Memory-only provider keys: kernel keyring store/exec/revoke (Tavily, user decision 2026-09-26) - #325

…lification receipt (follow-up to #325) (#329)

* Keyring guard, tvly-keyring wrapper and Tavily Research qualification receipt

Guard (scripts/hooks/secret_path_guard.py; SHA256SUMS updated):
- Unwrap `kernel_keyring.py exec <name> <ENV_VAR> -- <command>` (any path to
  the script, any launcher) and `tvly-keyring <args>`, so every existing rule
  applies to the command they start.
- keyring_variable_reference: the started command, code piped into it or a
  here-document names the injected variable beyond exec's own argument.
- environment_dump_in_keyring_exec: the started command dumps the environment
  it inherits (env, printenv, set, export -p, declare -p, ps e, ${!...},
  env or printenv as another program's argument, or whole-environment
  access in interpreter, awk or jq code).
- keyring_payload_read: keyctl print, pipe, read and dh_compute (keyctl(1):
  request, request2 and prequest2 print a key ID and pass), and payload reads
  in inline interpreter code (KEYCTL_READ, keyctl_read(, keyutils.read_key,
  kernel_keyring imports, raw keyctl syscalls with operation 11).
- `tvly auth` without --json (prints part of the key) is a
  native_token_print; ~/.tavily/config.json is a native store path;
  TAVILY_API_KEY is a secret name.

Credential inventory: `tavily` row with the new store kind kernel_keyring
(memory only, same-uid readable, lost at kernel restart). credential_status
reports it `unchecked` and never queries the keyring; set_credential refuses
it.

adoption/tools/tvly-keyring: POSIX sh wrapper that runs the real tvly through
kernel_keyring.py exec, never reads the key, passes arguments verbatim, and
exits 2 when the key is absent. Local integration tests with a fake tvly and
throwaway keyring keys (tests/test_tvly_keyring.py).

Evidence: tavily-research-qualification-20260926 receipt and a sanitized
summary of 33 completed Research (--model pro) reports: native provider
execution through the keyring exec, no quality comparison. The receipt and
the changed hash-listed files still need registration in
manifests/evidence.json.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Keyring guard repair: close the four reviewed bypasses at their root causes

Each reviewer finding was reproduced against the committed guard first
(check() returned None for all four), then fixed:

- Split-quoted exec argument (KK_DEMO_TO"KEN"): the variable check no
  longer subtracts a count of parsed arguments from raw-text matches. It
  exempts only the <ENV_VAR> argument's own span in the command after
  quote removal, so a split argument, an env/eval re-parse or a nested
  sh -c cannot use up the exemption. Backslash-newlines are joined first
  (a line continuation could hide the whole exec), and every raw-text
  rule also reads the unquoted command (sh -c 'echo $GH_TO''KEN').
- Launchers: strip_prefix reads launcher options as getopt does, from
  each tool's --help (stdbuf -o0, nice -n, timeout -s, sudo -iu, GNU
  time -f; xargs -i/-l/--max-lines take only glued values, checked with
  GNU findutils 4.9.0), and strips output redirections before a command.
  In a keyring exec, every argument naming a shell, interpreter, awk, jq,
  env, printenv, ps or a variable-printing builtin is read as a command
  from there on (watch, flock, taskset, find -exec).
- keyctl list/rlist print a user key's payload as integers (keyctl(1):
  "No attempt is made to check that the specified keyring is a keyring";
  act_keyctl_list/rlist in keyutils c076dff2). They pass only on @t @p @s
  @U @us @g, -1..-6 or %:name/%keyring:name; @A, serials and %user: are
  blocked, inline subprocess use included.
- Redirection operands (> >> 2> &> <<< < << <<-) are dropped before the
  tvly --json/--help and keyctl target checks.

The working-tree draft this replaces counted tokens across overlapping
segments and blocked the documented exec inside sh -c/bash -lc; those
forms are now ALLOWED regression cases.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Keyring guard: a URL argument is never a launched program (review low finding)

The Claude reviewer found the documented tvly-keyring extract form falsely blocked
(environment_dump_in_keyring_exec) when the URL's last path segment is env or printenv.
launched_commands now skips URL-shaped words; find -exec env and stdbuf /usr/bin/env
inside an exec stay blocked. Guard hash updated in adoption/hooks/claude/SHA256SUMS.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Keyring guard: close the GPT-6 re-check findings on the repair

Re-check of 74508203 (codex exec gpt-6-astra max, read-only): F2 resolved; F1, F3, F4
had variants and one false block. Each reproduced, then fixed:
- "$KK_DEMO_TOKEN"x: unquoted() merged it into another name; the variable rule now
  reads the written and the unquoted text (the exec argument exemption accepts quotes).
- keyctl rlist <serial> </dev/null: the serial was read as a descriptor; list and rlist
  are blocked whatever the target (kernel_keyring.py status answers presence).
- tvly auth {fd}>--json: bash's named descriptor is now a redirection.
- tvly-keyring search "export" ... --max-results: declare/export flags are short
  options only (false block removed).
Regression cases added; docs/secret-storage.md and the guard hash updated.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Register the keyring guard, tvly-keyring and Tavily Research receipt (hot-file commit)

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Re-register after rebasing onto #336 (hot-file commit)

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>