From e591e97f2268c367634b4ddb86584f9048b6f75a Mon Sep 17 00:00:00 2001
From: Eric Rakestraw <eric@rakestraw.us>
Date: Fri, 9 Oct 2026 03:42:29 +0000
Subject: [PATCH] Integrate indexed sensitivity propagation

---
 docs/roadmap/implementation.md             |  2 +-
 internal/engine/secret.go                  | 36 +---------------------
 internal/engine/secret_propagation_test.go | 15 ++++++++-
 3 files changed, 16 insertions(+), 37 deletions(-)

diff --git a/docs/roadmap/implementation.md b/docs/roadmap/implementation.md
index 24d6a1d..50f11cc 100644
--- a/docs/roadmap/implementation.md
+++ b/docs/roadmap/implementation.md
@@ -293,7 +293,7 @@ Roadmap candidate 6, isolated algorithm. Add private
 Validate: focused propagation tests and the everyday check. Match/output-sized
 work may still be large for broad dependencies; no blanket linear guarantee.
 
-## Stage 11: Integrate worklist sensitivity into publication
+## Stage 11: Integrate worklist sensitivity into publication — Complete
 
 Roadmap candidate 6, integration. Owner: engine `secret.go`.
 
diff --git a/internal/engine/secret.go b/internal/engine/secret.go
index 7490fa3..483c0ea 100644
--- a/internal/engine/secret.go
+++ b/internal/engine/secret.go
@@ -79,28 +79,7 @@ func classifySecretPaths(schema *schemaDescriptor, predicate func(Path) bool, me
 			secret[pointer] = true
 		}
 	}
-	for {
-		changed := false
-		for _, dependency := range dependencies {
-			if secretIntersectsPath(paths, secret, dependency.dependency) && !secret[dependency.target.String()] {
-				secret[dependency.target.String()] = true
-				changed = true
-			}
-		}
-		for _, link := range inherited {
-			if pathIsSecret(secret, link.dependency) && !secret[link.target.String()] {
-				secret[link.target.String()] = true
-				changed = true
-			}
-			if pathIsSecret(secret, link.target) && !secret[link.dependency.String()] {
-				secret[link.dependency.String()] = true
-				changed = true
-			}
-		}
-		if !changed {
-			return secret
-		}
-	}
+	return closeSecretDependencies(paths, secret, dependencies, inherited)
 }
 
 func addSecretPath(paths map[string]Path, pointer string) {
@@ -109,19 +88,6 @@ func addSecretPath(paths map[string]Path, pointer string) {
 	}
 }
 
-func secretIntersectsPath(paths map[string]Path, secret map[string]bool, candidate Path) bool {
-	for pointer := range secret {
-		classified, ok := paths[pointer]
-		if !ok {
-			continue
-		}
-		if pathContains(classified, candidate) || pathContains(candidate, classified) {
-			return true
-		}
-	}
-	return false
-}
-
 func schemaSecretRoot(schema *schemaDescriptor, path Path) (Path, bool) {
 	if schema == nil || schema.root == nil || !path.valid() {
 		return Path{}, false
diff --git a/internal/engine/secret_propagation_test.go b/internal/engine/secret_propagation_test.go
index a51415b..988ab56 100644
--- a/internal/engine/secret_propagation_test.go
+++ b/internal/engine/secret_propagation_test.go
@@ -89,7 +89,7 @@ func referenceSecretDependencyClosure(paths map[string]Path, seed map[string]boo
 	for {
 		changed := false
 		for _, dependency := range dependencies {
-			if secretIntersectsPath(paths, secret, dependency.dependency) && !secret[dependency.target.String()] {
+			if referenceSecretIntersectsPath(paths, secret, dependency.dependency) && !secret[dependency.target.String()] {
 				secret[dependency.target.String()] = true
 				changed = true
 			}
@@ -110,6 +110,19 @@ func referenceSecretDependencyClosure(paths map[string]Path, seed map[string]boo
 	}
 }
 
+func referenceSecretIntersectsPath(paths map[string]Path, secret map[string]bool, candidate Path) bool {
+	for pointer := range secret {
+		classified, ok := paths[pointer]
+		if !ok {
+			continue
+		}
+		if pathContains(classified, candidate) || pathContains(candidate, classified) {
+			return true
+		}
+	}
+	return false
+}
+
 func secretPaths(paths ...Path) map[string]Path {
 	result := make(map[string]Path, len(paths))
 	for _, path := range paths {