The public-surface gate refuses any tracked file carrying a URL with a
path outside .example, and 21d7f5a shipped two: the python.org Windows
downloads page and the Git for Windows download. Both are now named as
bare domains for the tester to search for, which the scanner allows and
which does not rot when a vendor moves a page.
The gate found this and I did not, for a reason worth recording: 21d7f5a
was verified while the file was still UNTRACKED, and that scan reads
`git ls-files`. The suite was genuinely green -- of a tree that did not
yet contain the file. Verify after `git add`, not before, whenever a gate
is scoped to tracked files.
Also states the rule in the operator section, so the links are not
restored as a courtesy later.
Verify: .venv/bin/python -m pytest tests/ -> 223 passed, exit 0, with the
file tracked. Scanner denominator 113 files / 609427 bytes, 0 findings;
the byte count moved with the edit, so the file is inside the scan.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Kjell Tore Guttormsen
9fa826c5ff