From 313f41b49c8c977a97ccd9ba50507ca2b67b4bf2 Mon Sep 17 00:00:00 2001 From: Kit OC5 Date: Thu, 24 Sep 2026 03:08:11 -0400 Subject: [PATCH] deploy: secret-guard BLOCK drop-in (orchestrator 09-24) Co-Authored-By: Claude Opus 5.5 --- deploy/systemd/windygit-sync.service.d/secret-guard-block.conf | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 deploy/systemd/windygit-sync.service.d/secret-guard-block.conf diff --git a/deploy/systemd/windygit-sync.service.d/secret-guard-block.conf b/deploy/systemd/windygit-sync.service.d/secret-guard-block.conf new file mode 100644 index 0000000..e39fd43 --- /dev/null +++ b/deploy/systemd/windygit-sync.service.d/secret-guard-block.conf @@ -0,0 +1,3 @@ +[Service] +# Orchestrator 09-24: secret-guard BLOCKS lane-owned findings; Grant-owned stay WARN. +Environment=SECRET_GUARD_MODE=block