Add CI validation script for checking unauthorized expose_secret() call sites. The script validates that all uses of expose_secret() are in approved locations (SecretFingerprint and test code). Also add verification note summarizing the bead completion status. Per pdftract-5l9m acceptance criteria: - CI grep guard rejects unauthorized expose_secret() call sites - Verification documents existing SecretString wrapping status Co-Authored-By: Claude Code <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| ci | ||
| check-provenance.sh | ||
| generate_test_corpus.py | ||