add blocked-string rewrite validation fixtures

DEVELOPER_GUIDE.md

@@ -31,9 +31,11 @@ go test ./...
 ## Project structure
 
 - `fixtures.go`: base repo creation and command helpers.
+- `sanitize_fixtures.go`: reusable sanitize/rewrite fixtures plus blocked-string scan/assert helpers.
 - `scenarios.go`: fluent scenario builder and predefined multi-repo scenarios.
 - `snapshots.go`: snapshot/restore utilities for expensive test setup reuse.
 - `fixtures_test.go`: external package tests (`testutil_test`) that validate public API usage.
+- `sanitize_fixtures_test.go`: coverage tests for blocked-string detection/removal across content/history/refs/paths.
 - `usb_fixtures.go` / `usb_fixtures_test.go`: USB volume root and `.git-fire` config helpers for backup-mode style tests.
 - `scenarios_test.go`: package-internal tests for scenario/snapshot behavior.
 
@@ -74,6 +76,18 @@ Common usage split:
 - `CreateTestRepo`: fast setup for single-repo state.
 - `NewScenario`: multi-repo topologies and fluent setup.
 - `SnapshotRepo`/`RestoreSnapshot`: performance optimization for repeated expensive setups.
+- `CreateRewriteValidationFixture` + blocked-string assertions: sanitize/rewrite validation against file contents, commit messages, refs, and paths.
+
+Sanitize/rewrite focused validation loop:
+
+```bash
+# Run only sanitize/rewrite fixture and assertion tests.
+go test ./... -run 'RewriteValidation|BlockedStringCoverage'
+
+# Full required local gate.
+go vet ./...
+go test ./...
+```
 
 ## Adding new helpers
 

README.md

@@ -30,6 +30,7 @@ go get github.com/git-fire/git-testkit
 - Repository fixtures (`CreateTestRepo`, `CreateBareRemote`, `RunGitCmd`)
 - Scenario builders for common multi-repo states (`NewScenario`, conflict/worktree helpers)
 - Snapshot helpers for capturing and restoring repository state in tests
+- Sanitize/rewrite validation helpers for blocked-string coverage across content/history/refs/paths
 
 ## API overview
 
@@ -38,6 +39,8 @@ go get github.com/git-fire/git-testkit
 - `NewScenario(t)` returns a fluent builder for multi-repo test topologies.
 - `SnapshotRepo(t, path)` and `RestoreSnapshot(t, snap)` speed up repeated fixture setup.
 - `IsDirty`, `GetCurrentSHA`, `GetBranches`, `GetRemotes` provide common assertions/helpers.
+- `CreateRewriteValidationFixture(t, opts)` seeds blocked strings across file contents, commit messages, refs, and paths.
+- `AssertBlockedStringCoverageDetected` and `AssertBlockedStringCoverageRemoved` validate sanitize/rewrite coverage before/after rewriting.
 
 ## Quickstart for using in tests
 
@@ -113,6 +116,33 @@ func TestUsingSnapshot(t *testing.T) {
 }
 ```
 
+### Validate sanitize/rewrite coverage
+
+```go
+func TestRewriteRemovesBlockedString(t *testing.T) {
+	fixture := testutil.CreateRewriteValidationFixture(t, testutil.RewriteValidationFixtureOptions{
+		Name:          "rewrite-fixture",
+		BlockedString: "blockedtoken",
+	})
+
+	// Confirm fixture coverage before running your rewrite logic.
+	testutil.AssertBlockedStringCoverageDetected(t, fixture.RepoPath, fixture.BlockedString)
+
+	// Run your sanitizer/rewrite command against fixture.RepoPath here.
+	// Example:
+	// testutil.RunGitCmd(t, fixture.RepoPath, "filter-branch", ...)
+
+	// Validate the blocked string is removed from all tracked surfaces.
+	testutil.AssertBlockedStringCoverageRemoved(t, fixture.RepoPath, fixture.BlockedString)
+}
+```
+
+Run just sanitize/rewrite-focused tests:
+
+```bash
+go test ./... -run 'RewriteValidation|BlockedStringCoverage'
+```
+
 ## Notes
 
 - Snapshots are intended for deterministic test fixtures and only restore regular files/directories.

doc.go

@@ -11,6 +11,8 @@
 //     remote, diverged clones, worktrees, conflict states).
 //   - [SnapshotRepo] / [RestoreSnapshot] for capturing expensive fixture state
 //     once and restoring it cheaply across subtests.
+//   - [CreateRewriteValidationFixture] plus blocked-string assertions for
+//     sanitize/rewrite validation across content, commit history, refs, and paths.
 //
 // All helpers integrate with Go's testing.T: repositories are created inside
 // t.TempDir() and cleaned up automatically, and setup failures call t.Fatalf