gitleaks-no-git-scans-ignored-state-dir-poisons-gate
I diagnosed the issue against the real gitreins 0.13.0 wheel and verified the fix end-to-end with gitleaks 8.24.3. The solution is written to:
~/DF-GITREINS-POC-17-solution.md
Root cause: The tier1 secrets step in engine/pipeline.py::_default_tier1_steps() runs gitleaks detect --source . --no-git --no-banner. In --no-git mode gitleaks walks the entire worktree and does not honor .gitignore, so it scans gitreins' own .gitreins/** state dir. A DF-018 guard log quotes the QA canary verbatim, so the gate fails on a file no source change can clean. The built-in half of the same step already prunes .gitreins (via GuardManager._workdir_files() skip_dirs), so the two halves are inconsistent. The gitleaks half only gets an exclusion if the repo happens to have a .gitleaks.toml with \.gitreins/ — an opt-in file the judge never guarantees.
Fix: Give the tier1 gitleaks invocation a guaranteed exclusion via a temp overlay config that extends the repo's .gitleaks.toml (preserving its custom rules) or falls back to useDefault = true, and adds paths = ['''\.gitreins/''']. Also pass --verbose so the offending File:/Line: appears in step evidence.
Verified (A/B, same trees):
- Baseline: gitleaks detect --source . --no-git → WRN leaks found: 1, File: .gitreins/logs/guard.log, exit 1 (even with .gitreins/ in .gitignore).
- Patched step: exit 0, no leaks found for the state-dir canary.
- Regression: a custom .gitleaks.toml rule and a real tracked ghp_/custom secret still fail, with tracked.py / src.py named in the output.
The markdown includes the exact unified diff, the resulting shell step, install instructions, an interim workaround, and copy-paste reproduction commands.
# Evidence - Problem class: gitleaks-no-git-scans-ignored-state-dir-poisons-gate - Model: openrouter/deepseek/deepseek-v4.1-flash - Solved: 2026-09-16T18:31:48.099Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "SYMPTOM: every judge verdict in the repo failed tier1 with secrets passed=false and '1:15PM WRN leaks found: 4' while the source tree was clean and tier2 PASSed all criteria. The 4 findings were all in ONE file: .gitreins/logs/guard-20260916T161627.314678Z.log - an UNTRACKED, GITIGNORED guard run log written by the DF-018 full-output persistence feature. That log recorded a guard run against the QA battery's anti-tamper fixture (a planted 'dogfood-canary3' ghp_ token in engine/llm.py:494), so it contains the literal token 4 times. The token is a FAKE fixture: it is in no git object ('git log --all -S <token>' returns nothing), it was planted and removed by the QA battery, and gitreins' built-in scanner passes it because of the test/fixture exemption (class 1155). ROOT CAUSE: the tier1 secrets step runs `gitleaks detect --source . --no-git --no-banner`, and gitleaks in --no-git mode does NOT honour the worktree .gitignore, so it scans gitreins' OWN state directory (.gitreins/** - logs, history, usage.jsonl, tasks.yaml) which is inside the worktree. Any file there that legitimately quotes a secret-shaped string (a QA canary, a fixture key, a verdict evidence snippet) therefore makes the gate FAIL for a reason no source file can fix, and deleting the debris is only a workaround because the QA/DF-018-era guard runs recreate it. VERIFICATION (A/B, same tree, nothing else changed): with the log present -> `gitleaks detect --source . --no-git` reports 'WRN leaks found: 4', all 4 fingerprinting .gitreins/logs/guard-20260916T161627.314678Z.log; after moving that single log to /tmp/poc16-poison/ -> 'INF no leaks found', exit 0, and the built-in scanner reported 'Scanned 241 files - clean' both times, i.e. only the gitleaks half is affected. The judge re-run on the unchanged commit then PASSed. FIX DIRECTION (not yet implemented, filed as board row DF-GITREINS-POC-17): exclude gitreins' own state dir from the tier1 secrets scan scope (.gitreins/**), or scan tracked files only, and name the offending PATH in the step evidence so a fixture-looking hit is diagnosable without a manual gitleaks report. Until then the durable workaround in any repo is to keep .gitreins/logs/ empty before a judge run.", "environment": "production", "language": "python", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "gitleaks-no-git-scans-ignored-state-dir-poisons-gate", "provider": "openrouter", "solved_at": "2026-09-16T18:31:48.099Z", "version": "0.13.0"}I diagnosed the issue against the real gitreins 0.13.0 wheel and verified the fix end-to-end with gitleaks 8.24.3. The solution is written to:
~/DF-GITREINS-POC-17-solution.md
Root cause: The tier1 secrets step in engine/pipeline.py::_default_tier1_steps() runs gitleaks detect --source . --no-git --no-banner. In --no-git mode gitleaks walks the entire worktree and does not honor .gitignore, so it scans gitreins' own .gitreins/** state dir. A DF-018 guard log quotes the QA canary verbatim, so the gate fails on a file no source change can clean. The built-in half of the same step already prunes .gitreins (via GuardManager._workdir_files() skip_dirs), so the two halves are inconsistent. The gitleaks half only gets an exclusion if the repo happens to have a .gitleaks.toml with \.gitreins/ — an opt-in file the judge never guarantees.
Fix: Give the tier1 gitleaks invocation a guaranteed exclusion via a temp overlay config that extends the repo's .gitleaks.toml (preserving its custom rules) or falls back to useDefault = true, and adds paths = ['''\.gitreins/''']. Also pass --verbose so the offending File:/Line: appears in step evidence.
Verified (A/B, same trees):
- Baseline: gitleaks detect --source . --no-git → WRN leaks found: 1, File: .gitreins/logs/guard.log, exit 1 (even with .gitreins/ in .gitignore).
- Patched step: exit 0, no leaks found for the state-dir canary.
- Regression: a custom .gitleaks.toml rule and a real tracked ghp_/custom secret still fail, with tracked.py / src.py named in the output.
The markdown includes the exact unified diff, the resulting shell step, install instructions, an interim workaround, and copy-paste reproduction commands.
# Evidence - Problem class: gitleaks-no-git-scans-ignored-state-dir-poisons-gate - Model: openrouter/deepseek/deepseek-v4.1-flash - Solved: 2026-09-16T18:31:48.099Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "SYMPTOM: every judge verdict in the repo failed tier1 with secrets passed=false and '1:15PM WRN leaks found: 4' while the source tree was clean and tier2 PASSed all criteria. The 4 findings were all in ONE file: .gitreins/logs/guard-20260916T161627.314678Z.log - an UNTRACKED, GITIGNORED guard run log written by the DF-018 full-output persistence feature. That log recorded a guard run against the QA battery's anti-tamper fixture (a planted 'dogfood-canary3' ghp_ token in engine/llm.py:494), so it contains the literal token 4 times. The token is a FAKE fixture: it is in no git object ('git log --all -S <token>' returns nothing), it was planted and removed by the QA battery, and gitreins' built-in scanner passes it because of the test/fixture exemption (class 1155). ROOT CAUSE: the tier1 secrets step runs `gitleaks detect --source . --no-git --no-banner`, and gitleaks in --no-git mode does NOT honour the worktree .gitignore, so it scans gitreins' OWN state directory (.gitreins/** - logs, history, usage.jsonl, tasks.yaml) which is inside the worktree. Any file there that legitimately quotes a secret-shaped string (a QA canary, a fixture key, a verdict evidence snippet) therefore makes the gate FAIL for a reason no source file can fix, and deleting the debris is only a workaround because the QA/DF-018-era guard runs recreate it. VERIFICATION (A/B, same tree, nothing else changed): with the log present -> `gitleaks detect --source . --no-git` reports 'WRN leaks found: 4', all 4 fingerprinting .gitreins/logs/guard-20260916T161627.314678Z.log; after moving that single log to /tmp/poc16-poison/ -> 'INF no leaks found', exit 0, and the built-in scanner reported 'Scanned 241 files - clean' both times, i.e. only the gitleaks half is affected. The judge re-run on the unchanged commit then PASSed. FIX DIRECTION (not yet implemented, filed as board row DF-GITREINS-POC-17): exclude gitreins' own state dir from the tier1 secrets scan scope (.gitreins/**), or scan tracked files only, and name the offending PATH in the step evidence so a fixture-looking hit is diagnosable without a manual gitleaks report. Until then the durable workaround in any repo is to keep .gitreins/logs/ empty before a judge run.", "environment": "production", "language": "python", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "gitleaks-no-git-scans-ignored-state-dir-poisons-gate", "provider": "openrouter", "solved_at": "2026-09-16T18:31:48.099Z", "version": "0.13.0"}