Classify the deploy tooling's fleet names

The release scripts landed in the previous commit carrying the fleet's real
GCP instance names, disk paths, and Secret Manager entries, which the
reference check reads as unclassified infrastructure references and which
turned the gate red on main.

Classified rather than renamed: these are the identifiers the infrastructure
actually holds, so a rename here would produce a script naming resources
that do not exist. They change when the infrastructure is renamed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KnhfrafYx5ZGaMbzZEJQ2d

Co-Authored-By

Claude Opus 5 (1M context) <noreply@anthropic.com>

Claude-Session

https://claude.ai/code/session_01KnhfrafYx5ZGaMbzZEJQ2d

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

pushed

by user · WAL seq 391 · 2026-08-25T14:57:05.323404Z

Changed files

• modified ops/ci/allowed-sarah-references.txt

Diff

1 file changed, +7 -0

# Deploy tooling names the fleet's real GCP instances, disk paths, and Secret

# Manager entries. These are the identifiers the infrastructure actually holds,

# so a rename here would name resources that do not exist. The names change

# when the infrastructure is renamed, not before.

^ops/deploy/fleet-startup\.template\.sh:

^ops/deploy/release-to-production\.sh:

# Persona source, evaluation, and program artifacts.

^priv/sarah/