Credential inventory: sharadar slot for the survivorship-free data feed - #1044

Scope

• What this PR changes, in one or two sentences: adds the sharadar entry to adoption/credential-inventory.json, mirroring databento, so the owner's hidden-input key entry (tools/credentials/open_credential_terminal.sh sharadar) and credential_run.py sharadar accept it on main. No loader or consumer yet: a pull from this vendor needs a scope amendment first.
• Base commit: 2f59d7448 (main). Rebased from d8f7e2051 for a registry-only conflict (manifests/evidence.json and the adjacent lines of adoption/hooks/claude/SHA256SUMS), re-derived with register_file and sha256sum; the hand-written files' patch-id is unchanged.
• Lane: lane:foundation
• Owned paths touched: adoption/credential-inventory.json, docs/secret-storage.md (the credentials table row), scripts/hooks/secret_path_guard.py (one name) and its pin in adoption/hooks/claude/SHA256SUMS, catalogs/foundation/upstream-surface-dispositions.json (five locators into docs/secret-storage.md moved down one line), tests/test_credential_status.py, tests/test_credential_run.py, manifests/evidence.json (re-registration)

What the entry holds: id sharadar, class provider_api_key, status user_only_paid, lane us-equities-research, a private_env_file store named sharadar.env under the stack's per-host store (the same template as databento's), one variable SHARADAR_API_KEY, no optional or pointer variables, no loaders or consumers. Rotation: rotate at https://sharadar.com/account, then open_credential_terminal.sh sharadar and type replace at the hidden prompt. The notes carry the vendor's facts: the direct API at https://api.sharadar.com/v1.0, not Nasdaq Data Link (never data.nasdaq.com or the nasdaqdatalink/quandl libraries); the key sent as the x-api-key header so it never sits in a URL or a log; bulk tables as GET /data/{table}?years=5|10|full, an HTTP 302 to a zip.

The guard: tests/test_secret_path_guard.py requires every inventory secret name in the guard's SECRET_NAMES, so the new variable joins the base tuple beside databento's, and the guard's pin moves. After merge a host reinstalls the user-scope guard with tools/adoption/install_claude_profile.py --only guard; until then tests.test_secret_path_guard.test_host_profile_copy_is_verbatim fails locally (it is skipped in CI), as after #1014.

Follow-ups (not in this change):

• A loader and a consumer for the feed, with the scope amendment for the trading lane; the consumer sends the x-api-key header.
• blueprints/runtime-workers/openhands/resolver/patch_policy.py:137 cites docs/secret-storage.md:199-200, already stale before this change (gate code, left as is).

SOTA sources

• Sharadar's own agent guide, https://sharadar.com/llms.txt, read 2026-10-12T16:42:23Z (9,065 bytes, sha256 e66cb895ba8fe2eb3209795963ce33049b997d578ca901dbe5f74bc2c47545af): line 9 (the direct API at https://api.sharadar.com/v1.0, not Nasdaq Data Link), line 11 (the key from https://sharadar.com/account), line 13 (the key as the api_key or apiKey query parameter or the x-api-key header), lines 17 and 54 (bulk zips by years=, HTTP 302). The rendered page https://sharadar.com/docs/auth is script-built and carries no static text to cite.
• The repository's own pattern: the databento row and Credential inventory: alpaca-paper-c slot for paper account C; the guard reads a one-letter pointer suffix #1014 (the alpaca-paper-c slot), docs/secret-storage.md.

Evidence-class table

Local commands run

$ python3 -m unittest tests.test_secret_path_guard tests.test_credential_status tests.test_credential_run tests.test_credential_tools tests.test_credential_boot_receipt tests.test_install_claude_profile tests.test_evidence_manifest tests.test_validate
Ran 505 tests ... FAILED (failures=1, skipped=3): test_host_profile_copy_is_verbatim, the host's installed guard predates this change (skipped in CI)
$ python3 -m unittest tests.test_credential_status tests.test_credential_run   # the new test files on main's code
FAILED (failures=2, errors=1)
$ python3 scripts/validate.py
exit 0 (11800 hashed files); evidence_manifest.py --check: exit 0
$ gitleaks git --log-opts="2f59d7448..HEAD" .
no leaks found
$ git merge-tree --write-tree origin/main HEAD
exit 0

Decision record

None new: the inventory and its rules are docs/decisions/2026-09-24-secret-storage.md and docs/secret-storage.md; the entry is a row of that design.

Host evidence

Not applicable: no receipt changes.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a
  version comment (no floating tags). (none changed)
• New/changed workflows declare top-level permissions: {} and grant each job
  only what it needs (contents: read, or an explicitly justified addition). (none changed)
• No secrets are printed, logged or committed; no new required secret was
  added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced. (the owner's own data subscription; nothing in the repository bills)
• Peer-owned untracked files and worktrees were preserved (not deleted,
  moved or overwritten).

🤖 Generated with Claude Code

Follow-ups after landing

Landed as 6934527 on 2026-10-12T19:11:08Z. CI was 33 ok; both families' reads were at 26da71a.

• The user-scope guard was reinstalled from main with tools/adoption/install_claude_profile.py --only guard
  (secret_path_guard.py installed; the other hooks already matched). That clears the expected host-copy test
  failure noted in the Claude-family check.
• credential_run.py sharadar --check on main reports the slot ready (the key name injected, value masked).
• The GPT read's five P3 items are listed in its verdict file and are kept as follow-ups there, not restated here.