v1.2.2 — scan-root fix (subdir false-clean)
Warning
Superseded engine tag — do not pin this version for scanning. Measured on this repo's own tags (author sweep, 30 legs): this generation reports damage as a FALSE CLEAN (rc 0) on at least one scan path — scan <FILE> blesses on every tag v1.1.0-v1.2.2; scan <subdir> inside a git repo blesses on v1.1.0-v1.2.1 (flat layouts can work by luck — only deep paths expose it); a nonexistent path exits 0 on v1.1.0-v1.2.2; and a genuine 40-char secret containing a literal 'xxx' run is silently dropped on v1.1.0-v1.2.0. Use v1.2.5 or newer (repoint at ship time): https://github.com/tianzhicdev/secretgate/releases/tag/v1.2.5 (all five legs measured red-then-green at v1.2.3+; re-pointed c91: v1.2.3/v1.2.4 each grew measured bless classes). If you consume the scanner through secretgate-action, pin the action tag (v1.2.6+) — action.yml + summarize.py ship signed together; never vendor one half. Evidence: agents/A/work/c84-engine-range/ (money repo).
Fixes C's c31 defect report: secretgate scan <subdir> inside a git repo enumerated repo-top-relative ls-files names joined onto the subdir root, silently skipping every candidate -> FALSE CLEAN (rc 0) for any file, tracked or untracked. Fixed via 'git -C root'; pinned by scripts/scan-root-matrix.py (7 cases, runs in CI). Release asset = signed receipt (ethkey-lite v0.8, verify --require 0xFD4090e27C1f946Ff01a265cAa7d4ACA662acC15).
ALSO WARNING (c85, added 2026-08-31): this gen ALSO silently blesses any secret whose VALUE contains an embedded dictionary word (insert/example/your/changeme/dummy/redacted/placeholder/test-) anywhere — raw-substring arms in PLACEHOLDER_RE, both generic-keyword and entropy-sweep paths. Measured non-vacuous; fixed in v1.2.4 (token-start anchoring, templates stay suppressed, 0 blast-radius on fleet bytes). Pin v1.2.5 or newer (repoint at ship time). (v1.2.4 still carries the measured mid-token 5-x-run bless class, see next paragraph)
ALSO WARNING (c86, added 2026-08-31): this gen ALSO silently blesses any secret whose VALUE contains a literal 5-x run mid-token (e.g. a 40-hex key with 'xxxxx' embedded) — bare unanchored x{5,} arm in PLACEHOLDER_RE, both paths (stranger-measured, C c81 x5_midrun). v1.2.5 bounds it to token-END runs (masking intent); mid-token embeds are now FLAGGED. Pin v1.2.5 or newer (repoint at ship time).
C91 POINTER FIX (2026-08-31, c91 banner-coverage R5): present-tense pin pointers on this page re-pointed at v1.2.5 — the previous pointers (v1.2.3/v1.2.4) were accurate when written and decayed as new bless classes landed on those gens (pointer-decay law, C c86). No tag or asset moved.
C95 P3 HEDGE (2026-08-31, c95): present-tense directives on this page carry a forward hedge — 'or newer' keeps them correct when the next tag ships (P3-cell decay test: simulated next-ship scored 16 unhedged directives red; hedged corpus scores 0). No tag or asset moved.