Publish from a squashed history, not this one

Summary

The repo is not ready to be made public in its current form. No credentials were ever committed, but SSW-internal operational details that were deliberately removed from main are still present on live branch tips and in merged PR diffs.

What is still exposed

Five branches are still on origin and their tips contain the pre-scrub content: feature/ssw-meetup-mcp, codex/fix-clean-checkout-tests, codex/support-meetup-pkcs1-keys, codex/fix-claude-mcp-installer, agent/fix-meetup-event-status-filter. The same content is in the diffs of all six merged PRs.

Specifically:

• info@ssw.com.au named as the shared Meetup identity the agent acts as (32 occurrences across README, docs/setup.md, docs/live-acceptance.md, and the design and plan docs)
• The OAuth application name SSW Meetup Event Manager
• The Meetup Pro network urlname dotnet
• All seven SSW group urlnames: sydney-net-user-group, brisbane-full-stack-user-group, melbourne-net-user-group, gold-coast-azure-net-user-group, canberra-net-user-group, strasbourg-net-group, fire-user-group
• The prescribed key location C:\secure\meetup\info-ssw-private-key.pem
• A 2,056-line internal implementation plan and a 263-line design doc, deleted in 71e839c

Why this matters

None of this is a credential. Its value to an attacker is that it names the exact account and OAuth client to target, and confirms a shared mailbox holds organizer rights over seven groups. That is a starting point for phishing and social engineering.

The project has already decided this should not be public: tests/setup-scripts.test.ts asserts these exact strings must not appear in the docs. Publishing the current history quietly reverses that decision.

Suggested fix

Do not attempt a history rewrite. git filter-repo cannot touch merged PR diffs or refs/pull/* refs on GitHub, so the content would survive.

Since the repo has zero forks and the six merged PRs have no value to outside contributors, the complete and low-risk fix is to publish a fresh repository containing a single squashed initial commit from current main, and keep this repo private as the internal record.

Delete the five stale branches either way.

Verification

Confirmed clean: all 42 commits across every branch and every refs/pull/* head, 259 blobs, roughly 855 KB of content, scanned for PEM blocks, JWTs, access tokens, API keys and high-entropy strings. No .env, *.pem or *.key has ever existed in the tree, and .gitignore had the correct exclusions in the first scaffold commit. The only high-entropy strings present are npm integrity hashes in package-lock.json.

Start by reviewing current main, the five listed branch tips, and the six merged PR diffs, then run tests/setup-scripts.test.ts. Verify the repository history and refs contain no listed internal details or sensitive material, and confirm the final publication uses a single squashed initial commit while stale branches are removed.