the lock records what the source could be read as, and check audits it

Access is verified once, at fetch, and the copy is durable — so whether an
adoption is still legitimate rests on the relative visibility of two
repositories, which somebody can change with a checkbox a year later without ever
seeing the adoption. The lock gains an optional fourth field and check turns that
from a silent permanent hazard into something that runs.

It costs nothing at add time, because the anonymous request already happened to
decide whether to warn and the answer was being thrown away, and one request per
run at check time rather than one per document, because only our own visibility
has to be current. The stored value decays in both directions, so a source
recorded not-public is re-probed only when the alarm would fire, and a source that
has since gone public updates the lock and says nothing.

Fixes a bug found while testing the alarm rather than after shipping it.
sourceVisibility returned public whenever no credential was configured, which is
sound at add time — the fetch had just succeeded anonymously — and wrong in the
audit, where it is a probe and not a fetch: it would have silently cleared real
alarms. Probing is now its own function that always asks with no credential,
because what matters is what a stranger can read and not what we can.

The value is recorded as public or not-public and never private: an anonymous
request tells those apart and nothing finer, so it cannot see two repositories
private to different people, which is the case that genuinely widens access.

Three-field locks still load, and unknown visibility round-trips as absent rather
than as a value.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris

internal/external/external.go

@@ -119,6 +119,7 @@ func Add(root, raw, override string, out io.Writer) error {
 	if body == nil {
 		return fmt.Errorf("%s: unexpected 304 for a document we do not have", raw)
 	}
+	vis := sourceVisibility(cfg, body.url)
 
 	// A document that is here but unlocked was fetched by hand before the tool
 	// existed. Supplying its URL is the only way it can ever be locked, because
@@ -145,7 +146,7 @@ func Add(root, raw, override string, out io.Writer) error {
 		}
 		// Identical, so the assertion a lock makes — this local copy is the one
 		// being served — is verified rather than assumed.
-		locks.Put(lock.Record{Path: rel, URL: body.url, ETag: etag})
+		locks.Put(lock.Record{Path: rel, URL: body.url, ETag: etag, Visibility: vis})
 		if err := locks.Save(); err != nil {
 			return err
 		}
@@ -161,14 +162,14 @@ func Add(root, raw, override string, out io.Writer) error {
 	if err := os.WriteFile(dest, body.data, 0o644); err != nil {
 		return err
 	}
-	locks.Put(lock.Record{Path: rel, URL: body.url, ETag: etag})
+	locks.Put(lock.Record{Path: rel, URL: body.url, ETag: etag, Visibility: vis})
 	if err := locks.Save(); err != nil {
 		return err
 	}
 
 	fmt.Fprintf(out, "adopted  %s\n", rel)
 	fmt.Fprintf(out, "  from   %s\n", body.url)
-	warnIfNotPublic(cfg, root, body.url, out)
+	warnIfNotPublic(root, body.url, vis, out)
 	notePublishedSurface(body.url, out)
 	if etag == "" {
 		fmt.Fprintf(out, "  etag   (none served — check cannot ask conditionally)\n")
@@ -186,26 +187,50 @@ func Add(root, raw, override string, out io.Writer) error {
 // moment of adoption. The tool can see half of that — whether this fetch needed
 // a credential — and cannot see the other half, which is who can read the
 // repository the copy is landing in. It reports the half it knows.
-func warnIfNotPublic(cfg *config.Config, root, raw string, out io.Writer) {
+// sourceVisibility reports what a document could be read as at the moment it was
+// fetched, given that the fetch had just succeeded.
+//
+// It is free: when no credential was configured the fetch itself was anonymous,
+// so the answer is already known; when one was, the extra request is the one the
+// warning needed anyway.
+//
+// It must not be used to re-check a document we are not fetching. "No credential
+// configured" says nothing about whether a probe would succeed, and treating it
+// as public there would silently clear a real alarm.
+func sourceVisibility(cfg *config.Config, raw string) string {
+	if u, err := url.Parse(raw); err == nil && cfg.TokenFor(u.Host) == "" {
+		return lock.Public // it came back without a credential
+	}
+	return probeAnonymous(raw)
+}
+
+// probeAnonymous asks, with no credential at all, whether a URL can be read.
+func probeAnonymous(raw string) string {
 	req, err := http.NewRequest(http.MethodHead, raw, nil)
 	if err != nil {
-		return
-	}
-	if cfg.TokenFor(req.URL.Host) == "" {
-		return // no credential was used, so the fetch was already anonymous
+		return ""
 	}
 	resp, err := client.Do(req)
 	if err != nil {
-		return
+		return ""
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
+		return lock.Public
+	}
+	return lock.NotPublic
+}
+
+// warnIfNotPublic says something when adopting would widen who can read a
+// document.
+//
+// Adopting is copying, so a document from a repository somebody may not read
+// ends up in a repository they may, and the publisher loses control of it at the
+// moment of adoption.
+func warnIfNotPublic(root, raw, vis string, out io.Writer) {
+	if vis != lock.NotPublic {
 		return
 	}
-
-	// The source is private. Whether that matters depends on where it is
-	// landing, and a warning on every adoption a private repository performs is
-	// noise in exactly the workflow that is legitimate.
 	public, known := selfVisibility(root)
 	if known && !public {
 		fmt.Fprintf(out, "  NOTE   private source, and this repository is not public either.\n")
@@ -219,8 +244,7 @@ func warnIfNotPublic(cfg *config.Config, root, raw string, out io.Writer) {
 		fmt.Fprintf(out, "         repository — no usable origin. Check before you commit.\n")
 		return
 	}
-	fmt.Fprintf(out, "  WARN   this needed a credential — anonymously it is %s — and THIS\n", resp.Status)
-	fmt.Fprintf(out, "         repository is public.\n")
+	fmt.Fprintf(out, "  WARN   this needed a credential, and THIS repository is public.\n")
 	fmt.Fprintf(out, "         Confidentiality does not travel with the copy: adopting this\n")
 	fmt.Fprintf(out, "         publishes it to everyone. Do not adopt from a source less\n")
 	fmt.Fprintf(out, "         readable than the repository you are adopting into.\n")
@@ -307,6 +331,8 @@ func Check(root string, out io.Writer) error {
 		staged += did
 		results = append(results, st)
 	}
+	auditPrinted := &strings.Builder{}
+	auditExposure(root, locks, auditPrinted)
 	if err := locks.Save(); err != nil {
 		return err
 	}
@@ -327,6 +353,7 @@ func Check(root string, out io.Writer) error {
 	if staged > 0 {
 		fmt.Fprintf(out, "\n%d staged in %s — apply or discard; nothing here drifts into being kept.\n", staged, PoladDir)
 	}
+	io.WriteString(out, auditPrinted.String())
 	return nil
 }