[diegosouzapw]

Connection selection can reject a keyless combo through its pin/allowlist while reporting that an API key caused the denial. The selector now carries the actual restriction source into the 403 response and records bounded, hashed allowlist references plus the reason an anonymous fallback was refused.

The existing allowlist intersection, combo pin, quota enforcement, synthetic-credential eligibility and retryable pause response are preserved. Diagnostic formatting also accepts a legacy scalar allowlist without affecting account selection. Two helpers keep the existing file-size ceilings intact.

Refs #15889. This fixes the locally reproduced diagnostic defect. The reporter's original clean-Docker 403/503 sequence has not been reproduced; its underlying cause remains open, and this change does not restore retired providers.

Evidence

• Focused RED: 14 tests, 11 failed/3 passed before implementation. Final contract regression: 124 passed, 0 failed across diagnostics, pins, chat helpers and credential selection. The paid-credit scalar-input regression found during the wider run now passes independently.
• Wider 186-file importer run: 1,512 passed, 9 failed, 4 skipped out of 1,525. Its failures were investigated, not presented as green: one runtime regression and one expected envelope assertion were corrected; exact-base probes reproduced the usage-quota wiring assertion, source-inventory drift, disconnect assertion and catalog timeout/race failures. One catalog refresh failure did not recur on isolated base or head.
• Isolated final 21-case check: 19 passed; remaining disconnect (1 vs 0 fetch) and catalog-body vs catalog_build_timeout failures were both observed on the exact base 3def9ae. A bounded suffix-effort file run was incomplete on both base and head after 480 seconds (9 and 18 passing cases respectively, no failed assertion before cancellation); its full acceptance still needs a completed run.
• Lint, core and noImplicitAny TypeScript, file size, cyclomatic/cognitive ratchets, changelog integrity and test discovery passed. Dashboard typecheck retains the same three error groups proved on the exact base (useModelImportHandlers TS2339/TS2345 and engineConfigSave TS2345). No baseline was widened.
• Independent source review found no remaining blocker in the diagnostic scope. No live Docker/provider smoke was executed.

Base-red inherited: #15306. This PR is left as a draft because the broader regression evidence is partial; it is not a merge-ready claim. No merge or deployment is included.

Mutation coverage follow-up

Registered tests/unit/credential-scope-diagnostics-15889.test.ts in stryker.conf.json so its auth-module checks participate in mutation testing. The strict coverage-drift gate failed with exactly this missing file before the update and passed after it. Normal commit hooks passed. This configuration-only follow-up does not change the original reproduction limitations or the draft status.

[diegosouzapw]

Follow-up validation of the diagnostic-reference CodeQL finding:

The traced value is an allowed connection ID from key policy, a combo pin, or quota scope; this helper does not store password verifiers. The real privacy gap was the publicly reproducible SHA-256 diagnostic fingerprint. References now use HMAC-SHA256 with a private random key generated once per process/module. Same-process correlation remains available; references change in a separate process. Sample bounds, restriction sources, counts and the noauth sentinel are preserved. The log prefix is now hmac-sha256:.

TDD: two new privacy assertions failed before the change (public digest matching and cross-process correlation), while two controls passed. All four now pass. The expanded five-file suite passed 128/128 tests, including the original 14 issue scenarios and auth/chat/combo consumers, with no skips. An independent reviewer reproduced the four privacy tests and found no Standards/Spec blocker.

This is diagnostic privacy hardening, not a claim that password storage was vulnerable. No CodeQL rule or alert was suppressed. The new scan still needs to confirm the alert status, and the original reporter's Docker acceptance remains outstanding; the PR stays a draft.

Published in commit 958b53a82f93eefd488a10654571224b179b3ebd on this PR’s original branch. Validation was repeated after an isolated, normal npm ci with versions matching the unchanged lockfile: 128/128 tests, core typecheck, formatting, test discovery/masking, file size, changelog integrity, cyclomatic complexity and cognitive complexity passed. Global ESLint passed across 12,565 files using four canonical CLI partitions with the original rules/suppressions; actual ESLint selection, complete union, stable hashes and final re-enumeration were verified. All four processes exited 0 and quality:gate passed using that complete report.

The dashboard gate still fails with 19 diagnostics outside its baseline in useModelImportHandlers.ts and engineConfigSave.ts. A new run on the pure pinned release base 3def9ae3105035fa0e7605a7d6842139d3213cae, using the exact same installation, reproduced byte-identical gate output (215 total diagnostics, the same three unbaselined groups). This is recorded as inherited failure, not a green dashboard gate. No baseline, workflow, suppression or rule was changed.

Fresh hosted checks for this commit remain to be evaluated. In particular, HMAC improves diagnostic privacy but does not by itself prove that CodeQL’s alert is resolved; the review thread is left open. No merge or deployment was performed.

GitHub currently reports this PR as CONFLICTING / DIRTY against the release branch. Base-red #15306 remains a separate hold: this follow-up does not merge or rebase the red release tip into the PR. Conflict reconciliation and fresh hosted validation are still required before any merge.

[diegosouzapw]

Fechando esta PR para esvaziar a fila aberta. A branch fix/15889-credential-scope-diagnostics-drain não é apagada. Se ainda precisar entrar, comente aqui que reabrimos.

[diegosouzapw]

Reabrindo. O fechamento foi um engano; esta PR volta para a fila de merge. A branch continua no lugar.

[github-actions]

CI Coverage Report

• Coverage job: skipped
• PR test policy: success

Coverage artifact was not available for this run.