# The leak check's allow list -- every line is a reviewed decision, with its reason.
#
#   rule  path-glob  [literal]  # reason
#
# A hit is allowed when its rule matches (or the rule is `*`), its path matches the glob (fnmatch; a glob that
# names a directory covers everything under it), and, if a literal is given, the matched text or its line
# contains that literal (case-insensitive; quote a literal with spaces). Anything not listed here fails the
# gate. Keep the reason: the next reader has to decide whether it still holds.
#
# What may NOT go here: a real secret, a real address, a real key. Owner-specific literals the gate must catch
# go in the git-ignored leak_extra.txt beside this file; nothing that identifies the owner goes in the tree in
# order to be allowed.

# -- commit identities (metadata mode): the public identity is deliberate. The owner's GitHub account is public
#    by nature; the agents' trailer address is Anthropic's no-reply.
commit-author    "<git metadata>"  "Craig Smith <cscotho@gmail.com>"   # the owner, GitHub `Scotho`; their call (Sprint 11 spec 3a)
commit-committer "<git metadata>"  "Craig Smith <cscotho@gmail.com>"   # same

# -- the local Horizon server's shipped DEV defaults. Nothing hosted uses them: the box's real config lives under
#    the git-ignored vm/lightsail/ and is never in the tree.
secret-assignment  server/config/db.config.json   socom2-local-dev-key   # the simulated DB's dev key; the hosted box has its own
secret-assignment  server/config/db.config.json   horizon                # `DatabasePassword: horizon`, the upstream default for a local DB

# -- the simulated account store WAS committed once (a3cef6c, before its .gitignore line) and untracked in the
#    pre-publication sweep. It is in public history: local dev accounts under the dev key above. Recorded for
#    the owner (HUMAN_TASKS 2026-09-20; row O13 since 2026-09-25); allowed here so the gate reports new exposures, not this known one.
ignored-path-in-history  server/config/simulated.db   # a3cef6c; the owner's decision is pending (HUMAN_TASKS O13)

# -- addresses that are public by nature
ip-address  *  67.222.156.250   # PSRewired's player DNS, published on their own guide (psrewired.com/guides/socom2)
ip-address  *  1.1.1.1          # Cloudflare's resolver
ip-address  third_party/ps2recomp/ps2xAnalyzer/include/ps2recomp/sce_symbol_database_data.h   # upstream ps2recomp data: SDK version strings

# -- upstream ps2recomp data (12 MB of symbol names, a Sprint 11 Goal 1 baggage row); not ours and not secret
opaque-secret  third_party/ps2recomp/ps2xAnalyzer/include/ps2recomp/sce_symbol_database_data.h   # upstream ps2recomp's symbol names
opaque-secret  recomp/socom2_names*.csv   # the names sidecar's Mangled column: Metrowerks-mangled C++ names (template argument lists, the @unnamed@ anonymous-namespace marker) read as opaque tokens; names from the demo's .symtab, not secrets (S12-R7, research/48)

# -- test fixtures and examples: the canonical joke password, the recompiler's long-name test, a fixed test token
secret-assignment  *  hunter2                          # the password every test uses; never a real one
secret-assignment  server/horizon-server/RT.Models/Lobby/MediusTicketLoginRequest.cs  TestPass   # upstream Horizon's placeholder
secret-assignment  third_party/ps2recomp/ps2xTest/src/ps2_iop_tests.cpp  0x1122334455667788      # a fixed test token
opaque-secret      third_party/ps2recomp/ps2xTest/src/ps2_recompiler_tests.cpp  ReallyLongFunctionName   # the clamp test's synthetic name

# -- a font's licence names its foundry's contact; that is the licence text and ships with the font
email  third_party/ps2recomp/ps2xLauncher/assets/fonts/OFL-*.txt   # the foundry's contact in its own licence text

# -- research/37 is a note, and "Route A" is its first option, not a street
street-address  docs/*  "37 Route A"   # research note 37, option A

# -- names of key FILES under git-ignored paths, in prose that says where the owner keeps them. The files are not
#    in the tree (the `ignored` mode proves vm/ never was); the names alone open nothing.
key-file-name  docs/archive/HUMAN_TASKS-to-2026-09-25.md  cert.pem                 # cloudflared's login certificate, under ~/.cloudflared (the sentence archived verbatim, Sprint 13 R4)
key-file-name  docs/HUMAN_TASKS.md  cert.pem                                   # the same sentence at its pre-2026-09-25 path: the history leg scans the old commits (moved by Sprint 13 R4; CI's secrets workflow was red from d94c55f1 to d162a228 for want of this row -- the second time a move lost its old-path row, after 05f35232)
key-file-name  docs/archive/sprints-7-12/2026-09-19-sprint-8-hosted-server.md  socom_unzipped.pem   # the Lightsail key pair, under vm/lightsail/keys/
key-file-name  docs/superpowers/plans/2026-09-19-sprint-8-hosted-server.md  socom_unzipped.pem   # the same file at its pre-2026-09-25 path: the history leg scans the old commits (moved by Sprint 13 R1)
commit-author    "<git metadata>"  "Claude <noreply@anthropic.com>"    # three agent commits; Anthropic's no-reply
commit-committer "<git metadata>"  "Claude <noreply@anthropic.com>"    # same
commit-committer "<git metadata>"  "GitHub <noreply@github.com>"       # merges made on github.com
commit-author    "<git metadata>"  "dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>"   # Dependabot's action-pin PRs (.github/dependabot.yml); GitHub's bot, GitHub's no-reply

# -- the gate's own files carry the planted controls: every secret shape, invented, so the scanner can prove it
#    still catches each one. Reviewed code; nothing real may be pasted here either.
*  tools_py/release/leakcheck.py         # the planted controls (PLANTED, PLANTED_NAMES)
*  tools_py/tests/test_leakcheck.py      # the same controls, as tests
*  tools_py/tests/test_leakcheck_external.py   # the sixth leg's controls: an invented token the fake siblings print
*  tools_py/release/leakrules.py         # the rules spell out the shapes they recognise, in comments and names
*  tools_py/release/leak_allow.txt       # this file names what it allows (a literal here is never a real secret)
key-file-name  .gitignore                # the patterns that refuse key files are spelled like key files
secret-assignment  docs/archive/sprints-7-12/2026-09-20-sprint-10-goal-9-online-credentials.md  persona   # a ternary's string literals, quoted from code
secret-assignment  docs/superpowers/plans/2026-09-20-sprint-10-goal-9-online-credentials.md  persona   # the same file at its pre-2026-09-25 path, for the history leg (moved by Sprint 13 R1)
secret-assignment  .gitleaks.toml  0x1122334455667788   # gitleaks's allowance for the same fixed test token, spelled out

# -- the canonical licence texts (LICENSES/<SPDX>.txt, verbatim from spdx/license-list-data) carry the FSF's street
#    address, a postcode and a maintainer address; they ship in every archive as they are
email           LICENSES/*.txt   # a licence's own contact line
street-address  LICENSES/*.txt   # the FSF's address in the GPL/LGPL texts
postcode        LICENSES/*.txt   # same

# -- the launcher scrubber's planted controls (Sprint 10 H6): a lower-cased home, an 8.3 short name, another account's
#    directory, a peer's address -- each must survive in the TEST so the test can prove it does not survive the scrub
home-directory-path  third_party/ps2recomp/ps2xTest/src/diagnostics_tests.cpp   # planted: SECRET~1, Otheruser, /home/otheruser
ip-address           third_party/ps2recomp/ps2xTest/src/diagnostics_tests.cpp  86.21.44.190   # planted: a peer's address
secret-assignment    third_party/ps2recomp/ps2xTest/src/diagnostics_tests.cpp  abc123DEF456   # planted: a credential value the scrub must remove
secret-assignment  .gitleaks.toml  abc123DEF456   # gitleaks's allowance for the same planted value, spelled out
opaque-secret  recomp/socom2_names*.csv   # the names sidecar's Mangled column: Metrowerks-mangled C++ names (template argument lists, the @unnamed@ anonymous-namespace marker) read as opaque tokens; names from the demo's .symtab, not secrets (S12-R7, research/48)
commit-author    "<git metadata>"  "GTTeancum <smmelton@gmail.com>"   # upstream ran-j/PS2Recomp PR author, cherry-picked in Task 6 (research/42): their public GitHub identity on their own commits
commit-author    "<git metadata>"  "hedgeg0d <werstak192@gmail.com>"   # upstream ran-j/PS2Recomp PR author, cherry-picked in Task 6 (research/42): their public GitHub identity on their own commits
commit-author    "<git metadata>"  "Grswld <206244388+Grswld@users.noreply.github.com>"   # the macOS fork's author (github.com/Grswld/socom-unzipped-macos), his commits cherry-picked with -x (docs/MACOS.md): his public GitHub no-reply identity on his own commits

# -- private addresses in the tracked tree (Sprint 13 S6: `tree` and `staged` report every one as tracked-private-ip).
#    A DEFAULT never goes here -- a default is required or an RFC 5737 example. What does: the dated record, which
#    says what the network was when a run happened and is not rewritten, and a planted control that must stay
#    private for its test to mean anything. One row per FILE (a directory glob would pass any new file below it).
tracked-private-ip  docs/archive/HANDOFF-2026-09-08.md                                                   # the archived handoff, verbatim: the LAN bring-up's DEV9 and DNS settings
tracked-private-ip  docs/archive/HANDOFF-reference-to-2026-09-13.md                                      # the archived handoff, verbatim: the LAN run recipe of its day
tracked-private-ip  docs/archive/sprints-1-6/2026-09-12-sprint-4-visible-defects-and-first-kill.md       # archived plan, verbatim: the LAN run recipe (PS2X_SOCOM2_SERVER) of its day
tracked-private-ip  docs/archive/sprints-7-12/2026-09-17-sprint-7-two-strangers-two-machines.md          # archived plan, verbatim: the put-it-back command of its day
tracked-private-ip  docs/archive/sprints-7-12/2026-09-19-sprint-9-goal-1-failures-explain-themselves.md  # archived plan, verbatim: its quoted test code (the tests themselves now use RFC 5737, Sprint 13 S6)
tracked-private-ip  docs/audits/2026-09-17-audit-and-code-review.md                                      # dated audit; its G3 row IS the finding about the old default
tracked-private-ip  docs/audits/2026-09-20-test-harness-and-process-audit.md                             # dated audit quoting the harness default it found (fixed by H6)
tracked-private-ip  docs/research/18-online-round-start.md                                               # dated research note: the LAN sessions' run recipes and packet dumps, as run
tracked-private-ip  docs/research/21-frostfire-control-handover.md                                       # dated research note: the LAN sessions' run recipes, as run
tracked-private-ip  docs/research/22-kill-readout.md                                                     # dated research note: the LAN session's setup line, as run
tracked-private-ip  docs/story/timeline.json                                                             # commit subjects quoted verbatim from the history
tracked-private-ip  docs/archive/STATUS-log-to-2026-09-26.md                                             # STATUS's archived log, verbatim (Sprint 14 S1): its dated sections record the LAN bring-up of 2026-09-08..09-15 as it happened
tracked-private-ip  third_party/ps2recomp/ps2xTest/src/diagnostics_tests.cpp  "server 3.143.65.100; lan"   # planted: the scrubber redacts every IPv4 but the hosted box's, and this LAN-range control stands for the category H6 found leaking -- it tests nothing more

# -- a git SSH remote in a documented command (feat/web-map-viewer, a5ab2280): the e-mail rule reads `git@github.com`
#    as an address; it is a hostname in a URL, and the whole line is public by nature.
email  web/README.md  git@github.com   # `git subtree push ... git@github.com:Scotho/...` -- a remote, not an address
email  web/redotcom/README.md  git@github.com   # the same line since the web/ split of 2026-09-29 (the row above stays for the history leg)

# -- the site's release: web/shared/deploy/site/deploy.sh runs `leakcheck artifact` over the staged tree (the landing
#    build, redotcom's build under redotcom/, the inbox). Artifact paths are relative to the scanned directory.
private-ip         *story/timeline.json                         # the landing build's copy of docs/story/timeline.json: commit subjects quoted verbatim (the tracked file's row is above)
secret-assignment  *assets/index-*.js  'credentials="include'   # Vite's modulepreload polyfill sets fetch's credentials mode; not a credential
postcode           *assets/index-*.js  RG16UI                   # three.js's WebGL texture format names (R16UI, RG16UI) in the minified bundle, not postcodes
postcode           *assets/index-*.js  R16UI                    # same

# -- web sprint 3's server deploy (33649f95, the cloud branch web-sprint-3-multiplayer) names its settings file
#    `deploy/.env` -- the name only: no value is in the tree (the file is excluded from the rsync, the image and
#    git). Each of the 19 history hits read by the web session and the controller, 2026-09-29.
key-file-name  web/deploy/deploy.sh               .env   # copies, chmods and greps the host's deploy/.env by name
key-file-name  web/deploy/compose.yaml            .env   # `env_file: .env` and the `set X in .env` messages
key-file-name  web/deploy/README.md               .env   # the owner's steps: `cp env.example .env`, never commit it
key-file-name  web/deploy/Dockerfile.dockerignore .env   # the ignore patterns that keep .env out of the image
key-file-name  web/deploy/env.example             .env   # the template's header: copy it to .env, never commit that (39e4d689; placeholders only)
key-file-name  web/redotcom/deploy/deploy.sh               .env   # copies, chmods, greps and moves the host's settings file by name (moved from web/deploy/, 2026-09-29)
key-file-name  web/redotcom/deploy/compose.yaml            .env   # `env_file: .env` and the `set X in .env` messages (moved from web/deploy/)
key-file-name  web/redotcom/deploy/README.md               .env   # the owner's steps: `cp env.example .env`, never commit it (moved from web/deploy/)
key-file-name  web/redotcom/deploy/Dockerfile.dockerignore .env   # the ignore patterns that keep .env out of the image (moved from web/deploy/)
key-file-name  web/redotcom/deploy/env.example             .env   # the template's header: copy it to .env, never commit that (moved from web/deploy/)
