base-layer/configkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Propagate matched sensitivity with one work queue

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-02 17:33:44 +00:00
parent 34c3241dae
commit ebf98ffc62
5 changed files with 149 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docs/roadmap/remediation.md
View File

@@ -125,7 +125,16 @@ operation path solely to satisfy an ancestor check.
## Finding 3 — Sensitivity propagation rescans the whole collection quadratically
**Priority:** P2. **Status:** Open.
**Priority:** P2. **Status:** Complete.
Completion: matching edges and real dependencies now share one indexed work
queue. Candidate coordinates are registered once, newly reached historical
coordinates are registered on demand, and each trigger fires at most once;
classification no longer rebuilds closure in full-map passes. Conservative
historical masking is retained. The existing earlier-matched-value regression
is retained in this fix, and a cyclic rotation regression covers removed fields
and dependency-derived values. Focused sensitivity tests and
`./scripts/check.sh` passed.
**Code:** [secret classification](../../internal/engine/secret.go),
`classifySecretPathsWithEvidence`, working-tree lines 83–122; associated