From fbeb63ba7923c1778c207d567de53548245f4a87 Mon Sep 17 00:00:00 2001
From: gramps <gramps@llamachile.shop>
Date: Fri, 9 Oct 2026 10:15:33 -0700
Subject: [PATCH] =?UTF-8?q?Docs:=20queue=20TASK=2056=20=E2=80=94=20pre-pub?=
 =?UTF-8?q?lication=20secret=20scan=20of=20the=20full=20git=20history=20(g?=
 =?UTF-8?q?ate=20before=20the=20repo=20goes=20public)=20(Unit:=20task=20ca?=
 =?UTF-8?q?talog)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 TASKS.md                     |  1 +
 TASKS/task-56-secret-scan.md | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 TASKS/task-56-secret-scan.md

diff --git a/TASKS.md b/TASKS.md
index 0071efc..caf4314 100644
--- a/TASKS.md
+++ b/TASKS.md
@@ -71,6 +71,7 @@
 | 53 | **Output-format verification: Shorts/TikTok geometry (9:16)** | ☐ Queued (2026-10-08) — output formats never tested end-to-end; pin + prove the vertical geometry | [`TASKS/task-53-output-formats.md`](TASKS/task-53-output-formats.md) |
 | 54 | **Marcom round: free-forever positioning + merch storefront** | 🔶 In progress — llamacasty.com copy live 2026-10-08 (pricing stripped); merch POD + app About links queued | [`TASKS/task-54-marcom-free-merch.md`](TASKS/task-54-marcom-free-merch.md) |
 | 55 | **Disk hygiene: log rotation + low-disk guard** | ☐ Queued (2026-10-09) — `startup.log` appears uncapped; also temp alert-clip cleanup + free-space check before recording | [`TASKS/task-55-disk-hygiene.md`](TASKS/task-55-disk-hygiene.md) |
+| 56 | **Pre-publication secret scan (full git history)** | ☐ Queued (2026-10-09) — gate before the Gitea repo goes public; report commit/path only, never values | [`TASKS/task-56-secret-scan.md`](TASKS/task-56-secret-scan.md) |
 
 ---
 
diff --git a/TASKS/task-56-secret-scan.md b/TASKS/task-56-secret-scan.md
new file mode 100644
index 0000000..1e17cf8
--- /dev/null
+++ b/TASKS/task-56-secret-scan.md
@@ -0,0 +1,23 @@
+# TASK 56 — Pre-publication secret scan of the full git history (queued 2026-10-09)
+
+> Catalog: [`TASKS.md`](../TASKS.md) — status and requirements live here.
+
+**Why:** the creator is switching the Gitea repo (`https://llgit.llamachile.tube/gramps/LlamaCasty`)
+to **public** (GPL-3.0-or-later release). The working tree is clean — `CREDENTIALS.md`,
+`MARCOM.md`, and `Helpers/OAuthCredentials.cs` are gitignored and were never committed — but every
+past commit becomes readable too. Anything ever committed by mistake would be exposed.
+
+**Gate:** do this BEFORE the repo is toggled public.
+
+**Slices:**
+
+1. ☐ **Scan every commit, every branch** for secret-shaped content: Google OAuth client secrets
+   (`GOCSPX-`), API keys / tokens (Polar OAT, `ghp_`, `AKIA`, private-key headers), passwords,
+   stream keys, and any once-tracked `CREDENTIALS.md` / `OAuthCredentials.cs`.
+   ⛔ **Report commit + path + rule only — never print a matched value** (see `MyMistakes.md` →
+   "NEVER PRINT CREDENTIALS.md"). A tool like gitleaks with `--redact`, or `git log -p` piped to a
+   counter, never to the screen.
+2. ☐ **If anything is found:** rotate that secret first (it's burned regardless), then decide with
+   the creator: rewrite history (`git filter-repo`) vs. accept the rotated value staying in history.
+3. ☐ Record the result (clean / what was rotated) here and in `HANDOFF.md`, then the creator flips
+   the repo public.