[Telschow]

No open issue was titled "Post-rewrite cleanup" (gh issue list --state all, 300 issues searched), so this PR has no Closes line.

Done from a fresh full clone (git fetch --prune first, not shallow), branch from origin/main at 66694c3.

Per file

• scripts/scan_secrets.py: KNOWN_HISTORY had one entry for the removed key. It is now an empty dict. is_known and the "known and accepted" reporting are kept. The comment says the list is empty on purpose and a test pins it.
• tests/test_scan_secrets.py: the test that asserted the removed entry is replaced by three tests, none tied to a real incident. (1) With a made-up entry patched in, is_known accepts only that commit prefix and rule and rejects another rule and another commit. (2) The shipped KNOWN_HISTORY is empty. (3) scan_secrets.py --history --root <scratch repo> exits non-zero on a key-shaped line (built from pieces), names the rule and does not print the value.
• SECURITY.md "Known incident": past tense. A provider key was committed in a documentation file, redacted the next day, rotated by the maintainer before the 2026-10-19 rewrite, and the rewrite removed it from the branches. It says what the rewrite cannot reach (hidden pull-request refs and cached views until GitHub Support removes them), that the key must be treated as exposed, and that rotation closed the exposure. No commit ids, no part of the key. The sentence about the scan accepting the incident is gone.
• RISKS.md R4: same facts. "History was not rewritten" and "still readable in history" are replaced with the true state. Entry, status and residual kept.
• .github/workflows/security.yml: the comment on the history scan said one finding is known and accepted. It now says none is accepted. Comment only. This file was not in your list; I found it with the grep.
• CHANGELOG.md: a dated entry under Unreleased, "Security", for the rewrite and the cleanup. Older entries untouched.
• Generated counts (docs/data/metrics.json and the markers in CONSTRAINTS.md, CONTRIBUTING.md, ROADMAP.md) from metrics.py --write: two tests added.

Greps

For "remains in git history", "still readable", "not been rewritten", "history was not rewritten", "KNOWN_HISTORY", "b80db1a" and "8380bde" the remaining hits are the code, its tests and the new text. No old commit id is cited anywhere. CHANGELOG.md line 328 (opencode.json, a different key that was never committed) is history and true, so it is unchanged.

Scans

$ python scripts/scan_secrets.py --history
no new credential-shaped strings in history
$ python scripts/scan_secrets.py
no new credential-shaped strings in tracked files

No finding and no "known" entry.

Tests first

On main plus the new tests, test_the_shipped_known_history_is_empty failed (the old entry was there). The other two passed on main, as expected: the mechanism and the history command already worked, and they now guard them.

Mutation checks (in a scratch clone)

• A KNOWN_HISTORY entry matching nothing, ("0000000", "github-token"):

  FAILED tests/test_scan_secrets.py::test_the_shipped_known_history_is_empty
  1 failed, 20 passed
  

  Restored, passes.
• A key-shaped line (built from pieces) appended to docs/index.md:

  docs/index.md:51: provider-key (free...)
  1 possible secret(s) in tracked files. Do not push; rotate anything real.
  exit=1
  

  Restored: exit=0.

Checks

ruff check, ruff format --check, mypy src, metrics.py --check, check_links.py (93 files, 0 broken) pass. tests/test_scan_secrets.py and tests/test_framing.py: 24 passed. Full suite: 1460 passed, 25 skipped, 2 xfailed in 580.85s. Nothing under src/, no ADR and no CLAUDE.md changed.

Left

docs/adr/0011-ci-and-supply-chain.md line 54 still says the history finding is "known, rotated and listed with its reason". That is now false. It is an ADR, so I did not edit it. Suggested wording is for the maintainer: say the history scan accepts no findings.

🤖 Generated with Claude Code