arnes/work/current.md

Current session

• Active feature: F-002 — Remove secrets and externalize config
• Start: 2026-05-25
• Orchestrator: leader

Plan

• Write SDD, ADR, and BDD trace for config externalization.
• Add one config loader for legacy PHP module.
• Remove hard-coded DB and OpenAI secrets from versioned PHP files.
• Centralize URLs and external endpoints in local config.
• Run ./scripts/verify.sh and security scan.

Log

• Feature F-001 is blocked by security gate because secrets remain in repo.
• Created follow-up ticket F-002.
• Switched active work item to F-002.
• Wrote SDD, ADR, and BDD trace for config externalization.
• Added shared config loader and local config template for legacy PHP module.
• Removed hard-coded DB and OpenAI secrets from tracked PHP files.
• Replaced inline production URLs in tracked PHP files with config lookups.
• Ran verify and security scans.
• Reviewer, security, QA, and documenter artifacts for F-002 are on disk.

Next step

• Publish F-002.
• Create follow-up ticket for SQL dump sanitization.