statecraft.
Catalog/action-gate

001-secret-detector-parity

Secret detector parity: a regex-free detector registry with ids and offsets, and an opt-in deny-by-default terminal check

Lifecycle approvedImplementation completeVerification unknownQualification unknown

Converges the family's secret detection upward into action-gate-core. aicortex-gate's detectors (aicortex spec 013 B-4: 24 published-prefix rules, 7 private-key armour markers including the PGP block, a URL credential detector, a JWT detector, and a Q16 fixed-point entropy detector) move here with their stable detector ids and byte offsets, joined by action-gate's own `api_key =` style assignment rule, as one pure, regex-free registry. A new `SecretScanCheck` reports which detector fired and where without echoing the value. The published `SecretsCheck` and the gate's allow-when-silent default are unchanged; a documented, opt-in `DenyByDefault` terminal check lets a consumer close the gate. Golden vectors ported from aicortex's corpus ship with the crate so aicortex spec 047 can assert parity by vector id. Semver-minor (0.2.0).

Read the full pinned specification ↗

Relationships

depends on

Claimed units

  • establishes
    {
  "kind": "file",
  "path": "crates/core/src/secrets.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/core/testdata/secret-vectors.json"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/core/tests/secret_vectors.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/core/tests/secret_properties.rs"
}
  • extends
    {
  "nature": "additive",
  "spec": "000-bootstrap",
  "unit": {
    "kind": "file",
    "path": "crates/core/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "000-bootstrap",
  "unit": {
    "kind": "file",
    "path": "crates/core/Cargo.toml"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "000-bootstrap",
  "unit": {
    "kind": "file",
    "path": "Cargo.toml"
  }
}

Source headings

  1. 001: Secret detector parity
  2. 1. Purpose
  3. 2. Scope
  4. 3. Behavior
  5. 3.1 The registry
  6. 3.2 Findings and offsets
  7. 3.3 Redaction-safe reporting
  8. 3.4 Dependencies: no `regex`
  9. 3.5 Backwards compatibility
  10. 3.6 Deny-by-default terminal check
  11. 3.7 Golden vectors
  12. 4. Functional requirements
  13. 5. Acceptance criteria
  14. 6. Resolved decisions
  15. 7. Provenance
  16. Verification
  17. Profile upgrade record (2026-10-02)
  18. Engine upgrade record (2026-10-02)

Frozen anchors

No frozen anchors declared.