Three corrections to a document whose measurements were right.
The "shapes commons reports and the guard is silent on" row said 6 across 4
commons entries. Re-derived from the differential rather than from the table:
7 witnesses across 5 entries. The old figure collapsed the two webhook hosts
into one row while keeping the two GitHub prefixes as two, so it was
inconsistent with itself, and it dropped GitHub Token from the entry count
even though two of its five prefixes are exactly what the guard misses. The
table now runs one row per witness and says why counting either way alone
misleads.
The mapping row for connection strings said "minus one scheme". The section
below it already said the right thing: commons catches mongodb:// and misses
the SRV form. Aligned.
The "seed B was read at a commit the guard did not port from" caveat is gone,
replaced by the measurement that dissolves it. knowledge/secrets-patterns.md
has one commit at or before 47905da - f153f96, 2026-04-08 - and the guard's
output.py was first committed 2026-07-04. The seed had been still for three
months when the port was written. The 5 real drifts are guard-side by
measurement now, not by inference.
Neither coord message carried the bad count, so nothing needs re-sending.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UFforUbBA7GnUYijg78kpK
The open question was recorded as "19 entries here against the guard's 25,
cut at different granularity". Measured at a pinned tag, that premise does
not hold: commons ported llm-security's `hooks/scripts/pre-edit-secrets.mjs`
(19 entries, name + pattern only), the guard ported its
`knowledge/secrets-patterns.md` (33 entries, ids + severity + FP notes) and
took 25 of them. Two seeds, not two cuts.
The guard's docstring asserting the second seed was not relayed - the file
was read at the pinned commit and all 25 guard ids are in it verbatim.
Beyond the count, three things a membership table would have hidden:
- Match semantics disagree. Commons declares first-match-wins with normative
ordering and a load-bearing last entry; the guard reports every match. One
Bearer-plus-JWT witness: one label vs two.
- Only 2 of 19 patterns are byte-identical across the two sides. The pair
earlier called the clean 1:1 (AWS access key) is not one of them.
- The guard suppresses placeholder and variable-reference values; commons has
no field that could carry that, because its seed carries none.
Membership diverges both ways and neither port is at fault - the seeds
disagree. Reported, not fixed, per the behaviour-preservation invariant.
No id is proposed: that is the carrier rule, and both runtimes are asked
first. manifest.json is untouched.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UFforUbBA7GnUYijg78kpK
