Skip to content

I1207 — No credential reaches any output, and hostile provider metadata renders safely

Prove the negatives. Place sentinel values in the client-secret and signing-key environment variables and exercise every output this repository produces — API responses, the Cockpit's HTML, the generated site, OpenAPI and its examples, MCP answers, the artifact manifest, the caches, the logs and the doctor report — asserting no sentinel appears anywhere. Separately, give a provider object a display name carrying control characters, ANSI sequences and markup, and assert it renders as text in the terminal, in the HTML and in the JSON.

BLOCKED wave 4 · p0 · implementation profile · parallel safe

Part of web-sign-in — The deployed surfaces know who is asking, and the identity providers are data.

Blocked. This issue cannot start until I1204 is done. The status is derived from that, not declared.

Objective

Prove the negatives. Place sentinel values in the client-secret and signing-key environment variables and exercise every output this repository produces — API responses, the Cockpit's HTML, the generated site, OpenAPI and its examples, MCP answers, the artifact manifest, the caches, the logs and the doctor report — asserting no sentinel appears anywhere. Separately, give a provider object a display name carrying control characters, ANSI sequences and markup, and assert it renders as text in the terminal, in the HTML and in the JSON.

Why

Every other guarantee of this milestone is a claim until a test tries to break it, and a credential that leaks once has leaked permanently.

Current state

No credentials exist yet, so no test can leak one.

Desired state

A sentinel test runs in CI and fails loudly if any future change routes a credential into an output.

Scope

  • apps/majordomus-cli/tests
  • test/cases
  • .ai/repo/ci/gates.yaml

Out of scope

  • Weakening the assertion to the outputs that happen to pass today

Dependencies

Acceptance criteria

  • The sentinel sweep covers every output surface the repository produces, enumerated from the registry rather than listed by hand where that is possible
  • A deliberate regression that renders a secret is caught by the test, proved by a negative case
  • Hostile provider metadata renders as text on every surface, with no escape and no truncation that hides it
  • The gate runs in CI on every change

Validation

  • bash test/run.sh
  • cargo test --workspace --all-features

Evidence required

  • sentinel_sweep
  • negative_case
  • hostile_metadata

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

A sweep that enumerates outputs by hand will miss the surface added after it. Where the registry can enumerate them, it does.

Timeline

started
—
verified
—
completed
—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I1207.yaml. Read it back with majordomus plan show I1207.