From ccc7c2e31aae013bc3bfdfc3ea3534e3a33c2db1 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 2 Oct 2026 16:21:48 +0100
Subject: [PATCH 1/3] fix(ci): stop gitleaks flagging the estate baseline the
 scanner stages itself

The standards secret-scanner reusable copies the estate baseline to
.gitleaks-estate.toml in the workspace root unconditionally
(hyperpolymath/standards#888). The baseline documents credential shapes,
so generic-api-key fires three times on it and the required
`scan / gitleaks` context is red on main and on every PR (e.g. #154).

Add a root-anchored self-exclusion (^\.gitleaks-estate\.toml$), the same
cure as metadatastician/IDApTIK#127. Root-only on purpose: a planted PAT
at src/.gitleaks-estate.toml is still detected (github-pat).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WPSJ7fBhVAMcpSffCBWUDo
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .gitleaks.toml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index db763a2..11f8599 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -52,6 +52,25 @@ paths = [
   # registry, which trip the generic-api-key entropy heuristic.
   '''(^|/)Project\.toml$''',
   '''(^|/)Manifest\.toml$''',
+
+  # The SCANNER'S OWN STAGED ARTEFACT -- not an exemption for a file that
+  # "is fine", which the DESIGN RULE above forbids, but the one file the
+  # scanner writes into its own scan target.
+  #
+  # The standards secret-scanner reusable copies
+  # `config/gitleaks/estate-baseline.toml` to `.gitleaks-estate.toml` in the
+  # workspace root UNCONDITIONALLY, before the step that decides whether this
+  # repo references it (hyperpolymath/standards#888). That baseline documents
+  # worked examples of credential SHAPES, so `generic-api-key` fires on it and
+  # the required `scan / gitleaks` gate goes red for reasons no commit here
+  # caused (3 findings on `.gitleaks-estate.toml`, run 37023024168).
+  #
+  # Anchored `^...$` -- ROOT ONLY. A path regex matches a BASENAME AT ANY
+  # DEPTH unless anchored, so `(^|/)` would also blind the scanner to a real
+  # `src/.gitleaks-estate.toml`. The reusable only ever writes the file at the
+  # root, so root-only is exact. Same cure as metadatastician/IDApTIK#127;
+  # remove once standards#888 lands and the caller pin is bumped past it.
+  '''^\.gitleaks-estate\.toml$''',
 ]
 
 regexes = [

From 8546edbde6faa37566dc7ccf6f3f3dcdcec92b51 Mon Sep 17 00:00:00 2001
From: "coderabbitai[bot]"
 <136622811+coderabbitai[bot]@users.noreply.github.com>
Date: Fri, 2 Oct 2026 16:46:13 +0000
Subject: [PATCH 2/3] docs: redact leaked Cloudflare token from rotation
 handover prompt

---
 .../prompts/earlier-02-cloudflare-token-rotation.adoc         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/handover/2026-05-26/prompts/earlier-02-cloudflare-token-rotation.adoc b/docs/handover/2026-05-26/prompts/earlier-02-cloudflare-token-rotation.adoc
index 5b0bb88..7f60b6b 100644
--- a/docs/handover/2026-05-26/prompts/earlier-02-cloudflare-token-rotation.adoc
+++ b/docs/handover/2026-05-26/prompts/earlier-02-cloudflare-token-rotation.adoc
@@ -11,7 +11,7 @@ confirmation.
 
 == Context
 
-* Token ID: `689fa59a165c47cc61095d984c453205`
+* Token value: [REDACTED — see the incident references below; rotation remains unverified].
 * Leak location: `standards/avow-protocol/deploy-repos.sh:5` commit `5f2f8b2`
 * Token status: **UNVERIFIED** at Cloudflare as of session-end 2026-05-26.
 * Code fix PR `standards#161` MERGED 2026-05-26 — removed the literal token from the file.
@@ -21,7 +21,7 @@ Memory: `project_cloudflare_token_leak_2026_05_21.md`.
 
 == Concrete steps
 
-. **ASK** the user explicitly: "Was Cloudflare token `689fa59a...` rotated?"
+. **ASK** the user explicitly: "Was the leaked Cloudflare token referenced below rotated?"
    Do not proceed without an unambiguous yes.
 . If yes:
 .. Confirm the new token works for whatever workflow depended on the old one.

From 37e79279b1236bc2271b0d09827ca1460518d9a3 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 2 Oct 2026 18:19:59 +0100
Subject: [PATCH 3/3] chore(ci): record the Ratchet-exception for the gitleaks
 self-exclusion

The Exemption ratchet reads .gitleaks.toml 14 -> 15. The one new entry is
the root-anchored path the reusable stages the estate baseline to; without
it gitleaks flags its own config (standards#888).

Ratchet-exception: .gitleaks.toml +1 path entry (^\.gitleaks-estate\.toml$), the scanner's own staged artefact; standards#888; remove when the caller pin passes the fix

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WPSJ7fBhVAMcpSffCBWUDo