doxa-life/doxa-maps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

public-hygiene: the packets' prayer point 1 may say persecution, exactly as written; nothing else may

Browse source 
Driver decision 2026-09-28: the prayer is kept word for word. The
operational-vocabulary rule now removes exactly the prayer text at
packet-strings.json <locale>.points[0].text (every locale, raw and as a string
literal) from a scanned file before it looks; the same word anywhere else is
still reported. Measured: 4 warnings to 0, and a planted file using the word
is still flagged.
This commit is contained in:
Doxa Maps 2026-09-28 01:31:56 +00:00
parent 64a2f42730
commit 085394fff2
1 changed files with 21 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
internal/public-hygiene-check.mjs
View file

@ -85,6 +85,25 @@ const LEAK_STRICT = [
[/\bpersecution\b/, 'operational-context vocabulary (allowed only inside data CSVs)'],
[/\.forgejo\/workflows/, 'CI workflow path — process, never ships in a public tree'],
]
// ★ THE PRAYER, WORD FOR WORD (Driver decision 2026-09-28): "Persecution happens globally, so the prayer is
// for the globe, and the packets carry the same prayer for all packets." The operational-vocabulary rule
// skips EXACTLY that prayer: the text at packet-strings.json <locale>.points[0].text (the packets' prayer
// point 1, which UPG-100's Two-Cross packet shows too), read from its source in every locale, removed from
// a scanned file before the rule looks at it. Scoped by file and key, never by the word: the same word
// anywhere else still counts.
const PRAYER_ALLOWED = (() => {
try {
const src = JSON.parse(readFileSync(join(ROOT, 'library/scripts/posters/packet-strings.json'), 'utf8'))
const out = []
for (const [lc, v] of Object.entries(src)) {
const text = !lc.startsWith('_') && v?.points?.[0]?.text
if (typeof text === 'string' && text) out.push(text, JSON.stringify(text).slice(1, -1)) // raw, and as a JS/JSON string literal
}
return out
} catch { return [] }
})()
const withoutPrayer = (t) => PRAYER_ALLOWED.reduce((acc, s) => acc.split(s).join(''), t)
// ★ WIDENED 2026-09-21. This held ONE pattern (the Mapbox JWT), on the reasoning that public/
// is a tree we GENERATE, so the only realistic leak is the token the build itself writes.
// THAT REASONING WAS WRONG: 855 files under public/ are TRACKED, 95 of them text — boundaries,
@ -131,7 +150,8 @@ for (const f of files) {
if (!isText || f.size > 40 * 1024 * 1024) continue
const t = readFileSync(f.abs, 'utf8')
for (const [re, why] of LEAK) if (re.test(t)) hit(findings, 'leaks', f.rel, why)
for (const [re, why] of LEAK_STRICT) if (re.test(t) && !/\.csv$/.test(f.rel)) hit(STRICT ? findings : warnings, 'leaks', f.rel, why)
const tNoPrayer = PRAYER_ALLOWED.length && /persecution/.test(t) ? withoutPrayer(t) : t
for (const [re, why] of LEAK_STRICT) if (re.test(re.source.includes('persecution') ? tNoPrayer : t) && !/\.csv$/.test(f.rel)) hit(STRICT ? findings : warnings, 'leaks', f.rel, why)
// ★ P2 (2026-09-24): a credential is a DOCUMENT, not a string. Every JWT-shaped value gets
// its payload DECODED and its claims reviewed: 'it is a public token' is not sufficient —
// the pk. accepted by the 2026-09-21 ruling turned out to carry a `u` claim naming a real,