Security hardening, multi-site portability, and a documentation and API-surface sweep

tests/test_docs_publishable.py

@@ -49,6 +49,29 @@ FORBIDDEN = [
     ('root' + 'password', 'contains a database root password'),
     (r'\b' + 'cla' + 'ude' + r'\b', 'names an LLM assistant'),
     (r'\b' + 'anthro' + 'pic' + r'\b', 'names an LLM vendor'),
+    # ADR-015. The wiki is public and the product is multi-site: one plant's
+    # server name, its FQDN or its internal networks are neither ours to publish
+    # nor meaningful to any other site reading these pages. Assembled from
+    # fragments for the same reason as the terms above.
+    ('tsg' + 'wp00525', 'names a production server'),
+    (r'\b' + r'172\.16\.' + r'\d', 'names an internal network'),
+    # A tool-call fragment reached the end of an ACCEPTED ADR and published to
+    # the wiki. It says nothing to a reader and everything about how the
+    # document was produced, which is not what a decision record is for.
+    ('</' + 'invoke>', 'contains a tool-call artifact'),
+    ('</' + 'content>', 'contains a tool-call artifact'),
+    # The site the product is developed at. Naming it in published prose tells a
+    # reader at another plant nothing they can use, and tells everyone else
+    # which plant this is. Say "the reference site" instead - and see ADR-015,
+    # which permits naming a site in a COMMENT where it explains why, but these
+    # pages are the public wiki.
+    ('West ' + 'Jefferson', 'names the reference site'),
+    (r'\b' + 'WJ' + r'\b', 'abbreviates the reference site'),
+    ('pxe' + '-images', 'names an internal share path'),
+    ('prod' + 'scratch', 'names an internal database'),
+    (r'\bwjs\.' + r'geaerospace\.net\b', 'names a site FQDN'),
+    (r'10\.134\.48\.', 'names an internal network'),
+    (r'10\.48\.249\.', 'names an internal network'),
 ]
 
 # Generated API surface. Not prose, not hand-edited, and regenerated from the