security: remove the plaintext OSF token from the research summary (Closes #10581) by gHashTag · Pull Request #10582 · gHashTag/t27

gHashTag · 2026-10-18T17:52:14Z

What

research/gamma-hypotheses/OSF-upload-summary.md carried the OSF OAuth token in plain text (line 9 on master). The line now says where the token is read from: OSF_TOKEN in the environment.

Why a separate PR

#6433 makes the same one-line change together with the secret gate (gitleaks config, lefthook commands, CI job). Its gate files are refused by the required own-language check until the owner adds owner-approved-foreign (lefthook.yml is the Only-t27 gate itself, and .gitleaks.toml is hand-written TOML). This PR lands the removal alone; it touches one Markdown file.

Still to do (owner)

The token stays in git history, so removing it from the tree does not unpublish it: revoke it at osf.io.

🤖 Generated with Claude Code

…loses #10581) The OSF OAuth token sat in research/gamma-hypotheses/OSF-upload-summary.md in plain text. The line now says where the token is read from (OSF_TOKEN in the environment). The token stays in history, so it still has to be revoked at osf.io. Same replacement as #6433, without that PR's gate files, which wait for the owner's owner-approved-foreign label. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-10-18T18:53:35Z

PR Dashboard

Generated at: 2026-10-18 18:53:27 UTC

t27f R4b.1: beat graph -- three scenes crossfaded at the beat clock's cuts, on whole frames (Closes #10603) #10605 t27f R4b.1: beat graph -- three scenes crossfaded at the beat clock's cuts, on whole frames (Closes #10603) | Created: 2026-10-18 | Updated: 2026-10-18 | 24 failing / 32 total
analog: sar_comparator.t27 -- the SAR ADC dynamic comparator, multi-node Newton, square law against ngspice LEVEL=1 (Closes #10583) #10604 analog: sar_comparator.t27 -- the SAR ADC dynamic comparator, multi-node Newton, square law against ngspice LEVEL=1 (Closes #10583) | Created: 2026-10-18 | Updated: 2026-10-18 | 26 failing / 34 total
docs: t27o front-end census of the roadmap repos -- Zig first, then deeper Rust, Python, TypeScript, shell (Closes #10599) #10601 docs: t27o front-end census of the roadmap repos -- Zig first, then deeper Rust, Python, TypeScript, shell (Closes #10599) | Created: 2026-10-18 | Updated: 2026-10-18 | 23 failing / 29 total
t27f: beat clock -- reel beats cut where the voice changes, crossfaded (Closes #10596) #10598 t27f: beat clock -- reel beats cut where the voice changes, crossfaded (Closes #10596) | Created: 2026-10-18 | Updated: 2026-10-18 | 24 failing / 32 total
ledger: re-derive from master 90f62487604b, as its lab verdict APPLY says (Closes #10594) #10595 ledger: re-derive from master 90f62487604b, as its lab verdict APPLY says (Closes #10594) | Created: 2026-10-18 | Updated: 2026-10-18 | 26 failing / 34 total
t27o: five refusal classes from the roadmap dogfood convert (Closes #10526) #10593 t27o: five refusal classes from the roadmap dogfood convert (Closes #10526) | Created: 2026-10-18 | Updated: 2026-10-18 | 28 failing / 35 total
t27f: scene renderers for the 12 archetypes and the still anomaly gate (R3) #10592 t27f: scene renderers for the 12 archetypes and the still anomaly gate (R3) | Created: 2026-10-18 | Updated: 2026-10-18 | 27 failing / 35 total
queen: key_credit.t27 -- a leased contributor key earns credit only for .t27 that landed (Closes #10589) #10591 queen: key_credit.t27 -- a leased contributor key earns credit only for .t27 that landed (Closes #10589) | Created: 2026-10-18 | Updated: 2026-10-18 | 31 failing / 38 total
tri t27o-sweep: t27o over a whole tree, rows reused while the file and the two seals hold (Closes #10543) #10587 tri t27o-sweep: t27o over a whole tree, rows reused while the file and the two seals hold (Closes #10543) | Created: 2026-10-18 | Updated: 2026-10-18 | 25 failing / 33 total
t27f: reel_beats.t27 -- every reel as open, main and close, no two the same sequence (Closes #10584) #10586 t27f: reel_beats.t27 -- every reel as open, main and close, no two the same sequence (Closes #10584) | Created: 2026-10-18 | Updated: 2026-10-18 | 27 failing / 35 total
claw: claw-t27f/suggest/refresh pass with a note when the App token cannot be minted; claw-refresh can read the queue (#10576) #10585 claw: claw-t27f/suggest/refresh pass with a note when the App token cannot be minted; claw-refresh can read the queue (#10576) | Created: 2026-10-18 | Updated: 2026-10-18 | 21 failing / 27 total
security: remove the plaintext OSF token from the research summary (Closes #10581) #10582 security: remove the plaintext OSF token from the research summary (Closes #10581) | Created: 2026-10-18 | Updated: 2026-10-18 | 22 failing / 29 total
t27f: reel_factory_plan.t27 -- print the factory's course-0 plan, and tri factory (Closes #10573) #10580 t27f: reel_factory_plan.t27 -- print the factory's course-0 plan, and tri factory (Closes #10573) | Created: 2026-10-18 | Updated: 2026-10-18 | 28 failing / 36 total
fpga(ax7203): RLC and 5-node ladder through the linear cell -- one board top for both circuits, PASS on the board, negative controls FAIL on their own circuit (Closes #10565) #10578 fpga(ax7203): RLC and 5-node ladder through the linear cell -- one board top for both circuits, bitstreams built, board run pending (Closes #10565) | Created: 2026-10-18 | Updated: 2026-10-18 | 22 failing / 42 total
claw: token_shape.t27 -- every App-token job passes with a note when the token cannot be minted (#10576) #10577 claw: token_shape.t27 -- every App-token job passes with a note when the token cannot be minted (#10576) | Created: 2026-10-18 | Updated: 2026-10-18 | 25 failing / 32 total
analog: sar_cdac.t27 -- the SAR ADC split capacitive DAC with its 1-unit bridge, charge redistribution against ngspice (Closes #10540) #10575 analog: sar_cdac.t27 -- the SAR ADC split capacitive DAC with its 1-unit bridge, charge redistribution against ngspice (Closes #10540) | Created: 2026-10-18 | Updated: 2026-10-18 | 8 failing / 34 total
claw: criteria.t27 + claw/criteria check -- commands settle the criteria they can (Closes #10549) #10572 claw: criteria.t27 + claw/criteria check -- commands settle the criteria they can (Closes #10549) | Created: 2026-10-18 | Updated: 2026-10-18 | 29 failing / 38 total
queen: key_vault.t27 -- one key store, every consumer leases, review lanes first (Closes #10564) #10567 queen: key_vault.t27 -- one key store, every consumer leases, review lanes first (Closes #10564) | Created: 2026-10-18 | Updated: 2026-10-18 | 27 failing / 34 total
spec(t27mcp): visual_output.t27 -- when answer_channel picks UI_RESOURCE #10563 spec(t27mcp): visual_output.t27 -- when answer_channel picks UI_RESOURCE | Created: 2026-10-18 | Updated: 2026-10-18 | 25 failing / 33 total
spec(queen): review_first.t27 -- no backlog dispatch while finished work waits in review (Closes #10555) #10562 spec(queen): review_first.t27 -- no backlog dispatch while finished work waits in review (Closes #10555) | Created: 2026-10-18 | Updated: 2026-10-18 | 27 failing / 34 total
ci: per-PR cancel groups on 9 uncancelled workflows, one provable paths filter (Closes #10552) #10557 ci: per-PR cancel groups on 9 uncancelled workflows, one provable paths filter (Closes #10552) | Created: 2026-10-18 | Updated: 2026-10-18 | 6 failing / 55 total
t27f: frontend.t27 -- T27F is t27's frontend, every visual surface in one law, served by TRI CLAW (Closes #10537) #10551 t27f: frontend.t27 -- T27F is t27's frontend, every visual surface in one law, served by TRI CLAW (Closes #10537) | Created: 2026-10-18 | Updated: 2026-10-18 | 25 failing / 34 total
claw: reel_still.t27 -- the TRI CLAW /mcp tool that renders one particle still #10548 claw: reel_still.t27 -- the TRI CLAW /mcp tool that renders one particle still | Created: 2026-10-18 | Updated: 2026-10-18 | 27 failing / 35 total
claw: visual_output.t27 -- a T27F visual in every output that did work (Closes #10508) #10510 claw: visual_output.t27 -- a T27F visual in every output that did work (Closes #10508) | Created: 2026-10-18 | Updated: 2026-10-18 | 27 failing / 35 total
fix(t27c): seal --verify reads the committed gen file; compile refuses a hand-written output (draft, needs owner-approved-foreign) #10481 fix(t27c): seal --verify reads the committed gen file; compile refuses a hand-written output (draft, needs owner-approved-foreign) | Created: 2026-10-18 | Updated: 2026-10-18 | 2 failing / 46 total
fpga(ax7203): ternary mat-vec over real tern-tc-9m weights in DDR3, UART receipt (Closes #10461) #10475 fpga(ax7203): ternary mat-vec over real tern-tc-9m weights in DDR3, UART receipt (Closes #10461) | Created: 2026-10-18 | Updated: 2026-10-18 | 9 failing / 49 total
spec(ml): eval_hslm and ngram_hslm -- HSLM held-out loss at step 8000 against unigram, bigram and trigram baselines (Refs #10372) #10467 spec(ml): eval_hslm -- held-out loss of an HSLM checkpoint, last position and full sequence (Refs #10372) | Created: 2026-10-18 | Updated: 2026-10-18 | 5 failing / 36 total
fix(seal): refuse a seal file another spec owns, re-check the hash after the write, land it by rename #10464 fix(seal): refuse a seal file another spec owns, re-check the hash after the write, land it by rename | Created: 2026-10-18 | Updated: 2026-10-18 | 7 failing / 48 total
igla ptx v2: cp.async ring, 128x128xBK64 tile, prmt-decoded W; within 1.33x of CUTLASS s8 (Refs #10404) #10456 igla ptx v2: cp.async ring, 128x128xBK64 tile, prmt-decoded W; within 1.33x of CUTLASS s8 (Refs #10404) | Created: 2026-10-18 | Updated: 2026-10-18 | 6 failing / 46 total
check: refuse a module that declares a top-level name twice (Closes #10421) #10442 check: refuse a module that declares a top-level name twice (Closes #10421) | Created: 2026-10-18 | Updated: 2026-10-18 | 5 failing / 44 total
t27c PTX backend: ternary x int8 GEMM kernel emitted by a .t27 spec (int8 mma.sync), ptx-run glue #10425 t27c PTX backend: ternary x int8 GEMM kernel emitted by a .t27 spec (int8 mma.sync), ptx-run glue | Created: 2026-10-18 | Updated: 2026-10-18 | 5 failing / 39 total
spec(ml): train_hslm -- main() trains the whole 3-block HSLM with STE and LAMB, writes MSLH checkpoints (Refs #10372) #10387 spec(ml): train_hslm -- main() trains the whole 3-block HSLM with STE and LAMB, writes MSLH checkpoints (Refs #10372) | Created: 2026-10-18 | Updated: 2026-10-18 | 2 failing / 36 total
demo: claw/sarif alert on a spec that does not parse (DO NOT MERGE, Refs #10356) #10381 demo: claw/sarif alert on a spec that does not parse (DO NOT MERGE, Refs #10356) | Created: 2026-10-18 | Updated: 2026-10-18 | 6 failing / 33 total
spec(hslm): nn/hslm_tokenizer and ml/hslm_corpus -- the 729-token BPE and a pinned TinyStories token file (Refs #10372) #10380 spec(hslm): nn/hslm_tokenizer and ml/hslm_corpus -- the 729-token BPE and a pinned TinyStories token file (Refs #10372) | Created: 2026-10-18 | Updated: 2026-10-18 | 4 failing / 32 total
spec(port): land the remaining CR-CHAT ring batch -- 18 targets (Closes #10579; Refs #8883, #8884) #10175 spec(port): land the remaining CR-CHAT ring batch -- 18 targets (Closes #10579; Refs #8883, #8884) | Created: 2026-10-18 | Updated: 2026-10-18 | 22 failing / 37 total
spec(port): port specs/port/trios-railway/crates/trios-igla-race/src/bin/smoke_agent.t27 (Closes #9714) #10022 spec(port): port specs/port/trios-railway/crates/trios-igla-race/src/bin/smoke_agent.t27 (Closes #9714) | Created: 2026-10-17 | Updated: 2026-10-18 | 2 failing / 35 total
spec(port): port specs/port/trios-railway/crates/trios-igla-race/src/bin/debug_queue.t27 (Closes #9704) #10015 spec(port): port specs/port/trios-railway/crates/trios-igla-race/src/bin/debug_queue.t27 (Closes #9704) | Created: 2026-10-17 | Updated: 2026-10-18 | 2 failing / 35 total
t27b: repair crypto and rust_convert; distinguish PR ledger lag #9637 t27b: repair crypto and rust_convert; distinguish PR ledger lag | Created: 2026-10-15 | Updated: 2026-10-15 | 3 failing / 33 total
spec(port): share tree helpers across eight gen_w ports (Closes #9633) #9636 spec(port): share tree helpers across eight gen_w ports (Closes #9633) | Created: 2026-10-15 | Updated: 2026-10-17 | 3 failing / 33 total
Port fpga/verilog/gft_xorpercep_jtag.v (Verilog, 1 module) to specs/port/fpga/verilog/gft_xorpercep_jtag.t27 #9549 Port fpga/verilog/gft_xorpercep_jtag.v (Verilog, 1 module) to specs/port/fpga/verilog/gft_xorpercep_jtag.t27 | Created: 2026-10-14 | Updated: 2026-10-14 | 4 failing / 29 total
Port gHashTag/trios:crates/trios-git/src/stage.rs (Rust, 2 functions) to specs/port/trios/crates/trios-git/src/stage.t27 #9548 Port gHashTag/trios:crates/trios-git/src/stage.rs (Rust, 2 functions) to specs/port/trios/crates/trios-git/src/stage.t27 | Created: 2026-10-14 | Updated: 2026-10-14 | 4 failing / 29 total
Port gHashTag/trios:crates/trios-rainbow-bridge/src/bridge.rs (Rust, 5 functions) to specs/port/trios/crates/trios-rainb #9485 Port gHashTag/trios:crates/trios-rainbow-bridge/src/bridge.rs (Rust, 5 functions) to specs/port/trios/crates/trios-rainb | Created: 2026-10-14 | Updated: 2026-10-14 | 4 failing / 29 total
Port scripts/gen_w734.py (Python, 3 functions) to specs/port/scripts/gen_w734.t27 #9484 Port scripts/gen_w734.py (Python, 3 functions) to specs/port/scripts/gen_w734.t27 | Created: 2026-10-14 | Updated: 2026-10-14 | 4 failing / 29 total
Port scripts/gen_w726.py (Python, 3 functions) to specs/port/scripts/gen_w726.t27 #9463 Port scripts/gen_w726.py (Python, 3 functions) to specs/port/scripts/gen_w726.t27 | Created: 2026-10-14 | Updated: 2026-10-14 | 3 failing / 29 total
Port gHashTag/trinity:src/tri/sacred_alu.zig (Zig, 4 functions) to specs/port/trinity/src/tri/sacred_alu.t27 #9427 Port gHashTag/trinity:src/tri/sacred_alu.zig (Zig, 4 functions) to specs/port/trinity/src/tri/sacred_alu.t27 | Created: 2026-10-13 | Updated: 2026-10-13 | 5 failing / 29 total
Port gHashTag/trios:crates/trios-phd/src/bin/rag_search.rs (Rust, 3 functions) to specs/port/trios/crates/trios-phd/src/ #9426 Port gHashTag/trios:crates/trios-phd/src/bin/rag_search.rs (Rust, 3 functions) to specs/port/trios/crates/trios-phd/src/ | Created: 2026-10-13 | Updated: 2026-10-13 | 4 failing / 29 total
Port gHashTag/trinity:src/vibeec/spec_loader.zig (Zig, 2 functions) to specs/port/trinity/src/vibeec/spec_loader.t27 #9407 Port gHashTag/trinity:src/vibeec/spec_loader.zig (Zig, 2 functions) to specs/port/trinity/src/vibeec/spec_loader.t27 | Created: 2026-10-13 | Updated: 2026-10-13 | 4 failing / 29 total
Port gHashTag/trinity:src/background_agent/config.zig (Zig, 5 functions) to specs/port/trinity/src/background_agent/conf #9345 Port gHashTag/trinity:src/background_agent/config.zig (Zig, 5 functions) to specs/port/trinity/src/background_agent/conf | Created: 2026-10-13 | Updated: 2026-10-13 | 5 failing / 29 total
chore(deps)(deps): Bump tower-http from 0.6.8 to 0.7.1 #9340 chore(deps)(deps): Bump tower-http from 0.6.8 to 0.7.1 | Created: 2026-10-13 | Updated: 2026-10-18 | 29 failing / 37 total
chore(deps)(deps): Bump futures-util from 0.3.32 to 0.3.34 #9339 chore(deps)(deps): Bump futures-util from 0.3.32 to 0.3.34 | Created: 2026-10-13 | Updated: 2026-10-18 | 27 failing / 35 total

Summary

Status	Count
Total Open PRs	50
PRs with Failing Checks	44
PRs with All Checks Green	6
READY	0
FAILING	44
PENDING	0
NO CHECKS YET	0

These columns do not partition: 0 + 44 + 0 + 0 = 44, and there are 50 open PRs. A PR is being counted twice or not at all.

Seal Status

⚠️ STALE -- sha256(compiler.rs)=fad12492937a != manifest seal=87e5cbd3ad94.
The committed NMSE numbers were certified against an older compiler.rs.
Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

…d tree (Closes #6432) tools/census/quiet.txt conflicted (master moved it too). Took master's census and ran tri census pin --bless on the merged tree: the gitleaks job still adds one shell job with two run steps (jobs 93 -> 94, steps 325 -> 327, runner-run steps 304 -> 306, quiet "named a path but not quiet" 237 -> 239). The OSF line merged clean: #10582 made the same change on master. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

gHashTag enabled auto-merge (squash) October 18, 2026 19:00

This was referenced Oct 18, 2026

security: lefthook + gitleaks secret gate (pre-commit, pre-push, CI); remove OSF token #6433

Merged

specs/functions: broadcast-message-send -- one step per batch of 25 #8021

Merged

gHashTag merged commit 016f1e5 into master Oct 18, 2026
29 of 30 checks passed

Navigation Menu

Repository navigation

security: remove the plaintext OSF token from the research summary (Closes #10581) - #10582

security: remove the plaintext OSF token from the research summary (Closes #10581)#10582
gHashTag merged 1 commit into
masterfrom
sec/remove-osf-token-10581

gHashTag commented Oct 18, 2026

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

gHashTag commented Oct 18, 2026

What

Why a separate PR

Still to do (owner)

Uh oh!

github-actions Bot commented Oct 18, 2026

PR Dashboard

Summary

Seal Status

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants