Stability checkpoint v0.8.0 — on-the-fly secret redaction (ADR-0046)
Closes the content-level exfiltration vector that v0.7.x left open :
Read of /workspace/.env was ALLOWed by policy but the content shipped
to the LLM verbatim. The project's 'no silent exfiltration' promise
is now load-bearing for content as well as paths.
User explicitly asked for this on 2026-05-01 ('ne peux tu pas prévoir
un mode d'obfuscation à la volée avec encodage et décodage avant
l'envoi à l'IA ?'). Passes the (1)/(2)/(3) scope-discipline rule
from CLAUDE.md cleanly.
- chore: TASKS.md scope-aware backlog (a4b347a)
- docs: drain TASKS items #3 + #4 (CLAUDE.md scope discipline + README honesty pass) (c157ca4)
- chore: drain TASKS #2 (policy template subcommand) (1840596)
- feat(audit-demo): MCP-poisoning + prompt-injection + supply-chain red-team scenarios (40a6b25)
- feat(cli): secured-claude policy template subcommand (developer-default + enterprise-strict)
- chore: drain TASKS #2 done in 1840596 (b998024)
- docs: ADR-0045 (rejected non-features) + README global pass + coherence fixes (e3824ed)
- feat(security): on-the-fly secret redaction for Read results (ADR-0046) (c399483 + 678fc0a)
CI :
- ✅ MR pipeline #228 green
- ✅ Main pipeline #229 green
- ✅ All 5 main-stages : lint / test / security / build / smoke
Local :
- ✅ uv run pytest -q → 291 tests pass (was 258 in v0.7.4 ; +33 redaction)
- ✅ Coverage 91.58 %
- ✅ uv run ruff check + format clean
- ✅ uv run mypy strict clean (17 source files, +redaction.py +hook_post.py)
- ✅ gitleaks no leaks (with .gitleaks.toml allowlist for test fixtures)
Themes :
🔒 Sécurité — ADR-0046 closes the content-level exfil vector. 15 curated
patterns + per-session placeholder map + Bash placeholder guard. 33 new
tests cover pattern coverage, restore semantics, session isolation,
forged placeholder rejection, env-driven activation, /transform end-to-end.
🤖 IA — PostToolUse hook on Read intercepts file content before it reaches
the LLM, so the agent works on tokenised secrets. The substitute-back
path lets the LLM's downstream Bash commands legitimately use the
secret value (broker substitutes before exec).
🏛 Architecture — 46 ADRs total. ADR-0045 formally documents 3 rejected
non-features (agent↔broker mTLS, background JWKS refresh, OTLP push).
ADR-0046 documents tokenise-everything as a non-starter (kills LLM utility).
📊 Observabilité — secured_claude_redaction_matches_total{rule} counter
for ops visibility on redaction firings.
🔄 CI/CD — .gitleaks.toml allowlists test fixtures. Test fixtures use
runtime string concat so GitHub Push Protection doesn't block.
🛠 DevX — SECURED_CLAUDE_REDACT_LEVEL=secrets activates redaction.
Default off ; existing v0.7.x deployments unaffected. policy template
subcommand for new repo onboarding (TASKS #2).
✅ Qualité — 291 tests, 91.58 % coverage, all gates green.
- False negatives : custom-format secrets won't match v0.8.0 patterns.
v0.8.x aggressive mode for user-marked sensitive paths (deferred).
- Inferred-from-context leak : env var name (AWS_KEY=...) leaks the
KIND of secret even if value is opaque. Out of scope for v0.8.0.
- Adversarial Bash : LLM-crafted base64-encoded placeholders not
caught — placeholder guard DENYs forged ones, strict but safe.
- v0.7.x speculative items (mTLS / background refresh / OTLP) remain
formally rejected per ADR-0045.
- v0.8.x : aggressive mode for user-marked SECURED_CLAUDE_REDACT_PATHS
(tokenise all string literals in those files) ; CLI 'secured-claude
redact <file>' for manual diff/paste workflows ; custom pattern
injection via SECURED_CLAUDE_REDACT_PATTERNS for org-specific tokens.