chore(secrets): scrub hardcoded /Users/sem paths — green the no-secrets gate

[webdevtodayjason]

Problem

The CI no-secrets gate (scripts/check-no-secrets.sh) has been red on main across the last 8 releases (v3.3.4–v3.3.12) — it forbids absolute /Users/sem paths in committed files, and three tracked files carry them (introduced in #39 and #45).

What changed (3 files, the complete tracked violation set)

File	Change
.subctl/docs/hermes-compact-and-skills-findings.md	/Users/sem/code/hermes-agent → ~/code/hermes-agent (doc)
ORCHESTRATION.md	/Users/sem/.local/bin/subctl, /Users/sem/bin/subctl → ~/... (doc)
.claude/settings.json	Read(/Users/sem/code/subctl/components/evy/node_modules/**) → Read(/components/evy/node_modules/**)

Note on the .claude/settings.json rule

Per Claude Code's gitignore-style permission semantics, a single leading slash is project-root-relative, not filesystem-absolute (that needs //). So the old rule resolved to <project-root>/Users/sem/code/subctl/components/evy/node_modules/** and never matched anything — it was a dead rule. The new project-root-anchored Read(/components/evy/node_modules/**) both passes the gate and restores the rule's intended function (allow reading evy's node_modules for pi-ai source inspection).

Verification

• CI-equivalent scan (all forbidden patterns — emails, API keys, home paths — over git ls-files): clean.
• .orchestration/* and .codegraph/* hits in a local working-tree scan are gitignored (absent from CI's fresh clone), so they don't affect CI.
• .claude/settings.json validated as well-formed JSON.

Follow-up (not in this PR)

The gate script scans the whole working tree (grep -r .) with a manual dir blocklist, so a local run still false-fails on gitignored .orchestration//.codegraph/. Hardening it to scan git ls-files only would eliminate that CI-vs-local divergence — happy to do that separately if wanted.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Improved portability of configuration and documentation by updating path references to use generic formats instead of environment-specific paths.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 294364d7-4a18-481e-a8c5-74277fd47e88

📥 Commits

Reviewing files that changed from the base of the PR and between fa8c0dd and e70a350.

📒 Files selected for processing (3)

• .claude/settings.json
• .subctl/docs/hermes-compact-and-skills-findings.md
• ORCHESTRATION.md

---

📝 Walkthrough

Walkthrough

This pull request removes hardcoded user-specific directory paths from three files across configuration and documentation. A Claude IDE settings file, a documentation path attribution, and an orchestration reference are all updated to use portable path formats instead of absolute user-home directories.

Changes

Path Normalization

Layer / File(s)	Summary
Normalize absolute user paths to portable path formats .claude/settings.json, .subctl/docs/hermes-compact-and-skills-findings.md, ORCHESTRATION.md	Claude IDE read permission uses project-relative components/evy/node_modules/** path; documentation source reference and orchestration PATH collision description both use home-directory-relative ~/ paths instead of absolute /Users/sem/... references.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 Three paths once hardcoded to one faithful soul,
Now freed to roam on machines of all whole,
From /Users/sem to ~/ we fly,
Portable and pretty beneath the sky! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically identifies the main change: removing hardcoded user paths to fix CI failures, accurately reflecting all three file modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/scrub-tracked-home-paths

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}