Krzysztof kuhy Rudnicki 37a27c6dff feat: refuse to commit personal data, learned from outside the repository ... The leak this repository had was not carelessness with a secret. It was somebody reaching for a real name because it was the example in front of them -- a fixture built from a live database, an envelope pasted out of a running container, a help text written while looking at the actual group. Three different people-shaped mistakes, none of which a rule about "be careful" would have stopped. So it is a gate. The hard part is that the thing being checked must not contain the list of what to refuse, or the check *is* the leak. It reads the names at run time from outside: the photo pack's manifest, the message database, the local .env. It never prints the word it matched, because this output reaches CI logs. On a machine with none of that private data it says "shapes only" out loud rather than passing quietly, and CI enforces the half that needs nothing -- phone numbers, uuids and Signal group ids, compared against an allowlist of values invented for the fixtures. It runs on staged files, on the commit message -- where two of the leaks actually travelled -- and over the whole tree in CI. It paid for itself twice before it was wired up. The live test group's id was in tests/test_config.py in two spellings, and truncated in three more files, after four rounds of grepping by hand had pronounced the tree clean -- nobody thinks to grep for base64. Then it refused the commit that introduced it, because DOCS-privacy.md had used a real name as the example of a name. An allowlist line may be scoped to one file, which is how the given names that are also popes stay legal in popes.json and refused in every fixture that has no business carrying them. The threshold is three characters, because one of this group's given names is three characters long. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017w1HZ3cZ7neL3rFdQ6VMBA		2026-08-30 23:28:29 +02:00
..
__init__.py	feat: rewrite the bot so it runs, and gate it like the other repos	2026-08-29 13:05:42 +02:00
conftest.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
gate_helpers.py	fix: a refused command no longer re-arms its own cooldown	2026-08-30 20:39:14 +02:00
pack_fixture.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
stats_seed.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
test_allowlist.py	feat: refuse to look healthy while deaf, and heal the container by itself	2026-08-29 19:01:55 +02:00
test_animals.py	fix: a refused command no longer re-arms its own cooldown	2026-08-30 20:39:14 +02:00
test_announce_render.py	release: 0.1.7 «Callistus I» — a version now says which pope, and when	2026-08-30 22:12:09 +02:00
test_announce.py	fix: a refused attachment no longer costs a group its release notes	2026-08-30 21:33:56 +02:00
test_app.py	fix: a signal-api that is not up yet no longer kills the bot at boot	2026-08-30 15:23:42 +02:00
test_bot_catchup.py	fix: the evening report is one message, not one per thing it has to say	2026-08-30 22:49:51 +02:00
test_bot_report.py	release: 0.1.6 «Zephyrinus» — 21:37 reports today, not yesterday	2026-08-30 22:09:13 +02:00
test_bot.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
test_changelog.py	release: 0.1.7 «Callistus I» — a version now says which pope, and when	2026-08-30 22:12:09 +02:00
test_cli.py	feat: discover groups from the account, so adding the bot is the whole setup	2026-08-29 15:30:08 +02:00
test_config_pack.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
test_config.py	feat: the message event log, and the nightly report built on it	2026-08-30 19:14:43 +02:00
test_cooldown_gate.py	fix: a refused command no longer re-arms its own cooldown	2026-08-30 20:39:14 +02:00
test_counting.py	feat: the message event log, and the nightly report built on it	2026-08-30 19:14:43 +02:00
test_decorators.py	fix: a refused command no longer re-arms its own cooldown	2026-08-30 20:39:14 +02:00
test_discovery.py	feat: the message event log, and the nightly report built on it	2026-08-30 19:14:43 +02:00
test_dispatcher_gates.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
test_dispatcher.py	release: 0.1.4 «Eleuteriusz» — the list of commands lives in the chat now	2026-08-30 21:08:02 +02:00
test_envelope_shape.py	fix: the operator's uuid was still a fixture in the envelope-shape test	2026-08-30 23:04:42 +02:00
test_fake_account.py	feat: refuse to look healthy while deaf, and heal the container by itself	2026-08-29 19:01:55 +02:00
test_fake_groups.py	feat: discover groups from the account, so adding the bot is the whole setup	2026-08-29 15:30:08 +02:00
test_fake_server.py	release: 0.0.7 «Telesfor» — !papież, and the bot can test itself	2026-08-30 17:06:25 +02:00
test_folding.py	fix: commands resolve when typed on another alphabet's keyboard	2026-08-30 14:22:43 +02:00
test_healthz.py	release: 0.1.7 «Callistus I» — a version now says which pope, and when	2026-08-30 22:12:09 +02:00
test_help_command.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
test_http_client.py	feat: !gekon posts a research-grade gecko photo	2026-08-29 23:26:40 +02:00
test_liveness.py	feat: refuse to look healthy while deaf, and heal the container by itself	2026-08-29 19:01:55 +02:00
test_logging_setup.py	feat: the bot can describe an envelope without quoting anybody	2026-08-30 19:29:06 +02:00
test_main.py	feat: the message event log, and the nightly report built on it	2026-08-30 19:14:43 +02:00
test_membership.py	feat: discover groups from the account, so adding the bot is the whole setup	2026-08-29 15:30:08 +02:00
test_models.py	feat: weekly, monthly and year-in-review posts, keyed off the day reported	2026-08-30 19:56:25 +02:00
test_pack_command.py	fix: the tagger pre-selected a group, which is how an album reaches the wrong chat	2026-08-30 22:41:42 +02:00
test_pack_load.py	fix: take real people, numbers and a member's uuid out of a public repository	2026-08-30 23:01:26 +02:00
test_pack.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
test_popes_command.py	release: 0.1.7 «Callistus I» — a version now says which pope, and when	2026-08-30 22:12:09 +02:00
test_portcheck.py	feat: make the bot actually reply on Signal, and gate every way it went silent	2026-08-29 14:37:27 +02:00
test_portraits.py	release: 0.0.7 «Telesfor» — !papież, and the bot can test itself	2026-08-30 17:06:25 +02:00
test_quoting.py	feat: answer the message that asked, not just the room	2026-08-29 23:01:01 +02:00
test_registry.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
test_scenario.py	feat: answer the message that asked, not just the room	2026-08-29 23:01:01 +02:00
test_scheduler.py	feat: rewrite the bot so it runs, and gate it like the other repos	2026-08-29 13:05:42 +02:00
test_selftest.py	release: 0.0.7 «Telesfor» — !papież, and the bot can test itself	2026-08-30 17:06:25 +02:00
test_startup.py	feat: the message event log, and the nightly report built on it	2026-08-30 19:14:43 +02:00
test_stats_backfill.py	fix: !ja told everybody their favourite hour was noon	2026-08-30 20:15:20 +02:00
test_stats_commands.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
test_stats_curiosities.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
test_stats_events.py	feat: the message event log, and the nightly report built on it	2026-08-30 19:14:43 +02:00
test_stats_nightly.py	release: 0.1.6 «Zephyrinus» — 21:37 reports today, not yesterday	2026-08-30 22:09:13 +02:00
test_stats_periods.py	feat: the message event log, and the nightly report built on it	2026-08-30 19:14:43 +02:00
test_stats_queries_period.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
test_stats_records.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
test_stats_render_day.py	feat: refuse to commit personal data, learned from outside the repository	2026-08-30 23:28:29 +02:00
test_stats_render_period.py	release: 0.1.1 «Pius I» — commands that explain themselves	2026-08-30 20:09:14 +02:00
test_stats_streaks.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
test_stats_text.py	feat: the message event log, and the nightly report built on it	2026-08-30 19:14:43 +02:00
test_store.py	feat: the message event log, and the nightly report built on it	2026-08-30 19:14:43 +02:00
test_transport_base.py	feat: rewrite the bot so it runs, and gate it like the other repos	2026-08-29 13:05:42 +02:00
test_transport_fake.py	feat: rewrite the bot so it runs, and gate it like the other repos	2026-08-29 13:05:42 +02:00
test_transport_media.py	release: 0.2.0 «Urbanus I» — a private photo album, and a tagger for it	2026-08-30 22:35:41 +02:00
test_transport_rest.py	feat: answer the message that asked, not just the room	2026-08-29 23:01:01 +02:00
test_trust.py	feat: the message event log, and the nightly report built on it	2026-08-30 19:14:43 +02:00
test_versioning.py	release: 0.1.7 «Callistus I» — a version now says which pope, and when	2026-08-30 22:12:09 +02:00