be nice if i could test content of this.  think i'm going to give up on visibility limitations.  wish golang didn't require changing every fucking instance of a reference when you change its visibility... time to learn refactoring tools.
refactor all of the gitattribs structures to full visibility using gofmt.
oh, good.  gofmt is totally fucking useless as a refactor tool because it's not smart enough to fix either struct defintions or literals.  so, it does about... 60% of the job, and then leaves me with uncompilable code and crawling back to fucking sed anyway.  great, thanks.
`gofmt -w -r 'a.lines -> a.Lines' *`, again, observe how great this tool is, i can't compile anymore
literally so much as even
assert we got the desired pattern written down.  remove debug printf.
do git staging from the KeepSecret command.  start proposing tests for that.  doesn't fly right now... realizing control flow in goconvey is having a bit of an argument with what i thought i was doing with tmpdirs, going to have to hammer that out before going any further.
can now goconvey with tempdirs.  full steam ahead.
remove all those noisy debugs.
fix test output to what git will actually say.  i was just stabbing blindly before.
add a check that files specified to the KeepSecret command actually exist.

... actually, not 100% sure this is a correct behavior, but let's run with it for now.  maybe in the future we add a "--ignore-missing" option in case you do want to tell grypt about files that should be secret before they actually exist.
thinking out loud about how to test over diffs.  i don't exactly want to include the 'index' line of the output, that's nonsense fragility.  maybe grepping out the '+' and '-' prefixed lines will do approximately the right thing?
trial and error research into how to best extract reliably diffs from git without letting any possible user config introduce ambiguity.  messy commit.  figure out later.  tired.  also, all of the KeepSecret behavior that actually involves encrypt can't be expected to work until we do all the other hooks for git that actually do crypto, so we're going to need to focus fire elsewhere before really finishing this section for good.
extract out those half-baked git inspection experiments into proper functions, give them their own test coverage, and then use them in the KeepSecret test.

these are a pain to write, but I'm very happy to do it: these are very, very important bits to get hammered down.  We don't want to have any accidental last-mile failure moments with staging cleartext and not noticing it, like engimail's recent hullaballoo with forgetting to encrypt bcc emails -- and these test utilities will help keep us covered from that category.
we're going to have to leave behind the rest of the keepSecret test until after we get more crypto connected to where git can call it, so toss some skipped steps in there to indicate we need to come back.
todo for some more coverage we need later.  stability rather than a correctness thing though.
more testing for the git inspections utils -- making sure the staged changes thing still works like I think it does when the diffs are on top of existing files.
outline plumbing commands.
fiddled around with the gitconfig a little more; keeping comments.

notice that PutGitFilterConfig isn't actually being called anywhere yet.... yeah, about that.  right now if you, say, put it at the front of KeepSecret, you'll get wicked error messages from git about commands not found.

we need to figure out how we're going to deal with tests where our execs of git need to exec grypt again.  i'm loathe to teach the test code how to drive the whole compiler, but i don't really see a lot of alternatives.
research driving a build of grypt from within its own tests.  we need some way to satisfy acceptance testing where test code execs git and git execs back to grypt when running the filters; this feels very convoluted, but we have no apparent alternative that's cleaner, so here we go.