authentication.md: cite Gitleaks staged and history scanning behind the secret-scan Verify step (TODO 1.295)

CHANGELOG.md

@@ -12,6 +12,7 @@ service can change a gate's answer, and a pull request number is only knowable f
 
 ## 2026-10-19
 
+- `authentication.md`: the secret-scan Verify step now cites Gitleaks v8.30.1's staged and pre-commit flags (which switch it to scanning `git diff`) and its `--log-opts` option over `git log -p` history, so the instruction to verify staged, all-ref and merge-commit coverage with the chosen scanner and configuration rests on cited behaviour; the claim keeps the limits of the supplementary `git log` search; rule 15 now says the cited protocol sources do not establish that an HTML login protects those endpoints; TODO row 1.295 moves to DONE (#698)
 - `agent-builders.md`: the Dify plugin debug-permission remedy now cites the pinned console web code that reads and writes the setting, alongside the API remedy already cited; which roles can reach it and where the console shows it stay open under TODO row 1.283 (#695)
 - Twenty more guides move to the two-section layout (maintainer request, 2026-10-18), with each guide's own tool named first in its header; `workflow-orchestrators.md`, already in the layout, now lists Temporal, Flower and Argo with its other headline tools in its header; no guide body or digest changes. Guides: `host.md`, `cloud-firewalls.md`, `egress-metadata.md`, `cloudflare.md`, `tunnels.md`, `tailscale.md`, `cloud-identity-proxies.md`, `fronting-auth.md`, `mfa.md`, `identity-providers.md`, `oidc-integration.md`, `self-hosted-idp.md`, `secrets.md`, `machine-auth.md`, `connection-poolers.md`, `neo4j.md`, `surrealdb.md`, `nodejs.md`, `go.md`, `java.md` (#697)
 - `authentication.md`: the transport-authentication rule now labels its requirements (authenticate and check each of WebSockets, SSE, GraphQL, gRPC, webhooks, inference and management APIs on its own, not through the HTML login; verify webhook signatures and reject replays) as this guide's, keeps the Stripe signature and timestamp citations, and states that the HTML-login boundary, GraphQL, inference and management API coverage, and replay rejection beyond those checks are not established by the cited sources; those parts stay open under TODO row 1.294 (#696)

DONE.md

@@ -10,6 +10,7 @@ because an item that simply vanishes gets proposed again six months later.
 
 | ID | Item | Ended |
 | --- | --- | --- |
+| 1.295 | `authentication.md`: verify-secret-scan: source or narrow staged, all-ref and merge-commit coverage beyond the cited Gitleaks and `git log -p` material. (M, M) | Done, #698. Pinned the Gitleaks v8.30.1 cmd/git.go staged and pre-commit git-diff flags, the README log-opts pass-through and Git v2.56.0 --all and merge-diff rules, keeping the coverage-verification instruction and labelling what those lines do not establish. |
 | 1.283 | `agent-builders.md`: debug-remedy: establish whether the debug_permission change is available in the console UI; API remedy is already cited and UI availability is unestablished. (M, M) | Done, #695. Cited, at the pinned console commit, the console UI read and write of both plugin permissions through the permission fetch and change endpoints, the payload type that pairs install_permission with debug_permission and allows everyone/admins/noone, and the canSetPermissions flag (RBAC off plus the plugin.plugin_preferences key) that the settings-access hook returns beside the write; which roles hold that key and where the console renders the control stay open in TODO.md under the same ID. |
 | 1.294 | `authentication.md`: transport-authentication: qualify the transport checks, HTML-login boundary and webhook replay requirement. (M, M) | Done, #696. Labelled the requirements and source limits, retained the Stripe signature and timestamp citations, and shortened the claim; evidence for the HTML-login boundary, GraphQL/inference/management coverage and comprehensive replay rejection remains open in TODO.md under 1.294. |
 | 1.293 | `authentication.md`: fail2ban: source or narrow the coverage and setup of login panels beyond the cited sshd jail and failure filter. (M, M) | Done, #694. Cited fail2ban 1.1.1 nginx HTTP-auth and Webmin jails and filter patterns, retained the SSH requirement, and labelled log-selection advice and the limits on panel coverage and setup ease. |

TODO.md

@@ -61,7 +61,6 @@ A real surface the guide never covers. Correct as far as it goes, and not far en
 | 1.290 | `firebase-supabase.md`: local-guards: establish the unrecorded bash and other tool/parser versions for the historical authoring guard and syntax runs; the ShellCheck v0.11.0 release is cited, but does not attest to the historical host binary. (M, M) | `[gap]` |
 | 1.291 | `pocketbase.md`: source-limits, remaining dependency gap: trace how utopia-php/database matches requester roles against stored collection/document permissions (including documentSecurity) for document reads and what the disabled default authorization status bypasses; the Appwrite-repository call sites, PocketBase CLI wrapper and `--dev` default are cited. (M, M) | `[gap]` |
 | 1.294 | `authentication.md`: transport-authentication, remaining source gaps: establish the HTML-login boundary for non-HTTP transports and authentication coverage for GraphQL, inference and management APIs; establish comprehensive webhook replay rejection beyond signature and timestamp-tolerance checks, including repeats within the accepted window. These remain guide requirements, not established deployment behaviour. (M, M) | `[gap]` |
-| 1.295 | `authentication.md`: verify-secret-scan: source or narrow staged, all-ref and merge-commit coverage beyond the cited Gitleaks and `git log -p` material. (M, M) | `[gap]` |
 | 1.296 | `docker.md`: secrets: source runtime secret-delivery methods and `.env` exclusion from Git beyond the cited Docker build/history behaviour. (M, M) | `[gap]` |
 | 1.297 | `elasticsearch.md`: os-gcs-azure: establish deployed GCS/Azure client-side encryption applicability and minimum versions beyond the cited OpenSearch plugin tree. (M, M) | `[gap]` |
 | 1.298 | `machine-auth.md`: key-hash: cite an API-key hash implementation covering algorithm, encoding, comparison and key-generation entropy. (M, M) | `[gap]` |

VERSION

@@ -1 +1 @@
-1.0.697
+1.0.698