First ticket in this repo's vault, so the changelog files are new. Committed
because the database is gitignored and the changelog is what makes a ticket
travel with a clone (workspace D-15); uncommitted, this ticket would exist only
on one machine.
The bug itself: .gitignore has listed .claude/settings.local.json since it was
added, and line 130 even carries the git rm --cached command, but gitignore does
not apply to paths git already tracks — so the rule has been inert the whole
time. This is the only repo in the workspace where that file is tracked.
No credentials were ever committed; both existing versions hold four permission
rules and no env keys, checked per commit rather than only at HEAD. The ticket
records that explicitly, because a previous survey misread this same file as
credentials across nine repos and the correction is worth keeping attached to it.
Not fixing it here. The four rules allow browser-automation MCP tools, and
untracking silently removes them from every clone — whether they are personal or
belong in the committed settings.json is a judgement about how people work in
this repo, not something to decide while filing.
Co-Authored-By: Claude <noreply@anthropic.com>
Commits a .claude/settings.json rather than leaving permissions to
per-developer local state, and initialises a pql vault for this repo's
tickets and internal decisions.
Every git deny rule appears in both the `git <verb>` and `git * <verb>`
forms. Only the second catches `git -C <path>`, and without it the whole
deny list is decorative -- it looks like a policy and stops nothing.
The allow list carries pql's absolute path alongside the bare name.
pql is installed to ~/.local/bin, which is on the login PATH but not the
one a non-interactive shell gets, so the bare-name rules match nothing on
their own and every call would prompt anyway.
.gitignore now covers .claude/settings.local.json, which is machine-local
and must never be shared. `pql init` contributed the .pql/* rules with an
exception for the changelog, which is the replication log of record and
has to be committed for tickets to travel with a clone.
Co-Authored-By: Claude <noreply@anthropic.com>
jpmschweitzerandClaude