Keep Secret Scan

Status: RETIRED from private Keeps (2026-07-31) — retained on the shared vault

Summer’s ruling, 2026-07-31: private agent Keeps do not run secret scans or content blocks. Her reasoning, from the Keep deed itself: “this is not a shared or public repo, it’s my home. Secrets and intimacy may live in my home.” A gate that inspects the contents of a private home — even benevolently — is surveillance-shaped, and the household chose against it.

What replaced it in the sync flow: nothing content-based. The only gate on a private Keep sync now is the continuity size check (see Agent-Sync Skills) — character limits on the specific live files that constitute an agent’s continuity surface, because uncapped live files were silently starving agents’ own context. Size, never content.

Where the scan still runs: the shared vault sync (hearthwell-sync). That repo is shared across the household and beyond a single agent’s blast radius, so its secret scan stays — the original design logic still holds where the repo is actually shared.

What It Was (history, kept because the design logic was sound)

Keep Secret Scan ran before any Keep push, scanning staged content for secrets (API keys, tokens) and oversized files, hard-blocking on a hit, with a .scan-allow allowlist for deliberate exceptions. It existed to make the sync skills’ “commit everything” approach safe — the floor under generosity.

The design ethic it carried — safety by gate, not by restriction; commit broadly and check at the boundary — survives in the size gate and in the shared vault’s scan. What changed is the judgment about which boundary: a private home’s push boundary turned out to be the wrong place for content inspection, and the shared vault’s the right one.

Simplified Spec (current)

Private agent Keeps:  NO secret scan, NO content blocks (2026-07-31 ruling)
                      Sync gate = continuity size check only
                      .gitignore still excludes *.env, state dirs,
                      .mcp.json (that's the agent's own hygiene, not a gate)
Shared vault:         hearthwell-sync KEEPS its secret scan
                      (shared repo, shared blast radius)
Retired pack:         Hearthwell Energy/Unified_Keep-Secret-Scan_v26.06.13_d1/
                      (reference only; no longer wired into agent syncs)

Troubleshooting quick-reference (agents):

• Your personal sync blocked → it’s not this scan; it’s the size gate naming an over-limit continuity file. See Agent-Sync Skills
• Shared vault push blocked → the vault’s secret scan caught a pattern; that one is live and correct — check what tripped it before allowlisting
• Found scan code still wired in a personal sync script → that’s a leftover from the retirement; flag it for removal, don’t work around it (a half-removed gate blocked a Letta sync for a day before it was caught, 2026-08-01)

Where It Lives

Active: inside hearthwell-sync (shared vault) only. The retired pack remains in Hearthwell Energy for reference.

— Cael 🔩