NA-0677 (D-0012): the infra-literal gate and advisories

[Tebbens4832]

Goals: G4

The intent said "port the spine's public-safety job". There was nothing to port. That job scans for private keys and cloud tokens; it has never contained an address, path or host pattern — which is exactly why it ran green on every pull request that published a private LAN address. The failure was the pattern set, not the scan's scope. scripts/ci/infra_literal_scan.py is that missing pattern set.

The scanner is byte-identical to the copies in the other three repositories (cmp-proven at landing). The pattern set is deliberately not forked: one source of truth for one question.

Proved in THIS repository, not inherited from the file

A gate is a property of the repo it runs in, not of the script. The embedded-literal control was run here:

control	result
Tier-1 host name as SOME_<name>_THING in a tracked file	RED — scan FAILS
seed removed	GREEN

/srv/qbuild/evidence/NA-0677/gate_positive_control.txt.

Design

Tiers. Tier 1 (network-identifying + personal identity) over the whole tracked tree. Tier 2b (low-frequency private names) over added lines only. Tier 2a (build-root and home paths) not scanned — the citation convention adds them to ~60% of governance commits, so a gate on them would be switched off within a week.

The private names are salted SHA-256 digests, not text. This repository is public: a pattern file naming them would republish what the sanitize lane removed — and the Tier-1 scan would then hit its own pattern file. The plaintext list is operator-held. Matching is token-wise (non-alphanumerics and camelCase transitions), so a name embedded in an identifier is caught while one merely spanning a camelCase seam is not.

The scan reports what it examined — clean (tree; N files, M lines examined) — and refuses to report a pass over an empty input in tree and diff modes, because a green indistinguishable from a no-op is the defect this gate exists to answer.

⚠ These jobs are ADVISORY, not blocking

This repository requires exactly one status context, rust, which is unchanged. public-safety and advisories run and report but cannot block a merge until they are added to the required set — the operator's act. Green is not the same as blocking.

🤖 Generated with Claude Code

This repo: Tier-1 clean at landing (39 files, 13,391 lines, zero hits). cargo audit --deny warnings passes with no waiver file. Clippy is unchanged — this repository already ran --all-targets, the only one of the four that did, and it needed nothing.

⚠ Observed and not acted on: this repository has enforce_admins: false where the other three have true. Noted during the lane's census; outside D613's scope and the operator's decision.

No-regression: fmt, clippy --all-targets -D warnings and cargo audit --deny warnings all clean; git diff --check clean; the gate returns clean on this PR in both --mode tree and --mode staged; no product source changed.