M2 results — GitHub integration verified live

Date: 2026-07-30 How: npm run verify-m2 (spike/m2-verify/) against a real private repository, using a fine-grained personal access token scoped to that repo with Contents: Read-only. Verdict: PASS — the zero-egress claim holds under observation.

Exit criterion (from ROADMAP.md)

Lists a private repo’s .tf files and runs the scanner on them end-to-end; no request leaves the allowlist (verified in the DevTools network log).

What was verified

• Network egress — the claim that matters. With DevTools → Network open for the whole run, every request went to api.github.com and nowhere else. No telemetry, no analytics, no third-party host, no CDN. This is the property the product is sold on, and it was confirmed by observation rather than by reading the code.
• End-to-end path. The harness drives the shipping modules — GitHubClient (src/lib/github/client.ts) resolves the default branch, walks the tree, filters to .tf, and base64-decodes contents; scan() (src/lib/scanner/) then runs all 40 rules over the result.
• Token handling. Read from a password field at click time, passed to the client, sent only in an Authorization header. Never stored, never logged, never placed in a URL — client.ts and token.ts are written so a token cannot ride along inside an error message either.

Caveats, recorded honestly

• Verified in the throwaway harness, not the side panel, because the panel is still a scaffold (its UI is M3/M4). The code path exercised is nonetheless the shipping one; what is untested is the panel wiring, not the client or the scanner.
• The privacy-auditor agent has not been run against this change. The DevTools observation is stronger evidence for egress specifically, but a full static audit of the manifest and dependency surface is still owed before any release.
• Repositories large enough to truncate the tree listing were not exercised here; that path has unit tests (T10) but no live confirmation.

Conclusion

M2 is complete. The GitHub client works against real private repositories and the extension’s central privacy promise survives direct observation. Proceed to M3 (wiring the pipeline together — Queue 2, T15–T22).