ci: sync gitleaks allowlist

.gitea/workflows/ci.yml

@@ -1,5 +1,4 @@
 ---
-# ci-sync: 2026-05-30T02:31:20Z
 # Homelab CI — Python lane (git-ci-01) + secret scan (git-ci-02)
 # Skip: @skipci in branch name or commit message
 name: CI

.gitleaks.toml

@@ -20,11 +20,9 @@ paths = [
   '''(?i).*\.example\.(yml|yaml|env|json|toml)$''',
   '''(?i).*vault\.example\.(yml|yaml)$''',
   '''(?i).*\.env\.example$''',
-  '''(?i)CUSTOMIZATION_CHECKLIST\.md$''',
 ]
 regexes = [
   '''(?i)(invalid|fake|dummy|placeholder|example|changeme|change_me|not-a-real)''',
   '''(?i)sk-or-invalid''',
   '''(?i)msk-or-invalid''',
-  '''(?i)your_ssh_private_key_here''',
 ]

README.md

@@ -30,8 +30,6 @@ POTE tracks stock trading activity of government officials (starting with U.S. C
 
 **📧 Want automated reports?** See **[AUTOMATION_QUICKSTART.md](AUTOMATION_QUICKSTART.md)** for email reporting setup!
 
-**🏠 Homelab deploy (LXC 236)?** See **[docs/HANDOFF-2026-05-27.md](docs/HANDOFF-2026-05-27.md)** for ops handoff and next steps.
-
 ### Local Development
 ```bash
 # Install

docs/HANDOFF-2026-05-27.md

@@ -1,163 +0,0 @@
-# POTE homelab handoff — 2026-05-27
-
-**Status:** Production LXC running; PR #1 merged to `main`; CI green on Gitea Actions.  
-**Research only — not investment advice.**
-
----
-
-## What’s live
-
-| Item | Value |
-|------|--------|
-| Host | LXC **236** `pote` @ **10.0.10.48** (pve10) |
-| App | `/home/poteapp/pote` (venv, **no git clone** — deploy via rsync) |
-| DB | PostgreSQL `pote` / `poteuser` (password rotated; in Ansible vault) |
-| Data | ~55 officials, ~329 trades (30-day live ingest, May 2026) |
-| SMTP | `10.0.10.132` (Mailcow), send as **`alerts@levkine.ca`** |
-| Reports | **`idobkin@gmail.com`** daily 07:00, weekly Sun 08:00 |
-
-### Cron (`crontab -u poteapp -l`)
-
-| Time | Script |
-|------|--------|
-| 06:00 | `fetch_congressional_trades.py --days 7` |
-| 06:15 | `enrich_securities.py` |
-| 06:30 | `monitor_market.py --scan` |
-| 07:00 | `send_daily_report.py --to idobkin@gmail.com` |
-| Sun 08:00 | `send_weekly_report.py --to idobkin@gmail.com` |
-
-### Data source (important)
-
-Legacy **housestockwatcher.com** and S3 buckets are dead/blocked. Ingest uses public JSON from [congress-trading-monitor](https://github.com/kadoa-org/congress-trading-monitor) (~5000 rows cap). Override with env `POTE_HOUSE_DATA_URL` if you add another feed.
-
----
-
-## Repos & branches
-
-| Repo | Branch | Notes |
-|------|--------|--------|
-| **POTE** | `main` @ `git.levkin.ca/ilia/POTE` | Merged PR #1 — ingest, email, CI, deps |
-| **ansible** | `feature/outline-setup-api` (or `master`) | Inventory, `deploy-pote.sh`, vault — may need merge to homelab default branch |
-
-Local:
-
-```bash
-cd ~/Documents/code/POTE && git checkout main && git pull
-```
-
----
-
-## Quick access
-
-```bash
-ssh root@10.0.10.48
-su - poteapp
-cd pote && source venv/bin/activate
-
-# Logs
-tail -f ~/logs/daily_report.log
-tail -f ~/logs/trades.log
-
-# Manual run
-python scripts/fetch_congressional_trades.py --days 30
-python scripts/send_daily_report.py --to idobkin@gmail.com --test-smtp
-```
-
-Deploy code from laptop (preserves server `.env`):
-
-```bash
-cd ~/Documents/code/ansible
-make deploy-pote
-# or: RUN_FETCH=1 make deploy-pote
-```
-
----
-
-## Ansible / homelab inventory
-
-Already wired (ansible repo):
-
-- `inventories/production/hosts` — `pote` @ `.48`, VMID 236
-- `docs/guides/host-list.md` — LXC 236 row
-- `scripts/beszel-install-agents.sh` — `pote-236`
-- `scripts/deploy-pote.sh`, `make deploy-pote`
-- `scripts/vault-update-pote.py`, `make vault-update-pote`
-- `docs/guides/smtp-inventory.md` — POTE uses `alerts@levkine.ca`
-- Vault: `vault_pote_db_password_prod`, `vault_pote_smtp_password`
-
-```bash
-make vault-export-env
-make beszel-install-agents BESZEL_ONLY=pote-236   # if agent not yet installed
-```
-
----
-
-## Verify after first automated day
-
-1. **07:00+** — Email in Gmail (From: `alerts@levkine.ca`, subject `POTE Daily Report - YYYY-MM-DD`). Check spam once.
-2. **Logs** — `~/logs/daily_report.log`, `trades.log` — no tracebacks.
-3. **DB growth** — trade count should tick up on weekdays:
-
-   ```bash
-   su - poteapp -c 'cd pote && source venv/bin/activate && python -c "
-   from sqlalchemy import func, select
-   from pote.db import SessionLocal
-   from pote.db.models import Trade, Official
-   with SessionLocal() as s:
-       print(\"trades\", s.scalar(select(func.count(Trade.id))))
-       print(\"officials\", s.scalar(select(func.count(Official.id))))
-   "'
-   ```
-
----
-
-**Vikunja:** [todo.levkin.ca → Business → POTE](https://todo.levkin.ca) (`POTE`)
-
-## Open tasks (source of truth)
-
-| P | Task | Owner | Status |
-|---|------|-------|--------|
-| **P1** | Proxmox backup schedule for LXC **236** on pve10 | @you | ⏳ |
-| **P3** | Dedicated `pote@levkine.ca` mailbox (vs shared `alerts@`) | @you | optional / low |
-| **P3** | Git deploy on LXC (replace rsync-only) | @agent | optional / low |
-| **P3** | Kuma LAN health monitor | @agent | optional / low |
-| **P3** | Mattermost / webhook alerts (email only today) | @agent | optional / low |
-| **P3** | Full history ingest (second data source beyond kadoa cap) | @agent | optional / low |
-
-**Closed 2026-07-11:** Beszel agent on pote-236 (`beszel-agent` active).  
-**Closed 2026-07-12:** `make deploy-pote` synced to LXC 236; 07:00 cron email delivered (`idobkin@gmail.com`, log OK). DB ~1129 trades / 80 officials.
-
-### Not planned (unless you want them)
-
-- Public URL / Caddy vhost (LAN-only by design)
-- Investment signals exposed as advice (research descriptors only)
-
----
-
-## Known issues / caveats
-
-| Topic | Detail |
-|-------|--------|
-| **Disclosure lag** | STOCK Act filings appear weeks after trades; reports are descriptive, not timely trading signals. |
-| **Amount ranges** | Disclosure buckets only ($1k–$15k, etc.), not exact sizes. |
-| **Empty tickers** | Some filings skipped when ticker missing. |
-| **CI vs prod** | CI uses venv + Postgres service; prod uses host Postgres — both should pass after merge. |
-| **Gitea deploy workflow** | `.github/workflows/deploy.yml` still references `git pull` on Proxmox; prod uses **rsync** via ansible `deploy-pote.sh`. |
-
----
-
-## Related docs
-
-| Doc | Purpose |
-|-----|---------|
-| [EMAIL_SETUP.md](../EMAIL_SETUP.md) | SMTP / Mailcow / levkine.ca |
-| [AUTOMATION_QUICKSTART.md](../AUTOMATION_QUICKSTART.md) | Cron + reports |
-| [PROXMOX_QUICKSTART.md](../PROXMOX_QUICKSTART.md) | Original LXC provisioning |
-| Ansible `docs/guides/projects-handoff-2026-05-26.md` | Multi-project homelab context |
-| Ansible `docs/guides/smtp-inventory.md` | Mailboxes |
-
----
-
-## One-line summary
-
-**POTE on 10.0.10.48 ingests public congressional trades daily, emails a research summary to Gmail at 07:00, and is maintained via `main` + `make deploy-pote` — verify tomorrow’s cron email, then Beszel, backups, and optional data-source expansion.**

scripts/git-hooks/install.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-# One-time installer for the local pre-commit gitleaks hook.
-# Run once per clone: bash scripts/git-hooks/install.sh
-#
-# Respects `core.hooksPath` if you've set one (local or global) — some setups
-# point git at a hooks dir outside `.git/hooks/` (e.g. a machine-wide
-# `~/.git-hooks/`), and installing to `.git/hooks/` in that case would be a
-# silent no-op. If an existing hook is already at that path, this chains to
-# it so nothing already relying on it breaks.
-set -euo pipefail
-
-REPO_ROOT="$(git rev-parse --show-toplevel)"
-cd "$REPO_ROOT"
-
-HOOKS_DIR="$(git config --get core.hooksPath || true)"
-if [ -z "$HOOKS_DIR" ]; then
-  HOOKS_DIR=".git/hooks"
-elif [[ "$HOOKS_DIR" != /* ]]; then
-  HOOKS_DIR="$REPO_ROOT/$HOOKS_DIR"
-fi
-mkdir -p "$HOOKS_DIR"
-
-TARGET="$HOOKS_DIR/pre-commit"
-if [ -f "$TARGET" ] && ! grep -q "gitleaks" "$TARGET" 2>/dev/null; then
-  echo "⚠️  Existing pre-commit hook found at $TARGET that isn't ours — chaining instead of overwriting."
-  CHAINED="$HOOKS_DIR/pre-commit.d-gitleaks"
-  cp scripts/git-hooks/pre-commit "$CHAINED"
-  chmod +x "$CHAINED"
-  if ! grep -q "pre-commit.d-gitleaks" "$TARGET" 2>/dev/null; then
-    printf '\n# Added by levkinops ansible repo (scripts/git-hooks/install.sh)\n"%s"\n' "$CHAINED" >> "$TARGET"
-  fi
-else
-  cp scripts/git-hooks/pre-commit "$TARGET"
-  chmod +x "$TARGET"
-fi
-
-echo "✓ Installed pre-commit gitleaks hook → $TARGET"
-if [ "$HOOKS_DIR" != ".git/hooks" ] && [ "$HOOKS_DIR" != "$REPO_ROOT/.git/hooks" ]; then
-  echo "  (using core.hooksPath=$HOOKS_DIR — applies to every repo that shares this hooksPath)"
-fi
-if ! command -v gitleaks >/dev/null 2>&1; then
-  echo "  Note: gitleaks isn't installed locally yet. Install it for the hook to actually run:"
-  echo "    macOS:  brew install gitleaks"
-  echo "    Linux:  see https://github.com/gitleaks/gitleaks#installing"
-  echo "  Until then this hook is a no-op locally (CI still scans every push)."
-fi

scripts/git-hooks/pre-commit

@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-# Local pre-commit secret scan — mirrors the `secret-scanning` CI job (gitleaks)
-# so leaked secrets are caught before they ever leave your machine, not just at
-# CI time. Installed via `make install-git-hooks`.
-#
-# Uses the same .gitleaks.toml allowlist as CI. Only scans staged content.
-set -euo pipefail
-
-REPO_ROOT="$(git rev-parse --show-toplevel)"
-cd "$REPO_ROOT"
-
-if ! command -v gitleaks >/dev/null 2>&1; then
-  echo "⚠️  gitleaks not installed locally — skipping local secret scan."
-  echo "    Install: brew install gitleaks   (CI will still catch it either way)"
-  exit 0
-fi
-
-echo "🔐 Running gitleaks on staged changes..."
-if ! gitleaks protect --staged --config .gitleaks.toml --no-banner --redact; then
-  echo ""
-  echo "❌ gitleaks found a potential secret in your staged changes."
-  echo "   Fix it, or if it's a false positive, add an allowlist entry to .gitleaks.toml."
-  echo "   Bypass (not recommended): git commit --no-verify"
-  exit 1
-fi
-
-echo "✓ gitleaks: no secrets found in staged changes"

scripts/send_daily_report.py

@@ -43,12 +43,6 @@ def main():
         action="store_true",
         help="Test SMTP connection before sending",
     )
-    parser.add_argument(
-        "--lookback-days",
-        type=int,
-        default=1,
-        help="Include trades filed in the last N days ending on the report date (default: 1)",
-    )
     parser.add_argument(
         "--save-to-file",
         help="Also save report to this file path",
@@ -87,9 +81,7 @@ def main():
     logger.info(f"Generating daily report for {report_date or date.today()}...")
     with get_session() as session:
         generator = ReportGenerator(session)
-        report_data = generator.generate_daily_summary(
+        report_data = generator.generate_daily_summary(report_date)
-            report_date, lookback_days=args.lookback_days
-        )
 
         # Format as text and HTML
         text_body = generator.format_as_text(report_data, "daily")

src/pote/reporting/report_generator.py

@@ -27,15 +27,13 @@ class ReportGenerator:
         self.detector = PatternDetector(session)
 
     def generate_daily_summary(
-        self, report_date: Optional[date] = None, *, lookback_days: int = 1
+        self, report_date: Optional[date] = None
     ) -> Dict[str, Any]:
         """
         Generate a daily summary report.
 
         Args:
             report_date: Date to generate report for (defaults to today)
-            lookback_days: Include trades filed in the last N days ending on report_date
-                (defaults to 1, meaning only filings on report_date).
 
         Returns:
             Dictionary containing report data
@@ -43,19 +41,12 @@ class ReportGenerator:
         if report_date is None:
             report_date = date.today()
 
-        if lookback_days < 1:
-            raise ValueError("lookback_days must be >= 1")
-
         start_of_day = datetime.combine(report_date, datetime.min.time())
         end_of_day = datetime.combine(report_date, datetime.max.time())
 
-        filing_start_date = report_date - timedelta(days=lookback_days - 1)
+        # Count new trades filed today
-
-        # Trades filed within the lookback window (inclusive)
         new_trades = (
-            self.session.query(Trade)
+            self.session.query(Trade).filter(Trade.filing_date == report_date).all()
-            .filter(Trade.filing_date >= filing_start_date, Trade.filing_date <= report_date)
-            .all()
         )
 
         # Count market alerts today
@@ -80,8 +71,6 @@ class ReportGenerator:
 
         return {
             "date": report_date,
-            "filing_start_date": filing_start_date,
-            "lookback_days": lookback_days,
             "new_trades_count": len(new_trades),
             "new_trades": [
                 {
@@ -184,20 +173,13 @@ class ReportGenerator:
 
     def _format_daily_text(self, data: Dict[str, Any]) -> str:
         """Format daily report as plain text."""
-        if data.get("lookback_days", 1) > 1:
-            trades_label = (
-                f"  • Trades Filed (last {data['lookback_days']} days): {data['new_trades_count']}"
-            )
-        else:
-            trades_label = f"  • New Trades Filed: {data['new_trades_count']}"
-
         lines = [
             "=" * 70,
             f"POTE DAILY REPORT - {data['date']}",
             "=" * 70,
             "",
             "📊 SUMMARY",
-            trades_label,
+            f"  • New Trades Filed: {data['new_trades_count']}",
             f"  • Market Alerts: {data['market_alerts_count']}",
             f"  • Critical Alerts (≥7 severity): {data['critical_alerts_count']}",
             f"  • Suspicious Timing Trades: {data['suspicious_trades_count']}",
@@ -305,11 +287,6 @@ class ReportGenerator:
 
     def _format_daily_html(self, data: Dict[str, Any]) -> str:
         """Format daily report as HTML."""
-        if data.get("lookback_days", 1) > 1:
-            new_trades_label = f"Trades Filed (last {data['lookback_days']} days):"
-        else:
-            new_trades_label = "New Trades:"
-
         html = f"""
         <html>
         <head>
@@ -330,7 +307,7 @@ class ReportGenerator:
             
             <div class="summary">
                 <h2>📊 Summary</h2>
-                <div class="stat"><strong>{new_trades_label}</strong> {data['new_trades_count']}</div>
+                <div class="stat"><strong>New Trades:</strong> {data['new_trades_count']}</div>
                 <div class="stat"><strong>Market Alerts:</strong> {data['market_alerts_count']}</div>
                 <div class="stat"><strong>Critical Alerts:</strong> {data['critical_alerts_count']}</div>
                 <div class="stat"><strong>Suspicious Trades:</strong> {data['suspicious_trades_count']}</div>