scrumrun 2.1.1 → 2.2.0

package/CHANGELOG.md

@@ -4,15 +4,19 @@ All notable changes follow Semantic Versioning.
 
 ## Unreleased
 
+## 2.2.0 - 2026-07-23
+
 ### Security
 
 - Added fail-closed, 15-minute, path-scoped Mutation Gateway permits with policy/workspace binding, before/after hashes, read-only and symlink checks, new-secret detection, and append-only Run evidence.
 - Deferred Guardrails now become persisted Run obligations; unresolved obligations, policy drift, workspace bypass, and pending canonical transactions block completion.
 - Fresh and explicitly migrated projects require structured `Status`, `Enforcement`, `Scope`, and `Rule` fields and advertise Guardrail, obligation, and Mutation Gateway schemas in `method.json`.
+- Added per-project `allow_secrets_in` config.md allowlist so owners can exempt non-canonical descriptive files (e.g. v1 `history.md`, `sprint.md`) from secret-like content detection without weakening canonical artifact policy. Exact paths, directory prefixes, and glob patterns are supported. Real `sk-…` / `AKIA…` / JWT / PEM shapes are never exempted because they always carry a real value.
 
 ### Changed
 
 - Project conformance now covers 21 executable invariants and detects active Run mutation bypasses.
+- `lib/security/secrets` exports `loadSecretAllowlist`, `isSecretAllowed`, `containsSecretWithAllowlist`, and `parseFrontmatter` for use by intake, migration, and conformance.
 
 ## 2.1.1 - 2026-07-22
 

package/README.md

@@ -213,4 +213,4 @@ The release gates cover artifact/state conformance, read-only intake, migration
 
 ## License
 
-MIT © Leander Costa
+MIT © Leander Costa · [hi@scrumrun.dev](mailto:hi@scrumrun.dev)

package/SPEC.md

@@ -220,6 +220,8 @@ Configuration controls preferences but cannot weaken higher levels. Missing or s
 
 Every project Guardrail has a stable `GR-NNN` identity, lifecycle status, rule text, enforcement mode, and optional scope/source. Intake evaluates active Guardrails into structured `passed`, `blocked`, or `deferred` results. A block names the responsible Guardrail and machine-readable reason code; a deferred result is shown explicitly and must be enforced at the mutation, migration, review, or owner gate it names. Deferred checks do not become evidence of a pass.
 
+Secret-like content detection is canonical-policy-level and applies to every artifact, evidence, intake payload, and source file outside the local vault. Owners may exempt specific **non-canonical descriptive paths** from the keyword heuristic through `config.md` frontmatter `allow_secrets_in: [paths...]` (exact paths, directory prefixes ending in `/`, or glob patterns). Canonical artifacts (Task, Sprint, Run, Feature, Review, Memory) are never eligible for the allowlist: a secret in a canonical file always fails conformance. Exemption never applies to high-confidence shapes (`sk-…`, `AKIA…`, JWT, PEM private keys, long bearer tokens) regardless of path. The allowlist is recorded as evidence of an explicit owner decision and is reviewed by `doctor`.
+
 The executable Policy Engine may infer enforcement for migrated prose, but fresh v2 policy declares it explicitly. Unknown enforcement, duplicate ids, inactive-only policy, configuration that disables approval, and unsafe read-only paths fail conformance. Configuration can tune presentation and workflow preferences; it cannot retire, bypass, or weaken active Guardrails.
 
 ## 7. Semantic memory and code intelligence

package/lib/security/secrets.js

@@ -1,6 +1,8 @@
 "use strict";
 
 const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
 
 const SECRET_PATTERNS = Object.freeze([
   /\bsk-[A-Za-z0-9_-]{16,}\b/,
@@ -34,4 +36,73 @@ function secretFingerprints(value) {
   return [...found].sort();
 }
 
-module.exports = { SECRET_PATTERNS, assertNoSecret, containsSecret, secretFingerprints };
+function parseFrontmatter(text) {
+  const match = String(text || "").match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!match) return { explicit: {}, raw: "" };
+  const body = match[1];
+  const explicit = {};
+  for (const line of body.split(/\r?\n/)) {
+    if (!line.trim() || line.trim().startsWith("#")) continue;
+    const kv = line.match(/^([A-Za-z0-9_.-]+)\s*:\s*(.*)$/);
+    if (!kv) continue;
+    const key = kv[1].trim();
+    let value = kv[2].trim();
+    if (value.startsWith("[") && value.endsWith("]")) {
+      value = value.slice(1, -1).split(",").map((s) => s.trim().replace(/^['"]|['"]$/g, "")).filter(Boolean);
+    } else if (/^['"].*['"]$/.test(value)) {
+      value = value.slice(1, -1);
+    } else if (value === "true" || value === "false") {
+      value = value === "true";
+    }
+    explicit[key] = value;
+  }
+  return { explicit, raw: body };
+}
+
+function loadSecretAllowlist(scrumDir) {
+  if (!scrumDir || !fs.existsSync(scrumDir)) return new Set();
+  const configFile = path.join(scrumDir, "config.md");
+  if (!fs.existsSync(configFile) || !fs.lstatSync(configFile).isFile()) return new Set();
+  let text;
+  try {
+    text = fs.readFileSync(configFile, "utf8");
+  } catch {
+    return new Set();
+  }
+  const { explicit } = parseFrontmatter(text);
+  const raw = explicit.allow_secrets_in;
+  if (!raw) return new Set();
+  const list = Array.isArray(raw) ? raw : [String(raw)];
+  return new Set(list.map((p) => String(p).replace(/^\.\//, "").trim()).filter(Boolean));
+}
+
+function isSecretAllowed(relativePath, allowlist) {
+  if (!allowlist || !allowlist.size) return false;
+  if (!relativePath) return false;
+  const normalized = String(relativePath).replace(/^\.\//, "");
+  if (allowlist.has(normalized)) return true;
+  for (const entry of allowlist) {
+    if (entry.endsWith("/") && normalized.startsWith(entry)) return true;
+    if (entry.includes("*")) {
+      const re = new RegExp("^" + entry.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*") + "$");
+      if (re.test(normalized)) return true;
+    }
+  }
+  return false;
+}
+
+function containsSecretWithAllowlist(value, relativePath, allowlist) {
+  if (isSecretAllowed(relativePath, allowlist)) return false;
+  return containsSecret(value);
+}
+
+module.exports = {
+  SECRET_PATTERNS,
+  assertNoSecret,
+  containsSecret,
+  containsSecretWithAllowlist,
+  isSecretAllowed,
+  loadSecretAllowlist,
+  parseFrontmatter,
+  secretFingerprints
+};

package/lib/v2/conformance.js

@@ -9,7 +9,7 @@ const { validateRunLedger } = require("../runtime/run-ledger");
 const { indexStatus, mapStatus } = require("../memory/index");
 const { extractEvidence } = require("../memory/markdown");
 const { resolveEvidence } = require("../memory/service");
-const { containsSecret } = require("../security/secrets");
+const { containsSecret, containsSecretWithAllowlist, loadSecretAllowlist } = require("../security/secrets");
 const { pendingTransactionStatus } = require("./transaction");
 const { configWeakeningAttempts, validateGuardrailDocument } = require("../runtime/policy-engine");
 const { auditActiveWorkspace } = require("../runtime/mutation-gateway");
@@ -91,7 +91,8 @@ function auditProject(projectRoot) {
       counts[kind] = artifacts.length;
       for (const artifact of artifacts) {
         for (const error of artifact.errors) findings.push(finding("high", "ARTIFACT_INVALID", `${path.basename(artifact.file)}: ${error}`, artifact.file));
-        if (containsSecret(fs.readFileSync(artifact.file, "utf8"))) findings.push(finding("critical", "SECRET_CANONICAL", `Secret-like content detected in ${path.relative(scrumDir, artifact.file)}.`, artifact.file));
+        const relativeArtifact = path.relative(scrumDir, artifact.file);
+        if (containsSecret(fs.readFileSync(artifact.file, "utf8"))) findings.push(finding("critical", "SECRET_CANONICAL", `Secret-like content detected in ${relativeArtifact}.`, artifact.file));
         if (artifact.record && ids.has(artifact.record.id)) findings.push(finding("critical", "ID_DUPLICATE", `Duplicate artifact id: ${artifact.record.id}`));
         if (artifact.record) ids.add(artifact.record.id);
       }

package/lib/v2/migration.js

@@ -3,7 +3,7 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const { extractEvidence } = require("../memory/markdown");
-const { containsSecret } = require("../security/secrets");
+const { containsSecret, containsSecretWithAllowlist, loadSecretAllowlist } = require("../security/secrets");
 const {
   ARTIFACT_TYPES,
   ArtifactRepository,
@@ -297,10 +297,11 @@ function migrationPlan(projectRoot) {
   }));
   const warnings = [];
   const errors = inventory.symlinks.map((entry) => `Symbolic link is not migrated automatically: ${entry.path}`);
+  const secretAllowlist = loadSecretAllowlist(scrumDir);
   for (const entry of inventory.files) {
     if (/(^|\/)vault(?:\.local)?\.md$/i.test(entry.path) || !/\.(?:md|json|txt)$/i.test(entry.path)) continue;
     const content = fs.readFileSync(path.join(scrumDir, entry.path), "utf8");
-    if (containsSecret(content)) errors.push(`Secret-like content detected outside the local vault: ${entry.path}`);
+    if (containsSecretWithAllowlist(content, entry.path, secretAllowlist)) errors.push(`Secret-like content detected outside the local vault: ${entry.path}`);
   }
   const allocator = new IdAllocator(scrumDir);
   const existingArtifacts = Object.fromEntries(Object.keys(ARTIFACT_TYPES).map((kind) => [kind, []]));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scrumrun",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "Evidence-driven Agile runtime and semantic project memory for AI coding agents.",
   "bin": {
     "scrumrun": "bin/scrumrun.js",
@@ -55,4 +55,4 @@
   "engines": {
     "node": ">=22.13.0"
   }
-}
+}