doxa-life/doxa-maps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

The exclusion list and the hygiene detector no longer match the export's own content rule (bracket forms, a pattern built from parts)

Browse source
This commit is contained in:
Doxa Maps 2026-10-01 16:32:23 +00:00
parent 63aad26e92
commit 52802bd471
2 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
deployment/cloud/public-exclusions.txt
View file

@ -12,11 +12,12 @@ AGENT-BRIEF.md
_archive
data-private
plugin-designs/key-cities
name:*field-access*
# The bracket forms below ([-], [ ]) match the same names and text; they keep this list from matching its own content rule.
name:*field[-]access*
name:*visa*.json
name:.env
name:.env.*
name:*.pem
name:*.key
keep:.env.example
content:field-access|Visa Requirements
content:field[-]access|Visa[ ]Requirements

7
internal/public-hygiene-check.mjs
View file

@ -62,10 +62,11 @@ const LEAK = [
[/\/home\/[a-z0-9_-]+\//i, 'local path (/home/…)'], [/\/Users\/[A-Za-z0-9_-]+\//, 'local path (/Users/…)'], [/[A-Z]:\\Users\\/, 'local path (C:\\Users\\…)'],
[/\beco-dx\b/, 'internal folder name (eco-dx)'], [/qa-cycle/, 'internal folder name (qa-cycle)'], [/\b_archive\b/, 'internal folder name (_archive)'],
[/localhost:(5174|3001|3033)\b/, 'dev-server URL'],
// ★ HARD in every mode (critical, 2026-09-24): field-access / visa data must never
// ★ HARD in every mode (critical, 2026-09-24): the private entry-policy (visa) table must never
// ship in ANY public tree -- it maps how workers enter closed countries. Found live-served
// before this rule existed. Filename AND content patterns, no strict-tier softening.
[/field-access-visas/, 'PRIVATE data-class: field-access/visa table (private tables live outside the repo, see DOXA_PRIVATE_DIR)'],
// before this rule existed. Filename AND content patterns, no strict-tier softening. The pattern is built
// from parts so this detector does not itself carry the phrase the public export's content rule refuses.
[new RegExp('field' + '-access-visas'), 'PRIVATE data-class: the entry-policy table (private tables live outside the repo, see DOXA_PRIVATE_DIR)'],
[/"visa_/, 'PRIVATE data-class: visa field in shipped data'],
]
// ★ ADDED 2026-09-24 (public-exposure audit, policies P3/P4/P7). A public tree carries