Reports are gitignored (.gitignore:94) but were swept into 17bdd08 —
even redacted they map secret types/locations for anyone with repo
access. Allowlists from the 2026-07-14 cso triage (75 findings → 0,
each class verified empirically): bare 40-hex git SHAs, gitflow-test
synthetic AWS fixture, presigned-URL key ids, expired GitHub image
JWTs, doc placeholders, IDE lock files, two prose literals. Converted
deprecated [allowlist] to [[allowlists]] (gitleaks 8.30 refuses the
mix). Makefile hint no longer suggests committing the reports.
Transcripts/file-history deliberately NOT path-allowlisted (BDR-057).
- Optional gate before agent dispatch: file in .claude/audits/external/
(PDF read directly), pasted PDF content / suggested AI prompt, or skip
- 30-day staleness check; normalized EXTERNAL FINDINGS block in shared
context; both dispatch prompts carry the data-not-instructions rule
(cross-check before bundling, never merge external score into /20 axes)
- Merge side: confirmed findings credited 'Confirmé par <tool>', refuted/
uncovered ones surfaced in §14 divergences; no report → §12 recommends
the free SORank extension; console summary line added
- STEP 0 collects user-confirmed CANONICAL NAP (LRN-032 zenquality:
duplicated-seed trap — source majority is not truth)
- Both dispatch prompts carry the canonical NAP + no-majority rule;
seo-analyzer spec forbids directional NAP fix without confirmation
- STEP 2 now emits .claude/audits/HUMAN-ACTIONS.md (checklist from §11)
and NAP-KIT.md (local business) in BOTH modes — audit-only runs leave
the user immediately actionable; /client-handover §4 consumes NAP-KIT
tokenstore remove/clear, fetch.sh forget dispatch, and a connect.sh wrapper
that sources ~/.claude/.env internally and runs from any project. /seo now
routes connect|accounts|forget before the audit flow; Makefile seo-connect
delegates to the wrapper. Labels are guarded to shell-safe ASCII (POSIX case,
whole-string, C-locale) as defense-in-depth; forget output states local
removal is not a Google-side revocation.
The seo-connect target ran connect.py without sourcing ~/.claude/.env, so
GOOGLE_OAUTH_CLIENT_ID/SECRET (documented to live there) never reached
os.environ — connect.py aborted telling the user to set what they had set.
Mirror fetch.sh's sourcing; add a regression lock.
config-protection.sh gates lib/tests/* as a guardrail dir; all 8 tasks
edit the engine test. Move it to lib/seo-data/seo-data.test.sh (co-located,
ungated) + extend the make test glob to discover lib/seo-data/*.test.sh.
Root-cause fix, no guardrail weakened. Chosen by user over per-edit bypass.
Model-switch re-review found 7 real defects, fixed before any code:
- fail-open contract now covers unexpected errors (403/5xx/DNS/timeout)
via top-level try/except -> degraded JSON, exit 0 (was: traceback+exit 1)
- test isolation: SEO_DATA_ENV_FILE override so tests never source the
real vault (degrade tests would hit network on machines with live keys)
- CrUX: None-safe normalizer (missing INP on low-traffic sites) +
origin-level fallback on page-level 404
- refresh errors split token_revoked (RefreshError) vs network_error
- fixed set-u STORE_MISSING ordering bug in Task 4 test
- Makefile read -p bashism wrapped in bash -c (dash-safe)
- SKILL.md fetch path -> ~/.claude/lib/... (skills run from project dir)
- spec/plan aligned: label not email in accounts output, ok+[] not
'empty', CrUX history -> YAGNI v2, PageSpeed-key routing rejected v1
(key would enter subagent context)
Transient design spec for a Google Search Console + CrUX data layer
feeding /seo (+/geo) FULL audits: isolated lib/seo-data engine (Python
venv), OAuth one-shot multi-account (label-keyed token store, scope
webmasters.readonly), per-call account/property isolation, graceful
degradation to anonymous PageSpeed, gitleaks allowlist for the store.
To be removed once the feature is shipped, documented and capitalized.
commit-changer committed code autonomously with no branch precondition
(gitflow-conformity §2a, verified MEDIUM CONFIRMED) — on develop/main it
attempted a direct code commit, backstopped only by the pre-commit hook.
Adds Phase 0: the same `gitflow-aiguillage.md` mechanism hotfixer/bugfixer/
feater already use (TYPE=chore) — branches to chore/* on a protected base,
no-op on a working branch — plus a report-only fallback (no develop / no
lib -> ask human, don't auto-branch). Commit-plan gate + scoped staging
untouched. SKILL.md pre-flight notes the aiguillage.
Dry-run (throwaway repos, REAL lib + REAL pre-commit hook) — both paths:
CASE 1 on develop: aiguillage -> chore/commit-pending, code commit
SUCCEEDS, hook never blocks; contrast: same commit direct on develop
is BLOCKED -> aiguillage is what avoids it. PASS
CASE 2 no develop: fallback -> no auto-branch, changes uncommitted,
no chore/* created, ask human. PASS
STEP 5 previously ran `git push origin "$CURRENT_BRANCH"` autonomously
after the fix loops (gitflow-conformity §2b, verified HIGH). Now:
- gitflow precondition: no develop / no lib -> skip commit+push, note in
summary (report-only fallback).
- push gated behind an explicit-GO AskUserQuestion (A push / B defer)
BEFORE the push; red-flag STOP on push without GO / finish / merge.
Core untouched: SEO/GEO/HARDEN/VALIDATE loops, scoring, doc + PDF branding.
Dry-run (throwaway repos) — both sides of each fallback:
CASE 1 report-only (no develop): DEVELOP_OK=no -> NO commit/push. PASS
CASE 2 gate answer A: -> RUN git push origin feature/handover. PASS
CASE 3 gate answer B: -> SKIP, push deferred; HEAD unchanged. PASS
Bastien Chanot