Integrate indexed sensitivity propagation

docs/roadmap/implementation.md

@@ -293,7 +293,7 @@ Roadmap candidate 6, isolated algorithm. Add private
 Validate: focused propagation tests and the everyday check. Match/output-sized
 work may still be large for broad dependencies; no blanket linear guarantee.
 
-## Stage 11: Integrate worklist sensitivity into publication
+## Stage 11: Integrate worklist sensitivity into publication — Complete
 
 Roadmap candidate 6, integration. Owner: engine `secret.go`.
 

internal/engine/secret.go

@@ -79,28 +79,7 @@ func classifySecretPaths(schema *schemaDescriptor, predicate func(Path) bool, me
 			secret[pointer] = true
 		}
 	}
-	for {
+	return closeSecretDependencies(paths, secret, dependencies, inherited)
-		changed := false
-		for _, dependency := range dependencies {
-			if secretIntersectsPath(paths, secret, dependency.dependency) && !secret[dependency.target.String()] {
-				secret[dependency.target.String()] = true
-				changed = true
-			}
-		}
-		for _, link := range inherited {
-			if pathIsSecret(secret, link.dependency) && !secret[link.target.String()] {
-				secret[link.target.String()] = true
-				changed = true
-			}
-			if pathIsSecret(secret, link.target) && !secret[link.dependency.String()] {
-				secret[link.dependency.String()] = true
-				changed = true
-			}
-		}
-		if !changed {
-			return secret
-		}
-	}
 }
 
 func addSecretPath(paths map[string]Path, pointer string) {
@@ -109,19 +88,6 @@ func addSecretPath(paths map[string]Path, pointer string) {
 	}
 }
 
-func secretIntersectsPath(paths map[string]Path, secret map[string]bool, candidate Path) bool {
-	for pointer := range secret {
-		classified, ok := paths[pointer]
-		if !ok {
-			continue
-		}
-		if pathContains(classified, candidate) || pathContains(candidate, classified) {
-			return true
-		}
-	}
-	return false
-}
-
 func schemaSecretRoot(schema *schemaDescriptor, path Path) (Path, bool) {
 	if schema == nil || schema.root == nil || !path.valid() {
 		return Path{}, false

internal/engine/secret_propagation_test.go

@@ -89,7 +89,7 @@ func referenceSecretDependencyClosure(paths map[string]Path, seed map[string]boo
 	for {
 		changed := false
 		for _, dependency := range dependencies {
-			if secretIntersectsPath(paths, secret, dependency.dependency) && !secret[dependency.target.String()] {
+			if referenceSecretIntersectsPath(paths, secret, dependency.dependency) && !secret[dependency.target.String()] {
 				secret[dependency.target.String()] = true
 				changed = true
 			}
@@ -110,6 +110,19 @@ func referenceSecretDependencyClosure(paths map[string]Path, seed map[string]boo
 	}
 }
 
+func referenceSecretIntersectsPath(paths map[string]Path, secret map[string]bool, candidate Path) bool {
+	for pointer := range secret {
+		classified, ok := paths[pointer]
+		if !ok {
+			continue
+		}
+		if pathContains(classified, candidate) || pathContains(candidate, classified) {
+			return true
+		}
+	}
+	return false
+}
+
 func secretPaths(paths ...Path) map[string]Path {
 	result := make(map[string]Path, len(paths))
 	for _, path := range paths {