patterncatalyst · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026
diff --git a/.github/workflows/content.yml b/.github/workflows/content.yml
@@ -43,12 +43,24 @@ jobs:
       - name: Voice scan totals (all tiers)
         run: bash scripts/voice-scan.sh --all-tiers-summary
 
+  # No tracked file may name the development machine or its owner (CLAUDE.md, publishing rule).
+  host-ids:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Scanner self-test
+        run: python3 scripts/host_ids.py self-test
+
+      - name: Host identifiers (paths only, values never printed)
+        run: python3 scripts/host_ids.py check
+
   # The one check branch protection requires: passes when every job above
   # succeeded or was skipped.
   content-ok:
     name: content-ok
     if: always()
-    needs: [validate]
+    needs: [validate, host-ids]
     runs-on: ubuntu-latest
     steps:
       - env:

diff --git a/.host-scrub.toml b/.host-scrub.toml
@@ -0,0 +1,6 @@
+# No identifier of the development machine belongs in this file.
+cpu_class = "Intel 8-core/16-thread laptop CPU"
+
+[allow_match]
+# The UBI OpenJDK builder image's own default account and home (public image defaults).
+home-path = ['^/home/default($|/)']
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -282,3 +282,23 @@ was expanded to a full event-driven-microservices treatment drawn from Bellemare
 - `_plans/phase3-backlog.md` — full history of the r62–r77 work and the Ch05 expansion tranches.
 - `_plans/examples-plan.md` — the runnable-examples manifest and per-example language/infra choices.
 - `_plans/modernization-plan.md` — the current modernization: section order, decisions, pins, status.
+
+## Publishing rule: nothing identifies the machine or its owner
+
+The repo is public, so no tracked file may name the development machine, its owner
+or anything that helps locate or attack it later:
+
+- No absolute home-directory path (under /home or /Users), no account name, no hostname.
+  Write `<repo>/...` or `~/...`; scripts derive the repo root from `__file__` or `git rev-parse`.
+- No laptop model (DMI `product_name` is `"redacted"`), no CPU model or model number. The
+  CPU is a class ("Intel 8-core/16-thread laptop CPU"); prose names its properties
+  (SMT, cache sizes, frequency driver), never the part.
+- No host kernel build number or build date: give `major.minor` and the preempt model.
+- No `/etc/machine-id`, DMI serial or UUID, MAC or IP address, `root=UUID=` or BOOT_IMAGE.
+- Generated output is scrubbed before it is committed: `python3 scripts/host_ids.py scrub <dir>`
+  on a results directory, `host_ids.py filter` on a captured log.
+- `host_ids.py check` runs in CI (`host-ids` job, required through `content-ok`) and fails the
+  build on a hit. A value that is public by design (a container image's default `/home/default`,
+  a package pin, a fixture of fake values) is exempted by value in `.host-scrub.toml` under
+  `[allow_match]`, with a regex that names only that public value; never allow a whole file,
+  and never write this machine's values into the config.
diff --git a/_plans/modernization-plan.md b/_plans/modernization-plan.md
@@ -100,7 +100,7 @@ S0 to S14 are done and main is green (f20e612). Nothing is required; these are t
 - S8: 0 :latest, -latest or kafka-ui; full matrix green.
 - S9: minikube appendix with evidence; profile stopped.
 - S10: Appendix S with evidence for 5 languages; scrub clean; CRC stopped and clean.
-  - Executed 2026-10-11 (awaiting validation). Evidence: `/tmp/claude-1000/-home-rsedor-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s10/live/`. crc 2.64.0, OpenShift 4.22.14, Kubernetes v1.35.6, AMQ Streams `amqstreams.v3.2.1-14` (channel `amq-streams-3.2.x`, default `stable`), Kafka 4.2.0.
+  - Executed 2026-10-11 (awaiting validation). Evidence: `/tmp/claude-1000/-home-user-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s10/live/`. crc 2.64.0, OpenShift 4.22.14, Kubernetes v1.35.6, AMQ Streams `amqstreams.v3.2.1-14` (channel `amq-streams-3.2.x`, default `stable`), Kafka 4.2.0.
   - verify.sh 10 passed, 0 failed in spring-boot, quarkus, dotnet, python and go (139, 123, 125, 121, 120 s); every pod on `restricted-v2` (no anyuid needed); linked traces with all three services per language; Route HTTP 302 to https; Grafana 13.2.3 health ok.
   - Three script fixes from the live run: inventory under `pipefail` on a clean cluster, waiting for cluster operators after the registry route change, ignoring OLM-copied CSVs (`-l '!olm.copiedFrom'`).
   - Teardown removed the operator, 10 CRDs, namespaces and the registry route change; `crc stop` (not deleted); second teardown exit 0; current-context unset and `~/.kube/config` sha256 unchanged.
@@ -193,7 +193,7 @@ Defects the baseline found and fixed in S1:
 
 ### S9 minikube (2026-10-11)
 
-Fedora 44, Docker Engine 29.8.2, minikube v1.39.0, kubectl v1.36.5 (kustomize v5.8.1), **Helm v4.3.0**, profile `cndp-k8s` (docker driver, containerd 2.3.4, Kubernetes v1.36.5, 8 GB, 4 CPUs, 40 GB), NodePorts 30080 and 30300 published on 127.0.0.1 only (`docker port cndp-k8s`). Evidence: `/tmp/claude-1000/-home-rsedor-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s9/` (`00-prechecks.txt`, `01-setup-profile.log`, `matrix/` with `results.tsv`, per-language logs and evidence, `docker-path/`, `10-static-checks.txt`, `11-final-state.txt`).
+Fedora 44, Docker Engine 29.8.2, minikube v1.39.0, kubectl v1.36.5 (kustomize v5.8.1), **Helm v4.3.0**, profile `cndp-k8s` (docker driver, containerd 2.3.4, Kubernetes v1.36.5, 8 GB, 4 CPUs, 40 GB), NodePorts 30080 and 30300 published on 127.0.0.1 only (`docker port cndp-k8s`). Evidence: `/tmp/claude-1000/-home-user-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s9/` (`00-prechecks.txt`, `01-setup-profile.log`, `matrix/` with `results.tsv`, per-language logs and evidence, `docker-path/`, `10-static-checks.txt`, `11-final-state.txt`).
 
 Pins re-verified at the start: Strimzi chart and operator 1.2.0 (Kafka image `quay.io/strimzi/kafka:1.2.0-kafka-4.3.1`, Kafka 4.3.1, Kafka CR `kafka.strimzi.io/v1`), postgres 18.6-alpine, otel-lgtm 0.36.0, kubeconform v0.8.0, actionlint 1.7.12, shellcheck 0.11.0, CRDs-catalog commit 63669a5. Kubernetes 1.37.1 exists upstream and minikube v1.39.0 lists 1.37.0 as its newest; v1.36.5 stays because the host kubectl and the other profiles are 1.36.5 and the plan was approved with it.
 

diff --git a/_plans/s10-openshift-local-plan.md b/_plans/s10-openshift-local-plan.md
@@ -110,7 +110,7 @@ packagemanifest `amq-streams` channels/currentCSV; CSV `STRIMZI_KAFKA_IMAGES`; `
 
 ## Live results (step 10, 2026-10-11)
 
-Evidence (outside the repo): `/tmp/claude-1000/-home-rsedor-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s10/live/` (`matrix/results.tsv`, `matrix/logs/`, `matrix/evidence/<lang>/`, `setup3.log`, `teardown.log`).
+Evidence (outside the repo): `/tmp/claude-1000/-home-user-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s10/live/` (`matrix/results.tsv`, `matrix/logs/`, `matrix/evidence/<lang>/`, `setup3.log`, `teardown.log`).
 
 - crc 2.64.0, OpenShift 4.22.14, Kubernetes v1.35.6.
 - AMQ Streams packagemanifest: default channel `stable`; `amq-streams-3.2.x` currentCSV `amqstreams.v3.2.1-14` (newest); CSV Succeeded; Kafka 4.2.0.

diff --git a/_plans/s12-deck-refresh-plan.md b/_plans/s12-deck-refresh-plan.md
@@ -106,7 +106,7 @@ notes or picture changed in the final validation (slide numbers of the current d
 
 ## Tooling
 
-Scratchpad venv (`/tmp/claude-1000/-home-rsedor-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/venv`, Python 3.14.7, never global), newest stable on PyPI 2026-10-12, pinned exactly:
+Scratchpad venv (`/tmp/claude-1000/-home-user-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/venv`, Python 3.14.7, never global), newest stable on PyPI 2026-10-12, pinned exactly:
 
 | Package | Version |
 |---|---|

diff --git a/_plans/s12-manifest/README.md b/_plans/s12-manifest/README.md
@@ -26,8 +26,8 @@ Run from the repository root (the `png` paths in the edit files are relative to
 venv python:
 
 ```bash
-V=/tmp/claude-1000/-home-rsedor-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/venv/bin/python
-export DECK_BACKUP_DIR=/tmp/claude-1000/-home-rsedor-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/backup
+V=/tmp/claude-1000/-home-user-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/venv/bin/python
+export DECK_BACKUP_DIR=/tmp/claude-1000/-home-user-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/backup
 D=lgtm-presentation/Designing-Cloud-Native-APIs-Python.pptx
 $V scripts/deck_edit.py "$D" lgtm-presentation/edits/_shared.json \
    lgtm-presentation/edits/Designing-Cloud-Native-APIs-Python.json --dry-run   # review the diff
@@ -428,8 +428,8 @@ Every batch, after applying its edit files and before committing, renders its de
 layout check; the batch does not commit until it reports 0 flags:
 
 ```bash
-V=/tmp/claude-1000/-home-rsedor-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/venv/bin/python
-LO_PROFILE=/tmp/claude-1000/-home-rsedor-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/lo-profile \
+V=/tmp/claude-1000/-home-user-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/venv/bin/python
+LO_PROFILE=/tmp/claude-1000/-home-user-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/lo-profile \
   $V scripts/deck_fit.py lgtm-presentation/<deck>.pptx --keep-pdf <scratch dir>
 # "deck_fit: <deck>.pptx: 0 flag(s) on 0 slide(s)", exit 0
 ```

diff --git a/_plans/s12-manifest/companions.md b/_plans/s12-manifest/companions.md
@@ -95,7 +95,7 @@ The full list (old block index, style, new text) is
 `_plans/s12-manifest/companions/network-policy-process-advisory.docx-ops.json`. Apply with the S12 venv python:
 
 ```bash
-V=/tmp/claude-1000/-home-rsedor-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/venv/bin/python
+V=/tmp/claude-1000/-home-user-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/venv/bin/python
 P=lgtm-presentation/edits/png
 $V _plans/s12-manifest/tools/companion_docx.py \
    lgtm-presentation/network-policy-process-advisory.md \

diff --git a/_plans/s12-manifest/tools/amend_decisions.py b/_plans/s12-manifest/tools/amend_decisions.py
@@ -16,7 +16,7 @@
 import sys
 from pathlib import Path
 
-REPO = Path("/home/rsedor/Dev/cloud-native-design-patterns")
+REPO = Path(__file__).resolve().parents[3]
 EDITS = REPO / "lgtm-presentation" / "edits"
 M = Path(sys.argv[1]) if len(sys.argv) > 1 else Path(__file__).resolve().parent.parent
 TAG = "S12 decision 6"

diff --git a/_plans/s12-manifest/tools/amend_vendor.py b/_plans/s12-manifest/tools/amend_vendor.py
@@ -20,7 +20,7 @@
 import sys
 from pathlib import Path
 
-REPO = Path("/home/rsedor/Dev/cloud-native-design-patterns")
+REPO = Path(__file__).resolve().parents[3]
 EDITS = REPO / "lgtm-presentation" / "edits"
 M = Path(sys.argv[1]) if len(sys.argv) > 1 else Path(__file__).resolve().parent.parent
 BASE = M / "work" / "vendor-base"

diff --git a/_plans/s12-manifest/tools/build.py b/_plans/s12-manifest/tools/build.py
@@ -27,7 +27,7 @@
 import sys
 from pathlib import Path
 
-REPO = Path("/home/rsedor/Dev/cloud-native-design-patterns")
+REPO = Path(__file__).resolve().parents[3]
 sys.path.insert(0, str(REPO / "scripts"))
 import deck_edit as de  # noqa: E402
 from pptx import Presentation  # noqa: E402

diff --git a/_plans/s12-manifest/tools/extract.py b/_plans/s12-manifest/tools/extract.py
@@ -1,11 +1,11 @@
 """Extract every text segment (paragraph split at a:br) of each deck, with sldId, kind, shape, code flag."""
 import json, sys
 from pathlib import Path
-sys.path.insert(0, "/home/rsedor/Dev/cloud-native-design-patterns/scripts")
+sys.path.insert(0, str(Path(__file__).resolve().parents[3] / "scripts"))
 import deck_edit as de
 from pptx import Presentation
 A=de.A; P=de.P; q=de.q
-ROOT=Path("/home/rsedor/Dev/cloud-native-design-patterns/lgtm-presentation")
+ROOT=Path(__file__).resolve().parents[3] / "lgtm-presentation"
 out={}
 for deck in sorted(ROOT.glob("*.pptx")):
     prs=Presentation(str(deck))

diff --git a/_plans/s12-manifest/tools/fixA_build.py b/_plans/s12-manifest/tools/fixA_build.py
@@ -36,7 +36,7 @@
 import fixA_rules as R  # noqa: E402
 from pptx import Presentation  # noqa: E402
 
-FIXA = Path(os.environ.get("FIXA", "/tmp/claude-1000/-home-rsedor-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/fixA"))
+FIXA = Path(os.environ.get("FIXA", "/tmp/claude-1000/-home-user-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/fixA"))
 EDITS = REPO / "lgtm-presentation" / "edits"
 COMMITTED = {"Python": "d51c29f", "Quarkus": "40db0f0", "Spring": "94b7ec5", "DotNet": "99c5bf5"}
 OUTFILE = {"Python": "fix1", "Quarkus": "fix1", "Spring": "fix2", "DotNet": "fix2"}

diff --git a/_plans/s12-manifest/tools/gen_advisory.py b/_plans/s12-manifest/tools/gen_advisory.py
@@ -9,7 +9,7 @@
 import json
 from pathlib import Path
 
-REPO = Path("/home/rsedor/Dev/cloud-native-design-patterns")
+REPO = Path(__file__).resolve().parents[3]
 OUT = REPO / "lgtm-presentation" / "edits" / "Network-Policy-Process-Advisory.json"
 P = "lgtm-presentation/edits/png/"
 

diff --git a/_plans/s12-manifest/tools/gen_appo.py b/_plans/s12-manifest/tools/gen_appo.py
@@ -2,7 +2,7 @@
 """Appendix O: shared sentence rewrites (rewrites/10-appo.json) and per-deck code/figure ops (ops-10-appo/)."""
 import json, sys
 from pathlib import Path
-REPO = Path("/home/rsedor/Dev/cloud-native-design-patterns")
+REPO = Path(__file__).resolve().parents[3]
 from pptx import Presentation
 from pptx.util import Emu
 WORK = Path(__file__).resolve().parent

diff --git a/_plans/s12-manifest/tools/gen_rs.py b/_plans/s12-manifest/tools/gen_rs.py
@@ -12,7 +12,7 @@
 import sys
 from pathlib import Path
 
-REPO = Path("/home/rsedor/Dev/cloud-native-design-patterns")
+REPO = Path(__file__).resolve().parents[3]
 sys.path.insert(0, str(REPO / "scripts"))
 from pptx import Presentation  # noqa: E402
 from pptx.util import Emu  # noqa: E402

diff --git a/_plans/s12-manifest/tools/hits.py b/_plans/s12-manifest/tools/hits.py
@@ -2,7 +2,7 @@
 from pathlib import Path
 segs=json.loads((Path(__file__).resolve().parent/"segs.json").read_text())
 pats=[]
-for line in Path("/home/rsedor/Dev/cloud-native-design-patterns/scripts/voice/patterns.tsv").read_text().splitlines():
+for line in (Path(__file__).resolve().parents[3] / "scripts/voice/patterns.tsv").read_text().splitlines():
     if not line or line.startswith("#"): continue
     f=line.split("\t")
     if len(f)<4: continue

diff --git a/_plans/s12-manifest/tools/images_gen_images.py b/_plans/s12-manifest/tools/images_gen_images.py
@@ -12,7 +12,7 @@
 
 import cairosvg
 
-REPO = Path("/home/rsedor/Dev/cloud-native-design-patterns")
+REPO = Path(__file__).resolve().parents[3]
 DIAG = REPO / "assets" / "diagrams"
 OUT = REPO / "lgtm-presentation" / "edits" / "png"
 SRC = OUT / "src"

diff --git a/_plans/s12-manifest/tools/images_gen_ops.py b/_plans/s12-manifest/tools/images_gen_ops.py
@@ -1,6 +1,8 @@
 import json,collections,sys
 from pptx import Presentation
-F="/tmp/claude-1000/-home-rsedor-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/manifest/fork-images"
+from pathlib import Path
+REPO = Path(__file__).resolve().parents[3]
+F="/tmp/claude-1000/-home-user-Dev/0dea024d-0bf0-4ae5-bddd-7dec0cf60b22/scratchpad/s12/manifest/fork-images"
 W=F+"/../work"
 idx=json.load(open(F+"/index.json"))
 ALL=["Cpp","DotNet","Go","Python","Quarkus","Spring"]
@@ -49,7 +51,7 @@ def lang(d,m): return m.get(d)
             break
 # captions: find the caption shape (y ~ 6.50in) on that slide
 for (deck,sid),text in CAPTIONS.items():
-    prs=Presentation(f"/home/rsedor/Dev/cloud-native-design-patterns/lgtm-presentation/Designing-Cloud-Native-APIs-{deck}.pptx")
+    prs=Presentation(f"{REPO}/lgtm-presentation/Designing-Cloud-Native-APIs-{deck}.pptx")
     s=[t for t in prs.slides if t.slide_id==sid][0]
     cap=[sh for sh in s.shapes if sh.has_text_frame and abs(sh.top/914400-6.50)<0.06]
     assert len(cap)==1,(deck,sid,[sh.name for sh in cap])

diff --git a/_plans/s12-manifest/tools/vendor_figures.py b/_plans/s12-manifest/tools/vendor_figures.py
@@ -10,7 +10,7 @@
 
 import cairosvg
 
-REPO = Path("/home/rsedor/Dev/cloud-native-design-patterns")
+REPO = Path(__file__).resolve().parents[3]
 DIAG = REPO / "assets" / "diagrams"
 OUT = REPO / "lgtm-presentation" / "edits" / "png"
 SRC = OUT / "src"

diff --git a/_plans/s12-manifest/tools/verify_all.py b/_plans/s12-manifest/tools/verify_all.py
@@ -5,7 +5,7 @@
 """
 import json, re, shutil, subprocess, sys
 from pathlib import Path
-REPO = Path("/home/rsedor/Dev/cloud-native-design-patterns")
+REPO = Path(__file__).resolve().parents[3]
 M = Path(__file__).resolve().parent.parent
 V = str(M.parent / "venv" / "bin" / "python")
 sys.path.insert(0, str(REPO / "scripts"))

diff --git a/_plans/s12-manifest/tools/watch_ledger.py b/_plans/s12-manifest/tools/watch_ledger.py
@@ -7,7 +7,7 @@
 from pathlib import Path
 M = Path(__file__).resolve().parent.parent
 VER = M / "verify"
-REPO = Path("/home/rsedor/Dev/cloud-native-design-patterns")
+REPO = Path(__file__).resolve().parents[3]
 SPLIT = re.compile(r"(?<=[.!?])\s+(?=[A-Z0-9'\"‘“(`\[])")
 decks = sys.argv[1:] or [p.stem for p in sorted(VER.glob("*.md")) if not p.name.startswith("watch")]
 ledger = collections.defaultdict(list)

diff --git a/examples/17-sagas/quarkus/README.md b/examples/17-sagas/quarkus/README.md
@@ -37,7 +37,7 @@ saga-orchestrator (Quarkus)
 ## Running it
 
 ```bash
-cd /home/rsedor/Dev/cloud-native-design-patterns/examples/17-sagas/quarkus
+cd <repo>/examples/17-sagas/quarkus
 docker compose up --build
 ```
 
@@ -251,7 +251,7 @@ Benefits:
 Run the automated test suite:
 
 ```bash
-cd /home/rsedor/Dev/cloud-native-design-patterns/examples/17-sagas
+cd <repo>/examples/17-sagas
 ./verify.sh quarkus
 ```