Exempt ai-memory's SHA-256 rejection fingerprints (#116's evidence) from generic-api-key

[seathatflowsinourveins]

This unblocks #116 without touching its branch.

#116's secret-scan fails on 4 generic-api-key findings. All four are "key": "<64-hex>" lines under learning.report.aggregate.repeated_rejection_fingerprints[] in observability/memory-scheduled-20260923.json. Each sits beside a count, in a list whose other entries use key for plain category names.

Why they are digests, not secrets. They are ai-memory's rejection_fingerprint values. The function is at akitaonrails/ai-memory crates/ai-memory-store/src/auto_improve.rs, around line 1450, and returns hex_sha256 over the rejection record's normalized target_path, kind, operation, edit_mode, reason and summary. The module doc describes "a whitespace/case-insensitive fingerprint so the telemetry report can spot the same proposal being re-staged and re-rejected."

Exemption. It follows this config's reviewed pattern: scoped to one rule, one exact file (the path does not exist on main yet, so the entry is inert until #116 lands), and whole anchored lines only (^\s*"key":\s*"[0-9a-f]{64}",?\s*$).

Regression tests.

• test_e: fingerprints in that file are not flagged.
• test_e2: an api_key in the same file, and the same lines in another file, are still detected.
• Both were mutation-checked.

Checks.

• gitleaks dir over Record scheduled memory learning and daily native lifecycle evidence #116's four added files with this config: no leaks; the current config finds 4.
• validate.py, evidence_manifest --check, the gate and tests.test_gitleaks_config pass.
• The full gitleaks dir is clean.

After this merges, #116 needs to merge main (which also brings the required verdict-review-gate job).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-24T01:50:16.080869Z	bab77ab	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bab77aba2c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[seathatflowsinourveins]

An independent review (evidence-reviewer, Opus at max) passed, and I adopted its optional hardening at c510b498:

• the entry pins the 4 reviewed digests by value (the QuantConnect precedent), so a later 64-hex value under key in this file is still a finding;
• test_e2 now asserts that an unreviewed key value and an api_key in the reviewed file are both detected, along with the same lines in another file;
• both new tests were mutation-checked again: changing a pinned digest makes test_e fail, and loosening back to any 64-hex makes test_e2 fail.

The reviewer confirmed at upstream HEAD 24ae5dd0 that rejection_fingerprint is hex_sha256, exported as key via SELECT normalized_fingerprint AS key (reader.rs). Under this config, a gitleaks dir over #116's added files reports no leaks; the old config finds 4. The full gitleaks dir is clean. Auto-merge is on.