Remove public Homebrew tap and Scoop bucket from code-fleet-watch denylist #700

New issue

Closed

opened 2026-07-30 17:59:48 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-07-30 17:59:48 +00:00

Owner

Outcome

Remove the Homebrew tap and Scoop bucket rules from the code-fleet-watch denylist. Both repositories are public distribution channels and must not produce product-policy findings.

Evidence

cli-guard#266 currently reports four findings under these aliases:

product:repo-homebrew-tap in README.md and docs/specgen-install.md
product:repo-scoop-bucket in README.md and docs/specgen-install.md

Those files correctly document the public installation URLs. The scanner is reporting its configured rules as designed. The denylist input is wrong.

Work

Remove the rules represented by product:repo-homebrew-tap and product:repo-scoop-bucket from the SSM-owned code-fleet-watch denylist.
Remove them entirely rather than adding repository or path exceptions.
Do not change the cli-guard installation documentation.
Provision the corrected denylist through the tracked code-fleet-watch-denylist Ward verb without printing decoded terms.
Run a complete code-fleet-watch sweep after the SSM update.

Acceptance

Neither alias exists in the effective denylist.
A complete sweep removes all four related findings from cli-guard#266.
No managed product-policy issue reports either alias.
Decoded denylist terms remain absent from tracked files, command arguments, logs, and Forgejo.

## Outcome Remove the Homebrew tap and Scoop bucket rules from the code-fleet-watch denylist. Both repositories are public distribution channels and must not produce product-policy findings. ## Evidence [cli-guard#266](https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/issues/266) currently reports four findings under these aliases: * `product:repo-homebrew-tap` in `README.md` and `docs/specgen-install.md` * `product:repo-scoop-bucket` in `README.md` and `docs/specgen-install.md` Those files correctly document the public installation URLs. The scanner is reporting its configured rules as designed. The denylist input is wrong. ## Work * Remove the rules represented by `product:repo-homebrew-tap` and `product:repo-scoop-bucket` from the SSM-owned code-fleet-watch denylist. * Remove them entirely rather than adding repository or path exceptions. * Do not change the cli-guard installation documentation. * Provision the corrected denylist through the tracked `code-fleet-watch-denylist` Ward verb without printing decoded terms. * Run a complete code-fleet-watch sweep after the SSM update. ## Acceptance * Neither alias exists in the effective denylist. * A complete sweep removes all four related findings from cli-guard#266. * No managed product-policy issue reports either alias. * Decoded denylist terms remain absent from tracked files, command arguments, logs, and Forgejo.

coilyco-ops added the

autonomy

live-collab

priority

labels

2026-07-30 17:59:49 +00:00

coilyco-ops added

priority

and removed

priority

labels

2026-08-05 10:25:58 +00:00

coilyco-ops referenced this issue

2026-08-14 06:40:46 +00:00

Retire code-fleet-watch #830

coilyco-ops commented

2026-08-14 06:53:36 +00:00

Author

Owner

Closing as superseded by #830. Retiring code-fleet-watch removes the denylist entirely, so there is no rule left to correct.

The underlying observation still stands and is worth recording: the Homebrew tap and Scoop bucket are public distribution channels, and any future scanner that treats their URLs as private terms will produce the same false findings.

Closing as superseded by #830. Retiring code-fleet-watch removes the denylist entirely, so there is no rule left to correct. The underlying observation still stands and is worth recording: the Homebrew tap and Scoop bucket are public distribution channels, and any future scanner that treats their URLs as private terms will produce the same false findings.

coilyco-ops closed this issue

2026-08-14 06:53:43 +00:00

coilyco-ops referenced this issue

2026-08-14 06:53:59 +00:00

Retire code-fleet-watch #830