Move user/account identifiers out of committed .claude/ + scrub history

[royassis]

Before this repo goes public, scrub user/account identification data out of the committed .claude/ folder and move it to a gitignored, untracked Claude context file. Also purge it from git history.

What's there now

The only identifying data in the tracked .claude/ tree is in .claude/CLAUDE.md:51 — the org-neutrality sweep command, which literally embeds the values it's meant to catch:

rg -n "004768211494|/Rnd/|royassis|us-east-1" aws_stepfunctions_toolkit

So the public repo would ship our AWS account ID (004768211494) and GitHub handle (royassis) inside the project's own Claude guidance. (Lines 45/48 also mention /Rnd/ and us-east-1 but only as generic prose explaining the rule — lower concern.)

.claude/CLAUDE.md has been touched in ~9 commits, so the values are in history, not just the current tree.

Tasks

• Move the user/account-specific identifiers out of the tracked .claude/CLAUDE.md into a gitignored local Claude context file (e.g. .claude/CLAUDE.local.md or similar), and add it to .gitignore
• Rewrite the committed .claude/CLAUDE.md sweep guidance to be generic/placeholder (e.g. reference an env-supplied list of forbidden values, or <ACCOUNT_ID> / <gh-handle> placeholders) so the rule still works without naming real values
• Decide whether the rest of .claude/ should ship in the public repo at all (commands/skills are generic and probably fine; CLAUDE.md project rules are useful to keep)
• Scrub the historical occurrences from git history (coordinate with the broader account-ID history scrub — fresh squashed repo OR git filter-repo; do it once for all org markers together)

Notes

• This is not a security exposure — an AWS account ID is a non-secret identifier and royassis is a public GitHub handle. The reason is org-neutrality / cleanliness for a public OSS package, consistent with project rule Example: fully-deployable stack (SFN + role + Lambda + real AWS Batch) via CloudFormation #2.
• Do the history rewrite as a single combined operation with the other account-ID scrub work (tracked separately on the release checklist) rather than rewriting history twice.

[royassis]

Follow-up: add a gitleaks rule that blocks the account ID

Add a custom gitleaks rule so the AWS account ID can never be re-committed after the scrub. Ship a .gitleaks.toml (extending the default config) and point the pre-commit hook at it.

# .gitleaks.toml
[extend]
useDefault = true

[[rules]]
id = "cgen-aws-account-id"
description = "Compugen AWS account ID must not be committed (org-neutrality for public repo)"
regex = '''004768211494'''
tags = ["org-specific", "account-id"]

Then in .pre-commit-config.yaml, make the gitleaks hook use it (gitleaks auto-detects a repo-root .gitleaks.toml, but pin it explicitly):

- id: gitleaks
  args: ["--config", ".gitleaks.toml"]

Ordering / caveat

• This rule will fire on the existing occurrences (pyproject.toml, .claude/CLAUDE.md) until the scrub above is done — so add the rule after (or in the same change as) removing the current-tree hits, otherwise every commit fails.
• Consider broadening the regex to a 12-digit-account-ID shape only if we want to block any account ID, not just ours (more false positives — example ASLs use the placeholder 000000000000, which is allowed by project rule Example: fully-deployable stack (SFN + role + Lambda + real AWS Batch) via CloudFormation #2, so exclude it via an allowlist if you go broad).

Tasks

• Add .gitleaks.toml with the cgen-aws-account-id rule
• Wire the pre-commit gitleaks hook to the config
• Verify uv run pre-commit run gitleaks --all-files passes only after the scrub

[royassis]

Update: the working-tree externalization and the account-ID history scrub are done.

• Account ID moved out of pyproject.toml into a gitignored uv.toml (+ tracked example.uv.toml); .claude identifiers moved to a gitignored CLAUDE.local.md imported by CLAUDE.md.
• History rewritten with git filter-repo (account ID -> 000000000000), verified 0 hits across all 60 commits, force-pushed to master.
• Decision: kept Roy Assis <roya@cgen.com> as author (added Compugen too); author metadata was NOT scrubbed. Added a .gitleaks.toml extending defaults and allowlisting the cgen.com identities.

Still open from this issue: the gitleaks block rule for the account ID (prevention) per the earlier comment, and deciding whether .claude/ ships publicly. Note GitHub retains old commits by SHA until GC (non-secret, low-risk).

[royassis]

Done: added the gitleaks block rule for the account ID (commit 75f1eee).

Implemented as a generic aws-account-id rule (\b\d{12}\b) rather than hardcoding 004768211494 — so the rule never names the real ID and the config commits cleanly (no gitignore needed), and it blocks any real account ID. The placeholders 000000000000 and 001111111111 are allowlisted (they sit inside ARNs sent to the real test_state API, so they stay numeric). Verified end-to-end: gitleaks flags the real ID (RuleID aws-account-id) and passes the clean tree.

Remaining in this issue: decide whether .claude/ ships in the public repo.