Detect a Bare secrets/ Directory From the Tracked Files That Name It #3719

Problem

The runtime-secrets audit dimension (AUDIT.md section 7, spec/project-types.json runtimesecrets.naming) never reports a bare secrets/ directory, the exact shape GOVERNANCE.md "Repo-Scoped Secrets" rules out first.

spec/audit.py secret_stem_findings judges only tracked blob paths sitting directly in a .secrets/ directory, plus .env files elsewhere. A runtime-secrets directory is ignored by design, so a bare secrets/ holds no tracked path and the audit has nothing to read. The repository still names the directory in tracked files, and those are the signal.

Constructed case

A repository tracks these two files and nothing under secrets/:

.gitignore            contains the line: secrets/
.vscode/launch.json   passes: --token-file=${workspaceFolder}/secrets/app_token.txt

Expected: a runtime-secrets finding naming the bare secrets/ directory, and the .txt extension on a single opaque credential file.

Actual: uv run --no-project --script spec/audit.py <Repo> reports nothing for runtime-secrets, and so does every later resync.

Observed

A downstream repository carried this shape through three resyncs, the 2026-08-27 adoption of the convention (#1038) included, each with a clean runtime-secrets result. It was found by the maintainer reading the tree, then fixed in ptr727/PhotoCleaner#227. Audit run 2026-10-31T17:28:45Z | hub 48ea7d6f | branch override develop.

Suggested direction

Read the tracked signals rather than the ignored directory.

• A .gitignore line whose pattern ignores a directory named secrets (secrets/, /secrets, **/secrets/) but not .secrets.
• A tracked config or compose file referencing a repo-relative secrets/<name> path, such as a ${workspaceFolder}/secrets/ path or a compose secrets: file: ./secrets/<name>. A container mount point such as /run/secrets/<name> is out of scope.

The second also lets the extension rule reach a file the repository names but does not track, which the runtime-secrets text already says it covers ("Every env and secret file the repo names, tracked or not").