Open-source readiness audit: no LICENSE, hardcoded repo1.dso.mil default, internal docs, history scan #107

Question

Is there anything in this repo that would prevent it from becoming open source?

I audited the current main tree (shallow clone, 167 files). Short answer: one hard blocker, four disclosure decisions, and one check that still has to be run. No secrets found.

1. Hard blocker — there is no LICENSE

gh repo view reports licenseInfo: null, and there is no LICENSE* file in the tree. Making the repo public without one does not make it open source — with no license, default copyright applies and nobody may use, modify, or redistribute it.

Action: pick a license (MIT or Apache-2.0; Apache-2.0 if you want the explicit patent grant) and add LICENSE. Add a short License section to README.md.

2. repo1.dso.mil is the hardcoded default host

Not a legal blocker — repo1.dso.mil is a public-facing DoD GitLab — but it's baked into shipped code, not just fixtures:

It appears in ~25 files overall including README.md, ARCHITECTURE.md, skill/SKILL.md, and the test suite.

Decision required: publishing this advertises that Radius Method works Platform One / Big Bang, and makes the tool read as single-tenant rather than a general GitLab CLI. Either (a) keep it as a documented default, or (b) make host required with no default and move repo1 to an example. Option (b) is the better OSS posture and is a small change; config_test.go asserts the default in three places and would need updating with it.

3. The PRD is internal product content

gitlab-kiosk-prd.md opens with the tool's purpose framed around "Platform One / DoD GitLab" and "Claude Code needs frequent read access to repo1.dso.mil during Platform One / Big Bang work", plus the rationale for replacing a prior MCP server. 14 dso.mil references.

Action: remove it from the public repo, or rewrite as a neutral DESIGN.md without the engagement framing.

4. docs-local/ is internal ops notes

docs-local/macos-go-test-approval-repro-2026-04-13.md documents reproducing "the real operator pain on managed macOS" — managed-device execution policy details. Internal troubleshooting, not user-facing.

Action: drop the directory (or move it out of the repo).

5. Packaging assumes a private repo

Formula/gitlab-kiosk.rb uses SSH URLs:

url "ssh://git@github.com/radiusmethod/gitlab-kiosk.git"
head "ssh://git@github.com/radiusmethod/gitlab-kiosk.git", branch: "main"

That works for a private repo with keys configured; a public formula should build from HTTPS or release tarballs so anyone can brew install. Also review .goreleaser.yml and .github/workflows/release.yml for private-tap assumptions and org-scoped secrets.

What is already clean — no action needed

• No secrets. Every glpat- occurrence is a placeholder (glpat-xxxxxxxxxxxxxxxxxxxx in README.md:242 and glkcli/init.go:17) or a test literal (glpat-secret in internal/gitlab/client_test.go). .envrc.example contains only commented placeholders.
• Recorded HTTP fixtures are scrubbed. testdata/fixtures/*.json and internal/vcr/testdata/*.json reference repo1.dso.mil but contain no auth headers, tokens, or email addresses. The recorded content is public projects (Big Bang, Kyverno).
• Dependencies are permissive. BurntSushi/toml (MIT), spf13/cobra + pflag (Apache-2.0), go.yaml.in/yaml/v3, modernc.org/sqlite (BSD-3). No copyleft. A formal go-licenses inventory is still worth generating for the record.
• AGENTS.md / CLAUDE.md are fine to publish in principle — give them a read for internal workflow references before flipping the switch.

6. Still to run — git history scan

This audit covered the current tree only (git clone --depth 1), so it says nothing about history. A credential committed and later removed is still public once the repo is. Run gitleaks detect or trufflehog git over full history before changing visibility, and if anything turns up, plan a history rewrite or a fresh-history re-publish rather than a simple flip.

Acceptance criteria

• LICENSE exists and README.md states the license.
• A decision on Implement GitLab HTTP client with safety invariants and optional token #2 is recorded in the PR, and if option (b) is chosen the default is removed and config_test.go updated.
• gitlab-kiosk-prd.md and docs-local/ are removed or rewritten for a public audience.
• Homebrew formula and release workflow work for an unauthenticated user.
• A full-history secret scan has been run and its result is reported on this issue.
• No change to the fixtures is required unless the history scan says otherwise.

🐦‍⬛ Created with Crow via Claude Code