Fix privacy guard enforcement parity

.beads/interactions.jsonl

@@ -11,5 +11,23 @@
 {"id":"int-094b242d80d5d56af716debade6c8a56","kind":"field_change","created_at":"2026-07-26T13:19:06.284453Z","actor":"Val Alexander","issue_id":"cmem-8qg","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Standalone local-first memory dashboard Phase 1 completed and verified across UI and Coven daemon worktrees; changes remain uncommitted for maintainer review."}}
 {"id":"int-bbf4154db905ff91cc0cb843006db298","kind":"field_change","created_at":"2026-07-26T15:18:30.083579Z","actor":"Val Alexander","issue_id":"cmem-4z6","extra":{"field":"priority","new_value":"2","old_value":"3"}}
 {"id":"int-83059a741e02cac2641710019910778f","kind":"field_change","created_at":"2026-07-26T15:35:16.33239Z","actor":"Val Alexander","issue_id":"cmem-4k9.7","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Responded"}}
+{"id":"int-75688f635fa60623a4cd42c51351eba7","kind":"field_change","created_at":"2026-07-26T17:41:26.970634Z","actor":"Val Alexander","issue_id":"cmem-4z6","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Strict per-request nonce CSP is implemented and independently verified, including prefetched HTML coverage."}}
+{"id":"int-3a376f23359a24f0868a2ac3df65198b","kind":"field_change","created_at":"2026-07-26T18:46:34.968359Z","actor":"Val Alexander","issue_id":"cmem-4k9.8","extra":{"field":"status","new_value":"blocked","old_value":"in_progress"}}
+{"id":"int-418708bdc1ea75851ce5f82699e42f38","kind":"field_change","created_at":"2026-07-26T18:59:50.783672Z","actor":"Val Alexander","issue_id":"cmem-4k9.8","extra":{"field":"status","new_value":"in_progress","old_value":"blocked"}}
+{"id":"int-95b9f72fefe9f3cf3c7aee47ca12ff0d","kind":"field_change","created_at":"2026-07-26T19:18:10.639167Z","actor":"Val Alexander","issue_id":"cmem-4k9.8","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Implemented and verified the supplied Memory.dc.html handoff from the ZIP, preserving secure read-only local data/session/privacy boundaries."}}
+{"id":"int-2f0b043f4c9d69b7118dfa7c809c5d3f","kind":"field_change","created_at":"2026-07-26T20:48:49.592797Z","actor":"Val Alexander","issue_id":"cmem-4k9.1","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Acceptance criteria satisfied by independently reviewed implementation and root browser/full-gate evidence at c7cc161."}}
+{"id":"int-a3b32155b68f18a7a01362824219d968","kind":"field_change","created_at":"2026-07-26T20:48:50.137868Z","actor":"Val Alexander","issue_id":"cmem-4k9.2","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Acceptance criteria satisfied by independently reviewed implementation and root browser/full-gate evidence at c7cc161."}}
+{"id":"int-fca076f04b054927264264305c1c6291","kind":"field_change","created_at":"2026-07-26T20:48:50.675374Z","actor":"Val Alexander","issue_id":"cmem-4k9.3","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Acceptance criteria satisfied by independently reviewed implementation and root browser/full-gate evidence at c7cc161."}}
+{"id":"int-bf3870ba5cfb19426691ecc88972fbdb","kind":"field_change","created_at":"2026-07-26T20:48:51.171455Z","actor":"Val Alexander","issue_id":"cmem-4k9.5","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Acceptance criteria satisfied by independently reviewed implementation and root browser/full-gate evidence at c7cc161."}}
+{"id":"int-319b50549e9fa67057b11180debc20a0","kind":"field_change","created_at":"2026-07-26T20:48:51.515253Z","actor":"Val Alexander","issue_id":"cmem-4k9.6","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Acceptance criteria satisfied by independently reviewed implementation and root browser/full-gate evidence at c7cc161."}}
+{"id":"int-786a052567c1fd800c5e42a1b9fe3e6f","kind":"field_change","created_at":"2026-07-26T22:06:34.65912Z","actor":"Val Alexander","issue_id":"cmem-4k9.8","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Approved design handoff is faithfully reconciled into the hardened dashboard with independent no-findings review and complete root verification."}}
+{"id":"int-a8c9bf4bdf6c6ab79f387e98f7d1477a","kind":"field_change","created_at":"2026-07-26T22:39:58.799175Z","actor":"Val Alexander","issue_id":"cmem-4k9.4","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Safe Markdown/source truthfulness acceptance is complete; authoritative summary source is merged after the compatible dashboard deployment, with cross-platform CI and exact-tree verification."}}
+{"id":"int-5241d5455c0c42abbe4bb3c8a386c561","kind":"field_change","created_at":"2026-07-26T22:40:13.763027Z","actor":"Val Alexander","issue_id":"cmem-4k9","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Comprehensive dashboard security and design-system UX hardening is merged and verified across both repositories; every child acceptance criterion is complete."}}
+{"id":"int-623f0ab60d817b939dd95f233078fe92","kind":"field_change","created_at":"2026-07-26T23:14:53.995497Z","actor":"Val Alexander","issue_id":"cmem-7i6.1","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Implemented and verified process-local transport proof, loopback injection, and strict loopback/Tailscale Host-Origin guard."}}
+{"id":"int-3b8822da215f159972b432a3abf5a632","kind":"field_change","created_at":"2026-07-26T23:21:18.104865Z","actor":"Val Alexander","issue_id":"cmem-7i6.2","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-db84506086a75aa221d78e38fe6f5812","kind":"field_change","created_at":"2026-07-26T23:25:28.656909Z","actor":"Val Alexander","issue_id":"cmem-7i6.3","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-bb83dd1e254f551904d7264e84ddc6bb","kind":"field_change","created_at":"2026-07-26T23:27:18.389227Z","actor":"Val Alexander","issue_id":"cmem-6g4","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Audit complete: no unpublished inactive branch has a relevant delta; the sole new branch remains actively owned by cmem-7i6.4."}}
+{"id":"int-4fab98e772e8b3769ac8c786e0f5ad39","kind":"field_change","created_at":"2026-07-26T23:36:35.98067Z","actor":"Val Alexander","issue_id":"cmem-7i6.4","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-c7b0fc45800ab6414db6ad52aad8264f","kind":"field_change","created_at":"2026-07-26T23:36:38.911625Z","actor":"Val Alexander","issue_id":"cmem-7i6","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
 {"id":"int-89520d833e15d70086dffa9bde0537a3","kind":"field_change","created_at":"2026-07-27T00:11:35.746186Z","actor":"Val Alexander","issue_id":"cmem-byc.7","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Replaced the single blocked familiar-workspace runtime path in cmem-8qg.4.1 notes with FAMILIAR_ROOT; fresh Beads-export guard passes."}}
 {"id":"int-43f83102ea4b17a1be7c7ab5ca17b0b5","kind":"field_change","created_at":"2026-07-27T07:26:26.516008Z","actor":"Val Alexander","issue_id":"cmem-7gn","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Implemented on fix/next-dev-csp-styles: development style-src now follows Next 16 guidance with self plus unsafe-inline, while production remains self plus the request nonce. TDD RED observed the old nonce-only development directive; focused 3/3 and full 138/138 tests passed. pnpm check passed lint, typecheck, tests, production build, smoke, and guard scan. Live dev response on disposable port 3755 emitted the expected development policy. No commit or push performed."}}

.github/workflows/privacy-guard.yml

@@ -20,15 +20,13 @@ jobs:
 
       - name: Install gitleaks
         run: |
-          curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz -o /tmp/gl.tgz
+          GITLEAKS_VERSION="$(tr -d '[:space:]' < .gitleaks-version)"
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o /tmp/gl.tgz
           tar -xzf /tmp/gl.tgz -C /tmp gitleaks
           sudo mv /tmp/gitleaks /usr/local/bin/gitleaks
           gitleaks version
 
-      - name: Full-history secret & privacy scan (gitleaks + Coven rules)
-        run: gitleaks detect --config .gitleaks.toml --no-banner --redact
-
-      - name: Tracked-tree privacy pattern scan
+      - name: Full-history secret scan and tracked-tree privacy scan
         run: bash scripts/guard-scan.sh
 
       - name: PR diff privacy scan (changed files only, loud on hits)
@@ -37,14 +35,13 @@ jobs:
           git fetch origin "${{ github.base_ref }}" --depth=1
           # Standalone diff so a git failure fails the step instead of emptying the list
           git diff --name-only -z "origin/${{ github.base_ref }}"...HEAD -- > /tmp/changed.zlist
-          PATTERNS='agent:[a-z0-9_-]+:(telegram|imessage|discord|whatsapp|signal|webchat):|telegram:direct:[0-9]|(/Users/|/home/)[A-Za-z0-9._-]+|~/\.(openclaw|coven)/(agents|workspaces|credentials|sessions)|\+1[0-9]{10}'
-          PLACEHOLDERS='(/Users/|/home/)(<[a-z-]+>|\$USER|USERNAME|example|placeholder|you)\b'
+          source scripts/privacy-patterns.sh
           FAIL=0
           # NUL-delimited iteration: filenames containing whitespace must not dodge the scan
           while IFS= read -r -d '' f; do
             case "$f" in *.png|*.jpg|*.jpeg|*.gif|*.pdf|*.ico|*.woff*|*.db) continue;; esac
             [ -f "$f" ] || continue
-            if grep -EnI "$PATTERNS" "$f" | grep -vE "$PLACEHOLDERS" | grep -v "guard-scan-allow"; then
+            if grep -EnI "$PATTERNS" "$f" | grep -vE "$PLACEHOLDERS" | grep -vE "$ALLOW_MARKERS"; then
               echo "::error file=$f::Privacy pattern found — see SECURITY.md. Nothing local/personal/session-identifying may enter this public repo."
               FAIL=1
             fi

.gitleaks-default.toml

@@ -0,0 +1,5 @@
+# Default gitleaks rules only. This pass ignores inline `gitleaks:allow`
+# annotations so a custom Coven privacy-rule exception can never suppress a
+# standard secret finding.
+[extend]
+useDefault = true

.gitleaks-version

@@ -0,0 +1 @@
+8.30.1

AGENTS.md

@@ -91,7 +91,7 @@ This protocol applies when ending a Beads implementation workflow. It is subordi
 
    # Team-maintainer opt-in only, unless current instructions forbid it:
    git pull --rebase
-   bd dolt push
+   scripts/bd-dolt-push.sh
    git push
    git status
    ```

SECURITY.md

@@ -66,13 +66,15 @@ memory must never be copied into tests, screenshots, traces, or issue notes.
 ## Enforcement layers (defense in depth)
 
 1. **Pre-commit hook** — `scripts/guard-scan.sh --staged`: gitleaks (with
-   `.gitleaks.toml` Coven rules) + plain-pattern scan on staged content.
+   `.gitleaks.toml` Coven rules and a separate default-rules-only pass) +
+   plain-pattern scan on staged content.
    Fail-closed: if gitleaks is missing, the commit is blocked.
 2. **Pre-push hook** — full-tree scan **plus a fresh `bd export` scan of the
    beads database**, because bead notes sync via dolt refs to this remote too.
    Fail-closed: if `bd export` fails, the push is blocked.
-3. **CI (`privacy-guard.yml`)** — runs on every push and PR: full-history
-   gitleaks scan, tracked-tree scan, and a changed-files scan on PRs.
+3. **CI (`privacy-guard.yml`)** — runs on every push and PR: the same
+   baseline-aware full-history gitleaks and tracked-tree scan as local hooks,
+   plus a changed-files scan on PRs.
    Local hooks can be skipped; **CI cannot**. CI is the authority for
    everything that reaches a branch.
    **Known limit:** bead notes sync via `bd dolt push` (refs/dolt/data), which
@@ -82,6 +84,12 @@ memory must never be copied into tests, screenshots, traces, or issue notes.
 4. **Review discipline** — PR reviewers treat any privacy hit as a blocker,
    never a warn-and-proceed. Same fail-closed principle as the promotion gate.
 
+All gitleaks invocations must use the exact version in `.gitleaks-version`.
+The local guard fails on version drift, and CI downloads that same tracked
+release. Shell-based local and PR-diff patterns live in
+`scripts/privacy-patterns.sh`; its privacy categories are checked against
+`.gitleaks.toml` by the guard-policy test.
+
 ## Contributor setup (one time, after clone)
 
 ```bash
@@ -93,12 +101,17 @@ Sync bead notes with `scripts/bd-dolt-push.sh` (guarded), not bare `bd dolt push
 
 ## False positives
 
-For the plain-pattern scan, add the inline marker `guard-scan-allow` on the
-flagged line. For a hit from a **custom Coven gitleaks rule**, use gitleaks'
-own inline marker `gitleaks:allow` on the flagged line. Either way, justify it
-in the PR description and reviewers must confirm the marker is legitimate.
-Neither marker excuses a hit from the gitleaks **default** rules — real
-secrets are never allowed, anywhere, including the guard files themselves.
+For a reviewed false positive from a **custom Coven privacy rule**, add
+`gitleaks:allow` on the flagged line. The gitleaks and plain-pattern tiers both
+honour that marker; `guard-scan-allow` remains accepted only for existing,
+reviewed annotations. Justify every marker in the PR description and have a
+reviewer confirm it is legitimate. A separate `.gitleaks-default.toml` pass
+uses `--ignore-gitleaks-allow`, so neither marker suppresses gitleaks default
+rules: real secrets are never allowed, including in the guard files.
+
+`.gitleaks-baseline.json` is optional and suppresses only recorded historical
+findings. When present, every local and CI gitleaks pass uses it; new findings
+still fail every pass.
 
 ## Bead-notes discipline (contributors and familiars)
 

package.json

@@ -54,12 +54,14 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:browser": "node scripts/verify-dashboard-ui.mjs",
+    "test:guard": "node --test scripts/guard-policy.test.mjs",
+    "check:instruction-sync": "bash scripts/check-instruction-sync.sh",
     "audit:prod": "pnpm audit --prod --audit-level high",
     "fake-daemon": "node scripts/fake-memory-daemon.mjs",
     "test:smoke": "node scripts/smoke-dashboard.mjs",
     "test:package": "pnpm build:package && node --test scripts/dashboard-bin.test.mjs scripts/sanitize-build-artifact.test.mjs && node scripts/package-contents-test.mjs",
     "prepack": "pnpm build:package",
-    "check": "pnpm lint && pnpm typecheck && pnpm test && pnpm test:demo && pnpm build && pnpm test:smoke && pnpm demo:check && ./scripts/guard-scan.sh"
+    "check": "pnpm lint && pnpm typecheck && pnpm test && pnpm test:guard && pnpm test:demo && pnpm build && pnpm test:smoke && pnpm check:instruction-sync && pnpm demo:check && ./scripts/guard-scan.sh"
   },
   "dependencies": {
     "@opencoven/coven-design-system": "git+https://github.com/OpenCoven/coven-design-system.git#6032f9f407982379e39ed1a40eec7a2e8b24e5c6",

scripts/check-instruction-sync.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Guard Beads sync guidance: Dolt note pushes bypass git hooks and branch CI.
+set -euo pipefail
+cd "$(git rev-parse --show-toplevel)"
+
+FAIL=0
+while IFS= read -r -d '' file; do
+  if grep -nE '^[[:space:]]*bd[[:space:]]+dolt[[:space:]]+push([[:space:]]|$)' "$file"; then
+    echo "instruction-sync: unguarded Beads sync command in $file." >&2
+    echo "Use scripts/bd-dolt-push.sh so bead notes are scanned before sync." >&2
+    FAIL=1
+  fi
+# These are instruction surfaces read directly by the supported agent tools;
+# keep the list explicit so prose documentation is not treated as an executable
+# command surface.
+done < <(git ls-files -z -- '*AGENTS.md' '*CLAUDE.md' '*GEMINI.md' '*COPILOT.md' '.github/copilot-instructions.md' '.cursorrules')
+
+exit "$FAIL"