Skip to content

Repository navigation

refactor(leaks): port whole-object range and push scans to Go #817

New issue
New issue
Open
Feature
Open
refactor(leaks): port whole-object range and push scans to Go#817
Feature
Labels
change:featPR adds or changes a feature (Conventional Commit type feat)refinement:readyPassed the Definition of Ready; may be picked up

Description

@tbhb-agent
tbhb-agent
opened on Oct 26, 2026

Problem

Part of #588. This is the whole-object scanning and shared push-selection slice of #329; #818 owns publication commit additions and reuses this boundary.

At origin/main (a0347a715fab580ece45edfcb3d13509620459a8), shell selects and reads whole outgoing Git objects (.devtools/scripts/check-leaks.sh:341, .devtools/scripts/check-leaks.sh:427, .devtools/scripts/check-leaks.sh:443). Push selection depends on Git's ref lines and the actual destination, not cached tracking refs. Move that boundary to tested Go while retaining its complete-history and nondisclosure guarantees.

Acceptance criteria

  1. AC1: --range checks exactly the objects added by its revision selection, including whole binary and text contents, tree names and merge results, with the frozen shell's results rather than diff-based coverage.
  2. AC2: Every relevant object path retains its current pattern-allowance behavior, including reused blobs with both allowed and ordinary paths, gitlink names and tagged non-commit payloads.
  3. AC3: Whole commit and annotated-tag contents retain their current findings, including author, committer and tag metadata, nested tags and values removed from the branch tip.
  4. AC4: Push scans check every supplied ref-update line and both ref names, accepting the existing supported object-ID widths and rejecting malformed input with status 2.
  5. AC5: Objects excluded from a push scan are exactly those the current destination-selection contract excludes; stale tracking refs and unrelated environment values cannot shrink coverage.
  6. AC6: A deletion sends no objects; empty input to --pre-push-hook has nothing to scan, while empty input to manual --pre-push retains its HEAD scan.
  7. AC7: Invalid arguments or revisions, shallow history, unavailable destination information when required, failed Git operations, missing or unreadable objects and incomplete object reads fail with status 2, never a clean result.
  8. AC8: Complete scans retain statuses 0/1, finding order, labels, opaque sensitive locations and stream behavior, without disclosing private values, refs, URLs or sensitive error arguments.
  9. AC9: Non-functional: existing entry points end as thin shell wrappers that probe Go subcommand support without writes or consuming ref input; missing binary or capability uses frozen shell behavior, while supported execution runs once with unchanged streams and status and never falls back after failure.
  10. AC10: Non-functional: the scan leaves refs, index and working files unchanged and performs no destination write or history fetch.
  11. AC11: Non-functional: native behavior works on Linux, macOS and Windows without raising the N-2 binary floor.
  12. AC12: Non-functional: no temporary matched content remains after success or failure.

Scope and non-goals

In scope: the whole-object contract currently covered by emit_objects, emit_range and emit_pre_push, its task boundary, and consumer documentation of range/manual/hook behavior, fallback and rollback. This issue owns tag payloads (AC2, AC3), ref-line parsing and OID widths (AC4), destination discovery and exclusions (AC5), and zero-line hook versus manual selection (AC6), including when #818 uses that boundary. Hook wiring means only --pre-push and --pre-push-hook mode handling; it excludes hook installation. Read-only destination discovery remains permitted when the existing contract requires it (.devtools/scripts/check-leaks.sh:434); it never supplies write authority. Temporary-content cleanup is current behavior at .devtools/scripts/check-leaks.sh:87.

Coverage: range cases at .devtools/scripts/check-leaks.bats:303, .devtools/scripts/check-leaks.bats:382, .devtools/scripts/check-leaks.bats:478, .devtools/scripts/check-leaks.bats:585, .devtools/scripts/check-leaks.bats:654; ref-line and object cases at .devtools/scripts/check-leaks.bats:752 through .devtools/scripts/check-leaks.bats:880; existing installed-hook mode regression cases at .devtools/scripts/check-leaks.bats:960 through .devtools/scripts/check-leaks.bats:1084; shared-object and failure cases at .devtools/scripts/check-leaks.bats:1346, .devtools/scripts/check-leaks.bats:1382, .devtools/scripts/check-leaks.bats:1390 and .devtools/scripts/check-leaks.bats:1442; shared whole-object tag cases at .devtools/scripts/check-leaks.bats:1890 and .devtools/scripts/check-leaks.bats:1913, owned here for both unscoped and publication-scoped pushes. These existing hook fixtures verify mode behavior without requiring installer changes.

Overlap: preserve origin/main's exported *_PRIVATE_STRINGS matching and nondisclosure behavior. All #501 source-loading changes remain out of scope: worktree/machine source resolution, precedence, configured-source refusal, source notices and provisioning. All #551/#573 changes remain out of scope: gitleaks local/ci modes, full-index snapshots, base resolution, caller changes and local history reduction. This port closes none of those issues.

Non-goals: publication commit additions (#818), staged comparison, .devtools/scripts/install-pre-push.sh and hook installation (#819), the shared-hooks work in #277, gitleaks selection, recursive submodule contents, transformed/split-value detection and preventing hook bypass. #277 is not a blocker for this mode-handling scope. Existing whole-object quirks remain characterized, including tab-name allowances and tag/commit shared-subtree selection. Removing the frozen fallback waits for separate N-2 follow-up work under D9.

Approach

Port the scoped requirements to Go while retaining the frozen shell compatibility behavior. Implementation choices remain open within these requirements.

Dependencies

Blocked by #753 before activation; cite its merged enforcement-protection evidence. #329 tracks the containing migration. #818 depends on this issue for the shared boundary; its publication commit-addition work is not a prerequisite here. #819 owns the installer, and #277 is not a dependency of this issue. #501 and #551/#573 retain the excluded source-loading and gitleaks changes. #661 governs compatibility; #333 owns distribution without requiring consumers to raise their pins for this port.

Size

M. One pull request for the whole-object and shared push-selection boundary, including mode handling; no installer work.

Verify plan

Write failing Go cases for a secret removed at the tip, a shared blob with a non-exempt use and an incomplete object read first. Port every scoped Bats behavior before reducing shell coverage.

  • AC1, AC2: real disposable Git fixtures for additions, removal-only and empty ranges, a bare HEAD revision, clean and leaking merges, suppressed diffs, binary/text type changes, mode changes, empty files, renames, reused blobs under mixed and all-exempt paths, gitlinks and tagged blobs/trees. Compare exact outcomes and streams with the pinned shell. Include tab/newline/backslash names and the tag-then-commit shared-subtree regressions without correcting their recorded quirks.
  • AC3: commit messages and author/committer identities, annotated and nested tags, and a finding later removed from the tip; each must remain detectable at its recorded object location.
  • AC4: both supported ID widths, multiple refs in either order, local and remote names containing synthetic literals, blank lines, missing fields, invalid IDs and surplus fields; assert findings or status 2 as appropriate.
  • AC5: known and unknown remote OIDs, a new ref, empty destination, repointed destination, multiple push URLs and stale tracking refs. Assert destination discovery occurs only for the current new/unknown-OID cases with a URL; no URL excludes nothing beyond known line OIDs. No interactive prompt is permitted.
  • AC6: deletion-only input and zero-line manual versus installed-hook input; compare exact coverage and status with shell.
  • AC7, AC8: missing range operand, invalid revisions, unknown options, shallow repositories, failed destination lookup, failed enumeration, missing objects, disappearing objects, truncated reads, unreadable path data and content resembling an object response. Assert status 2 for misuse or incomplete scanning, no clean acceptance, and no synthetic sensitive bytes on either stream; compare complete result order and diagnostics separately.
  • AC9: missing/old/supported command fixtures through the actual consumer path. Record ref input bytes before and after probing; supported output-then-error must propagate once with no shell rerun. A failed capability probe refuses rather than guessing absence.
  • AC10: record refs, index and working files before and after every failure class; recording Git/destination fixtures assert no fetch or destination write.
  • AC11: native platform tests, unchanged N-2 fixtures and shell parity where available. Record 20 warm process timings against the same 100-commit fixture for both implementations, excluding builds, and investigate regressions.
  • AC12: inspect the fixture temporary area after success, findings and each failure class; no matched content may remain. As D6 evidence, review documentation against the tested boundary and exercise its fallback and rollback instructions in disposable fixtures.
  • Run the branch binary through mise run test-leaks, preserving disposable local-destination integration coverage, then mise run check, fresh coverage and both coverage floors. Check build(agents): protect replacement Go enforcement paths #753's protection of replacement enforcement and registration. Regenerate and validate output if maintained skill sources change.
  • Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work (comments, descriptions) passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches, or the description says No doc impact with the reason. D7 every commit carries an Assisted-by trailer and the pull request carries the provenance:agent-assisted label. D8 the change stays within the pull request size limits. D9 follow-up work, including deferred review findings, is filed as issues, each with a Problem section and numbered acceptance criteria and linking this issue; the pull request's Related section lists them, and any code that defers work links its issue. D10 the merge closes this issue through a closing reference, the project board shows the state Done, and a final Status: comment names the merge commit.

Risks

An overbroad exclusion can hide an outgoing object; a changed path association can accidentally exempt a shared blob. Object accounting and exact-destination fixtures bound those risks. Undo: revert this PR to restore the original range and push entry points.

Operator authority

standing rule names the operator: replacement enforcement must be protected under #753 before activation, with its required exact-head owner review. This work authorizes no destination write. The thin-wrapper migration requirement follows #329 and #588.

Activity

  1. tbhb-agent
    added
    change:featPR adds or changes a feature (Conventional Commit type feat)
    on Oct 26, 2026
  2. github-project-automation
    added this to devtoolson Oct 26, 2026
  3. github-project-automation
    moved this to Backlog in devtoolson Oct 26, 2026
  4. tbhb-agent
    added the
    Feature
    issue type on Oct 26, 2026
  5. tbhb-agent
    added a parent issue on Oct 26, 2026

  6. tbhb-agent commented on Oct 26, 2026

    @tbhb-agent
    tbhb-agent
    on Oct 26, 2026
    ContributorAuthor

    Refinement: NOT READY — clarify whole-object boundary ownership with #818 and record #277 status
    Model: gemini-4-argon-high

    Checked

    • Verified origin in an independent clone identifies tbhb-dev/devtools and origin/main resolves to a0347a715fab580ece45edfcb3d13509620459a8.
    • Read live tbhb-dev/devtools#817 (title, change:feat label, Feature type, body, and zero comments) and the live issues named in the body and prompt: tbhb-dev/devtools#329, tbhb-dev/devtools#588, tbhb-dev/devtools#501, tbhb-dev/devtools#551, tbhb-dev/devtools#573, tbhb-dev/devtools#753, tbhb-dev/devtools#661, tbhb-dev/devtools#333, tbhb-dev/devtools#818, and tbhb-dev/devtools#277.
    • Verified origin/main source references cited in tbhb-dev/devtools#817:
      • .devtools/scripts/check-leaks.sh:341 (emit_objects comment and implementation at .devtools/scripts/check-leaks.sh:341-411), .devtools/scripts/check-leaks.sh:427 (emit_range at .devtools/scripts/check-leaks.sh:427-432), and .devtools/scripts/check-leaks.sh:443 (emit_pre_push at .devtools/scripts/check-leaks.sh:434-492).
      • .devtools/scripts/check-leaks.sh:434 (read-only destination discovery via git ls-remote at .devtools/scripts/check-leaks.sh:475) and .devtools/scripts/check-leaks.sh:87 (rm -rf "$tmp" cleanup in on_exit()).
      • .devtools/scripts/check-leaks.bats:303, .devtools/scripts/check-leaks.bats:382, .devtools/scripts/check-leaks.bats:478, .devtools/scripts/check-leaks.bats:585, .devtools/scripts/check-leaks.bats:654, .devtools/scripts/check-leaks.bats:752 through .devtools/scripts/check-leaks.bats:880, .devtools/scripts/check-leaks.bats:960 through .devtools/scripts/check-leaks.bats:1084, .devtools/scripts/check-leaks.bats:1346, .devtools/scripts/check-leaks.bats:1382, .devtools/scripts/check-leaks.bats:1390, .devtools/scripts/check-leaks.bats:1442, .devtools/scripts/check-leaks.bats:1890, and .devtools/scripts/check-leaks.bats:1913 all match the claimed range, ref-line, installed-hook, shared-object, failure, and whole-object tag test cases on origin/main.
    • Checked AC1–AC12: each criterion is observable, testable, scoped to one outcome, free of implementation prescriptions (no package layout, file structure, or library/driver mandate), and covers non-functional requirements (AC9 thin-wrapper capability probing without input loss or post-failure fallback, AC10 read-only Git/destination guarantees, AC11 Linux/macOS/Windows support and N-2 binary floor under docs/compatibility.md:1-20, and AC12 temporary matched-content cleanup).
    • Checked Verify plan: every AC ID (AC1–AC12) is mapped to concrete fixture checks that prove the criterion, alongside mise run test-leaks (mise.toml:584-586), mise run check, coverage floors, #753 protection checks, and D1–D10.
    • Checked #501 and #551/#573 non-goals: Scope and non-goals and Dependencies keep #501's new private-string source discovery, precedence, notices, and provisioning out of scope, and keep #551/#573's gitleaks --mode local/--mode ci selection, full-index snapshot, base resolver, caller changes, and local history reduction out of scope as non-goals while preserving this scanner's existing literal non-disclosure and history boundary.
    • Checked Operator authority: accurate against .agents/agent-skills.conf:4-9, packages/agents/source/skills/merge-pr/shared/scripts/merge-policy.py:474-595, and tbhb-dev/devtools#753. Replacement Go enforcement packages and subcommand registration must be protected under #753 before activation, requiring exact-head owner review (or the golden-only waiver where applicable), and any edit to .devtools/tasks/leaks.toml falls under gate_config_paths at .agents/agent-skills.conf:8.
    • Checked tbhb-dev/devtools#817 against tbhb-dev/devtools#818 for whole-object boundary ownership: both issues currently define whole-object push/tag scanning and claim overlapping Bats tests without referencing each other (Gap 1).
    • Checked tbhb-dev/devtools#277 (named in parent tbhb-dev/devtools#329): #277 is open with labels: [] (not refinement:ready and not done; its latest comment is Refinement: NOT READY — Go implementation, compatibility coverage, and verification need revision), and #817 does not cite #277 when excluding installer changes (Gap 2).

    Gaps

    1. Blocker — tbhb-dev/devtools#817 and tbhb-dev/devtools#818 both define the whole-object push and tag boundary instead of one owning it and the other referencing it.
      At origin/main, publication-scoped pre-push (emit_publish_pre_push at .devtools/scripts/check-leaks.sh:672-726) delegates non-commit objects and outgoing tags to the whole-object producer and scanner (emit_objects at .devtools/scripts/check-leaks.sh:341-411, called at .devtools/scripts/check-leaks.sh:725, and scan at .devtools/scripts/check-leaks.sh:865-869). Currently, neither #817 nor #818 names the other in Scope and non-goals or Dependencies:

      • #817 defines whole-object non-commit tag payloads (AC2), whole annotated and nested tags (AC3), push ref-line parsing and OID widths (AC4), destination discovery and exclusions (AC5), and zero-line --pre-push-hook versus --pre-push (AC6), and claims .devtools/scripts/check-leaks.bats:1890 and .devtools/scripts/check-leaks.bats:1913.
      • #818 also defines push ref-name and zero-line hook/manual behavior (AC6), whole outgoing annotations, followed/nested tags, and non-commit tag payloads (AC7), and destination discovery and OID-width/malformed-line refusals (Verify plan for AC6, AC7), and claims .devtools/scripts/check-leaks.bats:1774 through .devtools/scripts/check-leaks.bats:2095 (which includes .devtools/scripts/check-leaks.bats:1890 and .devtools/scripts/check-leaks.bats:1913).
        Update #817 (Scope and non-goals and Dependencies) and #818 so that #817 explicitly owns the whole-object scanning and push-selection boundary (emit_objects, emit_range, emit_pre_push, and the whole-object tag contract) and names #818 as the publication-scoped slice that references and reuses #817's whole-object boundary rather than redefining it.

    2. Blocker — tbhb-dev/devtools#277 is neither Ready nor done, and #817 does not record its disposition relative to #329.
      Parent issue tbhb-dev/devtools#329 states that the pre-push hook installer (install-pre-push.sh) needs the shared-hooks fix from tbhb-dev/devtools#277. On live GitHub, tbhb-dev/devtools#277 is open with no refinement:ready label (labels: []) and its latest refinement comment is Refinement: NOT READY — Go implementation, compatibility coverage, and verification need revision. While #817 lists installer changes under Non-goals, it exercises the installed pre-push wrapper in .devtools/scripts/check-leaks.bats:960 through .devtools/scripts/check-leaks.bats:1084 (via .devtools/scripts/install-pre-push.sh at .devtools/scripts/check-leaks.bats:901,935). Either bring tbhb-dev/devtools#277 to refinement:ready (or done) and cite #277 in #817's Scope and non-goals / Dependencies to confirm why installer changes in #277 are independent of this slice, or record the dependency if #277 must land first.

    Split

    No further split of tbhb-dev/devtools#817 is needed. Whole-object --range and unscoped --pre-push / --pre-push-hook share emit_objects (.devtools/scripts/check-leaks.sh:341-411) and scan (.devtools/scripts/check-leaks.sh:134-247) and fit one M pull request once the boundary reference with tbhb-dev/devtools#818 is explicit.

    Definition of done

    The definition of done for #817 (Feature). Tick each item and give its evidence.

    Boxes ticked below indicate planning coverage in the issue's acceptance criteria and verification plan, not completed implementation work.

    • D1 The author verified each AC on the merged head, and the Verification section of the pull request cites each AC ID with its evidence: the command and its result, or a link.
      Evidence: Planned in Verify plan (AC1, AC2 through AC12 and Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification).
    • D2 An independent reviewer approved the exact merged head, and the author resolved each finding or filed it as a follow-up.
      Evidence: Planned in Verify plan (D2 an independent review approves the exact merged head, and every finding has a recorded disposition).
    • D3 The required checks pass on that head, and any loosened gate has the owner's approval of that exact head.
      Evidence: Planned in Verify plan (Run the branch binary through mise run test-leaks ... then mise run check, fresh coverage and both coverage floors and D3 required checks pass with no gate loosened) and Operator authority.
    • D4 The leak scans come back clean: gitleaks, devtools' check-leaks.sh with the repository's private-strings list, and the leak review of each post.
      Evidence: Planned in Verify plan (D4 the leak scans the repository specifies are clean, and every post made for this work (comments, descriptions) passes the per-post leak review before it is posted).
    • D5 The author signed each commit, the squash included.
      Evidence: Planned in Verify plan (D5 every commit is signed).
    • D6 The docs match the change (README, docs/, CHANGELOG or help text), or the Verification section says "No doc impact" and why.
      Evidence: Planned in Scope and non-goals (consumer documentation of range/manual/hook boundaries, fallback and rollback) and Verify plan (As D6 evidence, review documentation against the tested boundary and exercise its fallback and rollback instructions in disposable fixtures and D6 the documentation matches, or the description says No doc impact with the reason).
    • D7 The commits and the squash have Assisted-by trailers, and the pull request has the provenance:agent-assisted label.
      Evidence: Planned in Verify plan (D7 every commit carries an Assisted-by trailer and the pull request carries the provenance:agent-assisted label).
    • D8 The pull request stays within the size limits, or the owner approved its exact head over the hard limit.
      Evidence: Planned in Size (M. One pull request for one whole-object scanning boundary and its two selection forms) and Verify plan (D8 the change stays within the pull request size limits).
    • D9 The author files follow-ups and deferred findings as issues with at least a Problem and numbered AC and lists them under the Related section of the pull request. Any work left in the code links its issue.
      Evidence: Planned in Scope and non-goals (Removing the frozen fallback waits for separate N-2 follow-up work under D9) and Verify plan (D9 follow-up work, including deferred review findings, is filed as issues, each with a Problem section and numbered acceptance criteria and linking this issue; the pull request's Related section lists them, and any code that defers work links its issue).
    • D10 The merge closes the issue through a closing reference and the board shows Done. The final Status: comment names the merge commit.
      Evidence: Planned in Verify plan (D10 the merge closes this issue through a closing reference, the project board shows the state Done, and a final Status: comment names the merge commit).

    Round: 1 of 3

  7. tbhb-agent commented on Oct 26, 2026

    @tbhb-agent
    tbhb-agent
    on Oct 26, 2026
    ContributorAuthor

    Refinement: READY — whole-object range and push boundary, #818 split, and #277 disposition are clear and verified
    Model: gemini-4-argon-high

    Checked

    • Verified in an independent clone that origin identifies tbhb-dev/devtools and origin/main resolves to a0347a715fab580ece45edfcb3d13509620459a8.
    • Read live tbhb-dev/devtools#817 (open, Feature, label change:feat, and its Round 1 comment) and the live issues named in its body: tbhb-dev/devtools#588, tbhb-dev/devtools#329, tbhb-dev/devtools#818, tbhb-dev/devtools#819, tbhb-dev/devtools#277, tbhb-dev/devtools#501, tbhb-dev/devtools#551, tbhb-dev/devtools#573, tbhb-dev/devtools#753, tbhb-dev/devtools#661, and tbhb-dev/devtools#333.
    • Verified both Round 1 blocker resolutions across live tbhb-dev/devtools#817 and tbhb-dev/devtools#818:
      • Boundary ownership: #817 explicitly owns the whole-object scanning and shared push-selection boundary (emit_objects, emit_range, emit_pre_push, tag payloads in AC2/AC3, ref-line parsing and OID widths in AC4, destination discovery and exclusions in AC5, and zero-line --pre-push-hook versus manual --pre-push selection in AC6), including when #818 reuses that boundary. Live #818 narrows its contract to publication commit additions (--publish and DEVTOOLS_LEAK_MODE=publish), lists #817 as a prerequisite in Dependencies, and cites #817 AC2, AC3, AC4, AC5, AC6, AC7, and AC8 in #818 AC7 and Verify plan rather than redefining the whole-object and push-selection boundary.
      • .devtools/scripts/check-leaks.bats ownership between #817 and #818: #817 claims the shared whole-object tag tests at .devtools/scripts/check-leaks.bats:1890 and .devtools/scripts/check-leaks.bats:1913 for both unscoped and publication-scoped pushes, and #818 delegates those cases to #817. (Note for #818: #818's Coverage text excludes .devtools/scripts/check-leaks.bats:1885 as belonging to #817, whereas .devtools/scripts/check-leaks.bats:1885-1889 is a --publish binary marker test; #817's own Coverage citations are exact and do not claim .devtools/scripts/check-leaks.bats:1885.)
      • #277 disposition: #817 clarifies in Scope and non-goals, Dependencies, and Size that hook wiring in #817 means only --pre-push and --pre-push-hook mode handling in .devtools/scripts/check-leaks.sh:743-752,847-853, while .devtools/scripts/install-pre-push.sh, hook installation, and #277's shared-worktree hook changes belong to tbhb-dev/devtools#819, so #277 is not a dependency or blocker for #817.
    • Verified all origin/main source and test references in tbhb-dev/devtools#817:
      • .devtools/scripts/check-leaks.sh:341 (emit_objects comment and implementation at .devtools/scripts/check-leaks.sh:341-411), .devtools/scripts/check-leaks.sh:427 (emit_range at .devtools/scripts/check-leaks.sh:427-432), and .devtools/scripts/check-leaks.sh:443 (emit_pre_push at .devtools/scripts/check-leaks.sh:443-492).
      • .devtools/scripts/check-leaks.sh:434 (comment documenting read-only destination discovery via git ls-remote at .devtools/scripts/check-leaks.sh:475) and .devtools/scripts/check-leaks.sh:87 (rm -rf "$tmp" cleanup in on_exit()).
      • .devtools/scripts/check-leaks.bats:303, .devtools/scripts/check-leaks.bats:382, .devtools/scripts/check-leaks.bats:478, .devtools/scripts/check-leaks.bats:585, .devtools/scripts/check-leaks.bats:654, .devtools/scripts/check-leaks.bats:752 through .devtools/scripts/check-leaks.bats:880, .devtools/scripts/check-leaks.bats:960 through .devtools/scripts/check-leaks.bats:1084, .devtools/scripts/check-leaks.bats:1346, .devtools/scripts/check-leaks.bats:1382, .devtools/scripts/check-leaks.bats:1390, .devtools/scripts/check-leaks.bats:1442, .devtools/scripts/check-leaks.bats:1890, and .devtools/scripts/check-leaks.bats:1913.
    • Verified AC1–AC12, Scope and non-goals, Dependencies, Size, Verify plan, Risks, and Operator authority against the Definition of Ready and origin/main (.agents/agent-skills.conf:4-9, .devtools/tasks/leaks.toml:1-23): all criteria are observable, testable, single-outcome, and free of unapproved implementation detail; #753 is open and refinement:ready; #501 and #551/#573 remain non-goals; and every AC ID is proved by concrete checks in Verify plan.

    Gaps

    None

    Split

    No further split is needed. tbhb-dev/devtools#817 (Size: M) cleanly scopes the whole-object scanning and shared push-selection boundary (emit_objects, emit_range, emit_pre_push, and --pre-push / --pre-push-hook mode handling) into one pull request, leaving publication commit additions to tbhb-dev/devtools#818 and pre-push hook installation to tbhb-dev/devtools#819.

    Definition of done

    The definition of done for #817 (Feature). Tick each item and give its evidence.

    Boxes ticked below indicate planning coverage in the issue's acceptance criteria and verification plan, not completed implementation work.

    • D1 The author verified each AC on the merged head, and the Verification section of the pull request cites each AC ID with its evidence: the command and its result, or a link.
      Evidence: Planned in Verify plan (AC1, AC2 through AC12 and Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification).
    • D2 An independent reviewer approved the exact merged head, and the author resolved each finding or filed it as a follow-up.
      Evidence: Planned in Verify plan (D2 an independent review approves the exact merged head, and every finding has a recorded disposition).
    • D3 The required checks pass on that head, and any loosened gate has the owner's approval of that exact head.
      Evidence: Planned in Verify plan (Run the branch binary through mise run test-leaks, preserving disposable local-destination integration coverage, then mise run check, fresh coverage and both coverage floors. Check #753's protection of replacement enforcement and registration and D3 required checks pass with no gate loosened) and Operator authority.
    • D4 The leak scans come back clean: gitleaks, devtools' check-leaks.sh with the repository's private-strings list, and the leak review of each post.
      Evidence: Planned in Verify plan (D4 the leak scans the repository specifies are clean, and every post made for this work (comments, descriptions) passes the per-post leak review before it is posted).
    • D5 The author signed each commit, the squash included.
      Evidence: Planned in Verify plan (D5 every commit is signed).
    • D6 The docs match the change (README, docs/, CHANGELOG or help text), or the Verification section says "No doc impact" and why.
      Evidence: Planned in Scope and non-goals (consumer documentation of range/manual/hook behavior, fallback and rollback) and Verify plan (As D6 evidence, review documentation against the tested boundary and exercise its fallback and rollback instructions in disposable fixtures and D6 the documentation matches, or the description says No doc impact with the reason).
    • D7 The commits and the squash have Assisted-by trailers, and the pull request has the provenance:agent-assisted label.
      Evidence: Planned in Verify plan (D7 every commit carries an Assisted-by trailer and the pull request carries the provenance:agent-assisted label).
    • D8 The pull request stays within the size limits, or the owner approved its exact head over the hard limit.
      Evidence: Planned in Size (M. One pull request for the whole-object and shared push-selection boundary, including mode handling; no installer work) and Verify plan (D8 the change stays within the pull request size limits).
    • D9 The author files follow-ups and deferred findings as issues with at least a Problem and numbered AC and lists them under the Related section of the pull request. Any work left in the code links its issue.
      Evidence: Planned in Scope and non-goals (Removing the frozen fallback waits for separate N-2 follow-up work under D9) and Verify plan (D9 follow-up work, including deferred review findings, is filed as issues, each with a Problem section and numbered acceptance criteria and linking this issue; the pull request's Related section lists them, and any code that defers work links its issue).
    • D10 The merge closes the issue through a closing reference and the board shows Done. The final Status: comment names the merge commit.
      Evidence: Planned in Verify plan (D10 the merge closes this issue through a closing reference, the project board shows the state Done, and a final Status: comment names the merge commit).

    Round: 2 of 3

  8. tbhb-agent
    added
    refinement:readyPassed the Definition of Ready; may be picked up
    on Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    change:featPR adds or changes a feature (Conventional Commit type feat)refinement:readyPassed the Definition of Ready; may be picked up

    Type

    Feature

    Fields

    Priority

    None yet

    Work type

    None yet

    Projects

    • devtools
      Status
      Backlog

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions