Every hole in the gate is signed

A commit in the hub repository triggered the content screen due to text that had been previously fine. The screen, a pre-commit door, blocked text matching the author's leak patterns. However, the text in question was something the hub was designed to hold. The exemptions for banned terms were stored in a file with one regex per line.

A recent update caused the auditor to read this format as unsigned, report it, then ignore it, rendering all exemptions ineffective. The failure occurred in the strict direction, blocking the commit and alerting the author. If the gate had checked less, no report would have been generated, leaving the issue undetected.

The author emphasizes the importance of properly documenting exemptions, noting that the exemption format changed from one-per-line to labeled lines with fields. This change forced the addition of new fields such as a pattern description, a reason, and timestamps. The new format made it clear which exemptions applied, preventing silent failures. The author stresses that the labeled lines are not a stylistic choice, but a necessary design decision to avoid ambiguity and ensure each field can be audited independently.

The author concludes by outlining a test they now apply to all gates they run: for each potential way the gate could stop checking, they ask what would signal a problem. If the answer is "a commit that should have failed," the gate's failure mode is an unaudited hole, and the author suggests signing these known issues as the most efficient first step.