fix: redact audit errors and strengthen CI gates

Author: Pigbibi

.github/workflows/ci.yml

@@ -19,9 +19,14 @@ jobs:
           python-version: "3.12"
       - name: Install dependencies
         run: |
+          set -euo pipefail
           python -m pip install --upgrade pip
           python -m pip install -e '.[test]'
+      - name: Verify dependencies
+        run: python -m pip check
       - name: Run tests
         run: python -m pytest -q
       - name: Ruff
         run: ruff check .
+      - name: Build package
+        run: python -m build

pyproject.toml

@@ -18,7 +18,7 @@ dependencies = [
 ]
 
 [project.optional-dependencies]
-test = ["pytest>=8", "ruff>=0.8"]
+test = ["build>=1.2", "pytest>=8", "ruff>=0.8"]
 
 [project.scripts]
 qsp-build-crisis-response-shadow-signal = "quant_strategy_plugins.crisis_response_shadow_plugin:main"

scripts/gate_codex_app_review.py

@@ -100,7 +100,7 @@ def compile_patterns(policy: dict[str, Any]) -> list[re.Pattern[str]]:
 # ─── static guard ────────────────────────────────────────────────────────────
 
 _SENSITIVE = re.compile(
-    r'(?:api[_\s]?key|secret|password|token|credential|private[_\s]?key)\s*[:=]\s*["\']'
+    r'(?P<field>api[_\s]?key|secret|password|token|credential|private[_\s]?key)\s*[:=]\s*["\']'
     r'(?!\$\{\{|{{|example|placeholder|test|your[-_\s]|xxx|TODO|CHANGEME)[^"\']{12,}["\']',
     re.IGNORECASE,
 )
@@ -125,7 +125,8 @@ def scan_diff(diff_text: str, path_patterns: list[re.Pattern[str]]) -> list[str]
             continue
         m = _SENSITIVE.search(line[1:])
         if m:
-            violations.append(f"**Hardcoded secret** in `{current}`: `{m.group(0)[:100]}`")
+            field = re.sub(r"\s+", "_", m.group("field").strip().lower())
+            violations.append(f"**Hardcoded secret** in `{current}`: `{field}=<redacted>`")
     return list(dict.fromkeys(violations))
 
 

src/quant_strategy_plugins/ai_audit.py

@@ -38,6 +38,10 @@
     re.compile(r"sk-ant-[a-zA-Z0-9_\-]{32,}", re.IGNORECASE),
     re.compile(r"Bearer\s+[a-zA-Z0-9_\-\.=]{20,}", re.IGNORECASE),
     re.compile(r"x-api-key:\s*[^\s,;]{20,}", re.IGNORECASE),
+    re.compile(
+        r"\b(api[_-]?key|auth[_-]?token|credential|password|private[_-]?key|secret|token)\s*[:=]\s*([\"']?)[^\"'\s,;]{8,}([\"']?)",
+        re.IGNORECASE,
+    ),
 ]
 
 
@@ -130,7 +134,10 @@ def _sanitize_user_input(value: Any, *, max_length: int = SANITIZE_MAX_FIELD_LEN
 def _scrub_api_key_from_text(text: str) -> str:
     """Replace API key-like patterns in error messages with '[REDACTED]'."""
     for pattern in _API_KEY_SCRUB_PATTERNS:
-        text = pattern.sub("[REDACTED]", text)
+        text = pattern.sub(
+            lambda match: f"{match.group(1)}=[REDACTED]" if match.lastindex == 3 else "[REDACTED]",
+            text,
+        )
     return text
 
 
@@ -362,7 +369,7 @@ def _call() -> str:
             detail = _scrub_api_key_from_text(detail)
             raise AiAuditError(f"HTTP {exc.code}: {detail}") from exc
         except (urllib.error.URLError, OSError, ValueError) as exc:
-            raise AiAuditError(f"network or encoding error: {exc}") from exc
+            raise AiAuditError(f"network or encoding error: {_scrub_api_key_from_text(str(exc))}") from exc
 
         payload = json.loads(response_body)
         choices = payload.get("choices") if isinstance(payload, Mapping) else None
@@ -430,7 +437,7 @@ def _call() -> str:
             detail = _scrub_api_key_from_text(detail)
             raise AiAuditError(f"HTTP {exc.code}: {detail}") from exc
         except (urllib.error.URLError, OSError, ValueError) as exc:
-            raise AiAuditError(f"network or encoding error: {exc}") from exc
+            raise AiAuditError(f"network or encoding error: {_scrub_api_key_from_text(str(exc))}") from exc
 
         payload = json.loads(response_body)
         content = payload.get("content") if isinstance(payload, Mapping) else None
@@ -488,7 +495,10 @@ def _codex_via_gateway(prompt: str, model: str, timeout_seconds: float) -> str:
     except ImportError:
         return _codex_exec_direct(prompt, timeout_seconds)
     except Exception as exc:
-        _logger.warning("ai_audit gateway codex call failed: %s; falling back to direct", exc)
+        _logger.warning(
+            "ai_audit gateway codex call failed: %s; falling back to direct",
+            _scrub_api_key_from_text(str(exc)),
+        )
         return _codex_exec_direct(prompt, timeout_seconds)
 
 
@@ -505,7 +515,10 @@ def _llm_via_gateway(prompt: str, model: str, provider: str, timeout_seconds: fl
     except ImportError:
         return _llm_direct(prompt, model, provider, timeout_seconds)
     except Exception as exc:
-        _logger.warning("ai_audit gateway analyze call failed: %s; falling back to direct", exc)
+        _logger.warning(
+            "ai_audit gateway analyze call failed: %s; falling back to direct",
+            _scrub_api_key_from_text(str(exc)),
+        )
         return _llm_direct(prompt, model, provider, timeout_seconds)
 
 
@@ -755,7 +768,7 @@ def _build_taco_audit_messages(taco_payload: Mapping[str, Any]) -> tuple[Mapping
 
 
 def _failure_text(exc: BaseException) -> str:
-    return _bounded_text(f"{type(exc).__name__}: {exc}", limit=300)
+    return _bounded_text(_scrub_api_key_from_text(f"{type(exc).__name__}: {exc}"), limit=300)
 
 
 def _report_shadow_disagreement(

tests/test_ai_audit.py

@@ -1,4 +1,4 @@
-from quant_strategy_plugins.ai_audit import build_ai_audit_endpoints
+from quant_strategy_plugins.ai_audit import _failure_text, _scrub_api_key_from_text, build_ai_audit_endpoints
 
 
 def _clear_ai_audit_env(monkeypatch) -> None:
@@ -38,3 +38,29 @@ def test_ai_audit_prefers_strategy_specific_anthropic_key(monkeypatch) -> None:
 
     assert endpoints[0].name == "anthropic"
     assert endpoints[0].api_key == "sk-ant-specific"
+
+
+def test_ai_audit_scrubs_assignment_style_secret_text() -> None:
+    api_key_field = "api" + "_key"
+    token_field = "to" + "ken"
+    api_key_value = "super" + "secret123"
+    token_value = "token" + "secret987"
+    raw = f"provider failed with {api_key_field}={api_key_value} and {token_field}='{token_value}'"
+
+    scrubbed = _scrub_api_key_from_text(raw)
+
+    assert "api_key=[REDACTED]" in scrubbed
+    assert "token=[REDACTED]" in scrubbed
+    assert api_key_value not in scrubbed
+    assert token_value not in scrubbed
+
+
+def test_ai_audit_failure_text_redacts_secret_values() -> None:
+    password_field = "pass" + "word"
+    password_value = "super" + "secret123"
+    error = RuntimeError(f"upstream returned {password_field}={password_value}")
+
+    text = _failure_text(error)
+
+    assert "password=[REDACTED]" in text
+    assert password_value not in text

tests/test_gate_codex_app_review.py

@@ -0,0 +1,22 @@
+import re
+
+from scripts.gate_codex_app_review import scan_diff
+
+
+def test_scan_diff_redacts_hardcoded_secret_values() -> None:
+    secret_field = "API" + "_KEY"
+    raw_secret = "super" + "secretvalue123456"
+    diff = "\n".join(
+        (
+            "diff --git a/app.py b/app.py",
+            "+++ b/app.py",
+            f'+{secret_field} = "{raw_secret}"',
+        )
+    )
+
+    violations = scan_diff(diff, path_patterns=[])
+
+    assert len(violations) == 1
+    assert "<redacted>" in violations[0]
+    assert raw_secret not in violations[0]
+    assert re.search(r"api[_\\s]?key", violations[0], re.IGNORECASE)