sync(sanitization): hardened scrubber, identifier-free capture discovery, and the absence scan — match fork 687cbc5/eb4f844

The slice ships the harvester, so it ships the FIXED harvester:
scrubBlock recurses into source (the payload one level below where the
old scrubber looked — the measured five-PNG leak class) and fails
closed on any long string there. Capture discovery in the two
real-pair tests recovers the file by hashing candidates against the
fixture's own token instead of hardcoding a capture id (a capture
UUID plus a home path is a live identifier in a public tree).
tools/absence-scan.mjs + its test make sanitization CHECKED rather
than claimed, per the cnighswonger#272 fixture-strategy thread; one allowlist
entry added with provenance (upstream's own org_id example in
docs/directives/proxy-cache-warmer-v3.7.0.md). The grafted nesting
tests pin the source.data class red-first at unit level.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016y33RMV399iYMXFEbAfQCk

Author: Gunther-Schulz

test/absence-scan.test.mjs

@@ -0,0 +1,324 @@
+// absence-scan — the scanner's own bite.
+//
+// The classes it carries were extracted out of harvest-scrub-relations.test.mjs
+// §6, where they assert the ABSENCE of a defect over a corpus that is clean.
+// That shape cannot bite itself: a neutered predicate over a clean corpus still
+// passes, so "the suite is green" says nothing about whether the extraction
+// kept the classes alive. What proves a class alive is a SEEDED defect — one
+// synthetic document per class, each of which must produce exactly its own
+// finding. That is what the first section does, and it is the guarantee the
+// extraction needed.
+//
+// The rest exercises the CLI contract the pre-push hook in the dotfiles repo
+// depends on: exit 2 on findings, 0 on clean, the git-range mode over a real
+// scratch repository, the allowlist, and the degraded (unparseable) path.
+//
+// Every identifier here is synthetic — this repo is public.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, readdirSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { scanDocument, scanContent, isAllowlisted, CLASSES } from "../tools/absence-scan.mjs";
+
+const TOOL = join(dirname(fileURLToPath(import.meta.url)), "..", "tools", "absence-scan.mjs");
+const CORPUS = "test/fixtures/harvested";
+
+// Synthetic, and shaped like the thing each class is defined against.
+const FAKE_UUID = "0123abcd-4567-89ef-0123-456789abcdef";
+const LONG_B64 = "QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0".repeat(4);
+const TOKEN_TEXT = "t_0123456789ab_42";
+
+// A document with nothing for any class to say anything about.
+const CLEAN = {
+  key: "s-0123456789ab",
+  ts: "2000-01-01T00:00:03.000Z",
+  messages: [
+    { role: "user", content: [{ type: "text", text: TOKEN_TEXT }] },
+    {
+      role: "user",
+      content: [{ type: "image", source: { type: "base64", media_type: "image/png", data: "data_0123456789" } }],
+    },
+  ],
+};
+
+// One seeded defect per class. Each entry is the MINIMAL deviation from CLEAN
+// that its class is defined to catch.
+const SEEDED = {
+  // On a `signature`, not on a `text`: a long base64 run inside a content
+  // field is legitimately BOTH an unsanitized payload and untokenized content,
+  // and a seed that trips two classes cannot show which one caught it.
+  "b64-run": {
+    ...CLEAN,
+    messages: [
+      { role: "assistant", content: [{ type: "thinking", thinking: TOKEN_TEXT, signature: LONG_B64 }] },
+    ],
+  },
+  "nested-payload": {
+    ...CLEAN,
+    messages: [
+      { role: "user", content: [{ type: "image", source: { type: "base64", data: "iVBORw0KGgoAAAA" } }] },
+    ],
+  },
+  "live-timestamp": { ...CLEAN, ts: "2026-08-01T09:15:00.000Z" },
+  "capture-uuid": { ...CLEAN, key: FAKE_UUID },
+  "raw-content": {
+    ...CLEAN,
+    messages: [{ role: "user", content: [{ type: "text", text: "plain prose that never went through the scrub" }] }],
+  },
+};
+
+test("every class goes RED on its own seeded defect, and only that class", () => {
+  for (const cls of CLASSES) {
+    const doc = SEEDED[cls.name];
+    assert.ok(doc, `no seeded defect for class ${cls.name} — a class without a bite is an orphan`);
+    const fired = new Set(scanDocument(doc).findings.map((f) => f.class));
+    assert.ok(fired.has(cls.name), `${cls.name} did not fire on its own seeded defect`);
+    assert.deepEqual([...fired], [cls.name], `${cls.name}'s seeded defect must not trip a second class`);
+  }
+});
+
+test("the clean document produces no finding at all", () => {
+  assert.deepEqual(scanDocument(CLEAN).findings, []);
+});
+
+test("a finding never carries the matched bytes", () => {
+  // A leak reporter that prints the leak has moved it, not found it.
+  const findings = scanDocument(SEEDED["capture-uuid"]).findings;
+  assert.equal(findings.length, 1);
+  assert.deepEqual(Object.keys(findings[0]).sort(), ["class", "file", "length", "path"]);
+  assert.ok(!JSON.stringify(findings).includes(FAKE_UUID));
+});
+
+test("the filename class fires on a UUID name and on an 8-hex s- prefix, not on the real token shape", () => {
+  const names = (n) => scanContent(JSON.stringify(CLEAN), `${CORPUS}/${n}`).findings.map((f) => f.class);
+  assert.deepEqual(names(`pinned-${FAKE_UUID}-26-28.json`), ["capture-uuid-filename"]);
+  assert.deepEqual(names("pinned-s-4b6a4352-26-28.json"), ["capture-uuid-filename"]);
+  assert.deepEqual(names("pinned-s-4b6a435234bf-26-28.json"), [], "12 hex after s- is the sanitized shape");
+});
+
+test("classes defined over the harvested corpus do not fire outside it; byte-level classes do", () => {
+  // Measured basis (report absence-guard-report.md): the corpus-shape classes
+  // fired ~205 times on hand-authored synthetic proxy fixtures, none of which
+  // is a defect. The byte-level classes fired only on real leaks.
+  const outside = scanContent(JSON.stringify(SEEDED["raw-content"]), "test/fixtures/hand-written.json");
+  assert.deepEqual(outside.findings, [], "prose in a hand-authored fixture is not a sanitization defect");
+  assert.equal(outside.partial, true, "and the run must SAY it only half-checked");
+
+  const uuidOutside = scanContent(JSON.stringify(SEEDED["capture-uuid"]), "test/fixtures/hand-written.json");
+  assert.deepEqual(uuidOutside.findings.map((f) => f.class), ["capture-uuid"],
+    "a live capture identifier needs no corpus to be one");
+});
+
+test("an unparseable file is scanned as raw bytes and reported degraded, never skipped", () => {
+  const r = scanContent(`{ not json at all ${FAKE_UUID}`, `${CORPUS}/broken.json`);
+  assert.deepEqual(r.degraded, ["does not parse"]);
+  assert.deepEqual(r.findings.map((f) => f.class), ["capture-uuid"]);
+});
+
+test("the allowlist covers the LEDGER watermark file and nothing else in the corpus", () => {
+  assert.equal(isAllowlisted(`${CORPUS}/LEDGER-Siren.json`), true);
+  assert.equal(isAllowlisted(`${CORPUS}/pinned-s-4b6a435234bf-26-28.json`), false);
+});
+
+// --- CLI ---------------------------------------------------------------------
+
+const run = (args, cwd) => spawnSync(process.execPath, [TOOL, ...args], { cwd, encoding: "utf-8" });
+
+function withTemp(fn) {
+  const dir = mkdtempSync(join(tmpdir(), "absence-scan-"));
+  try {
+    return fn(dir);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function seedCorpusFile(dir, name, doc) {
+  mkdirSync(join(dir, CORPUS), { recursive: true });
+  const rel = `${CORPUS}/${name}`;
+  writeFileSync(join(dir, rel), JSON.stringify(doc, null, 2));
+  return rel;
+}
+
+test("CLI: exit 2 on a file carrying a synthetic UUID, exit 0 on a clean one", () => {
+  withTemp((dir) => {
+    const dirty = seedCorpusFile(dir, "dirty.json", SEEDED["capture-uuid"]);
+    const bad = run([dirty], dir);
+    assert.equal(bad.status, 2, bad.stdout + bad.stderr);
+    assert.match(bad.stdout, /FINDING capture-uuid/);
+    assert.ok(!bad.stdout.includes(FAKE_UUID), "the CLI must not echo the matched bytes either");
+
+    const clean = seedCorpusFile(dir, "clean.json", CLEAN);
+    const ok = run([clean], dir);
+    assert.equal(ok.status, 0, ok.stdout + ok.stderr);
+    assert.match(ok.stdout, /absence-scan: clean/);
+  });
+});
+
+test("CLI: an allowlisted path is reported, not scanned", () => {
+  withTemp((dir) => {
+    const led = seedCorpusFile(dir, "LEDGER-Testhost.json", SEEDED["capture-uuid"]);
+    const r = run([led], dir);
+    assert.equal(r.status, 0, r.stdout + r.stderr);
+    assert.match(r.stdout, /^allowlisted: /m);
+    assert.ok(!r.stdout.includes("FINDING"));
+  });
+});
+
+test("CLI: no arguments is an internal-error exit, not a silent pass", () => {
+  const r = run([]);
+  assert.equal(r.status, 1);
+});
+
+// --- git range ---------------------------------------------------------------
+
+function gitRepo(dir) {
+  const g = (...args) => {
+    const r = spawnSync("git", args, { cwd: dir, encoding: "utf-8" });
+    assert.equal(r.status, 0, `git ${args.join(" ")}: ${r.stderr}`);
+    return r.stdout.trim();
+  };
+  g("init", "-q", "-b", "main");
+  g("config", "user.email", "t@t");
+  g("config", "user.name", "t");
+  return g;
+}
+
+test("git-range: red on a defect added in the range, green on the range before it", () => {
+  withTemp((dir) => {
+    const g = gitRepo(dir);
+    const cleanRel = seedCorpusFile(dir, "clean.json", CLEAN);
+    g("add", cleanRel);
+    g("commit", "-qm", "clean");
+    const first = g("rev-parse", "HEAD");
+
+    const dirtyRel = seedCorpusFile(dir, "dirty.json", SEEDED["capture-uuid"]);
+    g("add", dirtyRel);
+    g("commit", "-qm", "dirty");
+    const second = g("rev-parse", "HEAD");
+
+    const red = run(["--git-range", `${first}..${second}`], dir);
+    assert.equal(red.status, 2, red.stdout + red.stderr);
+    assert.match(red.stdout, /FINDING capture-uuid {2}test\/fixtures\/harvested\/dirty\.json/);
+    assert.ok(!red.stdout.includes("clean.json"), "an unchanged file is outside the range");
+
+    const green = run(["--git-range", `EMPTY..${first}`], dir);
+    assert.equal(green.status, 0, green.stdout + green.stderr);
+  });
+});
+
+test("git-range: EMPTY scans every file reachable at the new ref (the new-branch push)", () => {
+  withTemp((dir) => {
+    const g = gitRepo(dir);
+    const dirtyRel = seedCorpusFile(dir, "dirty.json", SEEDED["capture-uuid"]);
+    g("add", dirtyRel);
+    g("commit", "-qm", "dirty");
+    const head = g("rev-parse", "HEAD");
+    const r = run(["--git-range", `EMPTY..${head}`], dir);
+    assert.equal(r.status, 2, r.stdout + r.stderr);
+  });
+});
+
+test("git-range: a deleted file is not scanned, and a non-JSON file is ignored", () => {
+  withTemp((dir) => {
+    const g = gitRepo(dir);
+    const dirtyRel = seedCorpusFile(dir, "dirty.json", SEEDED["capture-uuid"]);
+    writeFileSync(join(dir, "notes.md"), `not scanned ${FAKE_UUID}\n`);
+    g("add", dirtyRel, "notes.md");
+    g("commit", "-qm", "dirty");
+    const first = g("rev-parse", "HEAD");
+
+    rmSync(join(dir, dirtyRel));
+    g("add", "-A");
+    g("commit", "-qm", "removed");
+    const second = g("rev-parse", "HEAD");
+
+    const r = run(["--git-range", `${first}..${second}`], dir);
+    assert.equal(r.status, 0, `${r.stdout}${r.stderr}`);
+  });
+});
+
+test("git-range: an unresolvable base ref degrades to a full scan rather than erroring", () => {
+  withTemp((dir) => {
+    const g = gitRepo(dir);
+    const dirtyRel = seedCorpusFile(dir, "dirty.json", SEEDED["capture-uuid"]);
+    g("add", dirtyRel);
+    g("commit", "-qm", "dirty");
+    const head = g("rev-parse", "HEAD");
+    // A sha this clone has never seen — the shape of a remote ref that was
+    // never fetched.
+    const r = run(["--git-range", `0000000000000000000000000000000000000001..${head}`], dir);
+    assert.equal(r.status, 2, r.stdout + r.stderr);
+    assert.match(r.stdout, /^degraded: base ref /m);
+  });
+});
+
+// ── Source files: a capture UUID may exist only on the allowlist ──────────────
+//
+// Fixtures are covered by the classes above; SOURCE leaks ride in comments and
+// string literals instead (found live 2026-08-01: the same capture UUID in a
+// test file's evidence comment and in tools/replay.mjs — public repo,
+// unscrubbable history). A bare "no UUIDs in source" rule would fire on the
+// synthetic ones, so the rule is: every UUID in test/, tools/, and proxy/
+// source is on the explicit synthetic allowlist below, or this test fails. A
+// new legitimate synthetic is added HERE, deliberately, in the same diff a
+// reviewer sees — never waved through.
+//
+// docs/ IS THE SAME SURFACE (widened 2026-08-01, BACKLOG "docs/ UUID triage"):
+// a directive, a review or a release-test log is as public as a source file,
+// and the same sweep found real capture keys and a session id sitting in four
+// of them. Prose carries more legitimate synthetics than code does — hence the
+// provenance line on each entry below.
+const SOURCE_UUID_ALLOWLIST = new Set([
+  FAKE_UUID,                              // this suite's seeded defect
+  "b16c607d-d484-4935-840e-e3f7ee78eb08", // proxy suites' synthetic session id
+  "00000000-0000-4000-8000-c4f1efb22220", // session-mirror synthetic
+  "9d1c250a-e61b-44d9-88ed-5944d1962f5e", // Anthropic's PUBLIC OAuth client_id
+  "1a6869d5-283e-43a3-9ba3-4495ceaa239a", // upstream docs/directives/proxy-cache-warmer-v3.7.0.md org_id example (upstream's own pre-existing content)
+  // docs/ synthetics, each a placeholder by construction:
+  "00000000-0000-4000-8000-c4f1efb22221", // release-test harness's pinned --session-id, sibling of ...22220
+  "abcd1234-5678-90ab-cdef-1234567890ab", // the "e.g." 8-4-4-4-12 format sample in proxy-jsonl-session-mirror.md
+]);
+
+test("source: every UUID in test/, tools/, proxy/ and docs/ is on the synthetic allowlist", () => {
+  const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+  const files = [];
+  const collect = (dir, ext) => {
+    for (const e of readdirSync(join(root, dir), { withFileTypes: true })) {
+      const rel = join(dir, e.name);
+      if (e.isDirectory()) {
+        // test/ and tools/ are flat; proxy/ and docs/ are not.
+        if (dir.startsWith("proxy") || dir.startsWith("docs")) collect(rel, ext);
+        continue;
+      }
+      if (e.name.endsWith(ext)) files.push(rel);
+    }
+  };
+  collect("test", ".mjs");
+  collect("tools", ".mjs");
+  collect("proxy", ".mjs");
+  collect("docs", ".md");
+  // Guard the guard: a walk that collected nothing from a root would pass
+  // this test while checking that root not at all — the silent scope collapse
+  // a rename or a moved directory causes.
+  for (const root_ of ["test", "tools", "proxy", "docs"]) {
+    assert.ok(files.some((f) => f.startsWith(root_ + sep)), `the walk collected no file under ${root_}/`);
+  }
+  const uuidRe = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/g;
+  const offenders = [];
+  for (const rel of files) {
+    const text = readFileSync(join(root, rel), "utf8");
+    for (const hit of text.match(uuidRe) ?? []) {
+      if (!SOURCE_UUID_ALLOWLIST.has(hit)) offenders.push(`${rel}: ${hit}`);
+    }
+  }
+  assert.deepEqual(
+    offenders, [],
+    `unlisted UUID(s) in source — a capture identifier in a public tree, or a new synthetic missing from the allowlist:\n${offenders.join("\n")}`,
+  );
+});

test/harvest-pin.test.mjs

@@ -27,6 +27,7 @@ import { tmpdir } from "node:os";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 
 import { parsePinRange, pinRange, readPinnedFixture } from "../tools/harvest.mjs";
 
@@ -122,7 +123,14 @@ test("pinRange: m beyond available requests throws rather than writing a truncat
 
 // --- CLI end-to-end: the actual entry point, not a re-derivation of it ---
 
-test("harvest --pin CLI: writes pinned-<key.slice(0,10)>-<n>-<m>.json with a header and sanitized records", async () => {
+// The sanitized token that names the fixture, stated from its DEFINITION
+// (docs/directives/fixture-sanitization-directive.md, settled design 2: a
+// conversation key becomes "s-" + the first 12 hex of its sha256) rather than
+// imported from tools/harvest.mjs — an expectation with the same parentage as
+// the code pins the bug it should catch.
+const KEY_TOKEN = `s-${createHash("sha256").update("s-tiny0000").digest("hex").slice(0, 12)}`;
+
+test("harvest --pin CLI: writes pinned-<s-sha12>-<n>-<m>.json, no session key in the name, header or records", async () => {
   const dir = await mkdtemp(join(tmpdir(), "harvest-pin-cli-"));
   const capturesDir = join(dir, "captures");
   const outDir = join(dir, "out");
@@ -136,16 +144,27 @@ test("harvest --pin CLI: writes pinned-<key.slice(0,10)>-<n>-<m>.json with a hea
   );
   assert.match(stdout, /pinned 4 record\(s\), range 0\.\.1/);
 
-  const outPath = join(outDir, "pinned-s-tiny0000-0-1.json");
-  assert.ok(existsSync(outPath), "fixture written at the expected name (key sliced to 10 chars, matching the scheduled harvest's own convention)");
+  const outPath = join(outDir, `pinned-${KEY_TOKEN}-0-1.json`);
+  assert.ok(existsSync(outPath), "fixture written at the expected name (the key's s-<sha12> token, never the session key)");
 
   const fixture = JSON.parse(await readFile(outPath, "utf-8"));
-  assert.equal(fixture.header.key, "s-tiny0000");
+  assert.equal(fixture.header.key, KEY_TOKEN);
   assert.deepEqual(fixture.header.range, { n: 0, m: 1 });
   assert.equal(fixture.header.replayFrom, 0);
   assert.ok(fixture.header.sanitizer, "sanitizer note present");
   assert.ok(fixture.header.harvestedAt, "harvest date present");
-  assert.ok(!JSON.stringify(fixture).includes(SECRET), "no raw content leaks through the CLI path either");
+  const serialized = JSON.stringify(fixture);
+  assert.ok(!serialized.includes(SECRET), "no raw content leaks through the CLI path either");
+  assert.ok(!serialized.includes("s-tiny0000"), "the raw conversation key leaks nowhere — header, records or metadata");
+  // Rebased, not stamped: the capture's own 2026-01-01 wall-clock is gone and
+  // the deltas between records survive (boot at +0s, the two requests at +1s
+  // and +3s, matching writeTinyCapture's spacing).
+  assert.equal(fixture.records[0].ts, "2000-01-01T00:00:00.000Z");
+  assert.deepEqual(
+    fixture.records.map((r) => Date.parse(r.ts) - Date.parse(fixture.records[0].ts)),
+    [0, 1000, 2000, 3000],
+  );
+  assert.ok(!serialized.includes("2026-01-01"), "no live wall-clock survives");
 });
 
 test("harvest --pin CLI: unknown key exits non-zero with a stated reason, writes nothing", async () => {