Fingerprint the reviewed narrative commit ids the merge-commit history scan now reaches - #1072

Scope

• What this PR changes, in one or two sentences: it adds 28 exact commit:path:rule:line fingerprints to .gitleaksignore for the reviewed narrative commit ids of the blind-catalog-convergence evidence. The CI history scan has read merge commits as first-parent diffs since the 2026-10-09 out-of-memory fix, so it now finds them again in the two merge commits that brought them into main.
• Base commit: 3f1a921d (main).
• Lane: lane:foundation
• Owned paths touched: .gitleaksignore (28 fingerprints under a dated comment); tests/test_gitleaks_config.py (GitleaksMergeCommitFingerprintTests, round 1); manifests/evidence.json (re-registration).
• Commits: d8f097ec (the fingerprints), 6fd00ad1 (round 1, the regression) and efb3158f (round 2, the pinned upstream citation).

What the scan found. The validate.yml run of 2026-10-13 (run 38372534999, workflow_dispatch, full history) reported 30 findings, all rule sourcegraph-access-token. The findings:

• are in two old merge commits on main: 9b7a67b9 ("Integrate PRs Finalize portable grand catalog with independent Codex and Claude convergence #55-SOTA repository convergence 2026-09-22: per-layer list, manifest, newcomer dispositions, engine reconciliation #58 into one grand-catalog base") and 5cfed346 ("Merge PR Finalize portable grand catalog with independent Codex and Claude convergence #55 ... into the grand-catalog base");
• cover 14 lines of evidence/artifacts/blind-catalog-convergence-20260921/claude-coverage-review.json and screening-ledger.json;
• are the same lines .gitleaksignore already fingerprints for 6568523f. The 2026-09-22 generation of that list used --log-opts=HEAD, and only the first-parent merge diffs reach these commits.

There are 28 distinct fingerprints: two findings share line 424 in each commit. No open PR's commits are involved.

How each was checked (shape only). The command center routed this to a Claude session with a value-free procedure. No matched value, or any character of one, is in this PR, its commit message or any record.

• The scan was reproduced locally at the run's head fb968aff with the CI's command (gitleaks 8.30.1, --config .gitleaks.toml --log-opts="--diff-merges=first-parent HEAD" --redact): the same 30 findings.
• Each matched span was read only inside a script, by byte offset. All 30 are 40-character lower-case hex with no sgp_ prefix, the shape of a git object id. There are 10 distinct values.
• 8 values (18 findings) resolve with git cat-file -t as commit objects in local mirrors of the upstream repositories the text names: QuantConnect/Lean, alpacahq/alpaca-skills, alpacahq/cli, grafana/grafana, grafana/loki, microsoft/playwright, prometheus/prometheus, skfolio/skfolio.
• 2 values (12 findings) are in no local mirror. This repository's own tree uses them 115 times as the commit of GitHub blob/<sha>/ and tree/<sha>/ links and in source_commit, source_pin and pin_of_record fields.
  • The GitHub API resolves each as a commit of the repository those links name: nkaz001/hftbacktest for 8 findings and ggml-org/llama.cpp for 4.
  • The values are already public in this repository, so the lookup adds no exposure.
• The command center confirmed every fingerprint from the value-free table below. Its confirmation record of 2026-10-13 and the api-actions lane's verification table are private records, cited by name only, with no digest.

Round 1 (6fd00ad1). The local codex review at d8f097ec (a review record cited by name) asked for one thing (P2): a regression that fails without these fingerprints and passes with them. GitleaksMergeCommitFingerprintTests adds two tests:

• The scan test: scans each merge commit alone, as its first-parent diff (<commit>^!, the CI's --diff-merges=first-parent), with .gitleaksignore, and requires no finding.
  • It is bounded to two commits and redacted, and about 4 s.
  • It skips when gitleaks or the commits are absent.
• The structural test: checks, with no scanner, that every reviewed narrative line is fingerprinted for both merge commits.
• Fail-before: with main's .gitleaksignore the scan test reports the 30 findings and the structural test the 28 missing entries. With this change both pass.
• Commit ids: the test names the two commits by 8-character prefixes, resolved with git at run time. A full 40-hex id in the test file would itself match the rule's 40-hex form; the pre-commit gitleaks hook caught exactly that on the first attempt, and the test was rewritten rather than the hook bypassed.

Round 2 (efb3158f). The local codex review at 6fd00ad1 (a review record cited by name) asked for one thing (P2): cite the pinned upstream source for how these fingerprints are built and matched. The citation is now in the .gitleaksignore comment and in SOTA sources below. Only an 8-character commit prefix is written there, since a full 40-hex id in that file would match the rule. Astra's delta read at 6fd00ad1 (ACK, no blockers) reached the same mechanism locators.

Follow-ups (not in this change):

• From Astra's delta read at 6fd00ad1 (P3):
  • The two values resolved through the GitHub API (nkaz001/hftbacktest, ggml-org/llama.cpp) are in no local mirror, and no pinned capture of those lookups is attached. Adding the two repositories to the mirror set would make the check reproducible offline.
  • GitleaksMergeCommitFingerprintTests discards the descriptor tempfile.mkstemp returns and only unlinks the path, as the neighbouring history tests do. Closing it, or using NamedTemporaryFile, belongs in a cleanup of that pattern across the module.
  • Inherited hostname labels in manifests/evidence.json; none is added here.
  • Some modules need a genuine worktree to run fully (fixture scratch paths, local server binds); the reader's packet lists them.
• .gitleaksignore's 2026-09-22 header describes a --log-opts=HEAD generation. A note on how first-parent merge diffs reach older reviewed lines, or a regeneration helper, would make the next such case mechanical.
• The secret-scan-betterleaks job of the same run reported 1,695 findings. That job does not fail CI, and those findings are outside this task.

SOTA sources

• gitleaks/[email protected], commit 83d9cd68 (the CI's pinned version, and the installed client; read from the local mirror at that tag):
  • detect/detect.go:711-733: AddFinding builds a git finding's fingerprint as commit:file:rule-id:start-line. It skips the finding when that fingerprint, or the commit-less file:rule-id:start-line, is in the ignore set.
  • detect/detect.go:153-193: AddGitleaksIgnore loads the set from the file, skipping blank and # lines and normalizing the path part.
  • cmd/root.go:90 and :311-318: the file is read from the -i/--gitleaks-ignore-path directory (. by default) and from the scanned source's root.
  • So a fingerprint suppresses only its own commit, file, rule and line. .gitleaksignore's 2026-10-13 comment carries the same citation (round 2).
• The scan options are the CI's, from .github/workflows/validate.yml at the base: gitleaks git . --config .gitleaks.toml --log-opts="--diff-merges=first-parent HEAD" --redact.
• The repository's rule for this file (its header): add a fingerprint only for a reviewed false positive, never for a real secret.

Evidence-class table

Local commands run

$ gitleaks git . --config .gitleaks.toml --log-opts="--diff-merges=first-parent HEAD" --redact --no-banner --report-format json --report-path <private>   # at fb968aff
leaks found: 30   (rc 1; 1.81 GB, 31 s)
$ (the same command on this branch, idle-class)
no leaks found   (rc 0)
$ gitleaks dir . --config .gitleaks.toml --redact --no-banner --report-format json --report-path <private>
no leaks found   (rc 0)
$ python3 -m unittest tests.test_gitleaks_config tests.test_secret_scan_metrics tests.test_secret_scan_size tests.test_workflow_hardening tests.test_evidence_manifest tests.test_validate
Ran 283 tests in 67.247s
OK (skipped=5)
$ python3 scripts/validate.py; python3 scripts/evidence_manifest.py --check
(rc 0); {"files": 11882, "status": "passed"}
$ gitleaks git --log-opts="origin/main..HEAD" --redact .
no leaks found
$ git merge-tree --write-tree origin/main HEAD   # main 3f1a921d, before the push
rc 0
# Round 1 (6fd00ad1):
$ python3 -m unittest tests.test_gitleaks_config.GitleaksMergeCommitFingerprintTests   # with main's .gitleaksignore
FAILED (failures=2)   # the 30 findings; the 28 missing fingerprints
$ python3 -m unittest tests.test_gitleaks_config.GitleaksMergeCommitFingerprintTests
Ran 2 tests in 4.275s
OK
$ python3 -m unittest tests.test_gitleaks_config tests.test_workflow_hardening tests.test_evidence_manifest tests.test_validate
Ran 267 tests in 57.838s
OK (skipped=2)
$ python3 scripts/validate.py
(rc 0)
$ git merge-tree --write-tree origin/main HEAD   # main 3f1a921d, before the push
rc 0
# Round 2 (efb3158f):
$ python3 -m unittest tests.test_gitleaks_config
Ran 58 tests in 31.212s
OK (skipped=1)
$ python3 scripts/validate.py
(rc 0)
$ gitleaks git --pre-commit --staged --redact .   # and the range scan origin/main..HEAD
no leaks found
$ git merge-tree --write-tree origin/main HEAD   # main 993cc890, before the push
rc 0

Decision record

None: this applies the rule in .gitleaksignore's own header (a fingerprint for each reviewed false positive). The command center's confirmation of 2026-10-13 is its private record, cited by name.

Host evidence

Not applicable (no evidence/hosts/ change).

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a
  version comment (no floating tags). (none changed)
• New/changed workflows declare top-level permissions: {} and grant each job
  only what it needs (contents: read, or an explicitly justified addition). (none changed)
• No secrets are printed, logged or committed; no new required secret was
  added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted,
  moved or overwritten).

🤖 Generated with Claude Code