From 3b5a1dd2df9a9ffa2495daafbdc92efc89c97b22 Mon Sep 17 00:00:00 2001 From: Bradley J Potts Date: Sat, 8 Aug 2026 10:23:10 +0800 Subject: [PATCH 1/2] docs: enforce confidential identity policy --- AGENTS.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 5af19ab..f386cf8 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -134,6 +134,23 @@ work queue. - App-specific state, feature logic, and domain behavior belong in downstream applications. +## Confidential External Identities + +Never record external customer, vendor, user, client-site, or private-project +identities in tracked files, git metadata, reviews, releases, issues, or +handoffs. Use anonymous role-based wording such as "a downstream integration" +or "a production consumer." Public package and platform names are allowed +only when technically required to identify a dependency or supported +integration. + +**Zero tolerance, no exceptions.** This is not a case-by-case judgment call. +Every upstream vendor, customer, client, or third-party identity — regardless +of how well-known, already public, or seemingly harmless — is forbidden from +appearing in any file, commit, tag, branch name, PR, issue, roadmap, TODO, or +agent output anywhere in this repo. If a vendor name is already present +anywhere in tracked files, it must be anonymized on sight, not left in place +because it predates this rule. + ## Upstream Requests and Roadmap Self-Expansion Full directive: project-team [AGENTS.md](../AGENTS.md) "Upstream Requests and From ae96a38edf202dfb786567a49eea47bd1f4395de Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 9 Aug 2026 01:13:01 +0000 Subject: [PATCH 2/2] Bump @phcdevworks/spectre-tokens from 4.0.0 to 4.1.0 Bumps [@phcdevworks/spectre-tokens](https://github.com/phcdevworks/spectre-tokens) from 4.0.0 to 4.1.0. - [Release notes](https://github.com/phcdevworks/spectre-tokens/releases) - [Changelog](https://github.com/phcdevworks/spectre-tokens/blob/main/CHANGELOG.md) - [Commits](https://github.com/phcdevworks/spectre-tokens/compare/v4.0.0...v4.1.0) --- updated-dependencies: - dependency-name: "@phcdevworks/spectre-tokens" dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index b8f0d9f..66b1eb5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -569,9 +569,9 @@ } }, "node_modules/@phcdevworks/spectre-tokens": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/@phcdevworks/spectre-tokens/-/spectre-tokens-4.0.0.tgz", - "integrity": "sha512-QlfE7mCJWKv8WiiLByzYzZ2Sd0aPcOPFr9JHZGCRpZj9WyMkbZ0pMZqW71VVvgxafDYTt3gWLppqCJ3EgyZpAQ==", + "version": "4.1.0", + "resolved": "https://registry.npmjs.org/@phcdevworks/spectre-tokens/-/spectre-tokens-4.1.0.tgz", + "integrity": "sha512-bwetMPEj+ZOoJ19SyzX76Z6S5yvVf+sr2Ecxmuy9m/BMoFxXCBs57O/uLkl6g63I+Xus21cFhcVWenGjSz73ew==", "funding": [ { "type": "github",