fix(provenance): make one length floor the whole substitution rule

[icecrasher321]

What

A secret literal shorter than 8 characters is no longer substituted anywhere.

Eight was already the floor for matches inside a larger token. Below it, a second tier still substituted whenever the hit sat on a word boundary — standing alone, delimited, or as the whole value — on the theory that those positions made the hit unambiguous.

Position is not the variable that matters. A hit on 7 is uninformative wherever it sits, because the value space is ten.

Why

That tier caused two production incidents:

• _raw_idx = 7 was rewritten to _raw_idx = {{WEEKLY_OWNWORK_TTL}} for the one shard whose index collided with a TTL variable's value. Shards 0–6 and 8–15 were untouched, which is the fingerprint of a value collision rather than a code path.
• 2,000 boolean had_error cells became [REDACTED_SECRET] because a *_ENABLED variable held false.

Each was patched with a per-value exception list (true/false/null, then almost single digits). The floor subsumes both, so the lists are deleted — this removes exceptions rather than adding one.

What else goes

With no literal below the floor reaching a matcher, the tier's machinery is unreachable and is deleted with it:

• ResolvedSecretMatchPolicy and getResolvedSecretMatchPolicy
• isWordBoundaryMatch / satisfiesResolvedSecretMatchPolicy and their code-point helpers
• the mode: 'detect' | 'render' matcher option, which existed only to select between the tiers

One constant, MIN_SUBSTITUTABLE_LITERAL_LENGTH, now governs the whole question. Net −350 lines.

The trade, stated explicitly

A secret shorter than 8 characters is no longer redacted from logs or model-visible content. Substitution cannot hide a value that short — an observer who can read the surrounding text can enumerate it.

Two tests pinned the old tier (projects a short secret standing alone or delimited…, keeps content and the control error safe from active one-character values). They are rewritten to pin the new rule, not deleted, so the trade stays visible in the suite rather than vanishing.

Entropy remains rejected as a criterion, for the reason already documented: an all-f HMAC key scores 0.00 bits/char, a zero-padded AWS key id 1.02. Length is the criterion.

Review notes

Most of the diff is test fixtures. Every short stand-in secret ('x', 'Test', '123', 'E', 'A', 'F', '!') was lengthened past the floor along with the content it is matched against, so each test still exercises its original shape. The fixture updates are where a real regression could hide — worth a skim for any case where a lengthened fixture no longer exercises what the test name claims.

Verification

• tsc --noEmit clean
• check:api-validation passed
• 18,671 tests passing across executor/, lib/, tools/, providers/, app/api/, background/
• Full suite: 22,718 passing. search-modal.test.tsx fails on this branch and on staging alike — it has no import path to any changed code and the file is untouched here. diff-engine.test.ts is the known load-flake (passes in isolation).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 11, 2026 7:14pm

[cursor]

PR Summary

Medium Risk
Changes core secret redaction across executor, logs, traces, copilot, and providers; mis-substitution risk drops but secrets under 8 characters may leak in display paths.

Overview
Stops substituting secret literals under 8 characters in logs, model egress, and copilot projection. The old split—full substring match for long values, word-boundary-only for short ones—is gone, along with ResolvedSecretMatchPolicy, boundary helpers, and matcher mode: 'detect' | 'render'.

MIN_SUBSTITUTABLE_LITERAL_LENGTH (8) and isNonIdentifyingSecretLiteral (length-only, replacing true/false/null blocklists) now decide whether a literal enters matchers at all. Trace projection and model egress matchers no longer pass mode: 'render'.

Accepted trade: PINs, single-character secrets, and values like false stay plaintext in projected surfaces instead of causing false rewrites (e.g. shard indices, boolean columns). Tests were updated with longer fixtures and expectations that document the new behavior.

^{Reviewed by Cursor Bugbot for commit eeb1001. Configure here.}

[greptile-apps]

Greptile Summary

The PR applies the eight-character minimum to all resolved-secret substitutions and removes the obsolete boundary-match tier.

• Replaces the short-literal exception set with one minimum-length predicate.
• Simplifies matcher construction and removes detect/render modes and word-boundary machinery.
• Updates fixtures to remain above the substitution floor.
• Corrects the post-projection byte-limit test so it reaches and isolates the final JSON wire-size check.

Confidence Score: 5/5

The PR appears safe to merge.

The previously reported byte-limit test gap is fixed: the registry now records the cataloged literal, projection succeeds within the decoded-content budget at 20 bytes, and only the final 25-byte JSON wire-size check rejects at that limit, so no blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/executor/utils/resolved-secret-match-policy.ts	Consolidates substitution eligibility into a single eight-character minimum, matching the explicitly documented tradeoff.
apps/sim/executor/utils/resolved-secret-matcher.ts	Removes boundary-policy and matcher-mode handling while filtering short literals during matcher construction.
apps/sim/executor/utils/resolved-secret-content-projection.test.ts	The prior fixture mismatch is fixed, and limits 20 and 25 now distinguish content-walk accounting from final serialized JSON size enforcement.
apps/sim/executor/utils/resolved-secret-content-projection.ts	Adapts model projection matcher creation to the unified substitution policy.
apps/sim/lib/logs/execution/trace-secret-projection.ts	Aligns trace projection with the unified matcher behavior without introducing an unresolved failure.

_{Reviews (3): Last reviewed commit: "test(provenance): make the byte-limit te..." | Re-trigger Greptile}

[icecrasher321]

@greptile

[icecrasher321]

@cursor review

[icecrasher321]

@greptile

[icecrasher321]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit fdfb439. Configure here.}