Kit OC5 5fa1e652ae compute-guard: gatekeeper rules (Mind 10-02) + allow-list exemptions that expire ...

New kinds: voice-ai host/key (Deepgram, ElevenLabs, Cartesia, PlayHT, Resemble, HeyGen, Google
Vision/Speech/TTS, AWS Transcribe/Polly), cloudflare workers ai (REST /ai/ + wrangler [ai] binding),
talk engine port (:8791/:8788/:8794/:8099). Own kinds so they roll out WARN-first via
COMPUTE_GUARD_WARN_KINDS. Allow entries now need a named exemption (local-user-hardware |
owner-approved | compute-door | guard-self) and an expires date; expired entries stop excusing
code and are reported. ci-hygiene keeps its own (non-strict) format.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

2026-10-02 18:11:07 -04:00

..

backup_state.sh

backup_state: pin restic cache dir (systemd has no HOME); init only on a MISSING repo, log other errors

2026-10-01 03:23:41 -04:00

backup.sh

security: never bundle credential repos to R2 in plaintext

2026-09-23 10:48:42 -04:00

canary.py

canary: end the hub session the login probe opens (journey cleanup rule)

2026-09-23 13:39:55 -04:00

cancel_unrunnable.sh

telemetry: ci.job_cancelled from the janitor; interval_s on heartbeat

2026-09-23 11:27:53 -04:00

cancel_unrunnable.sql

telemetry: ci.job_cancelled from the janitor; interval_s on heartbeat

2026-09-23 11:27:53 -04:00

ci_hygiene.py

compute-guard: gatekeeper rules (Mind 10-02) + allow-list exemptions that expire

2026-10-02 18:11:07 -04:00

compute_guard.py

compute-guard: gatekeeper rules (Mind 10-02) + allow-list exemptions that expire

2026-10-02 18:11:07 -04:00

drill_cross_host.sh

drill_cross_host.sh: read the R2 pair + endpoint from the lockbox (drill PASSED 10-01)

2026-10-01 03:19:56 -04:00

env_names.py

secret-scan + env-names: shared hash-only tools (Boss 10-01: lanes printed secrets while hunting them)

2026-10-01 01:17:30 -04:00

guards_report.py

secret-guard: no live credentials in bridged repos (hash-only findings)

2026-09-24 03:01:59 -04:00

import_from_github.py

ci: G11.5 resolved — onboard windy-pro; cloud cells + windytalk; promote script

2026-09-23 09:49:15 -04:00

install_secret_tools.sh

lockbox-names: names-only lister (section + label + resolvable yes/no/dup), never a value

2026-10-01 19:23:47 -04:00

lockbox_names.py

lockbox-names: names-only lister (section + label + resolvable yes/no/dup), never a value

2026-10-01 19:23:47 -04:00

lockbox_put.py

lockbox-put: append-only lockbox PR tool (no one reads/greps the lockbox); installer updated

2026-10-01 02:40:31 -04:00

pr_status_bridge.py

bridge + sync: onboard windy-calendar-site (static, no workflows; guards only)

2026-10-01 05:04:49 -04:00

promote_to_ci.sh

ci: G11.5 resolved — onboard windy-pro; cloud cells + windytalk; promote script

2026-09-23 09:49:15 -04:00

public_secret_scan.py

weekly public secret scan (all 5 GitHub accounts, full history, hash-only)

2026-09-24 03:05:16 -04:00

rerun_ci.sh

rerun_ci.sh: find wg-q in the invoking user home under sudo

2026-09-24 02:38:25 -04:00

runner_guard.py

runner-guard: block workflows that hand a self-hosted runner to strangers (Boss 10-01)

2026-10-01 05:28:37 -04:00

secret_guard.py

secret-guard: Twilio shapes (SID/API key, 32-hex secret assignment) + per-kind warn mode

2026-10-01 00:59:05 -04:00

secret_scan.py

secret-scan + env-names: shared hash-only tools (Boss 10-01: lanes printed secrets while hunting them)

2026-10-01 01:17:30 -04:00

secret_shapes.py

secret-guard/secret-scan: PyPI API token shape (pypi-AgE macaroon), WARN-first

2026-10-01 02:47:53 -04:00

sync_from_github.sh

runner-guard: block workflows that hand a self-hosted runner to strangers (Boss 10-01)

2026-10-01 05:28:37 -04:00

telemetry_emit.py

push velocity: correlate the SSO-id subquery on the grouped column

2026-09-23 14:06:27 -04:00

vocab_audit.py

G0: cell substrate — invariants made executable

2026-08-11 14:19:28 -04:00