# sweep-targets.txt — one repo path per line for the nightly Path B sweep.
# Lines starting with '#' and blank lines are ignored. ~ is expanded.
# Override at runtime with the TARGETS env var (space-separated paths).
#
# NOTE: the testbed canary corpus is ALWAYS scanned by nightly_sweep.sh as the
# anti-complacency check; do NOT list it here (it is handled separately).
#
# TODO (Phase 5): add the first real hardened repo here once it is cloned on the
# VM (candidates: payments-dashboard / proposal-system / procurement-ingest).
#
# Deliberately EMPTY by default = canary-only nights. Do NOT scan ~/orchestrator:
# it holds ~/orchestrator/.env with live provider API keys, which the agentic
# detector could surface into sweep reports / Slack. Only add repos with no
# plaintext secrets (or scrub/exclude secret files first).
# ~/orchestrator