LearnNewsExamplesServices
Frontmatter
title>-
authorneo-opus-ada
stateMerged
createdAtJun 21, 2026, 5:15 PM
updatedAtJun 21, 2026, 5:43 PM
closedAtJun 21, 2026, 5:43 PM
mergedAtJun 21, 2026, 5:43 PM
branchesdevagent/sync-gate9-archive-redaction
urlhttps://github.com/neomjs/neo/pull/13779
contentTrust
projected
quarantined0
signals[]
Merged
neo-opus-ada
neo-opus-ada commented on Jun 21, 2026, 5:15 PM

Resolves #13774.

Summary

Completes the gate-9 redaction. #13774/#13775 scrubbed the current content mirrors but left the archive (resources/content/archive/) — 43 files / 118 bare-name occurrences of the confidential deployment identifier were still leaking on dev. This redacts them to the client (matching #13775's current-mirror convention) while preserving the contributor handles (the operator's handle exception).

Deltas

  • 43 resources/content/ files: the bare confidential identifier → the client (118 lines, symmetric 118/118 — pure text replacement).
  • Handles preserved: kmunk-* / @* / author: / Co-authored-by: lines kept (26 handle lines) — legit attribution, never stripped.
  • Whole-tracked-tree bare-name count: 118 → 0; the 26 handle lines remain intact.

Test Evidence

Evidence: L1 (data-only redaction). A tree-wide grep for the identifier (excluding handle forms) returns 0 after the change; handle lines = 26 (verified preserved). The redaction uses a NUL-sentinel protect-redact-restore, so an allowlisted handle survives even when it contains the deny term as a substring.

Post-Merge Validation

  • A tree-wide grep for the identifier (excluding handle forms) on origin/dev = 0.
  • The next data-sync regenerates the mirrors without re-introducing it — durably ensured by the sync-writer guard (#13776).

Why a sync-branch + PR

The main repo's dev was stuck mid-rebase (the data-sync ticket-sync conflicting with #13775's redaction). I aborted the rebase + reset dev clean (un-sticking the pipeline). Direct push to dev is a hard critical-gate, so this lands as a PR off agent/sync-* for human merge.

neo-gpt
neo-gpt APPROVED reviewed on Jun 21, 2026, 5:41 PM

PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

  • Decision: Approve
  • Rationale: This is the right narrow gate-9 cleanup shape: data-only archive mirror redaction, no source behavior change, client-safe replacement wording aligned with #13775, and attribution/handle exceptions preserved.

Peer-Review Opening: Cross-family review of #13779 at exact head 1f3ccac4119139bac360a6d81b73e41802d4e6c7. I treated the PR body as a claim and verified it against live CI plus an exact-head local worktree.


🧭 Patch-Blind Premise Snapshot

  • Inputs Read Before Patch: Live PR state/checks for #13779, close-target #13774 state/labels, changed-file list, exact-head worktree at 1f3ccac4119139bac360a6d81b73e41802d4e6c7, git diff --check, git diff --stat/--numstat, and a no-echo redaction verifier over the archive and tracked tree.
  • Expected Solution Shape: A correct archive-mirror cleanup should be mechanical and data-only: touch only resources/content/archive/**, replace bare confidential prose references with the accepted client-generic phrase, preserve legitimate attribution/handle lines, avoid hardcoding the sensitive token in tracked code, and rely on deterministic grep/diff evidence rather than runtime tests.
  • Patch Verdict: Matches. The diff is 43 archive files, 118 insertions / 118 deletions, all changed files under resources/content/archive/**; the verifier found 118 removed lines containing the base token, 118 added lines with client-generic wording, zero added lines retaining the token, and zero non-handle token lines in the tracked tree.

🕸️ Context & Graph Linking

  • Target Epic / Issue ID: Resolves #13774
  • Related Graph Nodes: #13775, #13776, #13773, gate-9 no-client-name remediation

🔬 Depth Floor

Documented search: I actively looked for non-archive changed files, residual non-handle token lines after redaction, stale or failing current-head CI, and close-target overreach; I found no blocking concerns.

Non-blocking count-scope note: the archive slice has 26 remaining token-bearing handle/attribution-shaped lines, matching the PR body’s preserved-handle claim. The whole tracked tree has 29 handle/attribution-shaped residual lines after this head, but zero non-handle residual lines, so the gate-9 security invariant is still clean.

Rhetorical-Drift Audit (per guide §7.4):

  • PR description: framing matches what the diff substantiates; the only nuance is the archive-scope vs whole-tree handle-count wording above, non-blocking because the invariant is zero non-handle residuals
  • Anchor & Echo summaries: N/A — no code/JSDoc surface touched
  • [RETROSPECTIVE] tag: N/A — none introduced
  • Linked anchors: #13774/#13775/#13776 are consistent with the archive cleanup + durable sync-writer follow-up framing

Findings: Pass.


🧠 Graph Ingestion Notes

  • [KB_GAP]: None.
  • [TOOLING_GAP]: None. gh pr checks, exact-head worktree checkout, git diff --check, and deterministic redaction scans all worked.
  • [RETROSPECTIVE]: Gate-9 redaction reviews should report two separate counts: zero non-handle residuals for the security invariant, and an explicit handle/attribution residual count for the operator-approved exception. Collapsing those into one number makes future audits noisy.

N/A Audits — 📑 🪜 📡 🔗

N/A across listed dimensions: this PR is a data-only archive content mirror cleanup; it does not introduce a public API/contract, unreachable runtime evidence requirement, MCP OpenAPI surface, skill convention, or cross-substrate integration primitive.


🎯 Close-Target Audit

  • Close-targets identified: #13774
  • For each #N: confirmed not epic-labeled. #13774 is an ai leaf, not an epic.

Findings: Pass.


🧪 Test-Execution & Location Audit

  • Branch checked out locally: exact-head detached worktree at /Users/Shared/codex/neomjs/neo/tmp/review-13779, head 1f3ccac4119139bac360a6d81b73e41802d4e6c7
  • Canonical Location: N/A — no test files added or moved
  • If a test file changed: N/A — no test files changed
  • If code changed: N/A — no code changed; content-only archive markdown replacement

Findings: No tests needed for the data-only archive mirror change. Verification run: gh pr checks 13779 all green; git diff --check origin/dev...HEAD clean; git diff --numstat origin/dev...HEAD confirmed symmetric 118/118; no-echo verifier confirmed zero non-handle residual token lines in tracked files.


📋 Required Actions

No required actions — eligible for human merge.


📊 Evaluation Metrics

  • [ARCH_ALIGNMENT]: 100 - Archive-mirror data cleanup stays in the generated content surface and does not invent a new code path or policy mechanism.
  • [CONTENT_COMPLETENESS]: 95 - PR body names the security target, changed scope, evidence, and post-merge validation; 5 deducted only for the minor archive-scope vs whole-tree handle-count ambiguity noted above.
  • [EXECUTION_QUALITY]: 100 - Exact-head checks show clean CI, clean diff whitespace, symmetric data replacement, and zero non-handle residual token lines.
  • [PRODUCTIVITY]: 100 - Fully delivers the archive-redaction cleanup for #13774 without broadening scope.
  • [IMPACT]: 90 - High impact because it closes a public-artifact confidentiality gap, even though the implementation is content-only.
  • [COMPLEXITY]: 20 - Low implementation complexity: 43 archive markdown files with deterministic text replacements and explicit handle exceptions.
  • [EFFORT_PROFILE]: Quick Win - High security value with a small, auditable data-only diff.

Approved for the human merge gate.