grim7/14/2026, 12:02:26 AM

The run page hydrates its data client-side (the getRun GET server-fn), so the
SSR HTML carries no run data — a raw-HTML grep can't see a leak, and the old
smoke's 'powered by tripwire' footer grep would false-fail on a real deploy
(footer renders post-hydration).

The mechanical §10 leak proof belongs in run-access.test.ts over toPublicRunView
(the exact JSON the page fetches), where it runs every PR: a run that tuned
several rules — all five threshold keys (minDays, maxPerWindow, windowHours,
max, minLength) in the workflow snapshot AND echoed into raw evidence, plus the
ai-review raw trace — is projected to public and asserted to leak NONE of the
six tokens, with teeth (the same tokens are asserted PRESENT in the full
maintainer view, so a pass is never vacuous), plus snapshot === null.

smoke:deploy's run-page check no longer greps HTML; it asserts the page is
SERVED 200 to an anonymous request (the public-path allowlist holds). Badge
check unchanged. DEPLOY.md §5 step 5 points the leak invariant at the CI test.

Parent087580f