publish-readinesslisted

# publish-readiness The gate between a private repo and a public one. Working-tree scans catch today's leaks; history is where leaks hide. Verdict at the end: **ship** or **fix first**, with exact commands. ## The checklist Run every check. Report each as pass/fail with evidence. ### 1. Working tree scan Search tracked files for: - Secrets: API keys, tokens, passwords, private keys (`grep -rE` for common prefixes like `AKIA`, `ghp_`, `sk-`, `AIza`, `-----BEGIN`, plus `password\s*=`) - Private IPs: RFC 1918 ranges (`10\.`, `172\.(1[6-9]|2[0-9]|3[01])\.`, `192\.168\.`). Docs and examples should use RFC 5737 (`192.0.2.x`, `198.51.100.x`, `203.0.113.x`) or RFC 2544 (`198.18.0.0/15`) ranges instead. - Internal hostnames, machine names, LAN service URLs, personal email addresses that are not the public git identity - Agent session dirs accidentally tracked: `.claude/`, `.codex/`, memory handoffs, transcripts A policy-driven scanner beats ad hoc grep. Install `brigade-cli` with `pipx install brigade-cli`. The pre-push hook calls `brigade guard git`. Scan only tracked files (`git ls-files`), not `node_modules/`. ### 2. History scan The tree being clean means nothing if a secret was committed and later deleted: ```bash git log --all -p | grep -nE '<patterns from check 1>' git log --all --pretty=format:'%s%n%b' | grep -nE '<same>' # commit messages too ``` ### 3. Hygiene - LICENSE present and intentional - README states what/why/how-to-run; no dead internal links or references