Current authoritative state
The Docker build-context secret-exclusion defect is repaired on canonical single-writer Draft PR #295 / branch fix/docker-build-context-secrets-294. Protected shipped truth remains exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; current exact #295 head is 1bd73dc4da2d48432cb93e681d6b299e66de0ff7. The earlier issue snapshot naming predecessor head 6e3d1722b5e44470d6b249cb4b1cbad8578f1396 is stale and superseded.
Current .dockerignore recursively excludes local .env*, npm/pnpm/yarn/Python registry credential files, netrc credentials and common PEM/KEY/PKCS#12 private material, with an ordered exception preserving deliberate .env.example files. The executable contract proves required package, lock, source, style and demo inputs remain present. This changes only build-context admission; it adds no Docker ARG/ENV secret, secret mount, runtime network, database, model/provider, transport, persistence, authorization, tenancy, credential-management, deployment or durable-audit authority.
Test-first lineage
- RED exact test-only head
8ba8711dedcc2d85ee8fca451f53fd1fa16783a9: CI 31653842186 reached exact checkout/install/typecheck and failed because protected .dockerignore did not exclude .env or private-key material. Security Scan 31653842335 succeeded.
- SAST
31653842248 exposed a dynamic-RegExp defect in the first regression helper; that test defect was repaired instead of suppressed.
- Current exact head
1bd73dc4da2d48432cb93e681d6b299e66de0ff7 carries the bounded production contract after later synchronization/head movement; predecessor workflow/review evidence does not transfer.
Exact-current-head evidence
For unchanged current #295 head:
- CI
32075062128: completed / success;
- Security Scan
32075062158: completed / success;
- SAST Semgrep
32075062130: completed / success;
- formal submitted reviews: one historical GitHub Advanced Security
COMMENTED review, not approval;
- the only inline security thread is resolved and outdated;
- qualifying approving reviews: 0;
- GitHub reports the Draft mergeable.
Repository exact-head technical success is not qualifying independent approval and does not replace separately applicable central workflows or protected integration.
Integration boundary
The technical defect is repaired on active Draft #295 but is not protected-main shipped truth. Keep this issue open until #295 integrates under then-live governance. Keep #295 Draft/unmerged while #118 owns exact protected v0.6.0 publication/provenance acceptance. Before any lifecycle transition refetch exact head/live base, rules/permissions, reviews/threads and every applicable repository/central workflow. Do not create a competing build-context writer, transfer predecessor evidence, self-approve, weaken gates, move protected main or fabricate release identity.
Current authoritative state
The Docker build-context secret-exclusion defect is repaired on canonical single-writer Draft PR #295 / branch
fix/docker-build-context-secrets-294. Protected shipped truth remains exactmain@3b38ead2d00f44eb578d0689087b9293b3dabe1e; current exact #295 head is1bd73dc4da2d48432cb93e681d6b299e66de0ff7. The earlier issue snapshot naming predecessor head6e3d1722b5e44470d6b249cb4b1cbad8578f1396is stale and superseded.Current
.dockerignorerecursively excludes local.env*, npm/pnpm/yarn/Python registry credential files, netrc credentials and common PEM/KEY/PKCS#12 private material, with an ordered exception preserving deliberate.env.examplefiles. The executable contract proves required package, lock, source, style and demo inputs remain present. This changes only build-context admission; it adds no Docker ARG/ENV secret, secret mount, runtime network, database, model/provider, transport, persistence, authorization, tenancy, credential-management, deployment or durable-audit authority.Test-first lineage
8ba8711dedcc2d85ee8fca451f53fd1fa16783a9: CI31653842186reached exact checkout/install/typecheck and failed because protected.dockerignoredid not exclude.envor private-key material. Security Scan31653842335succeeded.31653842248exposed a dynamic-RegExp defect in the first regression helper; that test defect was repaired instead of suppressed.1bd73dc4da2d48432cb93e681d6b299e66de0ff7carries the bounded production contract after later synchronization/head movement; predecessor workflow/review evidence does not transfer.Exact-current-head evidence
For unchanged current #295 head:
32075062128: completed / success;32075062158: completed / success;32075062130: completed / success;COMMENTEDreview, not approval;Repository exact-head technical success is not qualifying independent approval and does not replace separately applicable central workflows or protected integration.
Integration boundary
The technical defect is repaired on active Draft #295 but is not protected-main shipped truth. Keep this issue open until #295 integrates under then-live governance. Keep #295 Draft/unmerged while #118 owns exact protected
v0.6.0publication/provenance acceptance. Before any lifecycle transition refetch exact head/live base, rules/permissions, reviews/threads and every applicable repository/central workflow. Do not create a competing build-context writer, transfer predecessor evidence, self-approve, weaken gates, move protected main or fabricate release identity.