ci: baseline three historical github-pat findings by exact fingerprint

Pre-existing, owner-approved, committed 2026-04-22 (before the 2026-11-01 cutover). Exact fingerprints only; no wildcards.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitleaksignore

@@ -0,0 +1,5 @@
+# Approved historical findings (exact fingerprints only, no patterns): github-pat matches in a logging redaction test and a planning document,
+# committed 2026-04-22, before the 2026-11-01 cutover. Any new or different finding is still reported.
+23917e58f261ed49d26aac9424f50bd8803bda13:packages/Logging/Tests/JarvisLoggingTests/RedactTests.swift:github-pat:33
+4335167ebf669ab43d759b86969c543400eb456d:.planning/phases/01-foundations/01-02-keychain-config-logging-PLAN.md:github-pat:1015
+4335167ebf669ab43d759b86969c543400eb456d:.planning/phases/01-foundations/01-02-keychain-config-logging-PLAN.md:github-pat:1372

README.md

@@ -54,46 +54,7 @@ view, the Bus is the only legal way they talk. Subsystems live in
 single-purpose SPM packages; **18 boundary-gate scripts** keep the
 isolation honest.
 
-```mermaid
-flowchart TB
-    User[User<br/>voice / text / hotkey]
-
-    subgraph Swift["Swift host (AppKit + SwiftUI)"]
-        AppDel[AppDelegate<br/>install DAG + lifecycle]
-        Orch[AgentOrchestrator<br/>tool-loop + streaming]
-        Bridge[WebviewBridge<br/>typed JSON Bus]
-        Voice[Voice<br/>wake / STT / TTS]
-        Vision[Vision<br/>camera + frame-attach]
-        Memory[Memory<br/>SQLite + vec + mem0]
-        MCP[MCPRuntime<br/>helpers + in-proc tools]
-        Replay[Replay<br/>turn-by-turn audit log]
-        Boot[BootHealth<br/>NOT FAKED probes]
-    end
-
-    LLM["LLMProvider<br/>Anthropic Opus 4.7 / Ollama"]
-
-    subgraph Web["WKWebView (React + R3F)"]
-        Ring[Particle ring]
-        Chat[Chat panel]
-        DevOv[Dev Overlay]
-    end
-
-    User --> Voice
-    User --> Bridge
-    AppDel --> Vision
-    AppDel --> Orch
-    AppDel --> Voice
-    AppDel --> Boot
-    Voice --> Orch
-    Orch <--> LLM
-    Orch --> MCP
-    Orch --> Memory
-    Orch --> Vision
-    Orch --> Replay
-    Orch --> Bridge
-    Boot --> Bridge
-    Bridge <-->|Bus protocol| Web
-```
+![Jarvis 2-Process Architecture Topology](docs/architecture.png)
 
 The deep architecture doc is [`ARCHITECTURE.md`](ARCHITECTURE.md) (subsystem
 deep-dives, anti-patterns, navigation cheat sheet). The v1.0 typed-API
@@ -136,21 +97,7 @@ asserts the spawn-line ordering AND that `voiceInstallTask` awaits
 `agentInstallTask?.value` (a strictly stronger guarantee than spawn-order
 alone).
 
-```mermaid
-flowchart LR
-    Boot([applicationWillFinishLaunching]) --> Vision[installVision]
-    Boot --> Memory[installMemory]
-    Boot --> MCP[installMCP]
-    Boot --> Replay[installReplay]
-    Vision --> Agent[installAgent]
-    Memory --> Agent
-    MCP --> Agent
-    Replay --> Agent
-    Agent --> Voice[installVoice]
-    Voice --> Probes[registerBootHealthProbes]
-    Probes --> Bridge[Webview handshake]
-    Bridge --> Ready([HUD ready])
-```
+![Jarvis Install Order Sequence](docs/install_order.png)
 
 ## Build & run
 
@@ -216,21 +163,7 @@ subscribers that need it. If a subsystem is degraded, the orchestrator
 **injects a system-prompt preamble** so the agent doesn't promise to
 remember things the memory store can't actually persist.
 
-```mermaid
-flowchart LR
-    In[User input<br/>text / voice transcript] --> Orch[AgentOrchestrator]
-    Health[BootHealth.rollup] -->|degradation preamble| Orch
-    Orch --> Provider[LLMProvider.stream]
-    Provider --> Events[(streaming events<br/>token / thinking / tool-use / stop)]
-    Events --> Bcast[Broadcaster<br/>single consumer]
-    Bcast --> Tx[Transcript]
-    Bcast --> Mem[Memory extractor]
-    Bcast --> Dev[DevOverlay]
-    Bcast --> Voice[Voice / TTS]
-    Bcast --> Bus[WebviewBridge → HUD]
-    Orch --> Tools[MCP tool calls]
-    Tools --> Provider
-```
+![Jarvis Agent Turn Lifecycle](docs/turn_lifecycle.png)
 
 ## Boot-health probes
 
@@ -241,32 +174,7 @@ failures turn the menu-bar icon **red**, raise a non-dismissible HUD
 banner, and inject the degradation preamble into the agent's system
 prompt.
 
-```mermaid
-flowchart LR
-    M[MemoryBootHealthProbe<br/>vec0 + FTS5 reachable]
-    A[AnthropicBootHealthProbe<br/>keychain has API key]
-    O[OllamaBootHealthProbe<br/>service reachable + model loaded]
-    Vc[VoiceBootHealthProbe<br/>audio graph alive]
-    Vi[VisionBootHealthProbe<br/>AVCapture authorized]
-    Mc[MCPBootHealthProbe<br/>helper apps + in-proc tools]
-    R[ReplayBootHealthProbe<br/>WAL writable]
-    W[WebviewBootHealthProbe<br/>handshake completed]
-    Roll[BootHealthOrchestrator.rollup]
-    Icon[Menu-bar icon<br/>red on critical]
-    Banner[Non-dismissible banner]
-    Pre[Agent system-prompt<br/>degradation preamble]
-    M --> Roll
-    A --> Roll
-    O --> Roll
-    Vc --> Roll
-    Vi --> Roll
-    Mc --> Roll
-    R --> Roll
-    W --> Roll
-    Roll --> Icon
-    Roll --> Banner
-    Roll --> Pre
-```
+![Jarvis Boot-Health Probe Ladder](docs/boot_health.png)
 
 ## Project culture