Security
The full verification gate errors when no secret scanner is available instead of passing silently, secret-looking paths (.env files, keys, Terraform state) are classified as secrets while ordinary source files are not, and API keys are redacted from escalation packets.
Curated source: paths, test names and the CI conclusion were checked against this commit by the evidence sync.
Asserted by TestFullGateRequiresSecretScanner
Asserted by TestIsSecretPath, TestFindSecretPaths, TestFindSecretPathsFailsClosed, TestSourceCodeIsNotSecret
Asserted by TestPacketCompactAndRedacted
success
An agent that follows injected instructions cannot weaken verification — a rewritten verification config is ignored because configuration is read from the base commit and the path is protected — and a host secret behind a planted symlink never reaches a context pack.