Audit: close the credential leak and four other real defects

[Tippel-AI]

The code half of the launch audit. Eight reviewers, each attacked by an
independent skeptic; 56 of 58 findings survived. This closes the ones that are
defects in shipped behaviour.

The one that matters most

A probed endpoint could steal the operator's API key with a 302.

Both probes attached an operator-supplied auth header and followed redirects
unconditionally. httpx strips exactly one header across hosts — Authorization —
while AuthConfig.header is configurable, and the two commonest real
alternatives are not it:

Deployment	Header	Stripped by httpx?
OpenAI-compatible	Authorization	yes
Azure OpenAI	api-key	no
Azure Functions	x-functions-key	no

The auditor ran it: two local servers, the target 302s to the second, and the
second logged 'api-key': 'SECRET-AZURE-KEY-123'. The endpoint under test decided
where markproof sent a production credential.

For a tool whose premise is point this at your live system with your real token,
that is worse than any marking failure it was built to catch. Those cost
compliance; this costs a key.

Redirects are still followed — an http→https upgrade is ordinary — but every
operator-supplied header is dropped the moment the origin changes: scheme,
host and port, so a downgrade to http counts. The POST body goes with it; the
prompt is the operator's too. The manifest fetch refuses to leave the origin at
all, because the same-origin check docs/DISCLAIMER.md promises was worth nothing
while a 302 could move the destination after it.

Four more

A correctly signed page was reported as unmarked. The link parsers matched
only quoted attributes and a single-token rel, so <link rel=c2pa-manifest href=m.c2pa> — valid HTML5, and exactly what html-minifier's
removeAttributeQuotes emits — was invisible, as was rel="preload c2pa-manifest". MPF-M-002 is severity fail, so a compliant deployment went red
while the finding text asserted there was no link element in bytes that contain
one.

Three mutations turned text marking into a silent PASS and survived 477 tests.
The detector was tested directly; the engine only ever on a passing fixture. The
mapping between them — the part that broke — was unguarded. All six outcomes are
now pinned, with the detector substituted so this runs everywhere rather than only
where the optional stack is installed. All three of the auditor's mutations are
caught.

A declared obligation with no matching probe vanished from the report. The
README promises the opposite. It held for a missing watermark config and not for a
missing probe: declaring synthetic-media-marking: true against a chat-only
target gave a green run and a report that never mentioned the obligation.

Every install command the tool printed was wrong. Rich reads brackets as
markup:

printed:  pip install 'markproof'
intended: pip install 'markproof[synthid]'

A command that installs the base package and does not fix what the user just hit.
Finding messages and identifiers now go through the same escaping — table cells
are markup too.

Also

• A configured sign_key that does not resolve stops the run, instead of writing
  an unsigned report with a note nobody reads in CI.
• The report is written by default. markproof init then markproof run produced
  nothing, and the report is the deliverable. --no-report opts out.
• The rulepack digest is joined by one over the pattern and label files: editing
  disclosure.de-en.yaml flips verdicts while leaving rulepack.sha256
  byte-identical — a cheaper substitution than the rulepack swap the digest was
  added to defend against.
• The determinism gate now builds reports with every field the CLI fills.
  probes and data_sha256 were both outside it.

Verification

Every fix is mutation-tested against the defect it closes: removing the
credential-dropping turns 5 tests red, removing the Rich escaping turns 2 red, and
each of the three synthid mutations is caught individually.

512 tests, ruff + mypy strict clean.

Docs and README findings follow in a second PR.

🤖 Generated with Claude Code