[ViperJuice]

Why

The gitleaks job in .github/workflows/scrub.yml checks out with fetch-depth: 0, so it scans every branch and tag. It always loads .gitleaks.toml from the checked-out tree. A synthetic test-vector digest on the branch for #1770 trips generic-api-key. That PR already allowlists the value, but only in its own config. Scans running from any other checkout still use main's config, which has no exception. That is why agent-harness#1763, agent-harness#1764, agent-harness#1744 and agent-harness#1762 all fail on the same finding: commit bbb3bb8b, phase-loop-runtime/tests/data/typed_review_contract_vectors.json:67.

The value is a SHA-256 digest computed from a test-only identifier. A Daybreak review independently recomputed it and confirmed it is not a credential.

What

• .gitleaks.toml: one allowlist regex, the exception from 37be3360 (agent-harness#1770). It is anchored with \A…\z so it must match the whole extracted secret. Nothing else changes: no path or rule exclusions, no .gitleaksignore, no change to the workflow or to what gets scanned.
• CHANGELOG.md: an [Unreleased] entry.

The first commit extracted the hunk exactly. Round 1 of the independent review rejected it: the regex was unanchored, so tokens with the value embedded inside them were also suppressed. The second commit adds the anchors and corrects the CHANGELOG wording. Both commits are kept.

Verification

• All runs used pinned gitleaks v8.21.2 with the same command as scrub.yml, over the full fetched history.
• Main's config gives 1 finding. This branch's config gives 0, with exactly that fingerprint removed and none added.
• Boundary cases (private synthetic fixtures, never committed):
  • the exact value is suppressed;
  • all of these are still detected: substitutions at the start, middle and end; a case change; a prefix, a suffix, and text on both sides; newline-adjacent placements; the value inside a longer hex run; and captures that include delimiters.
• Negative controls (generic-api-key, github-fine-grained-pat, github-pat, aws-access-token, slack-bot-token, gitlab-pat) produce the same findings under both configs.
• This head and its merge preview have 0 findings. make check and git diff --check pass.
• An independent Daybreak review accepted this head in round 2 and found no new issues.

Follow-ups

agent-harness#1770, agent-harness#1740 and agent-harness#1733 carry the same exception without anchors. Their owners have been told not to merge that version and to drop or replace it when they merge main.

Draft. A maintainer decides when to merge.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.