Integrity wave M3: betterleaks v1.8.1 non-required trial job beside the gitleaks gate - #455

…, explicit .gitleaksignore, null report)

The trial job now runs its steps under `shell: bash` (GitHub's
`bash --noprofile --norc -eo pipefail {0}`), so a failing check inside a
pipeline fails its step. Both scans pass --max-archive-depth 0 (gitleaks
8.30.1 does not open archives by default; betterleaks 1.8.1 opens eight
levels) and --gitleaks-ignore-path .gitleaksignore (betterleaks
cmd/root.go lines 100, 103, 281-291 and 465-469).

tests/test_gitleaks_config.py reads a JSON report of `null` as no
findings: betterleaks writes an empty report that way (cmd/git.go line
74, cmd/directory.go line 72, report/json.go), gitleaks writes `[]`
(detect/detect.go line 127) and is unaffected (25 of 25 ported fixture
tests and 28 of 28 module tests pass with gitleaks 8.30.1).
BetterleaksTrialJobTests grows to 7 tests: the bash default, the
verification order down to the pinned digests and certificate flags, the
exact fixture classes, both added flags, --redact without a lower value,
and no suppression channel that only betterleaks reads; 17 mutations each
fail their test.

The receipt records the review round: the live ruleset read-back, the
explorer line sizes behind gitleaks's 3,000,000-byte fragment skip, the
job-argv and one-fingerprint ignore controls, the .git skip control, the
ported fixtures (22 ok, 3 FAIL), a bash-pipefail simulation, value-blind
passphrase facts with owner confirmation pending, the first round's
retained checks, and every script that produced a recorded result.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…ssertion failures reported; passphrase rows resolved

Coordinator repair before the pull request opens (integrity wave, plan move M3).

- validate.yml: both scans pass betterleaks's own --exit-code 0 (cmd/root.go
  line 82 at v1.8.1). A scan error still exits 1 (lines 640-641) and an
  unwritable report is fatal (line 636), and each step exits with the
  scanner's status. The fixture step turns unittest's exit status 1 into 0
  only when its closing line is FAILED (failures=N), optionally with
  skipped=N: unittest counts an AssertionError as a failure and any other
  exception as an error. The steps append counts to the step summary:
  findings per rule id, never a value. No continue-on-error; the precedent
  is security-scan.yml's zizmor --no-exit-codes.
- tests/test_workflow_hardening.py: BetterleaksTrialJobTests asserts the
  flag and the exit paths, and runs the steps under GitHub's bash command
  with a stand-in scanner and a stand-in fixture module. 42 mutation
  controls (17 kept, 25 new) each fail their test and only that test.
- Receipt: real_secret_status is disposable_test_values_no_retained_repository,
  from the coordinator's host observation (our-integration; no values, host
  paths or usernames) with a value-blind recheck. README section 5,
  parity.json and its generator, run-record.json coordinator_repair; harness
  exit_code_controls.sh is new, mutation_controls.py and sim_job.py updated.

Local simulation: every run step returns 0 (fixture step: Ran 25 tests;
FAILED (failures=3), reported; scans: 91 and 16 findings). zizmor 1.30.1
and actionlint 1.7.12 with shellcheck 0.11.0 are clean.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

… its repair-round files, and the changed workflow and tests

Re-registered through the hot-file protocol (docs/lanes.md): the manifest
is the base commit's copy plus register_file for the 25 files this branch
adds or changes (22 inserted, including the repair's new
harness/exit_code_controls.sh; 3 updated: validate.yml,
test_gitleaks_config.py, test_workflow_hardening.py). Then
component_matrix.py --write and new_host_grand_list.py --write (both left
their outputs unchanged) and scripts/validate.py (passed: 69 components,
7395 hashed files, 4 profiles, 159 receipts). This replaces the review
round's registration commit a14d1a35, which listed 24 of these files at
their earlier hashes.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…error, so the fixture step fails on it

Cross-family GPT-6 review, P2 at validate.yml:425 (changes-needed):
_run_gitleaks turned an unexpected scanner exit into an AssertionError, a
unittest failure that the fixture step's failures-only filter accepts, and
it read exit status 1 without a report as no findings. Reproduced first
(harness/scanner_error_probe.py on the tree at 1c02980): scanner exits
-11, 139 and 1 mocked in memory on fixture test_a, then the step's own
status handling under bash --noprofile --norc -eo pipefail -c, each gave
FAILED (failures=1) and step exit status 0.

Exit statuses, read from the pinned sources (the local copies are
byte-identical to the files at the tags):
- gitleaks v8.30.1 cmd/root.go 463-491, betterleaks v1.8.1 cmd/root.go
  610-638: "// write report if desired / if detector.Reporter != nil {"
  writes the report before any exit; "failed to write report" is fatal
  (489, 636).
- 493-495 and 640-642: "if err != nil { os.Exit(1) }"; 497-499 and
  644-646: "if len(findings) != 0 { os.Exit(exitCode) }", and every test
  scan passes --exit-code 0.
- zerolog v1.33.0 log.go 389-398: Fatal() ends in "os.Exit(1)", also
  with the level off (482-487). 226-228 and 325-327: "unknown flag" exits
  126. Go go1.25.12 src/runtime/panic.go 1287 and 1336: a runtime crash
  is "exit(2)".
- 352-356 and 485-489: Detector() runs os.Create then os.Remove on the
  report path before the scan, so a scan that dies leaves no report;
  report/json.go 13-16 always encodes a value.
So under --exit-code 0, exit status 1 is never a findings status in
either tool, and exit status 0 always comes with a report.

tests/test_gitleaks_config.py now runs every scan through _scan_findings.
It builds the command with --exit-code 0 and a JSON report, and raises
_ScannerError (an Exception, not an AssertionError: CPython
Lib/unittest/case.py _addError records it as an error) for any nonzero
exit status and for a missing or empty report after exit status 0.
_run_gitleaks, the --exit-code 0 test, the git-mode fingerprint test
(which never read the exit status) and the history-ancestry test go
through it. A busy-lock skip now needs the guarded launcher's contract,
exit status 75 and "another scan holds the per-user lock"
(adoption/tools/gitleaks-guarded 23-32, gitleaks-guarded-macos 29 and
124-130); before, any stderr containing "lock" skipped, such as the Go
runtime's "all goroutines are asleep - deadlock!".

validate.yml: the fixture step's comment states this; its name, commands
and filter are unchanged, and so is the required secret-scan job's YAML.
That job's unittest step is stricter: the history-ancestry test now
errors on a scan that did not complete instead of reading zero findings.
On a host with the guarded launcher, "could not acquire the per-user
lock" (a status other than 75) is now an error, not a skip.

After: the probe's -11, 139, 1 with and without a report, exit 0 without
a report and the deadlock exit each give FAILED (errors=1) and step exit
1; a completed scan that misses the value still gives FAILED
(failures=1) and step exit 0. The whole fixture step over the real
module with a stand-in scanner: FAILED (errors=20, skipped=1) and step
exit 1 in six modes (before: failures=15 or 20, or OK (skipped=21), and
step exit 0).

New tests: ScannerErrorTests (5) and BetterleaksTrialJobTests.
test_fixture_step_fails_when_a_scan_does_not_complete_in_the_real_fixture_module.
harness/scanner_error_controls.py: 6 controls, each failed every named
test, module restored byte-identical. gitleaks 8.30.1 on PATH:
tests.test_gitleaks_config ran 33 tests, OK, none skipped. betterleaks
1.8.1 (verified binary) through the fixture step (harness/sim_job.py):
step exit 0, Ran 25 tests; FAILED (failures=3), d2, d4 and d5, no error,
no skip. harness/final_checks.sh: tests.test_workflow_hardening 72 tests
OK (skipped=2), freshness-pin and workflow-security modules OK, the 42
earlier controls failed their tests again, zizmor 1.30.1 "No findings to
report" (43 suppressed), actionlint 1.7.12 with shellcheck 0.11.0 and
shellcheck on the harness printed nothing.

Receipt: README.md section 6 and run-record.json scanner_error_repair
(coordinator_repair's limit marked superseded). The next commit
re-registers the files in manifests/evidence.json.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Hot-file protocol (docs/lanes.md): register_file for the 7 files the
scanner-error repair (11b4673) adds or changes, on top of the branch's
registration commit 1c02980. 2 inserted: harness/scanner_error_probe.py
and harness/scanner_error_controls.py. 5 updated: validate.yml,
tests/test_gitleaks_config.py, tests/test_workflow_hardening.py, and the
receipt's README.md and run-record.json. Then component_matrix.py --write
and new_host_grand_list.py --write (both left their outputs unchanged) and
scripts/validate.py (passed: 69 components, 7397 hashed files, 4 profiles,
159 receipts). On rebase, fold this commit and 1c02980 into one last
registration commit: take main's manifest and re-register the branch's
files.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…on time, lock-skip change

Verifier residuals on the scanner-error repair:
- The gitleaks-guarded-macos busy branch is lines 125-130, not 124-130; line 124 is
  `return descriptor`.
- The repair window's last_recorded_run becomes 08:33:28Z, the real-home read-back.
- behaviour_changes gains the lock-skip change: stderr that merely contains "lock" no
  longer skips a completed scan (gitleaks v8.30.1 sources/git.go lines 251-264 forward
  git stderr as warnings or errors).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…e protocol

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…e protocol

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…reason

The fixture step's comment, and the hardening test's docstring, said the history-ancestry
class scans without --redact and quotes its findings. That stopped being true when the
class started redacting (ScannerErrorTests.test_f). The class stays out because the job's
redacted history scan covers that ground. Comment and docstring only; the test name is
kept because the recorded controls cite it.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…e protocol

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>