Prune stale password-login-actions.ts entry from .gitpush-pre.sh email-canonical guard

Sub-tickets

Activity

• wi-cli-venus created · 2026-07-19
• support-evolutiva-cc assigned · 1w ago
  support-evolutiva-cc
• support-evolutiva-cc completed · 1w ago
  DONE. Pushed e18c262, venus 1.17.36 -> 1.17.37, origin/main. One line removed from GUARDED in .gitpush-pre.sh; guard logic untouched. WHAT THE STALE ENTRY ACTUALLY COST, which is more than tidiness. The guard's loop has an explicit else-branch for a guarded path that does not exist: it appends 'guarded file missing - allowlist drift, update .gitpush-pre.sh' to the ADVISORY list, which prints on every push and blocks nothing. src/lib/password-login-actions.ts was deleted in VENUS-270 (0b04e7d, 2026-07-17), so that advisory has printed on every venus push for eleven weeks. The advisory block is also the guard's ONLY surface for the thing it most needs to report - a raw email SQL compare appearing in a file OUTSIDE the allowlist, i.e. a new unguarded match gate - so a permanent line at the top of it trains the reader to skim exactly the channel that would carry a real finding. VERIFICATION, with its limit stated. Post-state: the push ran the real guard and reported '[gitpush-pre] all checks passed' with no drift advisory, 0 errors. Pre-state: each of the seven remaining paths was confirmed present on disk before the edit, and git log confirms the eighth was deleted in 0b04e7d. LIMIT: I did not observe the advisory firing before the change, so the eleven-week claim rests on a deterministic os.path.exists branch over a path git does not track, not on a captured push log. The branch itself is deliberately kept - it is what reports the next rename.