Review repo-sentinel baseline before enabling a remote gate

[stacknil]

Context

repo-sentinel-lite was previously available only as a local pre-push/manual hook in this repository. The original baseline numbers below are retained as historical context only; they are not canonical consumer evidence.

Historical context

• Released repo-sentinel-lite v0.7.1: 146 unsuppressed error-level findings against the then-current main.
• Historical upstream baseline snapshot: 275 active, 27 stale, 153 unmatched, and 4 ambiguous entries.
• Upstream duplicate-fingerprint work was completed before the v0.8 adoption.

Resolution evidence

PR #8 merged the reviewed consumer integration:

• Consumer repository SHA: 8d72ecd706aeaffa2893917ed93c99071454781d
• Consumer PR: ci: adopt repo-sentinel-lite v0.8.1 consumer gate #8
• Scanner: repo-sentinel-lite==0.8.1 from production PyPI
• Scanner release commit: eed8f484ba3e50cf0e86b61591a52b744dadf56a
• Exact audit command: python -m repo_sentinel baseline audit --format json --baseline .reposentinel-baseline.json .
• Redacted audit artifact SHA-256: c2193422cdf638f173c33890eef455d88aed7b039e3f7dcc3bf43501902ab962
• Current audit summary: active 272, relocated 7, changed 0, ambiguous 26, stale 0, unmatched 150
• Active repo.required_file_missing: 0
• Synthetic contract: PASS fixture, FAIL fixture, and redaction assertion passed in the independent clean clone
• Remote workflow run: https://github.com/stacknil/sec-writeups-public/actions/runs/31955666162
• Changed-file error gate: blocking and passed
• Baseline audit: continue-on-error: true, passed without becoming a blocking policy
• Workflow permissions: contents: read
• No raw token values were included in repository, issue, or reviewer-facing output.

Decision

The acceptance criteria are complete. Consumer proof is pinned to stable v0.8.1, not the provider development branch. New error-level findings in changed files block pull requests; baseline drift remains a separate review signal.

Rollback

Remove .github/workflows/repo-sentinel-gate.yml to disable the remote gate while retaining the local pre-push hook. The local hook can be returned to its previous release pin if required.

Non-goals

• No bulk baseline refresh for metric reduction.
• No claim that repo-sentinel replaces human authorization, PII review, or the canonical placeholder validator.

[stacknil]

Baseline classification is now recorded in docs/repo-sentinel-baseline-review.md.

Evidence is redacted and contains no raw token values:

• consumer snapshot: main at 9a18c74
• audit input: repo-sentinel-lite commit 8a6e064 from the v0.8 development line
• audit result: 275 active, 5 relocated, 26 ambiguous, 0 stale, 2,567 unmatched
• 2,414 unmatched findings are generated report artifacts; the remaining findings are documented fixtures, command examples, or repository metadata/path false positives
• no real credential is confirmed by this review; common credential marker checks were clean

Decision:

• .reposentinel-baseline.json was not regenerated or rewritten
• baseline audit remains non-blocking
• one active repo.required_file_missing entry for LICENSE remains unresolved
• the remote gate stays disabled until a reviewed release or reviewed immutable commit and the synthetic pass/fail/redaction integration test are available

Issue #5 remains open for that final gate decision. The historical issue snapshot and the v0.8 candidate audit are not directly comparable because rule coverage and identity semantics changed.

[stacknil]

License governance condition resolved by PR #7 (merged as 7db916e):

• original written content and pattern cards now have an explicit CC BY 4.0 scope
• third-party platform material, quotations, and linked resources remain excluded
• the baseline was updated only to remove the stale repo.required_file_missing entry for LICENSE
• clean-worktree audit against consumer commit 1dff619 reports repo.required_file_missing=0, stale=0, exit 0
• local audit artifact SHA256: ce5e84b0bff3c8825c51141a9278612837ae7cbf80baaafd52b1c1a71167fe9a

This resolves the policy disagreement; it does not close issue #5. The remote gate remains non-blocking until repo-sentinel v0.8.0 is formally released and pinned, the exact consumer audit is rerun against that release, synthetic pass/fail/redaction tests are complete, and changed-file gate rollout is reviewed.

[stacknil]

Closure check completed against consumer main 8d72ecd706aeaffa2893917ed93c99071454781d from an independent clean clone. The canonical v0.8.1 audit evidence and rollback path are now recorded in the issue body; historical pre-v0.8 counts are explicitly non-canonical.