The flow reads feed public pages. A private repository's pull showing up there is a privacy leak, and right now each read tests this on its own or not at all.
Done:
[ ] test/flow-public-only.test.ts seeds one private and one public repository, each with a pull in every state the reads count. It then calls every exported read in src/flow that takes publicOnly (today: alarm_stuck, checks_pile, conflicted, oldest_approved, red_batches, requested, reviewing, vitals) with publicOnly = true, and asserts that nothing from the private repository appears.
[ ] Any read that leaks is fixed in the same pull, and the pull names which one leaked.
The flow reads feed public pages. A private repository's pull showing up there is a privacy leak, and right now each read tests this on its own or not at all.
Done:
test/flow-public-only.test.tsseeds one private and one public repository, each with a pull in every state the reads count. It then calls every exported read in src/flow that takespublicOnly(today: alarm_stuck, checks_pile, conflicted, oldest_approved, red_batches, requested, reviewing, vitals) withpublicOnly = true, and asserts that nothing from the private repository appears.Files: test/flow-public-only.test.ts