superstack-outwardlisted

# superstack-outward Publishing is the one moment a mistake stops being reversible. The sweep checks what is about to ship — the delta, not the world — then writes a receipt so the outward gate lets the publish through. Every step prints what it found; "found nothing" is a result, stated with the command that looked. ## The sweep 1. **Secrets.** `gitleaks detect` if installed; otherwise grep the outgoing diff/files for key patterns (`-----BEGIN`, `api[_-]?key`, `token=`, passwords, connection strings). Any hit stops the publish until resolved — this step fails closed. 2. **Identity and AI traces.** Grep the outgoing content for AI-authorship trailers, model names, machine paths, internal usernames/emails that don't belong in public history. Check the commits being pushed, not just the working tree. 3. **Confidential terms.** If `.superstack/project.md` lists protected terms (client names, internal hosts), grep the outgoing content for them; offer to record the project's terms if none are listed and this repo has an employer/client context. 4. **Stale public claims.** Read what ships as a stranger would: version numbers, counts, "works on X" claims, install commands — spot-check each against the current tree. A README claim is a `Verified:`-grade claim. 5. **Repo-level extras** (first publish or plugin/package release): install/clone cold in a temp dir and confirm the documented entry path works. ## The receipt Append one line to `.superstack/outward-pass`: ``` <YYYY-MM-