security: make the secret-detection gates actually reject

[lmeyerov]

The problem

Both secret-detection gate modes had been unable to fail. They branched on the exit code of detect-secrets scan --baseline <file>, which is an update command — it rewrites the baseline file, prints nothing to stdout, and exits 0 regardless of what it finds. || print_error was unreachable in both CI and pre-commit mode.

Verified against the pre-fix scripts with a planted test secret staged:

pre-commit gate -> ✅ No secrets detected        exit 0
CI gate         -> ✅ Secret detection passed    exit 0

Neither gate had ever been able to reject anything.

Why nothing caught it. Every guard was tested only in the passing direction. The workflow's entire assertion was that the scripts exit 0 on a clean tree — which a gate hardwired to exit 0 satisfies forever. The one test with should_detect="yes" fixtures was never wired in (the step echoed "Skipping pattern tests") and was itself broken: it scanned an absolute /tmp path while cd'ed to the repo root, so every scan returned empty and all five "unsafe" fixtures silently looked undetected.

Placeholder cleanup

A few docs, docstrings and test fixtures carried credential-shaped example values against a development instance. They are replaced with explicit placeholders (<your-personal-key-id>, <your-org-name>, example.com hosts). The associated development test credentials have been rotated and no longer resolve.

What changed

Gates

• check_new_secrets.py does the comparison the shell was only assuming.
• Baseline keyed on (path, hashed_secret) — hash-only matching accepted a value allowlisted in docs/ anywhere, including src/louieai/_client.py.
• Pre-commit scans the index, not the worktree (git add <secret> then clean/delete used to pass).
• --no-renames (git mv + edit reported R, dropped by --diff-filter=ACM).
• NUL-terminate the staged list — joining meant the last staged file was never scanned.
• Missing baseline fails instead of auto-generating and passing.
• Concatenated scan documents merged (xargs ARG_MAX previously produced "New secrets detected!" on a clean tree).

Graphistry personal keys — check_credential_literals.py. detect-secrets' entropy plugins miss these (Shannon 3.1–3.8 vs a 4.5 threshold). Matches the shape without requiring quotes, so .ipynb, .env, YAML and Markdown are covered; excludes base64 neighbours so embedded images don't trip it (0 findings across 4 MB of random base64).

Integration fixtures — real_client hardcoded an internal endpoint and discarded the registered Graphistry client. Now resolved from LOUIE_SERVER, HTTPS-required, validated before authenticating. .env is opt-in via LOUIE_TEST_MODE, so a credential-free run stays offline (was 244 s and a hang; now 0.9 s).

Toolchain — CI ignored uv.lock and resolved ruff 0.16 / mypy 2.3 against a lockfile pinning 0.12.5 / 1.17.0. ruff 0.16 also formats Python inside Markdown fences, so it reformats — and echoes — file content the pinned version leaves alone. Now uv sync --frozen, with --frozen on uv run too (it otherwise re-resolves and drops the lockfile's exclude-newer pin).

Review focus

1. .secrets.baseline — 66 findings across 30 files. Turning the gate on surfaced the debt of a gate that never fired. Each was reviewed individually: test mocks, doc placeholders, and the AWS key in notebook 06, which is public Splunk BOTSv3 demo data. Please spot-check.
2. scripts/ci/secret-detection.sh — the index materialisation and NUL handling are the subtle parts.
3. Scope: the toolchain pin is included because CI is red without it on every branch, and because an unpinned formatter can reformat and echo arbitrary file content into logs.

Validation

Lockfile toolchain, repo-wide scope: secret detection, ruff check ., ruff format --check ., mypy . all pass. 565 unit tests, 85.44% coverage vs the 85% gate. Harness 19/0. mkdocs build --strict passes. Credential-free integration run: 29 passed / 25 skipped / 0.9 s.

Two adversarial review passes ran over this diff; their findings are folded in. One of them found a bug in the index-materialisation fix, and the regression test I added for it caught a second (the NUL terminator).

Known / follow-up

• tests/integration/notebook/test_cursor_new_integration.py fails on pristine main without credentials — pre-existing, fixed by feat: reasoning-aware response API #44, untouched here.
• uv lock --check exits 1, so uv sync --locked (which would catch lock/pyproject drift) is not yet viable. Regenerate the lock, then switch.
• Internal hostnames and the org name remain in ~8 other test files. Real but mechanical; deliberately not bundled.
• feat: reasoning-aware response API #44 will be rebased on top and reduced to reasoning-API changes only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MyiG851jxkDkqB5u9gnpox