codeArbiter 2.8.13: host-aware runtime vocabulary + dual-host audit hardening

[2.8.13] — 2026-07-12

Host-aware runtime vocabulary, plus dual-host audit-trail hardening.

Fixed

• Audit-log lines in gate-events.log now record the writing host
  (host=claude / host=codex), restoring per-writer attribution now that two
  hosts can share one .codearbiter/ store (ADR-0012).
• gate-events.log appends are now protected by a Windows byte-range lock and
  the file is created 0o600, so concurrent sessions cannot interleave or
  truncate audit lines.

Changed

• Every runtime-emitted command reference (startup briefing, NOT-INITIALIZED
  pointers, H-12/H-18 gate messages, doctor lines, the init scaffold's stub
  text) now flows through the host seam (Host.cmd_ref), so the same vendored
  core names /ca:<cmd> under Claude Code and $ca-<cmd> under Codex
  (ADR-0011 M3). Claude output is string-identical to 2.8.12.
• The markdown surface (commands/, skills/, includes/, COMMANDS.md,
  SPRINT.md, ORCHESTRATOR.md) is now rendered from core/surface/
  templates by tools/build-surface.py — byte-identical to the previous
  hand-maintained tree, with CI (--check) holding it there.

Released-at: 2026-07-12

ca-codex 0.2.4: first Codex CLI release, live-verified enforcement parity

[0.2.4] — 2026-07-12 — Codex hook-launch repair

Fixed

• Registered one OS-specific command handler per event, removing concurrent
  interpreter fallbacks that produced spurious failures or conflicting allows.
• Widened the PreToolUse exec matcher to Bash|shell_command|exec_command|unified_exec
  so the exec gate fires for every tool name the host map classifies as EXEC; a new
  adapter-suite drift guard fails if the matcher and the tool map ever diverge.
• Raised the documented Codex support floor to rust-v0.143.0, the earliest release
  with source-verified structured decision:block handling. The live-verified
  baseline remains 0.144.1.
• Added a Codex-only PreToolUse adapter. It runs the byte-identical shared
  guards, converts their exit-2 verdict to Codex's structured decision:block
  response, and preserves the exact gate feedback across the Windows shell.
• Corrected $ca-doctor path resolution and remediation for ordinary Codex
  tool calls, which do not inherit the hook runner's plugin-root environment.

Verified

• Codex 0.144.1 loaded the trusted plugin, injected the SessionStart persona,
  and blocked the live $ca-doctor probe with [H-03]. This satisfies the
  ADR-0011 promotion gate and removes the beta label.

Released-at: 2026-07-12

codeArbiter 2.8.11: tribunal remediation — 25 findings closed + update notifier

The tribunal remediation release. Closes all 25 findings from the 2026-07-01 deep-audit (#172–#196) — across security, reliability, performance, and observability — and adds an update-available notifier so third-party-marketplace installs stop running silently stale.

Highlights

• Security — fail-closed-on-crash guards (#189/#193); H-05 audit-log tail-anchoring + a literal --no-verify block (#172/#175); a repo-resolution fix so the mechanical guards judge the repo the git operation actually fires in (#190); SHA-pinned GitHub Actions + dependabot (#202).
• Reliability — atomic state writes, so a torn hook shim can no longer silently disable the git-enforce backstop; single-parse transcript prune (#191/#188).
• Performance — lower SessionStart latency: a fail-safe hooks-install skip, concurrent git reads, and de-duplicated briefing reads (#194).
• Observability — a durable .codearbiter/gate-events.log sink for every BLOCK/REMIND/WARN decision, plus an audit staleness-warn (#186).
• Features — the update-available notifier (SessionStart + statusline, once-daily, fail-silent, HTTPS-only) (#209); farm dispatcher hardening (#183/#187/#192).
• Refactors — statusline and command-helper thin entry points (#178/#179).

Per-version detail for 2.8.1 → 2.8.11 is in CHANGELOG.md.

codeArbiter 2.8.0: the tribunal deep-audit lane, eleven lenses

[2.8.0] — 2026-07-01

The tribunal release: a deep, resumable, whole-codebase audit lane, hardened by a full post-landing review and an eleventh lens, plus a fix for the false fail-closed commit-gate block that work surfaced.

Added

• /ca:tribunal — the deep resumable codebase-audit lane (#157, #168, #170). Convenes eleven bespoke tribunal-*-reviewer specialist lenses (appsec, architecture, coverage, infra, migration, observability, performance, reliability, secrets-supply, test-fidelity, typesafety) over the whole codebase in recorded priority waves. Each finding persists as its own crash-durable file under .codearbiter/reports/<run-id>/ alongside append-only triage/run logs, so an interrupted run resumes from disk across sessions and days; a triage pass recalibrates severity and confidence against a defined, severity-tiered confidence gate; approved findings file as deduped GitHub issues, only on explicit authorization. Rare and opt-in by design: never a required gate, never blocks a merge or commit. The infra lens covers CI/CD workflow security, container posture, IaC, and deploy manifests.

Fixed

• The commit gate no longer fails closed on commit messages containing ;, |, &, or a git -C mention (#169). The H-09b/H-10b/H-14 pre-commit scan truncated its argument parse at the first separator character inside a quoted or heredoc commit-message body; the leftover fragment leaked message words into a pathspec query whose failure blocked the commit as an unreadable diff. Heredoc bodies are now stripped before parsing, with the raw command retained as a fallback matcher so nothing scans less than before; the argument capture is quote-aware; and a fail-closed block message now carries the underlying git error, so the next read failure is diagnosable at a glance.

ca-sandbox 0.1.3: single docker primitive + helper-container hardening

Sandbox-driver consolidation and hardening, from the tribunal remediation. ca-sandbox is the sibling infrastructure plugin to ca and versions independently (ADR-0007); it remains a Feature Forge preview.

Changed

• One shared docker primitive (#180). tools/docker.ts is now the single module every docker invocation flows through, replacing duplicated spawn/argv logic across build/run/exec/cp/create/registry/claude-inside — so the argv-array discipline (no shell: true) and the container-hardening flags cannot drift between call sites.

Fixed

• Helper containers are labeled and time-bound (#173). The transient helper containers the driver spawns now carry an identifying label and a bounded lifetime, so an interrupted run cannot leak an unlabeled, unbounded container.

Also includes 0.1.2 (the ca-sandbox portion of the tribunal quick-kills, #197): atomic provenance/state writes, typed docker spawn options (shell omitted), dead re-bind cleanup, and fail-closed CI scripts. Full detail in the ca-sandbox CHANGELOG.

codeArbiter 2.6.1: P1 security hardening

[2.6.1] — 2026-07-01

A security-hardening release. Five P1 reports (thanks to @tg12) showed the enforcement layer being enforced against a forgeable or lexical surface (a writable activation file, writable gate markers, raw path strings, a literal command string, an env-controlled delete root) rather than the real underlying operation. Each is closed, and the rest of the repo was swept for the same class in every case. Also fixes a task-id parsing gap and finishes two stale AGPLv3 relicense surfaces.

Security

• The activation switch can no longer be flipped off from inside the repo it governs (#159). Every enforcement hook stays dormant unless .codearbiter/CONTEXT.md frontmatter reads arbiter: enabled, yet nothing protected that file, so writing arbiter: disabled (or corrupting the frontmatter) silenced every gate. The Write/Edit guards (H-18) now block a CONTEXT.md change whose resulting content drops arbiter: enabled or breaks the frontmatter, and the Bash pre-hook blocks the shell flank. A legitimate stage: change that keeps the flag enabled still passes.
• Gate-pass markers can no longer be forged by a direct write (#160). The .codearbiter/.markers/ tokens that turn a hard BLOCK into an allow were ordinary writable repo files, so a hand-written marker forged a security, migration, or ADR gate pass. The Write/Edit guards (H-19) now block tool writes to any marker, and the Bash pre-hook blocks shell redirects and file verbs naming security-gate-passed or migration-gate-passed. The sanctioned recorder scripts and the /ca:adr authoring marker still work.
• Symlink aliases no longer bypass the audit-log and ADR guards (#162). The Write and Edit guards classified the raw file_path, so a symlink whose visible path lacked .codearbiter/ slipped a write onto an append-only audit log or an immutable ADR. Every protected-path check now resolves the real path (the approach the Read and post-write hooks already used) and matches both the raw and resolved forms. NotebookEdit, previously wired to no hook, is now covered too.
• Git mutations are enforced below the command spelling (#161). The Bash pre-hook gates git commit, push, and add by matching the literal command string, so shell indirection such as g=git; c=commit; $g $c built a real commit the hook never saw, with no enforcement beneath it. codeArbiter now installs repo-level pre-commit and pre-push hooks that enforce the protected-branch, force-push, and crypto/secret/migration gates at the git operation itself, where spelling no longer matters. They reuse the same detection primitives as the Bash hook so the two cannot drift, never overwrite a pre-existing hook, and install idempotently at init and on session start.
• Farm worktree deletes are contained to the repo-scoped farm root (#163). The dispatcher resolved a worktree path from the env-controlled FARM_WORKTREE_ROOT plus a plan-controlled task id and recursively force-deleted it before git validated it, so a broad or misconfigured root plus a plausible id could delete an unrelated directory. The resolved root must now live inside the repository unless FARM_ALLOW_EXTERNAL_WORKTREE_ROOT=1 is set, every worktree path is asserted strictly inside that root before deletion, and the reserved ids . and .. are rejected.

Fixed

• A mistyped multi-part --id no longer strands a task (#158). /ca:task add --id accepted a value with more than two dot-separated parts and minted an un-targetable four-segment id that start/done could not reach and the board linter could not see. The id is now validated as a single GROUP.TYPE pair and rejected with a clear message otherwise, and the board reader recognizes an over-segmented id so it can be surfaced and repaired.
• Release-skill changelog heading and license declarations aligned (#151). The /ca:release skill now documents the Keep-a-Changelog ## [X.Y.Z] heading the repo and its release guards use, replacing the last reference to the bare ## vX.Y.Z form. The plugin manifest now declares AGPL-3.0-only (correcting a stale MIT), and the README license notice no longer implies a commercial license is currently on offer, completing the AGPLv3 relicense across those surfaces.

codeArbiter 2.6.0: context-drift provenance + just-in-time context injection

[2.6.0] — 2026-06-27

codeArbiter 2.6.0 spans several tracks. The headline additions are context-drift provenance (passive drift detection, a coarse code map, and commit-gate auto-heal) and file-scoped just-in-time context injection, which surfaces the governing decision, control, or spec at the moment an agent reads a file. The --farm preview gains best-of-N sampling and iterative retries for first-time-go accuracy, and commit-gate now lands task-board transitions atomically with the work (ADR-0008). This release also relicenses the project from MIT to AGPLv3 with a proprietary dual-licensing path; see the License note under Changed.

Added

• Best-of-N sampling against the gate (FARM_SAMPLES, default 1). Because the gate is a deterministic pass/fail oracle and each task runs in an isolated worktree, N candidates are drawn in parallel and the first to pass the gate is accepted. Each sample runs in its own scratch worktree cut from the integration HEAD; the winner's files are taken into the task worktree and merged, the losers discarded. Total in-flight worker calls never exceed FARM_CONCURRENCY — a shared limiter, so sampling shares the budget rather than multiplying it. FARM_SAMPLES=1 is byte-for-byte today's single-candidate path (pinned by a regression test). (report F1)
• Sampling parameters on the worker call (FARM_TEMPERATURE, FARM_MAX_TOKENS). The chat body now carries temperature (default 0; auto-bumped to 0.7 when FARM_SAMPLES>1 so samples diversify) and an optional max_tokens cap (default unset = provider default, today's behavior). (report F4)
• Best-of-N cost transparency. farm-report.json records both the summed sample-token spend and the accepted candidate's own tokens (acceptedPromptTokens/acceptedCompletionTokens), so the N×-tokens trade-off is visible rather than hidden. (report F1)
• Task-board transitions land atomically with the work (ADR-0008, #142). commit-gate is now the single board-sync chokepoint. A done-flip [~]→[x], start-flip [ ]→[~], or a single queued add to open-tasks.md is recognized by a new _taskboardlib.classify_board_diff classifier, retained by commit-gate Phase 6 (not flagged as scope creep), and staged by Phase 7 into the same commit as the work — so the flip is invisible on main until merge, then lands atomically, and an abandoned PR abandons the flip with it. No more lagging chore(board) PR or cross-session board drift. A new /ca:standup advisory drift sweep (hooks/boardsync.py reconcile, read-only and best-effort) surfaces any merged-but-not-flipped task; the fix still routes through /ca:task.
• Context-drift detection, a code map, and commit-gate auto-heal (#145). codeArbiter records which source files back each derived .codearbiter/ doc. When a tracked source changes, a single SessionStart line flags the drift, .codearbiter/code-map.md gives a coarse orientation map, commit-gate auto-heal re-baselines the provenance or proposes a doc update with the work commit, and /ca:context-check runs the audit on demand. A drifted claim is suppressed rather than surfaced as if it were fresh.
• File-scoped just-in-time context injection (#146). A PreToolUse:Read hook injects a budgeted (≤150-token), freshness-gated pointer to the security control, accepted ADR, approved spec, or fresh provenance claim that governs the file being read, in that priority order, then always allows the Read. A non-governed Read injects nothing and makes no git call. A spec opts in with an optional **Governs:** header line.

Changed

• Retries are now iterative. On a retry — a failed gate, or a sampling round with no green — the worker is shown its own previous in-scope output, not just the gate-failure tail, so it refines rather than restarts blind. The prior output rides the same FARM_ENRICH_MAX_BYTES byte-cap and secret-redaction chokepoint as all injected context; out-of-scope drift is never carried forward. (report F2)
• The follow-up harvest runs pre-commit. commit-gate's raise-new harvest moved from after-the-commit to Phase 7 before staging, so a discovered follow-up task rides the work commit as a contingent default; a follow-up that must survive PR abandonment is filed as a GitHub issue instead of the board. (ADR-0008, #142)
• Relicensed from MIT to AGPLv3 with proprietary dual-licensing (#147, ADR-0009). The open-source distribution moves to the GNU AGPLv3, whose network-use clause closes the hosted-fork loophole that MIT leaves open. Copyright is held solely by the owner, who reserves a proprietary dual-licensing path for a planned closed-source SaaS; future contributions require a CLA (see CLA.md). The change is forward-only, so code already published under MIT stays available under MIT. This supersedes ADR-0006's broad-adoption posture. See LICENSE and the README for the full terms.

Fixed

• Mutation-hook least privilege (#143). The pluggable mutation hook (FARM_MUTATION_CMD) no longer inherits the dispatcher's API key or OAuth token, giving it least-privilege parity with every other child command.
• Heredoc commit messages (#139). The commit gate no longer false-blocks a multi-line git commit -F - <<EOF commit message (H-09b).
• /ca:release hardening (#138). The release skill resolves the baseline tag, the notes heading, release-date consistency, and half-finished-publish recovery through tested helpers, and rebuilds farm.js unconditionally on every release.

codeArbiter 2.5.2: deep-review hard-gate hardening + enterprise docs

[2.5.2] — 2026-06-25

Deep-review (docs/reports/2026-06-24-root/) remediation, in two parts. The quick-kill batch is mechanical robustness, diagnosability, and hot-path hardening with no enforcement-behavior change (guard matrix, cold-install, and statusline render verified unchanged or byte-identical). The HARD-GATE batch closes real gaps in the crypto/secret commit gate and the append-only audit guards; each enforcement change shipped test-first (a RED test proving the gap, then the fix), with the full guard matrix, cold-install, migration backstop, and hook unit suites green.

Security

• Commit-time gates can no longer be bypassed by git commit <pathspec>. A git commit <path> records the worktree content of the named paths (bypassing the index), but the H-09b/H-10b crypto-secret gate and the H-14 migration gate scanned only the staged (--cached) diff — so an unstaged crypto/secret/migration change named as a pathspec committed with no recorded review. Both gates now union the worktree diff scoped to the named pathspecs (an unrelated worktree change elsewhere is not dragged in). The crypto/secret scan and the H-14 file-list read now also fail closed when git diff cannot be read (timeout/error) instead of silently passing. (appsec-001/002, reliability-003)
• Farm child commands no longer inherit dispatcher secrets. run() scrubs FARM_API_KEY and CLAUDE_CODE_OAUTH_TOKEN from the environment passed to every child (git, operator gate/setup/test, mutation) — the API key is used only by the in-process fetch. Least-privilege defense-in-depth; shrinks the blast radius of the operator-authored gate-command shell boundary (CodeQL js/shell-command-injection-from-environment #5, traced non-exploitable and dismissed).
• Two detection blind spots in the crypto/secret commit gate are closed. CRYPTO_RE did not match RC2 or Blowfish (both forbidden by security-controls.md), so a commit adding either passed the H-09b gate with no crypto-compliance review. SECRET_RE's leading word-boundary never fired when a secret keyword was the trailing segment of a compound identifier, so a hardcoded FARM_API_KEY = "..." committed clean past H-10b. Both now match. The outbound farm redactor and the commit-gate secret pattern are also pinned to a shared, CI-checked corpus (secret-detection-corpus.json) asserted against both, so they can no longer silently drift apart. (secrets-001/002, architecture-001, #132)
• The H-05 append-only audit-log guard no longer accepts an empty-old_string Edit. Because new.startswith("") is always true, an Edit with an empty old_string on overrides.log / triage.log / sprint-log.md slipped the append-only check entirely; it now blocks outright. The variable-indirection residual risk and the known truncation-spelling gaps (exec N>, >>>, process substitution) are now documented in security-controls.md so the policy matches the enforced scope. (migration-003, appsec-003, observability-005, #132)
• A session-boundary /ca:dev exit now closes the audit pair. When SessionStart clears a live dev marker (a prior session entered /ca:dev and ended without /ca:arbiter), it appends a synthetic DEV: exit line to overrides.log before removing the marker, so the audit trail no longer keeps an orphaned DEV: enter with no matching close. (observability-001, #133)

Fixed

• The task board can't be lost to a crashed write. taskwrite.py writes open-tasks.md atomically (temp file in the board's own directory + os.replace), so an interrupted write leaves the prior board intact. (migration-001)
• Farm dispatcher robustness + diagnosability. A per-command wall-clock timeout (FARM_GATE_TIMEOUT_MS, default 5m; git stays unbounded) kills a hung gate/setup/mutation child so a stuck command can no longer wedge a run and stall the final report; the worktree-cleanup finally is guarded against an early failure; plan validation emits named field errors instead of an opaque crash; a run-id correlates farm-results.jsonl lines and the report header. Response/parse shape guards turn malformed API or mutation-hook output into actionable errors instead of silent empties. (reliability-001/004, migration-004, observability-003, dx-001/002/003)
• ca-sandbox surfaces real failure causes. docker create/cp exit codes are checked and the failed-clone path captures a bounded slice of git stderr into the thrown error, so a failed sandbox build/clone no longer reports only a bare exit code. (reliability-002, observability-004)
• Task-board lib input guards. _taskboardlib.set_state/promote no longer raise or silently mutate state on an unexpected value; valid value sets are documented. (dx-004/005)
• Gate-pass markers are written atomically. migration-pass.py and security-pass.py write their pass markers through a temp file plus os.replace (shared _hooklib.write_text_atomic), so a crash mid-write can no longer leave a half-written marker that the backstop reads as an unrecognized digest and spuriously re-blocks the next commit. Fail-closed behavior is unchanged. (migration-002, #133)

Changed

• Hook hot-path and statusline render cost reduced (behavior-preserving). _hooklib caches the controls read (mtime-keyed, per ephemeral hook process) and precompiles its default path-globs at import; the statusline caches per-render state reads and its cost-ledger subsystem moved into a dedicated _ledgerlib.py. Verified: guard matrix 79/0, cold-install 134/0, and the statusline render byte-identical. (performance-001..005, architecture-005/007)
• Public-API header blocks added to _hooklib.py and _sloplib.py per the coding standard. (dx-007)
• Audit-guard path sets centralized in _hooklib (behavior-preserving). The append-only-log and ADR-decisions path patterns, previously triplicated inline across pre-write / pre-edit / pre-bash, now have a single definition (is_audit_log / AUDIT_LOG_NAMES, is_decisions_path / DECISIONS_DIR_RE), so adding an audit artifact touches one file instead of three. The detached-HEAD protected-tip check also resolves in one git show-ref spawn instead of three sequential git rev-parse calls, with the same block/allow decisions. (architecture-004, performance-006, #132, #133)

Tests

• Added integration/coverage for existing behavior with no source change: custom CI/deploy scope grammar, the H-12 governed-path reminder (incl. superseded-ADR), and validateRepoUrl scp double-colon rejection; plus a _ledgerlib suite. (coverage-003/004/005)

Documentation

• Full pre-release docs pass. Tightened the always-loaded orchestrator core (collapsed the duplicated non-negotiables, trimmed the register, made the lazy-load routers state one deterministic trigger-to-route surface) and reconciled the governance docs to the now-merged enforcement (the forbidden-crypto list, the secret-sweep pattern, and the audit-trail section that now names the automated session-cleanup DEV: exit write). Corrected stale references (/ca:arbiter no longer instructs a manual dev-exit line the hook already writes; auth-crypto-reviewer and the post-write reminder now list rc2/blowfish). The docs site gains an Enforcement & Security page and a complete Hooks reference documenting every hook (event, location, controls, and fail posture).

Released-at: 2026-06-25

codeArbiter 2.5.1: macOS/Windows scope-reminder fix + release-skill ca-scoping

Fixed

• Scope-touch reminders now fire on macOS and Windows (H-12/H-15/H-16/H-13).
  post-write-edit.py derived its repo-relative path with a lexical os.path.relpath. When
  the hook payload's file_path and git rev-parse --show-toplevel named the same repo via
  divergent forms (a symlinked /var vs /private/var on macOS, an 8.3 short name on
  Windows), the path came out ..-prefixed and every path-scoped reminder was silently
  dropped. A new _hooklib.repo_rel() canonicalizes both sides with realpath first. (#125)
• /ca:release is now scoped to the ca plugin (ADR-0007). The skill assumed a
  single-plugin repo: LAST_TAG resolved via bare git describe (returning a ca-sandbox
  tag), the bump and commit window spanned the whole repo, the derived version was never
  asserted against plugin.json, and the README/catalog surfaces had no sync step. All are
  now scoped to plugins/ca/ and enforced, including a read-back of the published Release. (#125)

codeArbiter 2.5.0: task-board lifecycle + gate hardening

Added

• Advisory scope-touch detection for CI, deploy/IaC, and auth (H-15/H-16/H-17). After a
  write/edit, post-write-edit.py now reminds when a CI/CD workflow (H-15), a deployment/IaC
  manifest (H-16), or narrow high-signal auth logic (H-17) is touched, pointing at
  security-reviewer. These are advisory only — no commit block: a workflow runs only once merged
  and IaC bites only on apply, so a hard per-commit gate would impede iterative infra work while the PR
  review still catches the change (the irreversible-once-committed harms — secret/migration/crypto —
  keep their blocking gates). commit-gate now dispatches security-reviewer on a staged CI/deploy touch
  even on bare /commit / the small lane, closing the same lane-skip gap H-14 closed for migrations.
  CI and deploy paths are detected by default glob sets, extendable/narrowable via ci-paths /
  deploy-paths blocks in security-controls.md (same grammar as migration-paths); the migration,
  CI, and deploy detectors now share one path_in_globs matcher in _hooklib.py. Resolves the
  scope-touch half of #73. (#73)
• /ca:metrics — governance trend glance (issue #79). Read-only command computing override rate,
  small-lane rate, and sprint low-confidence ratio over 20-commit windows, each with a direction arrow
  (↑/↓/→) vs. the prior window. Optional --window N to adjust the window size. Bare numbers only —
  not a second /ca:audit packet; writes nothing.
• Task-board lifecycle + /ca:task writer and follow-up harvest (#118). open-tasks.md gains a
  kanban-style lifecycle ([ ] queued, [~] in-progress, [x] done) with content-bearing IDs, so
  the in-flight count and stale-task nudge read real state instead of counting every bullet. The board
  now surfaces malformed or undated entries at SessionStart rather than letting work silently drop off.
  New /ca:task add|start|done is the sanctioned board mutator, and each gated workflow's terminal
  step harvests its un-actioned residue (NEEDS-TRIAGE markers, the checkpoint DEFERRABLE table,
  low-confidence sprint decisions) into the durable backlog.

Fixed

• --farm setup-doc error messages now point at the file that actually ships (#119). The no-model
  and no-API-key guards cited a never-scaffolded .codearbiter/farm.md; they now point at
  ${CLAUDE_PLUGIN_ROOT}/includes/farm.md, which is part of the plugin payload.
• The crypto and secret commit gates now catch the Node/TS forms (#120). CRYPTO_RE detects the
  TypeScript TLS-verification-disable patterns (the rejectUnauthorized bypass and the Node TLS-reject
  env override), not only the Python form; and SECRET_RE matches object-literal secrets
  ("api_key": "…") plus high-entropy key prefixes (AKIA, ghp_, sk-ant-), not only =-style
  assignments. The farm.ts outbound redactor is aligned so the gate and the redactor never disagree.