chore(fork-gates): drop .gitleaksignore from the allowlist so it matches the contract it claims to enforce

[jeremylongshore]

What

Removes .gitleaksignore from the ALLOW array in scripts/fork-gates/check-additive-only.sh (14 → 13 entries), re-pins .harness-hash, and files 000-docs/008-AA-AUDR recording the audit.

Why

That script carries a comment above ALLOW asserting the array is the machine form of FORK.md's must-survive table and must be kept in lockstep with it. Nothing tests that assertion — check-must-survive.sh asserts the listed paths exist, not that the two lists agree. Diffing them found exactly one entry in ALLOW with no row in FORK.md.

ALLOW is a permission, not a claim of existence — it means "if this path differs from upstream, that is allowed." So this was standing permission for a file that:

• does not exist in the worktree, nor in git diff upstream/main...HEAD; and
• nothing would use — gitleaks runs nowhere in this repo (fork-gates.yml has two steps), and the sole occurrence of that string anywhere in the repository was the ALLOW entry itself.

Decision rationale — removal over adding a FORK.md row

Both restore lockstep. Adding a row documents a file that does not exist, which is the instinct decision-log/048 (D170/D171) ratified against a week ago when it retired two phantom repositories rather than keep reserving their names.

Removal also fails closed: if a .gitleaksignore is ever genuinely wanted, the additive-only gate refuses the diff until FORK.md and ALLOW are updated together. That is the contract working — and precisely the review step 007 found had been missing.

FORK.md is not touched. It was already correct; the array had drifted away from it.

Layer(s) touched

The fork-contract enforcement surface only. No application code, no upstream-owned path, no deploy or runtime behaviour.

Incidental finding — recorded, not swallowed

Re-pinning .harness-hash (required: scripts/fork-gates/*.sh is inside the pinned surface per .harness-hash-extra-patterns:7) revealed that 000-docs/007 was never pinned when it was added on 2026-08-03 — audit-harness init was evidently not re-run. The manifest now covers 14 files instead of 12.

Nothing was tampered with; an unpinned file is simply one the verify step was silently not watching. That makes it the second instance in this one audit of enforcement whose scope quietly stopped matching its subject.

Verification & evidence

Check	Result
check-additive-only.sh upstream/main	additive-only OK vs upstream/main
check-must-survive.sh	must-survive set intact (12 paths)
scripts/audit-harness verify	harness-hash: OK
Divergence set vs upstream	unchanged by this commit

CI runs the first two as the required fork-contract check.

Risk assessment

Low, and one-directional — this narrows what the fork may diverge on. The only way it bites is a future change adding .gitleaksignore, which will now be stopped at the gate for a deliberate contract update rather than passing silently. That is the intended behaviour.

Operational impact

None. No secrets, no env, no migrations, no deps, no deploy ordering.

Follow-up & deferred

The lockstep comment is still an unenforced assertion. A gate that parses the FORK.md table and asserts set-equality with ALLOW would make it real. Noted as a follow-up in 000-docs/008 and deliberately not bundled here, so this stays reviewable as a one-line removal.

Governance links

• FORK.md § Must-survive set — the human contract
• 000-docs/007-AA-AUDR-fork-contract-breach-2026-08-03.md — the breach whose causal chain was "gates existed but were never in CI"; this is the adjacent failure
• intent-os decision-log/048 D170/D171 — the phantom-retirement precedent this follows

Refs 000-docs/008-AA-AUDR-fork-allowlist-lockstep-2026-08-08.md

• Jeremy Longshore
  intentsolutions.io

Summary by CodeRabbit

• Documentation

  • Added an audit record covering fork allowlist alignment, manifest verification, and fail-closed checks.
  • Updated the documentation index to include the new audit record.
  • Recorded a prior fork contract breach and subsequent allowlist lockstep review.

• Bug Fixes

  • Removed an undeclared .gitleaksignore path from the permitted fork paths, so future changes to that path are correctly flagged as violations.

[coderabbitai]

Warning

Review limit reached

@jeremylongshore, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 37 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ee5761d2-3d66-46b7-adff-90b64c4bd40e

📥 Commits

Reviewing files that changed from the base of the PR and between 83de1e1 and e5de303.

📒 Files selected for processing (2)

• .harness-hash
• 000-docs/008-AA-AUDR-fork-allowlist-lockstep-2026-08-08.md

📝 Walkthrough

Walkthrough

The fork gate removes .gitleaksignore from the allowed path prefixes. A new audit document records the correction and verification results. The documentation index and .harness-hash manifest are updated for the changed and new documents.

Changes

Fork allowlist audit

Layer / File(s)	Summary
Allowlist correction and audit record scripts/fork-gates/check-additive-only.sh, 000-docs/008-AA-AUDR-fork-allowlist-lockstep-2026-08-08.md, 000-docs/000-INDEX.md	The fork gate no longer allows .gitleaksignore. The audit document records the discrepancy, verification results, and deferred set-equality check. The documentation index links the audit.
Harness manifest synchronization .harness-hash	The manifest updates the hash for the index and fork gate script, and adds hashes for two audit documents.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• intent-solutions-io/buzz#17: This PR follows the documented fork-contract breach by correcting the fork-gate allowlist and adding an audit record.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing .gitleaksignore from the fork-gates allowlist to match the contract.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/fork-allowlist-lockstep

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kilo-code-bot]

Code Review Summary

The review did not run because the selected model is no longer available.

Choose another model in Kilo Code review settings: https://app.kilo.ai/code-reviews

Previous Review Summary

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review

The review did not run because the selected model is no longer available.

Choose another model in Kilo Code review settings: https://app.kilo.ai/code-reviews

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@000-docs/008-AA-AUDR-fork-allowlist-lockstep-2026-08-08.md`:
- Around line 29-37: The audit document’s allowlist comparison and counts are
stale: update the `ALLOW` entry table to match the actual array, remove
`REVIEW.md` unless it is genuinely allowlisted, add or remove its corresponding
`FORK.md` row as appropriate, and correct all stated entry and transition
counts, including the “14 → 13” claim.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 33faaa8f-7acf-4159-8017-96be8f5fad16

📥 Commits

Reviewing files that changed from the base of the PR and between 0611d14 and 83de1e1.

📒 Files selected for processing (4)

• .harness-hash
• 000-docs/000-INDEX.md
• 000-docs/008-AA-AUDR-fork-allowlist-lockstep-2026-08-08.md
• scripts/fork-gates/check-additive-only.sh

💤 Files with no reviewable changes (1)

• scripts/fork-gates/check-additive-only.sh

[jeremylongshore]

@coderabbitai — confirmed, and fixed in e5de303.

You were right and I verified it against git show origin/main:… rather than taking it on trust. The counts in 000-docs/008 came off the wrong branch: I read the ALLOW array from the unmerged chore/retire-phantom-lab-repos, which adds REVIEW.md to ALLOW and to FORK.md — correctly, in lockstep. On main, the base this PR targets, REVIEW.md is in neither list and the file does not exist there at all.

	Claimed	Actual on origin/main
ALLOW entries	14	13
FORK.md path rows	11	10
Transition	14 → 13	13 → 12
REVIEW.md	listed as matched	in neither list

The one-line removal itself was never affected — .gitleaksignore is entry 5 of 13 on origin/main and has no FORK.md row either way. Only the surrounding arithmetic and the comparison table were wrong.

I recorded the correction as a new § 5b rather than quietly amending the numbers. An audit about two lists disagreeing that itself miscounted the lists is the best argument available for the follow-up already named in § 6 — a gate that parses the FORK.md table and asserts set-equality with ALLOW, so the "keep in lockstep" comment stops being an unenforced assertion. Deleting the evidence for that argument to look tidier seemed like the wrong trade.

Gates re-run after the fix: additive-only OK vs upstream/main, must-survive set intact (12 paths), harness-hash: OK, divergence set unchanged.

• Jeremy Longshore
  intentsolutions.io

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@jeremylongshore Confirmed. The correction in e5de303 addresses the documentation-count error.

The retained § 5b correction preserves the audit trail. The reported origin/main values are now consistent with the stated base branch. The .gitleaksignore removal remains correct and independent of the count correction.

🐇 ✓

---

✏️ Learnings added

Learnt from: jeremylongshore
URL: https://github.com/intent-solutions-io/buzz/pull/24

Timestamp: 2026-08-08T22:31:23.326Z
Learning: For fork allowlist audits in `scripts/fork-gates/check-additive-only.sh` and `FORK.md`, derive `ALLOW` and table counts from the PR base branch (`origin/main` for PR `#24`). The unmerged `chore/retire-phantom-lab-repos` branch adds `REVIEW.md` to both lists, but `REVIEW.md` is absent from both lists on `origin/main`.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

---

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!

_{You are interacting with an AI system.}