From d71fa0e51868d94c6820b323afb5238daa91f5ec Mon Sep 17 00:00:00 2001 From: James Sesler Date: Mon, 21 Sep 2026 03:03:09 -0400 Subject: [PATCH] docs: name the FreeAgent evidence artifacts without machine paths The evidence baseline listed six absolute paths under a home directory on the author's machine. They dated from f3f7438 (#44) and served no reader: the FreeAgent run was local and its outputs were never published, so nobody cloning this repo could open any of them. All they carried was the operating system, the username, and the local directory layout of the machine that made the release. Replaced with the same six artifacts named relative to that workspace's .codecarto/, which is what the surrounding text actually needs - it is citing WHICH artifacts the conclusions rest on, not offering a link. R11 sweep - the class is "machine-specific absolute path in tracked content", swept across the whole tracked tree rather than this file: - /home// - six instances, all here, all closed. Five other hits are synthetic test inputs (/home/someone, /home/me) and one is /home/james in tests/dashboard.test.mjs, which is the INPUT to a test asserting that an absolute session path is not rendered as a link. It is not this machine's home and changing it would weaken the test. - /Users// and C:\Users\\ - none. - bare username, hostname, private IPs - none. - credential-shaped strings - one hit, "sk-abc...1234", a deliberate fixture in a test proving a secret never reaches the provider. Scope of the original exposure: docs/ is not in package.json files[], so this never shipped in an npm tarball (verified with a real npm pack: zero docs/ entries). It has been in public git history since f3f7438 and remains there - this commit stops it being in the current tree, and rewriting history is a separate decision for the maintainer. --- docs/plans/post-0.11-evidence-roadmap.md | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/docs/plans/post-0.11-evidence-roadmap.md b/docs/plans/post-0.11-evidence-roadmap.md index 195fd3c..2bc3712 100644 --- a/docs/plans/post-0.11-evidence-roadmap.md +++ b/docs/plans/post-0.11-evidence-roadmap.md @@ -11,14 +11,17 @@ The priorities below are based on two real `full-with-deep-audit` runs: - Aimbroidery dogfood: exercised a real isolated-phase compaction, atomic checkpoint creation, fresh-host `/codecarto-open` recovery, provider-stop recovery, and completion through the porting-bundle boundary. - FreeAgent dogfood with `codecartographer-pi` v0.11.0: completed 7/7 phases in a clean source tree, produced 312,044 bytes across the seven canonical primary findings, and validated as two `PASS WITH GAPS` plus five `PASS` phases. The final phase used the porting bundle by default, made one targeted lower-level findings read, and did not reopen source files. -Evidence paths for the FreeAgent run: - -- `/home/jamessesler/Documents/Github/FreeAgent/.codecarto/workflow/status.yaml` -- `/home/jamessesler/Documents/Github/FreeAgent/.codecarto/workflow/.usage.local.yaml` -- `/home/jamessesler/Documents/Github/FreeAgent/.codecarto/THREAD_LOG.md` -- `/home/jamessesler/Documents/Github/FreeAgent/.codecarto/dashboard.html` -- `/home/jamessesler/Documents/Github/FreeAgent/.codecarto/findings/porting/reverse-engineering-bundle.md` -- `/home/jamessesler/Documents/Github/FreeAgent/.codecarto/findings/reimplementation-spec/reimplementation-spec.md` +Evidence artifacts for the FreeAgent run, named relative to that workspace's +`.codecarto/`. The run was local and its outputs were never published, so +these identify *which* artifacts the conclusions below rest on rather than +pointing anywhere a reader can open: + +- `workflow/status.yaml` +- `workflow/.usage.local.yaml` +- `THREAD_LOG.md` +- `dashboard.html` +- `findings/porting/reverse-engineering-bundle.md` +- `findings/reimplementation-spec/reimplementation-spec.md` ## Confirmed decisions from the FreeAgent run