Apply verified event scopes to CI secret scans

[seathatflowsinourveins]

Scope

Scan every commit and merge-resolution patch in verified PR and normal-push ranges, while refusing unverified push boundaries. Record the exact scanner options in timing receipts and describe the implemented manual backstop accurately.

• Base commit: 66584736c076873ca7e5898e3bd8111cca1a1447.
• Candidate: 3b329a3ff306fcb4297bffad075e5d7d58afd6d8.
• Lane: lane:foundation.
• Owned paths: the CI workflow, scanner configuration comments, event-range helper and metric writer, their tests/docs, native evidence registrations, the helper's existing read-policy grant, and the immutable advisory baseline and dated observation.

PR merge checkouts use their actual first parent; PR head checkouts use the payload base's merge base. Normal pushes use verified available ancestor before..after. Every range uses --diff-merges=first-parent, which emits merge patches without restricting parent traversal. The actual emitted Git selection must be nonempty. Zero-before, unavailable-before and nonancestor-before events fail closed before emitting scanner inputs; successful tip-only fallback is removed.

The required Gitleaks step remains uncapped with the exact generated-explorer exclusion, redaction, native timing and status propagation. Both duplicate history acceptance scans now include merge patches and have no legacy 2 MB cap. The report-only Betterleaks history step receives the same resolved options. Both timing writers record those options. Only manual workflow_dispatch is wired as a CI backstop in this PR.

SOTA sources

• Native dated advisory mechanism at #1030: advisory-gate-deltas.md specifies immutable baselines, append-only dated observations and native GitTree/derive_ci_protected accounting; the owning integration test checks historical bytes and the latest native counts/shapes. The observation uses those existing native interfaces, not a replacement inventory.
• Gitleaks v8.30.1: sources/git.go:74 forwards explicit options to native git log -p -U0; detect/detect.go:431 implements the target-size skip; report/finding.go:78 defines redaction. The exact local mirror and installed 8.30.1 CLI were used.
• Git v2.53.0: Documentation/git-log.adoc:130 documents omitted merge patches without an explicit merge-diff option; rev-list-options.adoc:112 and its first-parent section distinguish merge exclusion and parent traversal. The fix uses the native merge-diff format exercised by the reviewer, without either traversal filter.
• GitHub event documentation: push.json defines full before/after SHAs and the capped commits array; pull_request.child-params.json defines base/head fields; event reference:473 describes generated PR merge checkouts. The selector verifies Git objects instead of inferring endpoints from the commits array.
• CPython 3.13 unittest: native CLI, subtests and TestResult distinguish failures, errors and skips. Tests execute the repository's actual selector, checked-in Bash step, metric writer and acceptance classes with disposable Git graphs.

Evidence-class table

Claim	Evidence class	Command / receipt
Unknown push boundaries cannot return successful incomplete scope	synthetic	New three-boundary CLI regression; exact447f red rc 1, corrected rc 0
Merged histories and PR merge-resolution additions remain detectable after removal, including targets over 3 MB	local_integration	Actual pinned Gitleaks, production workflow step and every applicable duplicate acceptance class on four disposable merge graphs; exact447f red rc 1, corrected rc 0
Reviewer graphs reproduce the old omissions and qualify the corrected paths	local_integration	Relocated review_repro.py: eleven exact-base cases; corrected run refuses three unsupported boundaries and detects all eight accepted graphs
Timing receipts retain actual options; scan failures keep their status	synthetic	Real workflow-script/writer fixture with inert scanners and all existing status combinations; actual scanner receipt assertions in native graph tests
Documentation describes the implemented backstop	source_review	Five manual-dispatch corrections and the requested text/trigger regression, red rc 1 then green rc 0
At content-fix head 39e9bde, evidence bindings and monitoring inventory matched the candidate	source_review	Native register_file, validator, GitTree/derive_ci_protected derivation and exact-head check; monitoring inventory carries no completeness claim

Rebase resolution

The five existing content commits rebased cleanly onto 66584736c076873ca7e5898e3bd8111cca1a1447 (#1030); per-commit range-diff marks all five equal outside manifests/evidence.json. One additional commit records this PR's own dated advisory observation, appends its index entry, restores the historical baseline bytes and regenerates native evidence bindings. Secret-scan production code is unchanged by that commit.

The baseline used by the 10-11 skill-use delta remains byte-identical to main (SHA-256 5ea8e4db0ab15115e5b1eec6c1939450514dc227e0f9308d865f661507c6c93d), and the old delta file is unchanged. The new unclassified-gate-reads-20261012-pr949-delta.json records the native observation at source commit b5164706abaf0d12905f4b07c2c089737c78b6df: 342 locations against the immutable baseline's 332, with ten existing skill-status reads and five installer source-location moves. The final event helper adds no unclassified read multiplicity. Every classification remains monitoring-only with permission_change: false.

This supersedes #949's earlier overwritten-baseline refresh, which failed the newly landed historical-byte check. The existing test failed before (rc 1, one failure) and passed after; the whole owning module passes 127 tests. #1030's dated skill-count correction is consumed unchanged. Both families read this advisory delta; the CC performs carry.sh and reads the delta before landing. Earlier source-code ACK/adjudication records remain scoped to their original heads.

Historical six-test comparison

This is the previously released comparison at the pins named in its columns, retained as historical evidence. It is not a new full-suite run or a measurement at the current candidate.

Full test ID	Main ccff876 rc/message	Head 447f9ca rc/message
tests.test_adaptive_paper_credential_race.MutationDriverSelfTests.test_import_error_mutation_is_not_a_kill	0 / OK	0 / OK
tests.test_adaptive_paper_credential_race.MutationDriverSelfTests.test_pristine_worktree_precondition_holds_in_the_copy	0 / OK	0 / OK
tests.test_adaptive_paper_credential_race.MutationDriverSelfTests.test_skipped_test_is_inconclusive_not_survived	0 / OK	0 / OK
tests.test_adaptive_paper_credential_race.MutationDriverSelfTests.test_teardownclass_error_is_inconclusive_not_survived	0 / OK	0 / OK
tests.test_adaptive_paper_credential_race.RealMutationKills.test_every_mutation_is_really_killed_by_the_named_test	0 / OK; every named mutation killed	0 / OK; every named mutation killed
tests.test_token_e2e_grader.F27c_KeysOnRealContent.test_keys_at_the_pinned_revision	1 / git clone failed: Invalid cross-device link, before grading	1 / same message, before grading

The prior full suite reported 13,305 tests, 8 failures and 1,136 skips (rc 1). Five adaptive pristine-child imports lacked exchange_calendars under Python 3.12; isolated Python 3.13 controls pass at both historical pins. The clone fault failed identically before grading. Hosted CI decides the environment cases. No new full repository suite was requested or run.

Local commands run

Current dated-delta qualification, under T2 CPUWeight=idle with nice10/ionicec2n7: historical-byte assertion red rc1/one failure then green rc0/one test; python3 -B -m unittest tests.test_runtime_worker_openhands_push_gate rc0/127 tests/no skips (71.490s); native derivation342; validator rc0/70 components/11776 bindings/4 profiles/239 receipts; final_stack --check rc0/34 layers; registry ordering and diff checks rc0; final bounded --diff-merges=first-parent 66584736..HEAD scan rc0/six commits/zero findings. No full repository suite ran. Retained scratch is under /var/tmp; future subprocess commands also set TMPDIR=/var/tmp.

The prior checks below qualify the content-fix head 39e9bde at its recorded base. The e7e02bb registry rebase was qualified at base 8b1ef0c: final_stack.py --check passed (34 layers); evidence_manifest.py --check and git diff --check passed; the 8b1ef0c..e7e02bb range scan passed on 5 commits with zero findings; validate.py passed with 70 components, 11740 hashed files, 4 profiles and 239 receipts. Their original counts and results are preserved as historical evidence; current qualification is stated above.

• Exact447f review_repro.py, with only ROOT/TREE relocation because the supplied tree directory was absent: rc 0; seven exposed omissions versus detecting bounded controls.
• New P1 regressions against exact447f production: rc 1, two tests, seven failing subcases. Corrected focused run: rc 0, 32 tests.
• A1 text assertion: red rc 1, green rc 0. A2 native PR/push receipt assertion: red rc 1 with two failing subcases, green rc 0.
• Corrected review_repro.py uses the same graphs/scans with a controlled-refusal branch for the three newly rejected events: rc 0, three refusals with no outputs, eight detecting scans, matching scope receipts and all applicable acceptance scans detecting.
• python3 -B -m unittest tests.test_ci_secret_scan_range tests.test_secret_scan_metrics tests.test_secret_scan_size tests.test_gitleaks_config tests.test_workflow_hardening tests.test_local_pages_policy_grants: rc 0; 239 tests, 4 skips (68.058s), with private GNU tee PATH shim.
• Exact-head native monitoring-baseline test: rc 0; 1 test (6.671s).
• python3 -B scripts/validate.py: rc 0; 70 components, 11,693 hashed files, 4 profiles, 239 receipts.
• python3 -B scripts/evidence_manifest.py --check and git diff --check: rc 0.
• gitleaks git . --config .gitleaks.toml --log-opts="--diff-merges=first-parent c735e8b2e7d096475ceed380ce956b9191af508c..HEAD" --redact --no-banner --report-format json: rc 0; 5 commits, zero findings.

A first combined test invocation exceeded its tool's 60-second limit and yielded no suite result. The following complete run found three obsolete test-fixture expectations (missing supplied scope in the Betterleaks stand-in, and the old log-options assertion). Those fixtures were corrected; their focused rerun passed. Only completed runs are counted.

Decision record

The event policy is executable in scripts/ci_secret_scan_range.py and its graph tests; documentation is in docs/github-automation.md. The previous vendor tip-fallback policy is superseded by reproduced native Git/Gitleaks omissions. Publication to all branches/tags and the scheduled history-only backstop are the separately ruled C1 follow-up after this PR lands.

Red/green evidence, reviewer-graph JSON and final checks are retained in the lane's landscape-live-foundation.pr949-final-fix-20261012/ packet; earlier sealed packets retain their original bytes. Astra's delta ACK and the CC Gate PASS are recorded at39e9bde0. The five source commits retain their patch identity outside the registry; the new dated advisory delta receives both families' reads before the CC carries and lands.

Host evidence

No host receipt or platform-status change is introduced. Local native fixture execution does not claim hosted Actions execution. GNU tee is supplied through a private PATH shim; host binaries are unchanged. Pinned Betterleaks 1.8.1 execution remains a hosted qualification boundary.

Follow-ups

• Current advisory delta: both families read the Apply verified event scopes to CI secret scans #949 dated observation at3b329a3f; the CC runs carry.sh and reads the delta file. Earlier baseline-overwrite qualification is superseded by this immutable-baseline record.
• Astra delta ACK at 39e9bde (04:00:14Z): no in-scope blocker; its five P3s remain follow-ups below. C1's previously ruled publication-coverage finding stays in its own PR.
• Astra delta P3 hosted merge regression: enroll CiSecretScanMergedHistoryTests in the pinned-scanner job; this is C1 entry F2.
• Astra delta P3 exact-candidate snapshot acknowledgment: obtain the runtime-workers owner's receipt for the current dated-observation candidate 3b329a3ff306fcb4297bffad075e5d7d58afd6d8; the acknowledgment at an earlier candidate cannot be assumed.
• Astra delta P3 active source locators: repair the inherited OpenHands shell-helper comment locators separately, preserving revision-bound historical references.
• Astra delta P3 hostname hygiene: inherited host references had zero additions in the patch and remain separately owned hygiene work.
• Astra delta P3 evidence packet: attach the missing exact source blobs, historical receipts and original reproduction captures; unavailable captures are not treated as verified by this registry rebase.
• CC Gate at 39e9bde: PASS under adjudication-pr949-39e9bde0-20261012.md; Astra's delta ACK is now in. The CC's carry.sh and the two families' reads of the new dated advisory delta precede landing. Secret-scan source code remains unchanged by the dated-observation commit.
• C1 required entry F1: bind the 14 reviewed merge-reached fingerprints to the reaching merge (or the supported exact global fingerprint form), with the reviewer's bounded per-merge regression failing first at 39e9bde. The manual backstop's 15 re-reported reviewed findings are fail-safe over-reporting. Codex's first thread at 3b329a3 names the same mechanism on the pull-request path (a reviewed finding repeated in the generated merge's patch); that case and its regression are part of this entry.
• C1 required entry F2: add tests.test_secret_scan_size.CiSecretScanMergedHistoryTests to the hosted secret-scan test step so native merge/large-target detection and uncapped acceptance stay enforced where Gitleaks is installed.
• CC P3-1 stale workflow comments: update the superseded vendor-baseline citation and pre-merge-diff comment separately.
• CC P3-2 commit enumeration (rides C1): add -s to the helper's and selection tests' git log --format=%H walks; merge-diff formatting otherwise emits patch lines and buffers the merge patch. Codex's second thread at 3b329a3 is this item; measured at that head, the probe's output for a merge tip is the whole merge patch (24,134,939 bytes for the newest reachable merge) against 41 bytes with patch output suppressed. A merge fixture with a non-empty tree rides with it.
• CC P3-3 body wording: corrected here: the removed advisory row belonged to the unfiltered emptiness check, rather than the push filter.
• CC P3-4 backstop volume (rides C1): retain the measured patch-stream increase (+38% at c735e8b) as a volume observation; qualify native scheduled/manual scan resources on hosted CI. No full-history local scan or fresh hosted measurement is claimed.
• CC P3-5 Betterleaks rule coverage: installed 1.9.0 detected two of three synthetic control shapes; retain this report-only rule-set boundary without substituting it for pinned 1.8.1 execution.
• CC P3-6 duplicate scan cost: the uncapped duplicate acceptance classes repeat the PR-range scan in addition to the history step; retain the cost boundary and hosted budget qualification.
• C1 publication coverage: separate PR immediately after Apply verified event scopes to CI secret scans #949 lands: every branch/tag push, verified complete new-ref ranges and a scheduled/manual history-only backstop. The present helper fails closed for unverified push boundaries.
• Astra P3 schedule: all five current claims are corrected to manual dispatch; wiring the scheduled backstop remains in C1.
• Astra P3 snapshot acknowledgment: obtain and attach the runtime-workers owner's acknowledgment for this exact candidate; an acknowledgment at an earlier head does not establish it.
• Astra P3 hostname hygiene: inherited hostname occurrences in changed files had zero additions in the patch; handle separately under the hostname ruling.
• Astra P3 active locators: separately update OpenHands push-gate comments that cite old workflow-hardening helper line numbers, preserving dated retained references.
• Astra P3 packet completeness: reconcile the two historical six-test capture-hash mismatches and attach missing exact vendor-action/UET/Git/Betterleaks/GNU-time source captures and historical run evidence. Current correction cites the available Git 67ad4214 pin; unavailable older pins are not newly qualified.
• Correctly stopped false positive: generic-api-key — blueprints/runtime-workers/openhands/evidence/unclassified-gate-reads-20261004.json.
• Hosted CI qualification of environment cases and native pinned Betterleaks; the CC's carry.sh and dated-delta read before landing.

Checklist

• Existing action pins and least-privilege permissions preserved.
• No new required secret, paid hosting or subscription.
• Peer-owned worktrees and files preserved.
• Native manifest registration and validator completed.
• No scanner bypass or allowlist added; final publication scans required before push.

Follow-ups after landing

Landed at 9cfe3a9 on 2026-10-12T13:53:09Z from head 3b329a3 (CC gate PASS with addendum 01, GPT read ACK). The C1 coverage PR opens next; its required entries are F1 (including the pull-request path Codex named at this head), F2 and CC P3-2 with a merge fixture that has a non-empty tree. The other Follow-ups above carry forward; none blocks.

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

[seathatflowsinourveins]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T11:29:51.807001Z	3b329a3	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b329a3ff3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".