Make Git repository scanning opt-in

.env.example

@@ -2,5 +2,6 @@ PORT=3082
 TRACE_PASSWORD=replace-me
 # Project-scoped ingestion credentials: project:token pairs.
 TRACE_RECEIPT_TOKENS=goonk:replace-with-a-long-random-token
-# Comma-separated id:absolute-path pairs. Mount paths read-only in Docker.
+# Optional: comma-separated id:absolute-path pairs for deliberately mounted
-TRACE_REPOS=goonk:/repos/goonk,flit:/repos/flit
+# read-only repository mirrors. Leave empty when production has no Git repos.
+TRACE_REPOS=

README.md

@@ -7,7 +7,9 @@ cp .env.example .env
 npm start
 ```
 
-Node 24+, no runtime dependencies. Uses built-in `node:sqlite`. Set `TRACE_PASSWORD`; configure read-only repositories through `TRACE_REPOS`. Nothing publishes automatically: export creates a draft under `data/exports/` for manual review.
+Node 24+, no runtime dependencies. Uses built-in `node:sqlite`. Set `TRACE_PASSWORD`. Nothing publishes automatically: export creates a draft under `data/exports/` for manual review.
+
+Git candidate scanning is optional and disabled by default. If an installation deliberately mounts read-only repository mirrors, list their container paths in `TRACE_REPOS`; production receipt ingestion does not require repository access.
 
 ## Deployment receipts v1
 

docker-compose.yml

@@ -8,6 +8,5 @@ services:
     ports: ["${HOST_PORT:-3082}:3082"]
     volumes:
       - trace-data:/app/data
-      - ../goonk:/repos/goonk:ro
 volumes:
   trace-data: