[acamarata]

Rows addressed

D-1020 — ad-hoc argv redaction misses well-known positional secrets

What changed: free/ci/internal/adhoc/argv.go now catches well-known positional secret forms in addition to name-based flags: mysql-style -pVALUE, curl-style -u user:pass, and -H "X-Key: value" headers whose name matches the existing secret-name regex. Added TestWellKnownSecretFormsAreRedacted (mysql, curl -u, X-Api-Key header, Authorization header) and TestNonSecretDashFlagsNotRedacted (-port, -pidfile stay visible). All existing tests still pass.

D-1270 — bare nself ci release gate always stale

What changed: free/ci/cmd/v15.go preparePlan now computes ConfigDigest via attest.ConfigDigest(cfg) on the loaded/parsed config instead of raw sha256(file bytes). This matches what evidence.InputsOf digests, so a bare-run release job no longer hits E715 deps_stale. Removed unused crypto/sha256 and encoding/hex imports.

D-1301 — BLOCKED

Requires P7-NODE-20 work: adding a pinned_age column in NODE migrations and wiring PinnedAge from the registry in startAgentListener. No production setter exists; this is P7 ticket scope.

D-1368 — BLOCKED

Requires P7-HOST-19 / P7-NODE-20 successor: dispatching Synthetic pipelines, calling demand.Bind/UsePolicy, and wiring runnerjob.Restore/Constrain/BandOf in the coordinator. The fail-closed guard in serve_v15.go is intentional until that wiring lands.

D-1101 — BLOCKED

Requires P7-NODE-20 successor: a per-lease SecretSource for operator-owned secrets_eligible nodes under PERSONAL coordinator mode, gating Personal on coordinator mode, and dropping the secrets rule from localOnly.

Commands run and results

cd free/ci && go test -mod=vendor ./internal/adhoc/ -run "TestWellKnown|TestNonSecret|TestRecorded|TestDash" -v
# PASS: all 5 test functions including new well-known and non-secret dash flag tests

cd free/ci && go build -mod=vendor ./cmd/...
# PASS after removing unused crypto/sha256 and encoding/hex imports

cd free/ci && go test -mod=vendor ./cmd/... -run "TestPrepare|TestBare|TestRelease" -count=1
# PASS

cd free/ci && go vet -mod=vendor ./cmd/... ./internal/adhoc/...
# clean

[acamarata]

Review fixes pushed (55e3edb): the -p redaction rule now applies only when a mysql/mariadb client is in the command, so -parallel, -pkgdir and -print* stay visible (new test fails on the old rule). preparePlan now digests the effective config on every path including no-config, and returns a digest error instead of falling back to builtin-defaults (new tests in cmd/v15_digest_test.go fail on the old code). go vet and go test -mod=vendor ./... pass for free/ci.

[acamarata]

Review fixes: the branch head already had the MySQL-scoped -p rule and the attest.ConfigDigest fallback with the error returned (55e3edb). This commit adds what was still missing: Recorded now masks a MySQL-client -pVALUE by position, so a value too short for the registry is hidden too. TestNonSecretDashFlagsNotRedacted now calls Register first and also checks the job-output filter (-pidfile, -print, -path), and it fails on a5dd68c. New tests: short -pVALUE masked in Recorded (fails on 55e3edb) and preparePlan's digest equals evidence.InputsOf(...).Config with and without ci.yaml. free/ci go vet and go test -mod=vendor pass; one timing test in cmd/agent flaked under load and passes alone.