[rmcdaniel]

Part of durable-workflow/.github#355 (other repositories remain, so this does not close it).

Same change as waterline#290 and sdk-php#379:

• .gitignore covers .claude/settings.local.json and **/.claude/settings.local.json.
• scripts/check-public-boundary.sh refuses any tracked .claude/settings.local.json (root or nested) before the content scans. It runs git ls-files over the whole tracked tree, so it catches a copy that was already tracked before the PR range. It prints only the path and never reads the file. The existing content and metadata scans are unchanged.
• tests/test_public_boundary_scanner.py gains controls: root and nested tracked copies are refused (the canary content never appears in output), .claude/settings.json, .claude/settings.local.json.example and component/settings.local.json pass, and both ignore forms match. The two refusal tests fail against the old scanner.

Local checks: the boundary script passes on this branch. In a scratch repo with this script and .gitignore, tracked root and nested copies exit 1 without printing content, untracked copies are ignored and pass, and .claude/settings.json, .claude/settings.local.json.example and c/settings.local.json pass.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security: PASS. The .gitignore ignores .claude/settings.local.json and **/.claude/settings.local.json, and scripts/check-public-boundary.sh fails (exit 1) when git ls-files lists one. It prints only the path, never the file contents, matching .github#356 and sdk-php#379 for .github#355. (head a293b8db) The new tests force-add the file at the repository root and in a subdirectory, assert exit 1 with the path reported, and confirm the canary content never appears in stdout or stderr. Near-miss names such as settings.json and .example still pass.