(magpie) branch main updated: docs(spec-loop): mark branch-name confidentiality check as shipped (#972)

[jm...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

justinmclean pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/magpie.git


The following commit(s) were added to refs/heads/main by this push:
     new 55acb4d9 docs(spec-loop): mark branch-name confidentiality check as shipped (#972)
55acb4d9 is described below

commit 55acb4d91250ee5d20bb703f8fac38004fc60006
Author: Shaurya Srivastava <10...@users.noreply.github.com>
AuthorDate: Tue Jul 28 04:59:25 2026 +0530

    docs(spec-loop): mark branch-name confidentiality check as shipped (#972)
    
    Rewrite the privacy-llm-gate Known gaps bullet:
    validate_branch_name_confidentiality already runs as a SOFT advisory
    over skills/ and docs/, so the plan beat must not treat the gap as
    open work.
    
    Generated-by: Cursor Grok 4.5
    
    Signed-off-by: shaurya2k06 <sh...@gmail.com>
---
 tools/spec-loop/specs/privacy-llm-gate.md | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/tools/spec-loop/specs/privacy-llm-gate.md b/tools/spec-loop/specs/privacy-llm-gate.md
index be984bf8..55fb7c46 100644
--- a/tools/spec-loop/specs/privacy-llm-gate.md
+++ b/tools/spec-loop/specs/privacy-llm-gate.md
@@ -90,7 +90,12 @@ uv run --project tools/privacy-llm --group dev pytest
 
 - `stable`; gaps surface as new PII patterns or new public-emission
   surfaces not yet covered by the scrub — caught as drift by the plan pass.
-- **Branch-name confidentiality validation is missing.** Security-fix
-  workflows already require neutral branch names, but no deterministic
-  check scans skill/docs examples for CVE IDs or embargoed terms in
-  generated branch names.
+- **Branch-name confidentiality validation is shipped** as a SOFT
+  advisory in `tools/skill-and-tool-validator`
+  (`validate_branch_name_confidentiality`, category
+  `branch-name-confidentiality`). It scans `git checkout -b` and
+  `git switch -c` / `--create` examples in fenced code blocks under
+  `skills/` and `docs/`, and flags concrete branch names that contain a
+  CVE ID (`CVE-YYYY-NNNNN`), `security`, `vulnerability` / `vuln`, or
+  `advisory`. Placeholder names and explicit bad-example lines are
+  exempt. Advisory only unless `--strict`.