m038andClaude Opus 4.8
6dc6af6359
The prior model claimed git-sync's add-set is scoped to the configured `folders` (pages/config/themes), so accounts/ and user/env/ were "safe by construction." That was wrong: prod auto-commit 9337003 pushed the whole user/env/<host>/config tree (JWT secret, CSRF salt, git-sync token + webhook secret), accounts/mischa.yaml, and system.yaml to Gitea — all outside the configured folders. git-sync stages everything under user/ not gitignored; .gitignore is the only reliable exclusion. - Rewrite the architecture-patterns doc around the corrected predicate and document the incident + remediation (gitignore /env/, rotate token+webhook). - Correct git-sync-notes.md: env/ is NOT safe on folder scope; drop the "never reaches Gitea" claim; fix the secret-files table intro + add /env/. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Np4cMQLF77i664CAQXySzU
docs/
If you're Mischa
Doing something operational? → guides/
- Posting a journal entry
- Managing GPX files
- Switching to a new trip
- Rebuilding local dev from scratch
Checking project status? → working/
Design or architecture decisions? → reference/
If you're Claude
Always-loaded project rules → CLAUDE.md (repo root)
Active specs and plans → working/specs/ and working/plans/
Stable facts → reference/
Raw research input → research/