Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- The size gate shall pass on main: allowlist entries equal current line counts (api/tests/test_rbac_permissions.py 1070, tests/helpers/api_client.py 854).
- When the gitleaks tracked-tree scan finds a leak, the CI log shall name RuleID, file and line for each finding, with secret values redacted, and the step shall still exit non-zero.
- If a tracked file holds a gitleaks finding, then it shall be removed or, when it is a test placeholder, made a non-secret placeholder; never added to a path-wide allowlist.

Pipeline 3801 (highway 16720f9): job 13857 size gate FAIL (two shrunk files); job 13856 gitleaks 'leaks found: 2' on the 7.98 MB tracked tree, log names no files.

TECHNICAL PROBLEMS: 1. stale ratchet baseline; 2. scanner output without locations.
SOLUTION DOMAINS: existing scripts/ci gates; gitleaks --report-path JSON with --redact (same as the history step).
ALTERNATIVES: report in CI [CHOSEN: names files on every future failure, no vm-1 scan]; run gitleaks on vm-1 [REJECTED: director's CI-only rule].

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #1053