fix(scanner): distinguish password indirection and authenticated boundary comments from real findings

[seonghobae]

Downstream failure

LifeOS PR #198 exact head 8a9e417b15f89f972e242e07197a3a4a818ff82a ran AppGuardrail workflow 33925458503 on 2026-09-05. Checkout, scanner execution, detector-contract verification, SARIF upload, and retained-evidence upload all succeeded; only the blocking-enforcement step failed. The retained appguardrail-evidence artifact is 9960678559, SHA-256 3e6fe87e28ce13c41e6f1430d5b1a03071a5f7e810935c3607f15d70e67ef6fd.

Fresh retained evidence reproduces scanner-owned false positives on unchanged downstream source. These should be repaired here rather than suppressed or cosmetically rewritten in LifeOS:

1. hardcoded-password treats variable indirection as a literal secret. infra/postgres/provision/notification-runtime.psql uses PASSWORD :'runtime_password'; infra/postgres/provision/upgrade-legacy-local.sh forwards operator-provided POSTGRES_PASSWORD, LEGACY_POSTGRES_PASSWORD, NOTIFICATION_RUNTIME_DATABASE_PASSWORD, and PGPASSWORD through environment/psql variables. No secret literal is embedded by those expressions.
2. hardcoded-password also marks assertions in packages/commercial-development-agent/src/compose-runtime-workflow-regression.test.mjs as deploy-blocking application code even though the file is an explicit *.test.mjs regression contract.
3. hardcoded-database-url marks credential-free postgresql://runtime.invalid/... sentinels in apps/notification-service/src/notification-http.test.ts as deploy-blocking application evidence. .invalid is deliberately non-routable test authority and the URI contains no credentials.
4. todo-skip-auth fires on the explanatory production comment Requires one ordinary JSON object so prototypes cannot add hidden authority fields. in notification-data-rights-http-boundary.ts. The comment documents prototype/authority validation and expresses no skip, disable, bypass, or deferral of authentication.
5. Test-context classification is path-shape sensitive: explicit *.test.ts / *.test.mjs files under src/ or another production-looking directory can remain app-code, so otherwise test-only findings become deploy-blocking. Context should be derived from test-file semantics as well as directory names.

Two positive-control fixture findings remain expected and must continue to be detected: tests/appguardrail-fixtures/oauth-open-redirect.ts and tests/appguardrail-fixtures/dangerous-cors.ts. Do not broadly exempt tests from detection; distinguish realistic test evidence from deploy-blocking production evidence while preserving test findings as non-deploy-blocking where appropriate.

Required RED → GREEN

Add scanner-owned regressions before changing classification:

• RED: shell self/variable assignment (POSTGRES_PASSWORD="$POSTGRES_PASSWORD", PGPASSWORD="$LEGACY_POSTGRES_PASSWORD") and psql variable use (PASSWORD :'runtime_password') are not hardcoded-password; a real literal such as password='secret123' remains detected.
• RED: *.test.ts and *.test.mjs are classified as test context even when located under src/; scanner findings may still exist but must not become deploy-blocking solely because of directory placement.
• RED: a credential-free postgresql://runtime.invalid/... value in explicit test context is not deploy-blocking; a credential-bearing production literal remains blocking.
• RED: ordinary comments containing words such as prototypes, hidden authority fields, or authentication do not become todo-skip-auth unless the comment actually expresses skip/disable/bypass/defer intent; existing true-positive skip-auth fixtures remain detected.
• GREEN: rerun the scanner fixture suite plus the retained LifeOS cases and prove the expected positive controls still fire, false positives above do not block, and evidence schema/rule IDs remain stable unless a versioned contract change is explicitly required.

Prefer semantic/context discrimination over broad allowlists. Produce an immutable reviewed AppGuardrail release/commit after GREEN so LifeOS can update the exact pin and rerun #198 without source contortions or gate weakening.

Refs ContextualWisdomLab/life-os#198, ContextualWisdomLab/life-os#212.

[seonghobae]

Additional downstream RED from LifeOS #247 now reproduces on four exact heads without any LifeOS suppression or cosmetic wording workaround.

Earlier retained evidence: exact head 6308261d9befd44fae05d11e6a6116509eaf7d9f, AppGuardrail run 34032503414 / job 101484542666, pinned AppGuardrail 4e4f6c34e4e9640ba769020e9ab4a6ebee07bab1. The scanner, detector-contract verification, SARIF/evidence upload all completed and only gate enforcement failed. The sole deploy-blocking HIGH was todo-skip-auth on packages/commercial-readiness/src/github-client-self-review-provenance.test.mjs:101, whose test title is rejects padded author identity instead of trimming it into independent approval authority.

Second reproduction: LifeOS #247 exact head c8e124d2a514762a48e7764e20dea30bdd484a56, AppGuardrail run 34050790878 / job 101533918395. Checkout, scanner execution, detector-contract verification, SARIF upload and retained-evidence upload all succeeded; only Enforce AppGuardrail gate failed. Retained artifact appguardrail-evidence is artifact 9994890297, digest sha256:376b8c386bd28a715271a58b4a3b6d17cd27fd5a8b4f2017a74c945243600ba1.

Third reproduction: LifeOS #247 exact head 80c48ce04cb593602f27b51db5cddcf917e60428, AppGuardrail run 34061630269 / hosted job 101563065998, still pinned to AppGuardrail 4e4f6c34e4e9640ba769020e9ab4a6ebee07bab1. The Ubuntu 24.04 hosted runner checked out the exact LifeOS head, executed the scanner, verified the detector contract, uploaded SARIF and retained evidence, and failed only the blocking-enforcement step. Artifact appguardrail-evidence is 9998003711, digest sha256:b28b82a5efd9ab8f94e7038581ee11c03779233b3512ea1bc4f35bb66745538c.

Fresh fourth reproduction: LifeOS #247 exact head 6f3014ebc421afc561440c47dd0d23416e6e2699, AppGuardrail run 34066285177 / hosted job 101575500221. Checkout, scanner execution, detector-contract verification, SARIF upload and retained-evidence upload all succeeded; only Enforce AppGuardrail gate failed. Retained artifact appguardrail-evidence is 9999408601, digest sha256:98247e02ae7b52f1ab2bae2d652139c3485330f7cd4f4b15bd58e02bfcf30685. The deploy blocker is again todo-skip-auth at packages/commercial-readiness/src/github-client-self-review-provenance.test.mjs:101; the exact source there is an explicit test title rejecting padded author identity from becoming independent approval authority.

The evidence strengthens #1106's existing acceptance boundary: explicit *.test.* / *.integration.test.* semantics must influence context even under production-looking directories, and todo-skip-auth must require actual skip/disable/bypass/defer intent rather than incidental author/authority wording. Test findings may remain evidence but must not become deploy-blocking merely because directory placement maps them to app-code.

Please repair this in the scanner owner with RED→GREEN regression coverage, preserve positive controls, then produce an immutable reviewed AppGuardrail commit/release so LifeOS can consume the exact pin and rerun #247/#198. Until then LifeOS will keep the review thread unresolved and will not weaken the gate, suppress the rule, or rewrite security wording to evade detection.

[seonghobae]

Scanner-owned LifeOS #247 regression is now locked on AppGuardrail PR #1129 exact head 4a026d5f2938685844efab95f7dd52e98564883d:

• packages/commercial-readiness/src/github-client-self-review-provenance.test.mjs titles about padded author identity / independent approval authority do not emit todo-skip-auth.
• *.integration.test.* files under src/ are test context and are not deploy-blocking solely from directory placement.
• True-positive skip/disable/bypass/defer comments remain detected.

This does not close #1106. LifeOS still needs an immutable reviewed AppGuardrail pin after ordinary protected merge of the successor stack (#998 then #1129). No gate weakening or wording workaround is implied.

[seonghobae]

Fresh LifeOS exact-head reproduction adds a second current false-positive shape on the same scanner-owner lane.

ContextualWisdomLab/life-os#247 exact head 2590fc2b884e8ef5701f60f1fe74a6b5ed8ca946, AppGuardrail run 34099637840, job 101670863349 completed on an actual ubuntu-24.04 runner. Checkout, scanner execution, detector-contract verification, SARIF upload, redacted retained-evidence staging/upload all succeeded; only Enforce AppGuardrail gate failed. Retained artifact 10014219549, digest sha256:e3094e8d8b8630a929e7a6cc6226008bbda5d4fc290fc3f0fd72cd85f00cba6d.

The new current code-scanning thread is packages/commercial-readiness/src/github-client.mjs:590. The source is contract JSDoc for workflow-run provenance: attempt cannot create authority; when the same valid workflow name also has exact-head evidence, .... It explicitly says malformed run-attempt evidence cannot become merge authority; it does not skip/defer authentication or authorization, and it changes no runtime security control. AppGuardrail nevertheless reports Comment suggests authentication or security check was intentionally skipped.

The earlier current false positive at github-client-self-review-provenance.test.mjs:101 remains unresolved as well. Please include both exact lexical/provenance forms in owner RED/GREEN acceptance while preserving positive detection of real skip-auth/defer-auth comments. LifeOS will not rewrite accurate contract documentation, suppress the result, or weaken the gate; both threads remain unresolved pending immutable owner repair and consumer-pin update.

[seonghobae]

Fresh downstream evidence on LifeOS #276 exact 7973277a4c97db6eaa071ff2726187f6b33009f5, AppGuardrail run 34637792706 / job 103389923269, pinned scanner 4e4f6c34e4e9640ba769020e9ab4a6ebee07bab1 confirms the path-semantics problem remains broader than the earlier examples.

• apps/identity-service/tests/session-authentication-migration-contract.test.ts still produces todo-skip-auth HIGH findings in explicit test context, though they are non-blocking.
• apps/integration-service/src/plugin-operator-http.integration.test.ts produces 12 state-changing-fetch-without-csrf-token warnings and is classified as app-code solely despite the explicit .integration.test.ts filename.

The latter is a direct current-head canary for this issue's requirement that *.test.ts under src/ be classified by test-file semantics rather than directory shape. Please include the CSRF rule in the same test-context regression: findings may remain visible as test evidence, but should not be mislabeled as deployable app-code. No LifeOS suppression or source wording change was applied.

[seonghobae]

Fresh unchanged-source downstream evidence from LifeOS #247 (2026-09-15 KST): exact head d44bbedfea8bf65e95dbe745ef4edd4ba948a9ea, AppGuardrail run 34843589489, job 103974037766 is terminal FAILURE. Checkout, scanner setup/execution, detector-contract verification, evidence redaction, SARIF upload, and retained-evidence upload all succeeded; only Enforce AppGuardrail gate failed. The two LifeOS review threads remain the same scanner-owner todo-skip-auth false-positive shapes already recorded here: an explicit test title rejecting padded author identity as approval authority, and production JSDoc stating malformed/mismatched workflow evidence cannot create merge authority. LifeOS has not rewritten the wording, suppressed the rule, or weakened the gate.

Owner stack is still #998@8b95c2bee24567ab3200a96da807259e023eee73 → Draft #1129@c5be73c52a78a1c63c6ddf212de7d6281b9bd96b. On #998 the current exact Tests, Python-shell AST coverage, Security Scan, SAST, path-context and related lanes are terminal success; its sole hosted source-independent blocker is central CodeQL terminal-publication failure. I dismissed only the stale OpenCode CHANGES_REQUESTED review bound to obsolete head e2b0637..., whose coverage-only reason is no longer true on current head, and requested fresh current-head CodeRabbit reviews on both #998 and #1129. Neither action is approval or merge authorization.

Keep #1106 open until #998 and #1129 normally integrate, an immutable reviewed AppGuardrail owner version/commit is available, and LifeOS consumes that exact pin and reruns the unchanged false-positive cases GREEN.

[seonghobae]

Fresh current-review finding on the #1106 owner successor changes its acceptance boundary before LifeOS can consume it.

AppGuardrail #1129 predecessor exact c5be73c52a78a1c63c6ddf212de7d6281b9bd96b received a current CodeRabbit Critical finding: _PASSWORD_INDIRECTION_RE = re.compile(r""":['\"]|["']\$""") treats the unanchored :' in JavaScript/TypeScript password:'secret123' as password indirection, so a real embedded password can evade the deploy-blocking hardcoded-password rule.

Regression-first exact c1921e12dbb01de06a3b4566e83cd69e75fa30be now adds test_js_colon_password_literal_remains_detected while leaving production unchanged, so #1129 intentionally remains Draft/RED until the causal regex repair lands. The same review also found a package-scan CWE-400 budget defect and LICENSE/NOTICE evidence mismatch; those are #1099-side findings and remain open on #1129.

Do not close #1106 or publish/consume an AppGuardrail owner pin from this stack until the Critical false-negative regression is GREEN, all valid successor findings are repaired, #998/#1129 integrate normally, and an immutable reviewed version is available. LifeOS #247 remains unchanged and fail-closed.

[seonghobae]

Fresh downstream canary extends #1106 with a different todo-skip-auth false-positive shape.

LifeOS #276 exact 2ba9cc944279aaf80be6a3660e5dcc0980e10cda, AppGuardrail run 34956914811 / job 104341072996, still pins owner commit 4e4f6c34e4e9640ba769020e9ab4a6ebee07bab1. Scanner execution, detector-contract verification, SARIF upload, and retained-evidence upload all succeeded; enforcement failed on one deploy-blocking HIGH at packages/commercial-development-agent/src/node24-actions-flow-style-contract.test.mjs:122:

`${path} uses a flow-style checkout/setup-node step that bypasses direct step authority validation`,

This is an executable test error string inside a helper that rejects flow-style reviewed actions; it is not a comment and does not skip authentication/security. The pinned rule's broad regex therefore proves another semantic defect: todo-skip-auth scans arbitrary source text rather than comment syntax.

The active successor #1129 exact 5986b5d83e0dc898bf4dbf43d4287528b54250ff already carries the comment-anchored rule (//, #, /* ... */) and preserves true-positive skip/disable/bypass/defer comments, so no additional LifeOS wording workaround is appropriate. #1106 must remain open until that owner semantics is part of an immutable reviewed AppGuardrail release/authority and LifeOS can bump the exact pin and rerun the unchanged #276 canary GREEN. AppGuardrail's current GitHub release inventory is still empty.