privacy: tracked config, corpus and docs carry no real paths or private names - #129
Merged
Conversation
…rivate names The 2026-08-19 scrub genericised projects.yaml; the 08-31 cwd-identity work put the real roots back, plus a 250-row export of the production job DB as a test corpus, a plan doc with an ssh line to the broker's tailnet address, and a collaborator's name in a path. A scrub is a state, not a commit, and nothing was checking the state. - config/projects.local.yaml (gitignored, beside projects.yaml) now carries machine-specific roots and private names; each entry replaces the same-named tracked entry wholesale. load_local_projects is a no-op when the file is absent, so existing deployments start unchanged -- but they lose cwd-derived identity for the real roots until the file is created (docs/projects-yaml.md). - projects.yaml, tests/data/project_cwd_corpus.csv, tests, plans, docs and docstrings are pseudonymised: /home/user, greek-letter project names, the broker address as a hostname. Every name variant a test relied on was mapped by substring, so folding/variant behaviour is unchanged (1296 passed). - tests/test_no_private_paths.py scans every tracked file for private paths, hosts, addresses and session trailers, with a planted-hit positive control.
musharna
force-pushed
the
privacy/pseudonymise-corpus
branch
from
September 2, 2026 16:46
45fe03f to
409c884
Compare
musharna
added a commit
that referenced
this pull request
Sep 2, 2026
tests/test_changelog_fragments.py requires [Unreleased] to stay empty; the broken header from #129 had hidden this entry from that test.
musharna
added a commit
that referenced
this pull request
Sep 2, 2026
…130) * fix: .gitignore and CHANGELOG were appended with literal backslash-n The privacy commit (#129) wrote both files through a script whose "\\n" was the two characters backslash-n, not a newline. .gitignore therefore had one line that matched nothing, so config/projects.local.yaml -- the file that holds the real roots -- was NOT ignored (git check-ignore printed nothing). CHANGELOG gained a second, broken [Unreleased] header. Found by the ~/jobd session's cat -A. Both rewritten with real newlines; check-ignore now resolves to .gitignore:32. * docs: changelog entry moves to a changelog.d fragment tests/test_changelog_fragments.py requires [Unreleased] to stay empty; the broken header from #129 had hidden this entry from that test.
This was referenced Sep 2, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 2026-08-19 scrub genericised projects.yaml; the 08-31 cwd-identity work
put the real roots back, plus a 250-row export of the production job DB as a
test corpus, a plan doc with an ssh line to the broker's tailnet address, and
a collaborator's name in a path. A scrub is a state, not a commit, and nothing
was checking the state.
machine-specific roots and private names; each entry replaces the same-named
tracked entry wholesale. load_local_projects is a no-op when the file is
absent, so existing deployments start unchanged -- but they lose cwd-derived
identity for the real roots until the file is created (docs/projects-yaml.md).
docstrings are pseudonymised: /home/user, greek-letter project names, the
broker address as a hostname. Every name variant a test relied on was mapped
by substring, so folding/variant behaviour is unchanged (1296 passed).
hosts, addresses and session trailers, with a planted-hit positive control.
Deploy note: the broker keeps working without
config/projects.local.yaml, but cwd-derived identity for the real roots only returns once that file exists beside the deployedprojects.yaml(a ready copy is at~/.config/jobd/projects.local.yamlon the laptop; gt76 was unreachable from this session).