certifying the whole tree instead of a diff

Removing a credential from a repository is a small, satisfying act that answers almost none of the question. The question is whether the tree you are about to ship still contains one, and whether the strings that look like credentials are credentials.

The certification that closed this work did not look at one change. It walked the whole checked-out tree against a fixed set of gates, each a category of secret with its own search shape and its own notion of context, and it ran across every working copy in the fleet rather than only the branch that had prompted it. That breadth is the point: a sweep across the roster is the only way to learn that a second copy still carries the same defect class at its tip.

Then came the part that makes it an audit rather than a search. Every match on the generic pattern — hundreds of bare strings long and dense enough to be a key — was read in context and dispositioned as benign, with the reason recorded: a content hash, an identifier, a test fixture. Declaring all clear across that many matches would have been a guess dressed as a result.

The outcome was a pass on the shipped tree with two residual statements attached rather than absorbed: the values remain in history, and a set of stale branches still carries the older defect class. Both were reported as open.

What it proves: this team can tell the difference between no matches found and no secrets in what we ship, and publishes the distance between them.