Canonical all-modified-files packager and secret scanning

Problem

The historical all-modified-files evidence packager lived only as a copied handoff script.

Its private-key scanner matched the fragment:

BEGIN PRIVATE KEY

instead of a complete PEM header. A regression test containing that literal therefore caused a false secret finding even though the candidate contained no credential.

A task had to use a temporary evidence-only compatibility packager to complete its bundle. That is acceptable as an emergency workaround but not as a durable unattended path.

Repository source of truth

The canonical implementation is now:

active-runtime/app/aios_all_modified_files_packager.py

It preserves the historical output/bundle schemas:

aios.all-modified-files.bundle.v1
aios.all-modified-files.bundle-summary.v1
aios.modified-documents.index.v1

and the host-visible status lines:

ALL_MODIFIED_FILES_BUNDLE=PASS
ALL_MODIFIED_FILES_BUNDLE_PATH=...
ALL_MODIFIED_FILES_BUNDLE_SHA256=...

Future governed tasks should use this repository version instead of copying an unversioned scanner.

Secret scanning invariant

Private-key detection requires a complete PEM header:

-----BEGIN [RSA|EC|DSA|OPENSSH ]PRIVATE KEY-----

The following source/test/document text is not secret material and must remain packageable:

BEGIN PRIVATE KEY
PRIVATE KEY
PEM private-key header

Bearer and key/value credential detection remains fail-closed:

Authorization: Bearer <20+ token chars>
password=<12+ non-space chars>
passwd=<12+ non-space chars>
secret=<12+ non-space chars>
api_key=<12+ non-space chars>
api-key=<12+ non-space chars>

Tests construct the real PEM header dynamically so the scanner's own test source does not contain a literal credential-looking header.

Bundle integrity

The packager continues to enforce:

exact base→candidate ancestry;
before/after file capture;
rename/copy/delete handling;
path traversal denial;
execution evidence symlink denial;
secret scan over repository before/after and execution evidence;
document index;
SHA-256 closure;
ZIP without symlinks.

No secret finding is downgraded to a warning.

Migration

The old handoff script may remain for historical reproducibility, but new handoffs should call the repository packager from the verified candidate lineage.

A temporary compatibility scanner is no longer needed once this candidate is in the lineage.

2.5 KiB Raw Blame History