fix(guard): protect ai-memory, Muse Code and Codex dotenv stores (A2 G8-A02) - #1240

Fold 3 of PR #1240 (A2 finding G8-A02) on e4309ef, the two blocking
findings of the CC verdict CC-DELTA-e4309efc.md (findings 1 and 2 of
MICRO-delta-e4309efc.md).

- Finding 1 (P2): ai-memory's data-directory override is a directory,
  and the pointer-variable field means the path of a store file. The
  four ai-memory rows now read it the way the CODEX_HOME and HF_HOME
  rows read theirs, as a path-template default:
  ${AI_MEMORY_DATA_DIR:-$HOME/.local/share/ai-memory}/<file>, with
  pointer_variables []. scripts/credential_status.py accepts that one
  extra template prefix; expand_template, which the checker,
  credential_run.py and canary_proof.py all use, already resolves it.
  With the variable exported, canary_proof.py's pointer_paths no longer
  lists the directory (so prepare binds no directory pointer), its
  exclusions hold the four token files under it as key paths instead of
  the directory, and credential_run.py no longer strips the variable
  from child environments. The guard keeps refusing reads through the
  variable (POINTER_VARIABLE keeps the name; its comment says why).
- Finding 2 (P3): the STORE_ROOTS comment now states the rule exactly.

Tests: tests.test_canary_proof
UnitTests.test_ai_memory_data_dir_override_is_no_pointer and
StabilityTests.test_st9_ai_memory_data_dir_override_passes_prepare
(needs a reviewed ripgrep), and the updated
tests.test_secret_path_guard test_g8_a02_inventory_rows. SHA256SUMS
re-pinned; manifest rows re-registered.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…rride

Fold 4 of PR #1240 (A2 finding G8-A02) on 0378825, the P2 of the CC
verdict CC-DELTA-03788258.md (MICRO-delta-03788258.md).

Fold 3 made the four ai-memory rows' templates follow the data-dir
variable while the canary U8 root stays at the default directory, so an
exported non-default value moved the exclusions away from the root that
is scanned and dropped the checker's override warning.

The shape chosen is the CC's first one, the smallest that keeps every
reader consistent:
- The four rows keep the fixed default path. This stack pins --data-dir
  to it wherever it runs ai-memory, and the flag wins over the variable
  (akitaonrails/ai-memory v3.1.0 crates/ai-memory-cli/src/config.rs
  :2349-2355; the variable is read at :760).
- AI_MEMORY_DATA_DIR moves to a new optional, warning-only field,
  override_variables. scripts/credential_status.py validates it and
  native_store_overrides reads it, so the checker reports
  store_path_overridden again. canary_proof.py and credential_run.py do
  not read it: no scan root, exclusion, pointer binding or child
  environment follows it.
- The TEMPLATE_PREFIXES addition of fold 3 is reverted.
- The guard keeps refusing reads through the variable; the pointer
  variable test now also covers override_variables.

The other shape, U8 following the same template with exclusions under
every root it walks, was not taken: it moves a scan root after a value
the stack never passes to ai-memory.

Two claims of fold 3 corrected: the rows' shape is not the CODEX_HOME
and HF_HOME shape (Codex roots and exclusions both follow the registered
homes; U8 has no equivalent), and the variable does not move the data
directory for this stack's own invocations, whose flag wins.

Test: tests.test_canary_proof
UnitTests.test_ai_memory_data_dir_override_is_no_pointer exports the
variable to a non-default directory and asserts the token files under
every U8 ai-memory root are keys and the checker reports the override;
it fails on 0378825. SHA256SUMS re-pinned; manifest rows re-registered.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ride

Fold 5 of PR #1240 (A2 finding G8-A02) on 0c21a1d, B1-B4 of the CC
verdict CC-DELTA-0c21a1d1.md (security read MICRO-security-0c21a1d1.md).

- B1 (P2): the four ai-memory token names are key exclusions under the
  default and also under the override variable's absolute, non-blank
  value (scripts/credential_status.py override_paths, used by
  tools/credentials/canary_proof.py exclusions, the one list prepare
  digests and the scan uses). No scan root moves. The three claims that
  this stack pins --data-dir everywhere are narrowed to the settings
  template's hooks and the drafted launchd template; runs without the
  flag follow the variable, and the exclusions now cover them.
- B2 (P2): the data-dir resolution is cited at the pinned tags, from the
  vendor's source at each tag: v2.4.1 (Linux pin, 433a19f3)
  crates/ai-memory-cli/src/config.rs:1358-1364 with the variable at :573,
  and v2.3.2 (macOS pin, 353841d9) :1137-1143 and :462. v3.1.0
  (11ca7c5b, installed on the WSL host) agrees at :2349-2355 and :760. The
  token-file locators are given at the pinned tags too; auth-tokens/ comes
  from v3.1.0 only.
- B3 (P3): the override warning fires only for a non-blank value other
  than the default, as ai-memory's env_string reads it (v2.4.1
  config.rs:2086-2095, v2.3.2 :1808-1817).
- B4 (P3): the store_path_overridden comment is corrected, the checker
  paragraph of docs/secret-storage.md names override variables, and the
  key-management decision gains a dated addendum that defines
  override_variables beside pointer_variables.

Tests, failing on 0c21a1d: tests.test_canary_proof UnitTests
test_ai_memory_tokens_written_under_a_moved_data_dir_are_keys_under_every_root
and test_ai_memory_override_warning_needs_a_non_blank_value_other_than_the_default.
SHA256SUMS re-pinned; manifest rows re-registered.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…th sides

Fold 7 of PR #1240 (A2 finding G8-A02) on c467543, B1-B3 of the CC
verdict CC-DELTA-c4675431.md (security read MICRO-security-c4675431.md),
by the verdict's RULING: match on canonical forms on both sides instead
of enumerating spellings.

- B1 (P2): the scan worker (tools/credentials/canary_scan_worker.py)
  takes each walked root's canonical path from the directory descriptor
  it opened (fd_path, /proc/self/fd/<fd>; the proof runs on Linux only)
  and excludes an entry when either its literal spelling or
  canonical_root + "/" + rel matches, for exact rules and for a glob
  rule's parent. Prepare (canary_proof.py exclusions) adds
  canonical_exclusion(path) = realpath(dirname) + "/" + basename beside
  every literal exact exclusion and glob directory. The four-spelling
  enumeration in scripts/credential_status.py override_paths is dropped;
  it returns the literal path only. A trailing-slash CODEX_HOME, a
  trailing-slash HOME with the variable unset (the routed case, closed
  by the same rule) and a trailing-slash glob directory now match.
- B2 (P3): the final component is never resolved, so a symlink planted
  at a token name keys only itself; its target directory is walked.
- B3: the fold-6 commit's B1 bullet described the four-spelling
  enumeration, which this fold replaces; key-management.md and the
  inventory note now state the canonical-on-both-sides rule, naming dir
  and glob roots as tested and the tasks root as covered by the same
  code but not separately tested.

Tests, through the worker's own walk (canary_scan_worker.Walk.traverse,
no scanner): test_ai_memory_moved_tokens_are_keyed_by_the_worker_in_every_spelling
(seven shapes plus a glob-root case; the two trailing-slash shapes and
the glob case fail on c467543) and
test_ai_memory_symlink_at_a_token_name_keys_only_itself (fails on
c467543). The end-to-end StabilityTests
test_st9_ai_memory_moved_tokens_are_never_opened_end_to_end needs a
reviewed ripgrep and setpriv and is skipped on this host and in CI.
Manifest rows re-registered; the guard is unchanged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…nical form, fail-closed canonical path

Fold 8 of PR #1240 (A2 finding G8-A02) on 98e94f0, the CC verdict
CC-DELTA-98e94f0b.md (Claude read MICRO-delta-98e94f0b.md, Muse read
MICRO-muse-98e94f0b.md). Scanner-class PR: findings cited by path and id.

- B1 (P2; MICRO F4, Muse P2-1): the new ST9 end-to-end test
  (tests/test_canary_proof.py, StabilityTests) wrote the canary before
  prepare, so under a reviewed ripgrep it raised TypeError and pinned
  nothing. It now writes placeholders before prepare and the canary after
  it, and the unreachable doubled-slash forbidden entries are dropped (the
  seam builds dir_fd paths from readlink of the descriptor). Both ST9 tests
  now run and pass under ripgrep 15.2.0 (official release, sha256 checked).
- F1 (P3): a glob rule's directory is canonical by its whole realpath
  (canary_proof.py canonical_exclusion, directory=True); exact rules keep
  realpath(dirname) + basename. New test for a symlinked glob directory.
- F2 and Muse P3-1 (P3): an opened root whose descriptor has no path now ends
  the walk as walk_error (canary_scan_worker.py Walk.traverse, directory and
  file roots), never literal-only matching. Seam test forcing fd_path to
  None, plus fd_path direct cases.
- F3 (P3): kept by the ruling; the residual is stated in
  docs/decisions/2026-09-29-key-management.md and
  adoption/credential-inventory.json.
- F5 and Muse P3-3 (P3): g8_walk builds the plan with the sink's group and
  the current pointer paths; the glob-parent case moves to an agent-group A4
  walk.
- F6 (P3): new tests for a file root, a glob root, a glob parent and an exact
  rule that only the worker's canonical path meets, and for
  canonical_exclusion's forms; eleven G8-* mutants in tests/canary_mutants.py,
  each killed by a named test.
- F7 (P3): key-management.md and the inventory note say scan_sink builds the
  forms at each scan (prepare records a digest only), and list file roots as
  tested and git and tasks roots as served and untested.
- F8 (P3): the G8 unit tests that need /proc carry skipUnless(LINUX).
- Muse P3-2 (P3): recorded in key-management.md: the macOS F_GETPATH branch
  is not implemented, as the proof refuses non-Linux platforms.
- Q2: docs/decisions/2026-10-15-credential-term-grace.md locators re-pointed
  to canary_proof.py:1454-1455 and credential_status.py:361.
- manifests/evidence.json: six rows refreshed.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

# Conflicts:
#	manifests/evidence.json

Fold on ac01e51 for the native codex review's P2: canary_scan_worker.py's fd_path() and the decision addendum now cite microsoft/[email protected] (d504d40a) fs/d_path.c and man-pages-6.19 for the appended suffix, and state how the ambiguous suffix is handled. 1 of 1 findings covered.

Built by GPT (cx/gpt-6.1-sol, max) through the Codex worker profile; committed, gated and pushed by the CC.

The CC removed the build's in-tree PR-body copy (.github/pr-body-1240.md), its manifest row and the decision paragraph that
named it: the body is on the PR. The sandbox had no writable scratch for it then.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Finding statuses from the builder's report:
- R-1240-1: fixed
- R-1240-2: fixed
- NC-1240-1: recorded
- R-1240-3: recorded
- F3: recorded

Built by GPT through the Codex worker profile (stack-worker, effort max); committed, fail-first tested, gated and pushed by the CC's script, whose results are in the PR body.

Co-Authored-By: Claude Opus 5.5 <[email protected]>