Docs
Observation Mode
Before anything is enforced, Occlude watches. For a window you choose, it records which files every build, test run, ticket and agent session touches, and turns that into an inventory and profile templates.
What it reads
| Source | What it yields | How |
|---|---|---|
| A read-only GitHub app | Tickets, the pull requests that close them and the files each touched; contributors; cadence | Webhooks and the REST API, on a read-only install |
| A recorded build | The files your build and tests actually open | A session in record mode: every path Visible, and the same component that enforces later notes every access |
| A CI step | The same, for builds that run only in your CI | A step that wraps the build in a file-access recorder |
What it produces
- The inventory: files, by toolchain, by task. Which tickets touched which folders, what the build needs that nobody edits, what the tests read.
- Profile templates, derived from the inventory. The last twelve dashboard tickets touched 42 files becomes a profile with those files Visible.
- Proposed Absent paths: secret-pattern detectors and data-seed heuristics run over the tree and propose Absent for every hit.
"Create profile from this" writes the rules. An admin reviews, names and owns them.
What it is not
Nothing is enforced, and nothing is written to your repository. The app removes in one click. A report your security lead finds accurate is the step before the first grant.