From 7dfb41bf12a35d3a4872b5a0b0099a17e476dad0 Mon Sep 17 00:00:00 2001
From: Val Vladescu <valentin@vvladescu.com>
Date: Wed, 8 Apr 2026 15:53:35 +0300
Subject: [PATCH 1/3] ci: add docs CI workflow (link check + leak guard)

---
 .github/workflows/ci.yml | 47 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..b345dc4
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,47 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  links:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Lychee link check
+        uses: lycheeverse/lychee-action@v2
+        with:
+          args: >-
+            --no-progress
+            --exclude-mail
+            --exclude-loopback
+            --max-redirects 5
+            --accept '200..=204,206,301..=308,403,429'
+            --exclude 'sonarcloud.io'
+            './**/*.md'
+          fail: true
+
+  leak-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Scan for accidental leaks
+        shell: bash
+        run: |
+          set -e
+          # Excludes:
+          # - workflows dir (regex literals would self-match)
+          # - paper.md (intentional author byline)
+          # - bench/v2/results/* (raw LLM trajectories — sanitized in #11
+          #   but still under monitoring)
+          PATTERN='UNKNOWN @ file://|/home/[a-z][a-z0-9_-]+/(orchestrator|models)/|sk-ant-api03-[A-Za-z0-9_-]{20,}|sk-proj-[A-Za-z0-9_-]{20,}|BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY'
+          if git ls-files \
+             | grep -vE '^\.github/workflows/' \
+             | grep -vE '^paper\.md$' \
+             | xargs -r grep -EHn "$PATTERN" 2>/dev/null; then
+            echo "::error::Leak guard found suspicious patterns above"
+            exit 1
+          fi
+          echo "Leak guard clean"

From e81b3eea725b278135b3bb86425603a245a72279 Mon Sep 17 00:00:00 2001
From: Val Vladescu <valentin@vvladescu.com>
Date: Wed, 8 Apr 2026 15:57:10 +0300
Subject: [PATCH 2/3] ci: drop --exclude-mail (removed in lychee v2) + tighten
 PRIVATE KEY regex

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b345dc4..47cbbba 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ jobs:
         with:
           args: >-
             --no-progress
-            --exclude-mail
+            
             --exclude-loopback
             --max-redirects 5
             --accept '200..=204,206,301..=308,403,429'
@@ -36,7 +36,7 @@ jobs:
           # - paper.md (intentional author byline)
           # - bench/v2/results/* (raw LLM trajectories — sanitized in #11
           #   but still under monitoring)
-          PATTERN='UNKNOWN @ file://|/home/[a-z][a-z0-9_-]+/(orchestrator|models)/|sk-ant-api03-[A-Za-z0-9_-]{20,}|sk-proj-[A-Za-z0-9_-]{20,}|BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY'
+          PATTERN='UNKNOWN @ file://|/home/[a-z][a-z0-9_-]+/(orchestrator|models)/|sk-ant-api03-[A-Za-z0-9_-]{20,}|sk-proj-[A-Za-z0-9_-]{20,}|-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----'
           if git ls-files \
              | grep -vE '^\.github/workflows/' \
              | grep -vE '^paper\.md$' \

From 17c9f8899ca08c3fd6e95cbb3ff6a00883f1ef6c Mon Sep 17 00:00:00 2001
From: Val Vladescu <valentin@vvladescu.com>
Date: Wed, 8 Apr 2026 15:59:53 +0300
Subject: [PATCH 3/3] ci(links): exclude github.com/zenprocess/switchyard
 (private repo, 404 to unauth)

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 47cbbba..2c8c3b9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,7 @@ jobs:
             --exclude-loopback
             --max-redirects 5
             --accept '200..=204,206,301..=308,403,429'
+            --exclude 'github.com/zenprocess/switchyard'
             --exclude 'sonarcloud.io'
             './**/*.md'
           fail: true