leftblock 0.4.0__tar.gz → 0.4.3__tar.gz

{leftblock-0.4.0 → leftblock-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: leftblock
-Version: 0.4.0
+Version: 0.4.3
 Summary: LeftBlock: a pluggable inspection gate for Git commits
 License: MIT License
         
@@ -124,7 +124,7 @@ configures the integration; it does not install scanner binaries.
 In the intended Python environment:
 
 ```bash
-python -m pip install leftblock==0.4.0
+python -m pip install leftblock==0.4.3
 python -m leftblock.cli --help
 ```
 
@@ -397,11 +397,11 @@ PEM private keys, and other standard secret formats.
 
 | Rule | What it catches |
 |---|---|
-| `leftblock-personal-email` | Personal email addresses (infrastructure identities like `git@github.com`, `@users.noreply.github.com` and `@example.*` placeholders are allowlisted) |
+| `leftblock-personal-email` | Personal email addresses (infrastructure identities like `git@github.com`, `@users.noreply.github.com`, no-reply addresses, `@example.*` placeholders, `@example.edu` and any address on a `.test`, `.example`, `.invalid` or `.localhost` domain are allowlisted) |
 | `leftblock-home-path-posix` | Home-folder paths `/Users/<name>`, `/home/<name>` |
 | `leftblock-home-path-windows` | `C:\Users\<name>` and `\Users\<name>` |
-| `leftblock-session-uuid` | Potential session UUIDs, with narrow exceptions for canonical Kanbus structural fields and example values |
-| `leftblock-actor-id` | `actor_id` / `user_id` / `author_id` JSON values |
+| `leftblock-session-uuid` | Potential session UUIDs (not flagged in Kanbus board data; example values and the `.kanbus.yml` `project_id` line are also allowed) |
+| `leftblock-actor-id` | `actor_id` / `user_id` / `author_id` JSON values (not flagged in Kanbus board data) |
 | `leftblock-openai-key` | `sk-`, `sk-proj-`, `sk-svcacct-` OpenAI keys |
 | `leftblock-anthropic-key` | `sk-ant-` Anthropic keys |
 | `leftblock-eth-private-key` | Ethereum-style private keys (`0x` + 64 hex) |
@@ -409,7 +409,7 @@ PEM private keys, and other standard secret formats.
 | `leftblock-bip39-mnemonic` | BIP-39 seed phrases (12–24 words) in seed/mnemonic/recovery context |
 
 A blocked check prints a one-line hint after each rule's findings (once per
-rule): use a role or placeholder address for personal emails; a relative path,
+rule): use a role address or a reserved placeholder for personal emails; a relative path,
 `$HOME` or `~` for home paths; drop or describe session and actor identifiers;
 and for API, private and wallet keys, remove the value **and rotate the key**,
 since it may already be exposed. Findings in Kanbus board data
@@ -417,18 +417,13 @@ since it may already be exposed. Findings in Kanbus board data
 those files and that the content should be fixed through `kbs` (for example
 `kbs update` or `kbs comment`) rather than by hand.
 
-Kanbus exceptions apply to complete identifier property lines in
-`project/issues/*.json` and `project/events/*.json`. Event actor attribution
-must occupy a root property line in the canonical two-space format.
-Coordination claim references must occupy the canonical payload depth.
-The legacy `project/.cache/index.json` allows only canonical issue ID/parent
-lines and issue-filename keys with numeric modification times; cached
-descriptions and comments still receive the normal checks.
-Provider session fields, nested actor values, prose and arbitrary arrays
-remain scanned. A project prefix alone grants no exception, and a second
-value on the same line cannot inherit one. These checks recognize syntax;
-they do not validate a full JSON schema or prove an identifier is public.
-Other secret rules still apply to values in the accepted fields.
+Kanbus is the mandated task tracker, so identifiers in its board data (actor
+ids, session UUIDs, and UUIDs in any field or prose) are not sensitive and never
+block a `kbs` write. Board data means `project/issues/*.json`,
+`project/events/*.json` and `project/.cache/index.json`; the exception is
+limited to the session-UUID and actor-id rules, so personal emails, home paths
+and API or wallet keys in those files are still detected, and the same content
+in any other path is still flagged.
 
 ### Crypto wallet material: what is and is not flagged
 

{leftblock-0.4.0 → leftblock-0.4.3}/README.md

@@ -91,7 +91,7 @@ configures the integration; it does not install scanner binaries.
 In the intended Python environment:
 
 ```bash
-python -m pip install leftblock==0.4.0
+python -m pip install leftblock==0.4.3
 python -m leftblock.cli --help
 ```
 
@@ -364,11 +364,11 @@ PEM private keys, and other standard secret formats.
 
 | Rule | What it catches |
 |---|---|
-| `leftblock-personal-email` | Personal email addresses (infrastructure identities like `git@github.com`, `@users.noreply.github.com` and `@example.*` placeholders are allowlisted) |
+| `leftblock-personal-email` | Personal email addresses (infrastructure identities like `git@github.com`, `@users.noreply.github.com`, no-reply addresses, `@example.*` placeholders, `@example.edu` and any address on a `.test`, `.example`, `.invalid` or `.localhost` domain are allowlisted) |
 | `leftblock-home-path-posix` | Home-folder paths `/Users/<name>`, `/home/<name>` |
 | `leftblock-home-path-windows` | `C:\Users\<name>` and `\Users\<name>` |
-| `leftblock-session-uuid` | Potential session UUIDs, with narrow exceptions for canonical Kanbus structural fields and example values |
-| `leftblock-actor-id` | `actor_id` / `user_id` / `author_id` JSON values |
+| `leftblock-session-uuid` | Potential session UUIDs (not flagged in Kanbus board data; example values and the `.kanbus.yml` `project_id` line are also allowed) |
+| `leftblock-actor-id` | `actor_id` / `user_id` / `author_id` JSON values (not flagged in Kanbus board data) |
 | `leftblock-openai-key` | `sk-`, `sk-proj-`, `sk-svcacct-` OpenAI keys |
 | `leftblock-anthropic-key` | `sk-ant-` Anthropic keys |
 | `leftblock-eth-private-key` | Ethereum-style private keys (`0x` + 64 hex) |
@@ -376,7 +376,7 @@ PEM private keys, and other standard secret formats.
 | `leftblock-bip39-mnemonic` | BIP-39 seed phrases (12–24 words) in seed/mnemonic/recovery context |
 
 A blocked check prints a one-line hint after each rule's findings (once per
-rule): use a role or placeholder address for personal emails; a relative path,
+rule): use a role address or a reserved placeholder for personal emails; a relative path,
 `$HOME` or `~` for home paths; drop or describe session and actor identifiers;
 and for API, private and wallet keys, remove the value **and rotate the key**,
 since it may already be exposed. Findings in Kanbus board data
@@ -384,18 +384,13 @@ since it may already be exposed. Findings in Kanbus board data
 those files and that the content should be fixed through `kbs` (for example
 `kbs update` or `kbs comment`) rather than by hand.
 
-Kanbus exceptions apply to complete identifier property lines in
-`project/issues/*.json` and `project/events/*.json`. Event actor attribution
-must occupy a root property line in the canonical two-space format.
-Coordination claim references must occupy the canonical payload depth.
-The legacy `project/.cache/index.json` allows only canonical issue ID/parent
-lines and issue-filename keys with numeric modification times; cached
-descriptions and comments still receive the normal checks.
-Provider session fields, nested actor values, prose and arbitrary arrays
-remain scanned. A project prefix alone grants no exception, and a second
-value on the same line cannot inherit one. These checks recognize syntax;
-they do not validate a full JSON schema or prove an identifier is public.
-Other secret rules still apply to values in the accepted fields.
+Kanbus is the mandated task tracker, so identifiers in its board data (actor
+ids, session UUIDs, and UUIDs in any field or prose) are not sensitive and never
+block a `kbs` write. Board data means `project/issues/*.json`,
+`project/events/*.json` and `project/.cache/index.json`; the exception is
+limited to the session-UUID and actor-id rules, so personal emails, home paths
+and API or wallet keys in those files are still detected, and the same content
+in any other path is still flagged.
 
 ### Crypto wallet material: what is and is not flagged
 

{leftblock-0.4.0 → leftblock-0.4.3}/leftblock/cli.py

@@ -335,7 +335,7 @@ _REMOVE_AND_ROTATE = "Remove it AND rotate the key: it may already be exposed."
 _HOME_PATH = "Use a relative path, $HOME or ~ instead."
 _DESCRIBE_ID = "Drop the identifier or describe it instead."
 RULE_HINTS = {
-    "leftblock-personal-email": "Use a role or placeholder address, or describe it instead.",
+    "leftblock-personal-email": "Use a role address or a reserved placeholder (example.com/.org/.net, or any .test, .example or .invalid domain), or describe it instead.",
     "leftblock-home-path-posix": _HOME_PATH,
     "leftblock-home-path-windows": _HOME_PATH,
     "leftblock-session-uuid": _DESCRIBE_ID,
@@ -348,11 +348,18 @@ RULE_HINTS = {
     bypass.MARKER_RULE: "Remove the marker and fix the content, or record a reasoned override.",
     bypass.IGNORE_RULE: "Don't suppress findings silently; record a reasoned override per finding.",
 }
-KANBUS_HINT = (
-    "This file is written by Kanbus; fix the content through kbs "
-    "(e.g. kbs update or comment), don't hand-edit it."
+KANBUS_ISSUE_HINT = (
+    "This issue file is written by Kanbus; fix the content with kbs update "
+    "(or kbs comment), don't hand-edit it."
 )
-KANBUS_DATA = re.compile(r"(^|/)project/(issues|events)/[^/]+\.json$")
+# Events are append-only history: kbs update/comment add a new event and leave
+# the flagged text in place.
+KANBUS_EVENT_HINT = (
+    "This Kanbus event is append-only history and can't be edited. If the issue "
+    "isn't committed yet, run kbs delete <issue id> and recreate it without the "
+    "content; otherwise ask the board owner."
+)
+KANBUS_DATA = re.compile(r"(^|/)project/(issues|events)/[^/]+\.jsonl?$")
 
 
 def print_failures(failures):
@@ -377,7 +384,8 @@ def print_failures(failures):
                 if rule in RULE_HINTS:
                     print("      Hint: " + RULE_HINTS[rule], file=sys.stderr)
             for name in kanbus_files:
-                print(f"      {_plain(name)}: {KANBUS_HINT}", file=sys.stderr)
+                hint = KANBUS_EVENT_HINT if KANBUS_DATA.search(name).group(2) == "events" else KANBUS_ISSUE_HINT
+                print(f"      {_plain(name)}: {hint}", file=sys.stderr)
         else:
             print_warn(str(result.findings))
 

{leftblock-0.4.0 → leftblock-0.4.3}/leftblock/data/gitleaks.toml

@@ -21,9 +21,10 @@
 # indistinguishable from SHA-256 and is intentionally left to the
 # generic-api-key keyword context (see docs).
 #
-# Allowlists are scoped to exact structural values and field names
-# (placeholder usernames/actor ids, Kanbus structural id fields, the
-# 00000000-0000-4000-8000-... example UUID shape) — never whole paths.
+# Allowlists are scoped to exact values (placeholder usernames/actor ids,
+# the 00000000-0000-4000-8000-... example UUID shape, the .kanbus.yml
+# project_id line). The one path-wide exception is Kanbus board data, whose
+# identifiers are not sensitive for the session-uuid and actor-id rules only.
 
 title = "LeftBlock sensitive-data rules"
 
@@ -62,8 +63,16 @@ keywords = ["@"]
 regexes = [
   # Infrastructure and placeholder identities, not personal ones.
   '''@users\.noreply\.github\.com''',
+  # No-reply addresses (e.g. commit Co-Authored-By trailers) are not personal.
+  '''(^|[^a-zA-Z0-9._%+\-'])no-?reply@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}''',
   '''git@github\.com''',
   '''@(example|github)\.(com|org|net|io|ai)''',
+  # Domains reserved for documentation and testing: the TLDs .test, .example,
+  # .invalid and .localhost (RFC 2606 section 2, RFC 6761 section 6) at any
+  # subdomain depth, and example.edu (RFC 2606 section 3). Anchored on the end
+  # of the address so look-alikes such as test.com or example.test.co still flag.
+  '''@(?:[a-zA-Z0-9\-]+\.)*(?:test|example|invalid|localhost)$''',
+  '''@example\.edu$''',
 ]
 
 [[rules]]
@@ -106,64 +115,19 @@ regexes = [
   '''^11111111-1111-4111-8111-1111111111[0-9a-f]{2}$''',
 ]
 
-# Kanbus serializes board records as indented JSON. Accept a complete
-# structural field on its own line in board issue/event files. Prefixes
-# alone, prose, array elements and a second value on that line do not
-# qualify. This is a syntax-based exception, not JSON schema validation.
-# Gitleaks includes the preceding newline in its line context; permit that
-# single boundary byte, plus CRLF endings, without spanning properties.
+# Kanbus board data (issues, events and the derived cache index) is written by
+# Kanbus and is the mandated tracker in these repositories. Its identifiers,
+# including actor ids and session UUIDs, are not treated as sensitive
+# (decision 2026-10-20), so LeftBlock never blocks a kbs write on them. Emails,
+# home paths and keys in board files are still detected by their own rules.
 [[rules.allowlists]]
-description = "Kanbus board structural identifier fields"
-condition = "AND"
+description = "Kanbus board data identifiers"
 paths = [
   '''(^|/)project/(issues|events)/[^/]+\.json$''',
-]
-regexTarget = "line"
-regexes = [
-  '''^\n?[ \t]*"(id|comment_id|event_id|issue_id|parent_id|parent|target|target_id|from|to)"[ \t]*:[ \t]*"(?:[A-Za-z][A-Za-z0-9_]*-)*[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",?[ \t]*\r?$''',
-]
-
-# Event actor attribution is structural too. Keep this separate from
-# session_id/provider_session_id/resumed_session, which remain detected.
-[[rules.allowlists]]
-description = "Kanbus event UUID actor attribution"
-condition = "AND"
-paths = [
-  '''(^|/)project/events/[^/]+\.json$''',
-]
-regexTarget = "line"
-regexes = [
-  '''^\n?  "actor_id"[ \t]*:[ \t]*"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",?[ \t]*\r?$''',
-]
-
-# Coordination events refer to a generated claim by its prefixed key.
-# Require the canonical payload-property depth; bare session values,
-# root/deeper properties, prose and neighboring values are not exempt.
-[[rules.allowlists]]
-description = "Kanbus coordination payload claim reference"
-condition = "AND"
-paths = [
-  '''(^|/)project/events/[^/]+\.json$''',
-]
-regexTarget = "line"
-regexes = [
-  '''^\n?    "claim_id"[ \t]*:[ \t]*"(?:[A-Za-z][A-Za-z0-9_]*-)+[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",?[ \t]*\r?$''',
-]
-
-# The legacy Kanbus cache duplicates issue identifiers and stores numeric
-# mtimes keyed by issue filename. Do not exempt the cache file: it also
-# contains full descriptions and comments that still require scanning.
-[[rules.allowlists]]
-description = "Kanbus cache issue identifiers and numeric filename mtimes"
-condition = "AND"
-paths = [
+  # Kanbus's LLM usage log (one JSON record per line).
+  '''(^|/)project/events/[^/]+\.jsonl$''',
   '''(^|/)project/\.cache/index\.json$''',
 ]
-regexTarget = "line"
-regexes = [
-  '''^\n?      "(id|parent)"[ \t]*:[ \t]*"(?:[A-Za-z][A-Za-z0-9_]*-)+[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",?[ \t]*\r?$''',
-  '''^\n?    "(?:[A-Za-z][A-Za-z0-9_]*-)+[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.json"[ \t]*:[ \t]*-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?,?[ \t]*\r?$''',
-]
 
 # Kanbus 0.40+ records a public per-project UUID v4 in .kanbus.yml so every
 # clone shares one realtime topic. Accept only the top-level YAML key with a
@@ -191,19 +155,18 @@ regexes = [
   '''^example[-_a-z0-9]*$''',
 ]
 
-# Kanbus event files record the local actor that made each board change
-# ("actor_id"). That is the board's attribution design, not a leaked user
-# id; scoped to project/events and a two-space root property line. Nested
-# payload actor values and attribution outside event files remain detected.
+# Kanbus board data (issues, events and the derived cache index) is written by
+# Kanbus and is the mandated tracker in these repositories. Its identifiers,
+# including actor ids and session UUIDs, are not treated as sensitive
+# (decision 2026-10-20), so LeftBlock never blocks a kbs write on them. Emails,
+# home paths and keys in board files are still detected by their own rules.
 [[rules.allowlists]]
-description = "Kanbus board event actor attribution"
-condition = "AND"
+description = "Kanbus board data identifiers"
 paths = [
-  '''(^|/)project/events/[^/]+\.json$''',
-]
-regexTarget = "line"
-regexes = [
-  '''^\n?  "actor_id"[ \t]*:[ \t]*"[^"]+",?[ \t]*\r?$''',
+  '''(^|/)project/(issues|events)/[^/]+\.json$''',
+  # Kanbus's LLM usage log (one JSON record per line).
+  '''(^|/)project/events/[^/]+\.jsonl$''',
+  '''(^|/)project/\.cache/index\.json$''',
 ]
 
 # --------------------------------------------------------------------

{leftblock-0.4.0 → leftblock-0.4.3}/leftblock.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: leftblock
-Version: 0.4.0
+Version: 0.4.3
 Summary: LeftBlock: a pluggable inspection gate for Git commits
 License: MIT License
         
@@ -124,7 +124,7 @@ configures the integration; it does not install scanner binaries.
 In the intended Python environment:
 
 ```bash
-python -m pip install leftblock==0.4.0
+python -m pip install leftblock==0.4.3
 python -m leftblock.cli --help
 ```
 
@@ -397,11 +397,11 @@ PEM private keys, and other standard secret formats.
 
 | Rule | What it catches |
 |---|---|
-| `leftblock-personal-email` | Personal email addresses (infrastructure identities like `git@github.com`, `@users.noreply.github.com` and `@example.*` placeholders are allowlisted) |
+| `leftblock-personal-email` | Personal email addresses (infrastructure identities like `git@github.com`, `@users.noreply.github.com`, no-reply addresses, `@example.*` placeholders, `@example.edu` and any address on a `.test`, `.example`, `.invalid` or `.localhost` domain are allowlisted) |
 | `leftblock-home-path-posix` | Home-folder paths `/Users/<name>`, `/home/<name>` |
 | `leftblock-home-path-windows` | `C:\Users\<name>` and `\Users\<name>` |
-| `leftblock-session-uuid` | Potential session UUIDs, with narrow exceptions for canonical Kanbus structural fields and example values |
-| `leftblock-actor-id` | `actor_id` / `user_id` / `author_id` JSON values |
+| `leftblock-session-uuid` | Potential session UUIDs (not flagged in Kanbus board data; example values and the `.kanbus.yml` `project_id` line are also allowed) |
+| `leftblock-actor-id` | `actor_id` / `user_id` / `author_id` JSON values (not flagged in Kanbus board data) |
 | `leftblock-openai-key` | `sk-`, `sk-proj-`, `sk-svcacct-` OpenAI keys |
 | `leftblock-anthropic-key` | `sk-ant-` Anthropic keys |
 | `leftblock-eth-private-key` | Ethereum-style private keys (`0x` + 64 hex) |
@@ -409,7 +409,7 @@ PEM private keys, and other standard secret formats.
 | `leftblock-bip39-mnemonic` | BIP-39 seed phrases (12–24 words) in seed/mnemonic/recovery context |
 
 A blocked check prints a one-line hint after each rule's findings (once per
-rule): use a role or placeholder address for personal emails; a relative path,
+rule): use a role address or a reserved placeholder for personal emails; a relative path,
 `$HOME` or `~` for home paths; drop or describe session and actor identifiers;
 and for API, private and wallet keys, remove the value **and rotate the key**,
 since it may already be exposed. Findings in Kanbus board data
@@ -417,18 +417,13 @@ since it may already be exposed. Findings in Kanbus board data
 those files and that the content should be fixed through `kbs` (for example
 `kbs update` or `kbs comment`) rather than by hand.
 
-Kanbus exceptions apply to complete identifier property lines in
-`project/issues/*.json` and `project/events/*.json`. Event actor attribution
-must occupy a root property line in the canonical two-space format.
-Coordination claim references must occupy the canonical payload depth.
-The legacy `project/.cache/index.json` allows only canonical issue ID/parent
-lines and issue-filename keys with numeric modification times; cached
-descriptions and comments still receive the normal checks.
-Provider session fields, nested actor values, prose and arbitrary arrays
-remain scanned. A project prefix alone grants no exception, and a second
-value on the same line cannot inherit one. These checks recognize syntax;
-they do not validate a full JSON schema or prove an identifier is public.
-Other secret rules still apply to values in the accepted fields.
+Kanbus is the mandated task tracker, so identifiers in its board data (actor
+ids, session UUIDs, and UUIDs in any field or prose) are not sensitive and never
+block a `kbs` write. Board data means `project/issues/*.json`,
+`project/events/*.json` and `project/.cache/index.json`; the exception is
+limited to the session-UUID and actor-id rules, so personal emails, home paths
+and API or wallet keys in those files are still detected, and the same content
+in any other path is still flagged.
 
 ### Crypto wallet material: what is and is not flagged
 

{leftblock-0.4.0 → leftblock-0.4.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "leftblock"
-version = "0.4.0"
+version = "0.4.3"
 description = "LeftBlock: a pluggable inspection gate for Git commits"
 readme = "README.md"
 license = {file = "LICENSE"}
@@ -27,14 +27,14 @@ leftblock = "leftblock.cli:main"
 version_toml = ["pyproject.toml:project.version"]
 commit_message = "chore(release): {version}"
 tag_format = "v{version}"
-# Keep the README install pin on the released version; NEW_VERSION is set by
-# semantic-release, and README.md is committed with the release.
+# scripts/release_prepare.py keeps the README pin on NEW_VERSION and drops
+# commit trailers from the generated changelog; both files are committed.
 build_command = """
-sed -i "s/leftblock==[0-9][0-9.]*/leftblock==$NEW_VERSION/" README.md
+python scripts/release_prepare.py
 python -m pip install build
 python -m build
 """
-assets = ["README.md"]
+assets = ["README.md", "CHANGELOG.md"]
 
 [tool.semantic_release.branches.main]
 match = "main"

{leftblock-0.4.0 → leftblock-0.4.3}/tests/test_bypasses.py

@@ -10,7 +10,7 @@ from leftblock import bypass
 from test_commit_gate import GITLEAKS, RepositoryFixture
 
 MARKER = "gitleaks" + ":allow"
-EMAIL = "info" + "@" + "public-role.test"
+EMAIL = "info" + "@" + "public-role" + ".co"
 REASON = "Reviewed: documentation example, not a real finding"
 
 

{leftblock-0.4.0 → leftblock-0.4.3}/tests/test_false_positives.py

@@ -73,12 +73,15 @@ class KanbusIdTests(unittest.TestCase):
             "notes.md": "see PPY-%s; session %s\n" % (_uuid(rng), _uuid(rng)),
         }))
 
-    def test_prefixed_session_value_is_not_structural_bookkeeping(self):
-        self.assertIn("leftblock-session-uuid", scan_and_rule_ids({
-            "project/events/synthetic.json": json.dumps({
-                "session_id": "PPY-" + _uuid(_rng()),
-            }, indent=2),
-        }))
+    def test_session_value_with_prefix_passes_in_board_files_only(self):
+        doc = json.dumps({"session_id": "PPY-" + _uuid(_rng())}, indent=2)
+        self.assertEqual(
+            scan_and_rule_ids({"project/events/synthetic.json": doc}), [])
+        for path in ("src/synthetic.json", "project/other.json",
+                     "project/events/sub/synthetic.json"):
+            with self.subTest(path=path):
+                self.assertIn("leftblock-session-uuid",
+                              scan_and_rule_ids({path: doc}))
 
 
 def _uuid4(rng):

{leftblock-0.4.0 → leftblock-0.4.3}/tests/test_kanbus_advice.py

@@ -24,7 +24,7 @@ class RuleHintTests(unittest.TestCase):
         for rule in ("openai-key", "anthropic-key", "eth-private-key", "wif-key", "bip39-mnemonic"):
             self.assertIn("rotate", cli.RULE_HINTS["leftblock-" + rule])
         self.assertIn("relative path", cli.RULE_HINTS["leftblock-home-path-posix"])
-        self.assertIn("role or placeholder", cli.RULE_HINTS["leftblock-personal-email"])
+        self.assertIn("reserved placeholder", cli.RULE_HINTS["leftblock-personal-email"])
 
 
 @unittest.skipUnless(GITLEAKS, "Gitleaks must be installed for actual scanner tests")
@@ -79,11 +79,19 @@ class KanbusBoardTests(RepositoryFixture):
         self.assertIn("leftblock-home-path-posix", proc.stderr)
         self.assertIn("Hint: Use a relative path, $HOME or ~ instead.", proc.stderr)
         self.assertEqual(
-            proc.stderr.count("This file is written by Kanbus; fix the content through kbs "
-                              "(e.g. kbs update or comment), don't hand-edit it."), 1,
+            proc.stderr.count("This issue file is written by Kanbus; fix the content with kbs update"), 1,
         )
         self.assertNotIn(home_path, proc.stdout + proc.stderr)
 
+    def test_event_file_hint_says_delete_and_recreate_not_update(self):
+        self.write("project/events/2026-10-20T10-00-00.000Z__x.json",
+                   '{\n  "note": "see /' + 'Users/someone/notes"\n}\n')
+        proc = self.leftblock("check")
+        self.assertEqual(proc.returncode, 1)
+        self.assertIn("append-only history", proc.stderr)
+        self.assertIn("kbs delete <issue id>", proc.stderr)
+        self.assertNotIn("kbs update", proc.stderr)
+
     def test_hint_is_printed_once_per_rule(self):
         self.write("notes.md", "a /" + "Users/one/x\nb /" + "Users/two/y\n")
         proc = self.leftblock("check")

{leftblock-0.4.0 → leftblock-0.4.3}/tests/test_recorded_overrides.py

@@ -12,8 +12,8 @@ from test_commit_gate import GITLEAKS, RepositoryFixture
 
 # Flagged by the shipped personal-email rule; the rule allowlists only
 # example.* and GitHub identities.
-EMAIL = "info" + "@" + "public-role.test"
-OTHER_EMAIL = "help" + "@" + "public-role.test"
+EMAIL = "info" + "@" + "public-role" + ".co"
+OTHER_EMAIL = "help" + "@" + "public-role" + ".co"
 PAGE = "page.tsx"
 REASON = "Public role address for the site"
 
@@ -100,7 +100,7 @@ class RecordedOverrideTests(RepositoryFixture):
         detail = [l for l in proc.stderr.splitlines() if l.startswith("      ")]
         self.assertEqual(detail, [
             f"      {PAGE}:2: leftblock-personal-email [id {ident}] (Personal email address)",
-            "      Hint: Use a role or placeholder address, or describe it instead.",
+            "      Hint: Use a role address or a reserved placeholder (example.com/.org/.net, or any .test, .example or .invalid domain), or describe it instead.",
         ])
         self.assertIn(f"leftblock-personal-email in {PAGE}:2 [id {ident}]", proc.stderr.splitlines()[-1])
         self.assertNotIn(EMAIL, proc.stdout + proc.stderr)

{leftblock-0.4.0 → leftblock-0.4.3}/tests/test_sensitive_rules.py

@@ -109,7 +109,7 @@ class SensitiveFixtureTests(unittest.TestCase):
         # Synthetic personal values are assembled at test time so this
         # test source is itself clean under the shipped ruleset.
         user = "jd" + "oe"
-        email = "jane." + "doe@" + "example-corp." + "t" + "est"
+        email = "jane." + "doe@" + "example-corp" + ".co"
         findings = scan_and_rule_ids({
             "issues/one.json": (
                 '{"assignee_email": "%s", "session_id": "%s",'
@@ -222,6 +222,34 @@ class SensitiveFixtureTests(unittest.TestCase):
 class NegativeTests(unittest.TestCase):
     """Public wallet addresses and hash-like hex must NOT be flagged."""
 
+    def test_no_reply_addresses_pass_but_lookalikes_still_flag(self):
+        at = "@"
+        self.assertEqual(scan_and_rule_ids({"CHANGELOG.md": "\n".join([
+            "Co-Authored-By: Bot <noreply" + at + "vendor" + ".co" + ">",
+            "From: no-reply" + at + "vendor" + ".co",
+        ]) + "\n"}), [])
+        self.assertEqual(scan_and_rule_ids({"notes.md": "mail jo" + at + "vendor" + ".co\n"}),
+                         ["leftblock-personal-email"])
+        self.assertEqual(scan_and_rule_ids({"notes.md": "mail notnoreply" + at + "vendor" + ".co\n"}),
+                         ["leftblock-personal-email"])
+
+    def test_reserved_placeholder_domains_pass_but_lookalikes_still_flag(self):
+        at = "@"
+        passing = [
+            "person" + at + "example.invalid",
+            "a" + at + "mail.acme.test",
+            "b" + at + "deep.sub.host.example",
+            "c" + at + "app.localhost",
+            "d" + at + "example.edu",
+            "e" + at + "x.test",
+        ]
+        self.assertEqual(scan_and_rule_ids({"notes.md": "\n".join("mail " + a for a in passing) + "\n"}), [])
+        for domain in ["test" + ".com", "invalid" + ".org", "example.test" + ".co", "mytest" + ".dev",
+                       "example" + ".edu.co", "notexample" + ".edu"]:
+            with self.subTest(domain=domain):
+                self.assertEqual(scan_and_rule_ids({"notes.md": "mail jo" + at + domain + "\n"}),
+                                 ["leftblock-personal-email"])
+
     def test_public_wallet_addresses_and_hashes_not_flagged(self):
         rng = _rng()
         findings = scan_and_rule_ids({
@@ -332,172 +360,148 @@ def _uuid(rng):
 
 @unittest.skipUnless(GITLEAKS, "gitleaks not installed")
 class KanbusBoardAllowlistTests(unittest.TestCase):
-    """Kanbus board bookkeeping passes; the same shapes elsewhere still fail."""
+    """Kanbus board data identifiers are not sensitive; nothing else changes.
+
+    Policy (2026-10-20): in board data, actor ids, session UUIDs and UUIDs in
+    any field or prose pass. Emails, home paths and keys are still detected
+    there, and the same content outside board data is still flagged.
+    """
+
+    BOARD_PATHS = (
+        "project/issues/PPY-x.json",
+        "project/events/2026-10-20T00-00-00.000Z__x.json",
+        "project/events/llm_usage.jsonl",
+        "project/.cache/index.json",
+        "sub/dir/project/issues/PPY-x.json",
+        "sub/dir/project/events/e.json",
+        "sub/dir/project/.cache/index.json",
+    )
+    NON_BOARD_PATHS = (
+        "notes.md",
+        "project/other.json",
+        "project/issues/sub/x.json",
+        "project/events/sub/x.json",
+        "project/events.json",
+        "project/issues/x.json.bak",
+        "project/issues/x.jsonl",
+        "src/project/issues-like/x.json",
+        "myproject/issues/x.json",
+        "project/.cache/other.json",
+        "project/.cache/sub/index.json",
+    )
 
     def setUp(self):
         self.rng = _rng()
 
-    def test_prefixed_issue_ids_in_board_issue_files_pass(self):
-        for prefix in ("PPY", "LIM", "blbs", "chatticus", "decision-flywheel"):
-            iid = f"{prefix}-{_uuid(self.rng)}"
-            doc = json.dumps({"id": iid, "parent": f"{prefix}-{_uuid(self.rng)}",
-                              "comments": [{"id": _uuid(self.rng), "text": "done"}]}, indent=2)
-            self.assertEqual(scan_and_rule_ids({f"project/issues/{iid}.json": doc}), [], prefix)
-
-    def test_event_actor_id_passes_only_in_board_events(self):
-        event = json.dumps({"event_id": _uuid(self.rng), "issue_id": f"LIM-{_uuid(self.rng)}",
-                            "event_type": "issue_created", "actor" + "_id": "local" + "user"}, indent=2)
-        self.assertEqual(scan_and_rule_ids({"project/events/2026-10-20T00-00-00.000Z__x.json": event}), [])
-        self.assertIn("leftblock-actor-id", scan_and_rule_ids({"src/telemetry.json": event}))
-        self.assertIn("leftblock-actor-id", scan_and_rule_ids({"project/issues/x.json": event}))
-
-    def test_prefixed_ids_outside_board_files_still_flagged(self):
-        doc = json.dumps({"id": f"LIM-{_uuid(self.rng)}"}, indent=2)
-        self.assertIn("leftblock-session-uuid", scan_and_rule_ids({"src/state.json": doc}))
-
-    def test_bare_uuid_in_board_free_text_still_flagged(self):
-        doc = json.dumps({"id": f"PPY-{_uuid(self.rng)}",
-                          "description": f"session {_uuid(self.rng)} reproduced it"}, indent=2)
-        self.assertIn("leftblock-session-uuid", scan_and_rule_ids({"project/issues/PPY-x.json": doc}))
-
-    def test_event_uuid_actor_is_structural_only_in_event_attribution(self):
-        actor = _uuid(self.rng)
-        event = json.dumps({
-            "schema_version": 1, "event_id": _uuid(self.rng),
-            "issue_id": f"PPY-{_uuid(self.rng)}", "event_type": "comment_added",
-            "occurred_at": "2026-10-20T00:00:00.000Z", "actor_id": actor,
-            "payload": {"comment_id": _uuid(self.rng), "text": "Reviewed."},
-        }, indent=2)
-        self.assertEqual(scan_and_rule_ids({"project/events/synthetic.json": event}), [])
-        for path in ("src/telemetry.json", "project/issues/synthetic.json"):
-            with self.subTest(path=path):
-                findings = scan_and_rule_ids({path: event})
-                self.assertIn("leftblock-session-uuid", findings)
-                self.assertIn("leftblock-actor-id", findings)
-
-    def test_structural_id_does_not_hide_session_on_same_line(self):
-        for prefix in ("PPY-", "BOTSPY-", "kanbus-", ""):
-            with self.subTest(prefix=prefix):
-                doc = json.dumps({
-                    "id": prefix + _uuid(self.rng),
-                    "session_id": _uuid(self.rng),
-                })
-                self.assertIn("leftblock-session-uuid", scan_and_rule_ids({
-                    "project/issues/synthetic.json": doc,
-                }))
-
-    def test_session_uuid_fields_and_prose_remain_blocked_in_board_files(self):
-        for field in ("session_id", "provider_session_id", "resumed_session", "description", "text"):
-            for prefix in ("", "PPY-", "BOTSPY-", "kanbus-"):
-                with self.subTest(field=field, prefix=prefix):
-                    doc = json.dumps({field: prefix + _uuid(self.rng)}, indent=2)
-                    self.assertIn("leftblock-session-uuid", scan_and_rule_ids({
-                        "project/events/synthetic.json": doc,
-                    }))
-
-    def test_structural_values_must_fill_the_field(self):
-        value = _uuid(self.rng)
-        for doc in (
-            json.dumps({"id": "PPY-" + value + " extra"}, indent=2),
-            json.dumps({"description": ['PPY-' + value]}, indent=2),
-            json.dumps({"actor_id": value, "session_id": _uuid(self.rng)}),
-        ):
-            with self.subTest(doc_shape=len(doc)):
-                self.assertIn("leftblock-session-uuid", scan_and_rule_ids({
-                    "project/events/synthetic.json": doc,
-                }))
-
-    def test_all_structural_prefixes_still_flagged_outside_board_files(self):
-        for prefix in ("", "PPY-", "BOTSPY-", "kanbus-"):
-            with self.subTest(prefix=prefix):
-                doc = json.dumps({"id": prefix + _uuid(self.rng)}, indent=2)
-                self.assertIn("leftblock-session-uuid", scan_and_rule_ids({
-                    "src/state.json": doc,
-                }))
-
-    def test_actor_attribution_does_not_allow_other_sensitive_rules(self):
-        actor = "sk-proj-" + rand_openai_like(self.rng, 56)
-        doc = json.dumps({"actor_id": actor}, indent=2)
-        self.assertIn("leftblock-openai-key", scan_and_rule_ids({
-            "project/events/synthetic.json": doc,
-        }))
-
-    def test_nested_actor_and_split_line_actor_remain_detected(self):
-        nested = json.dumps({"payload": {"actor_id": _uuid(self.rng)}}, indent=2)
-        findings = scan_and_rule_ids({"project/events/synthetic.json": nested})
-        self.assertIn("leftblock-actor-id", findings)
-        self.assertIn("leftblock-session-uuid", findings)
-        split = '"actor_id"\n:\n"local' + 'user"'
-        self.assertIn("leftblock-actor-id", scan_and_rule_ids({"src/state.json": split}))
-
-    def test_example_or_cache_key_does_not_hide_another_uuid(self):
-        example = "-".join(("00000000", "0000", "4000", "8000", "0123456789ab"))
-        for first in (example, f"PPY-{_uuid(self.rng)}.json"):
-            line = first + " session=" + _uuid(self.rng)
-            self.assertIn("leftblock-session-uuid", scan_and_rule_ids({
-                "project/events/synthetic.json": line,
-            }))
-
-    def test_canonical_crlf_event_passes(self):
-        event = json.dumps({
-            "event_id": _uuid(self.rng), "actor_id": _uuid(self.rng),
-            "issue_id": f"PPY-{_uuid(self.rng)}",
-        }, indent=2).replace("\n", "\r\n")
-        self.assertEqual(scan_and_rule_ids({"project/events/synthetic.json": event}), [])
-
-    def test_coordination_claim_reference_passes_only_in_event_payload(self):
-        claim = "claim-" + _uuid(self.rng)
-        event = json.dumps({"event_type": "coordination.claim",
-                            "payload": {"claim_id": claim}}, indent=2)
-        self.assertEqual(scan_and_rule_ids({"project/events/synthetic.json": event}), [])
-        for path in ("project/issues/synthetic.json", "src/state.json"):
-            with self.subTest(path=path):
-                self.assertIn("leftblock-session-uuid", scan_and_rule_ids({path: event}))
-        for doc in (
-            json.dumps({"claim_id": claim}, indent=2),
-            json.dumps({"payload": {"nested": {"claim_id": claim}}}, indent=2),
-            json.dumps({"payload": {"claim_id": claim + " copied"}}, indent=2),
-            json.dumps({"payload": {"session_id": claim}}, indent=2),
-            json.dumps({"payload": {"claim_id": claim, "session_id": _uuid(self.rng)}}),
-            json.dumps({"payload": {"claim_id": _uuid(self.rng)}}, indent=2),
-        ):
-            self.assertIn("leftblock-session-uuid", scan_and_rule_ids({
-                "project/events/synthetic.json": doc,
-            }))
-
-    def test_cache_bookkeeping_passes_without_exempting_cached_content(self):
+    def _content(self):
+        """Identifier-bearing content in many shapes (indented and minified)."""
+        u = lambda: _uuid(self.rng)  # noqa: E731
+        actor_key = "actor" + "_id"
+        return {
+            "session_fields": json.dumps({
+                "session_id": u(), "provider_session_id": u(),
+                "resumed_session": u()}, indent=2),
+            "prose": json.dumps({
+                "description": "session " + u() + " reproduced it",
+                "text": "see PPY-" + u() + " and BOTSPY-" + u()}, indent=2),
+            "nested_actor": json.dumps(
+                {"payload": {actor_key: u()}}, indent=2),
+            "split_actor": '"%s"\n:\n"%s"' % (actor_key, u()),
+            "minified_event": json.dumps({
+                "event_id": u(), actor_key: u(), "session_id": u(),
+                "payload": {"comment_id": u(), "text": "x " + u()}}),
+        }
+
+    def test_identifiers_pass_in_every_board_path(self):
+        for path in self.BOARD_PATHS:
+            for shape, doc in self._content().items():
+                with self.subTest(path=path, shape=shape):
+                    self.assertEqual(scan_and_rule_ids({path: doc}), [])
+
+    def test_session_style_fields_pass_with_any_prefix_in_board_files(self):
+        for path in self.BOARD_PATHS:
+            for field in ("session_id", "provider_session_id", "resumed_session"):
+                for prefix in ("", "PPY-", "BOTSPY-", "kanbus-"):
+                    with self.subTest(path=path, field=field, prefix=prefix):
+                        doc = json.dumps({field: prefix + _uuid(self.rng)}, indent=2)
+                        self.assertEqual(scan_and_rule_ids({path: doc}), [])
+
+    def test_bare_and_prefixed_uuids_in_prose_pass_in_board_files(self):
+        for path in self.BOARD_PATHS:
+            for field in ("description", "text"):
+                for prefix in ("", "PPY-", "kanbus-"):
+                    with self.subTest(path=path, field=field, prefix=prefix):
+                        doc = json.dumps({
+                            "id": "PPY-" + _uuid(self.rng),
+                            field: "seen in %s%s today" % (prefix, _uuid(self.rng)),
+                        }, indent=2)
+                        self.assertEqual(scan_and_rule_ids({path: doc}), [])
+
+    def test_actor_ids_pass_nested_split_and_minified_in_board_files(self):
+        key = "actor" + "_id"
+        for value in (_uuid(self.rng), "local" + "user"):
+            shapes = {
+                "root": json.dumps({key: value}, indent=2),
+                "nested": json.dumps({"payload": {key: value}}, indent=2),
+                "split": '"%s"\n:\n"%s"' % (key, value),
+                "minified": json.dumps({"event_type": "x", key: value}),
+                "same_line_session": json.dumps(
+                    {key: value, "session_id": _uuid(self.rng)}),
+            }
+            for path in self.BOARD_PATHS:
+                for shape, doc in shapes.items():
+                    with self.subTest(path=path, shape=shape):
+                        self.assertEqual(scan_and_rule_ids({path: doc}), [])
+
+    def test_canonical_crlf_event_and_cache_pass(self):
         iid = "PPY-" + _uuid(self.rng)
-        cache = {
+        event = json.dumps({
+            "event_id": _uuid(self.rng), "actor" + "_id": _uuid(self.rng),
+            "issue_id": iid}, indent=2).replace("\n", "\r\n")
+        self.assertEqual(scan_and_rule_ids({"project/events/e.json": event}), [])
+        cache = json.dumps({
             "file_mtimes": {iid + ".json": 1792500000.25},
-            "issues": [{"id": iid, "parent": "PPY-" + _uuid(self.rng)}],
+            "issues": [{"id": iid, "description": "s " + _uuid(self.rng),
+                        "session_id": _uuid(self.rng)}]}, indent=2)
+        self.assertEqual(scan_and_rule_ids({"project/.cache/index.json": cache}), [])
+
+    def test_same_identifiers_still_flagged_outside_board_paths(self):
+        for path in self.NON_BOARD_PATHS:
+            for shape, doc in self._content().items():
+                with self.subTest(path=path, shape=shape):
+                    findings = scan_and_rule_ids({path: doc})
+                    self.assertIn("leftblock-session-uuid", findings)
+
+    def test_actor_ids_still_flagged_outside_board_paths(self):
+        key = "actor" + "_id"
+        doc = json.dumps({key: "local" + "user"}, indent=2)
+        split = '"%s"\n:\n"%s"' % (key, "local" + "user")
+        for path in self.NON_BOARD_PATHS:
+            for shape, content in (("root", doc), ("split", split)):
+                with self.subTest(path=path, shape=shape):
+                    self.assertIn("leftblock-actor-id",
+                                  scan_and_rule_ids({path: content}))
+
+    def test_personal_email_home_path_and_key_still_flagged_in_board_files(self):
+        email = "jane." + "doe@" + "example-corp" + ".co"
+        user = "jd" + "oe"
+        cases = {
+            "leftblock-personal-email": json.dumps(
+                {"assignee": email}, indent=2),
+            "leftblock-home-path-posix": json.dumps(
+                {"description": "see /Users/%s/work" % user}, indent=2),
+            "leftblock-openai-key": json.dumps(
+                {"text": "key sk-proj-" + rand_openai_like(self.rng, 56)},
+                indent=2),
         }
-        doc = json.dumps(cache, indent=2)
-        path = "project/.cache/index.json"
-        self.assertEqual(scan_and_rule_ids({path: doc}), [])
-        self.assertIn("leftblock-session-uuid", scan_and_rule_ids({"src/index.json": doc}))
-        for field in ("id", "parent"):
-            self.assertIn("leftblock-session-uuid", scan_and_rule_ids({
-                path: json.dumps({field: iid}, indent=2),
-            }))
-        for field in ("description", "session_id"):
-            cache["issues"][0][field] = _uuid(self.rng)
-            self.assertIn("leftblock-session-uuid", scan_and_rule_ids({
-                path: json.dumps(cache, indent=2),
-            }))
-            del cache["issues"][0][field]
-        cache["issues"][0]["actor_id"] = "sk-proj-" + rand_openai_like(self.rng, 56)
-        self.assertIn("leftblock-openai-key", scan_and_rule_ids({
-            path: json.dumps(cache, indent=2),
-        }))
-
-    def test_cache_key_allowance_cannot_hide_another_uuid(self):
-        key = "PPY-" + _uuid(self.rng) + ".json"
-        value = _uuid(self.rng)
-        for line in (
-            f'    "{key}": 123.5, "session_id": "{value}"',
-            f'    "{key}": "{value}"',
-            f'    "{key}": {{"session_id": "{value}"}}',
-        ):
-            self.assertIn("leftblock-session-uuid", scan_and_rule_ids({
-                "project/.cache/index.json": line,
-            }))
+        for path in self.BOARD_PATHS:
+            for rule, doc in cases.items():
+                with self.subTest(path=path, rule=rule):
+                    self.assertIn(rule, scan_and_rule_ids({path: doc}))
+
+    def test_key_in_actor_field_still_flagged_in_board_files(self):
+        doc = json.dumps({"actor" + "_id": "sk-proj-" + rand_openai_like(self.rng, 56)},
+                         indent=2)
+        for path in self.BOARD_PATHS:
+            with self.subTest(path=path):
+                self.assertIn("leftblock-openai-key", scan_and_rule_ids({path: doc}))