fix(docs): remove leaked deployment values from sidecar worked example (lr-f1e995)

[clagentic-builder]

What

Rewrites the Worked example block in docs/SIDECAR-READ-CONTRACT.md (added by lr-61cc4a, PR #21) to remove leaked local/retired deployment values and to stop framing the example as citing Gatekeeper own deployed configuration as a concrete instance.

Why

The worked example embedded two values that never belonged in a public doc:

• file_prefix: crew-agent-spawn- -- a RETIRED prefix (pre-lr-6fd8f4); factually wrong for any current deployment. The live prefix is subagent-.
• session_id_env: CREW_SPAWN_AGENT_ID -- a local harness environment variable name, not a general contract value.

Root cause (per lr-f1e995 / lr-1cd33c thread): the dispatching spec for lr-61cc4a instructed citing Gatekeeper deployed config block as the worked example -- i.e. instructed copying local config into a public doc. That is a spec defect, not a one-off typo, so this PR also neutralizes the surrounding prose that framed the example as one concrete deployed instance, in favor of reference-implementation-only, placeholder values only.

The spawn-scoped entry dir/file_prefix/session_id_env are now the same placeholder style already used in docs/SETUP.md around lines 225-236. The session-scoped entry prose no longer asserts it reflects Gatekeeper actual deployed config -- section 7 lore-agent-name- note is preserved as a conditional statement, since that prefix genuinely is not renameable per section 7, but the doc no longer claims this is what Gatekeeper actually runs.

docs/SETUP.md and config.example.yaml are untouched; both are out of scope for this task.

Test plan

• make check (go vet + go test ./...) -- all packages pass; docs-only change, no Go source touched.
• Manual read-through of the worked-example section post-edit to confirm no remaining references to crew-agent-spawn- or CREW_SPAWN_AGENT_ID.

Task: lr-f1e995 (P1 bug). Cross-ref: lr-61cc4a (PR #21, introduced the defect this fixes).

Tests: passed (go vet and go test ./... via make check).

[clagentic-security]

BOBBIE -- clean

Reviewed diff for #22 (base 05279d6 -> head e15581a), scope base..head, single file docs/SIDECAR-READ-CONTRACT.md.

The PR removes two previously-leaked deployment-specific values from the Worked example section: a directory/prefix pairing (dir: /tmp, file_prefix: crew-agent-spawn-, session_id_env: CREW_SPAWN_AGENT_ID) and a session-scope entry (file_prefix: lore-agent-name-, session_id_env: CLAUDE_CODE_SESSION_ID), replacing them with generic angle-bracket placeholders (

, <file_prefix>, <SPAWN_IDENTITY_ENV>, <SESSION_IDENTITY_ENV>). Accompanying prose that asserted these were Gatekeeper own currently deployed configuration values is also removed, eliminating the deployment-specific claim rather than just the literal strings.

Verified: none of the removed literal values (/tmp path use as a deployment claim, crew-agent-spawn-, CREW_SPAWN_AGENT_ID, lore-agent-name-, CLAUDE_CODE_SESSION_ID) reappear in any added line of the diff. No new secret, credential, token, or real deployment value is introduced. This is a documentation-only change; no reachable code sink. gitleaks (working tree, no-git mode) and semgrep --config=auto both ran clean on the changed file.

Findings: none. Removal is complete.

{"reviewer": "bobbie", "review_status": "clean", "head_sha": "e15581a7540ca62885f9544503a1121ff1cd8168", "pr_number": 22}

[clagentic-reviewer]

PEACHES — clean (0 nits)

Scope verified: docs/SIDECAR-READ-CONTRACT.md single-file change, task lr-f1e995

Review focus findings:

• Retired deployment values eliminated: crew-agent-spawn-, CREW_SPAWN_AGENT_ID, CLAUDE_CODE_SESSION_ID, hardcoded /tmp paths fully removed from worked example
• Placeholder style consistent: <dir>, <file_prefix>, <SPAWN_IDENTITY_ENV>, <SESSION_IDENTITY_ENV> align with SETUP.md:225–236
• Prose neutralized: line 174–176 explicitly states config values are placeholders, not actual deployment; multi-paragraph deployment mismatch note removed
• Cross-references intact: section refs accurate, implementation pointer unchanged

No code-craft issues. Remediation complete and minimal.

{"reviewer": "peaches", "review_status": "clean", "head_sha": "e15581a7540ca62885f9544503a1121ff1cd8168", "pr_number": 22}

[clagentic-security]

Re-audit of PR #22 at head c892595 (base 05279d6, 5 files, +40/-40).

Scope: cmd/gatekeeper/main_test.go, config.example.yaml, docs/SIDECAR-READ-CONTRACT.md, internal/attestation/chain_test.go, internal/config/config_test.go.

Verified:

• gitleaks detect (no-git, full source): no leaks found.
• semgrep --config=auto: 2 findings, both pre-existing in .github/workflows/ci.yml, outside this diff — not attributable to this PR.
• osv-scanner: 25 Go stdlib advisories tied to go.mod toolchain version, pre-existing, unrelated to this diff.
• trufflehog: unavailable in this environment (binary not found) — recorded as scanner_status unavailable, judgment-only coverage applied in its place.
• Repo-wide search (git-tracked + working tree) at head c892595 for retired token crew-agent-spawn- and local harness var CREW_SPAWN_AGENT_ID: zero occurrences remain repo-wide. Removal is complete.

Replacement values (spawn-, MY_HARNESS_SPAWN_ID,

/<file_prefix>/<SPAWN_IDENTITY_ENV>/<SESSION_IDENTITY_ENV>) are neutral/fictional placeholders, not credential-shaped, and carry no exposure.

Fixture renames (chain_test.go, main_test.go, config_test.go): path literals, FilePrefix fields, and assertion strings were moved together consistently. All fixture file paths are built under Go t.TempDir() (ephemeral, test-scoped) via filepath.Join with simple string literals — no path traversal, no injection surface introduced by the rename.

docs/SIDECAR-READ-CONTRACT.md worked example now uses only

/<file_prefix>/<...ENV> angle-bracket placeholders, removing the prior concrete deployed-config citation entirely — consistent with the neutral-placeholder style already used elsewhere in the doc set.

No new secret, credential, or real deployment value introduced by this PR. No blocking findings.

{"reviewer": "bobbie", "review_status": "clean", "head_sha": "c892595cfe2b3010a150f7a9a7202b580b5dbe10", "pr_number": 22}

[clagentic-reviewer]

PEACHES — clean (all scope requirements met)

Re-review of extended PR #22 at head c892595 (task lr-f1e995 scope amendment, P1).

Summary: All fixture renames are internally consistent. Retired prefix crew-agent-spawn- and CREW_SPAWN_AGENT_ID are completely removed repo-wide. Replacement values (spawn-, MY_HARNESS_SPAWN_ID) are neutral/fictional and explicitly marked in config.example.yaml comment. Documentation updated to clearly state worked example values are illustrative placeholders only, not deployed configuration. No real deployment values remain.

Checked:

• cmd/gatekeeper/main_test.go: path literals, FilePrefix, session_id_env, assertions all consistent across lines 323, 349
• internal/attestation/chain_test.go: fixtures (spawn-spawn-9, spawn-spawn-10) and FilePrefix values consistent across 4 test functions
• internal/config/config_test.go: YAML config, FilePrefix field, and assertion error messages all expect spawn- prefix
• config.example.yaml: replaced crew-agent-spawn- with spawn-, CREW_SPAWN_AGENT_ID with MY_HARNESS_SPAWN_ID; comment clarified as fictional example
• docs/SIDECAR-READ-CONTRACT.md: worked example rewritten to style; docstring clarified; no cross-ref regressions
• amos.code-craft: minimal change (fixture renames necessary), no hardcoded secrets/hosts/paths remain

No findings.

{"reviewer": "peaches", "review_status": "clean", "head_sha": "c892595cfe2b3010a150f7a9a7202b580b5dbe10", "pr_number": 22}

[clagentic-merger]

Merged via clagentic-loadout v0.1.0

Field	Value
Gated HEAD SHA	c892595cfe2b3010a150f7a9a7202b580b5dbe10
Merged SHA	c892595cfe2b3010a150f7a9a7202b580b5dbe10
Reviews	clagentic-reviewer[bot], clagentic-security[bot]
CI status	no-runner-by-design (0 commit-status entries at HEAD)
task_id	lr-f1e995