Finding
CONTRIBUTING.md (a public, tracked file in a public repo) documents a push target using an internal .lan hostname literal, at two lines. kanon lint . --all reports both as OIKOS/private-content (severity: error) — this is the one finding in the current lint sweep that blocks a clean local kanon gate for every future PR to this repo, independent of any code change.
Evidence
Why this matters
akroasis is a public repo (confirmed: dependabot/GitHub Actions run on it as a public repo per the fleet's own CI-minute policy). kanon.lan is an internal fleet hostname, not a public DNS name — publishing it in a contributor-facing doc leaks internal network topology to anyone reading the public repo, and is the specific class OIKOS/private-content exists to catch.
Desired correction
Replace the kanon.lan literal in both push-target and Stoa-UI examples with either a placeholder (<forge-host>) or a public-safe description of the forge-mirror relationship, consistent with how other public forkwright repos describe self-hosted-forge-plus-GitHub-mirror without naming the internal host.
Done when: kanon lint . --all reports zero OIKOS/private-content findings in CONTRIBUTING.md, and a local kanon gate run's kanon lint stage passes on a repo checkout with no other unrelated debt.
Finding
CONTRIBUTING.md(a public, tracked file in a public repo) documents a push target using an internal.lanhostname literal, at two lines.kanon lint . --allreports both asOIKOS/private-content(severity: error) — this is the one finding in the current lint sweep that blocks a clean localkanon gatefor every future PR to this repo, independent of any code change.Evidence
CONTRIBUTING.md:8:origin = http://kanon.lan/forkwright/akroasis.git (authoritative)CONTRIBUTING.md:18:Open `http://kanon.lan/prs/forkwright/akroasis`, click "New PR"origin/maintoday (not introduced by any open PR) viagit show origin/main:CONTRIBUTING.md.kanon lint . --allon a cleanorigin/maincheckout reports these as the onlyOIKOS/private-contenterrors in the repo, andkanon gate'skanon lintstage isERROR-severity-gated, so no PR can currently produce a clean local Gate-Passed trailer regardless of what it touches.Why this matters
akroasis is a public repo (confirmed: dependabot/GitHub Actions run on it as a public repo per the fleet's own CI-minute policy).
kanon.lanis an internal fleet hostname, not a public DNS name — publishing it in a contributor-facing doc leaks internal network topology to anyone reading the public repo, and is the specific classOIKOS/private-contentexists to catch.Desired correction
Replace the
kanon.lanliteral in both push-target and Stoa-UI examples with either a placeholder (<forge-host>) or a public-safe description of the forge-mirror relationship, consistent with how other public forkwright repos describe self-hosted-forge-plus-GitHub-mirror without naming the internal host.Done when:
kanon lint . --allreports zeroOIKOS/private-contentfindings inCONTRIBUTING.md, and a localkanon gaterun'skanon lintstage passes on a repo checkout with no other unrelated debt.