[HugoXK]

Fixes #1095

What changed

rsi_telemetry._is_secret_key dropped an attribute when a component spelled a
credential word, when the last component was token/secret, or when two
adjacent components spelled a pair. A credential written as one word reached
none of the three — and one of those words is libpq's own variable.

Before, all False: PGPASSWORD, pgpassword, pgpasswords, passwords,
db_passwords, db_secrets, client_secrets, CLIENT_SECRETS, api_keys,
secret_keys, s3secretkey, AWSSecretAccessKey, so a caller that recorded the
environment it ran under exported the password.

After, all True, while the #1070 counters stay False — tokens,
max_tokens, input_tokens, output_tokens, token_count, tokens_in,
budget_tokens, secret_free, secrets_scanned.

• agentdescent/rsi_telemetry.py — the suffix test runs only when the split
  yields a single component, and only against whole credential words;
  _CREDENTIAL_NOUNS gains secrets (last position only);
  _CREDENTIAL_COMPONENTS gains the plural compounds passwords, passwds,
  secretkeys, apikeys, privatekeys, accesskeys, clientsecrets; the
  adjacent-pair lookup tolerates one plural s per component and always tries
  the unfolded spelling, which is what keeps AWS_SECRET_ACCESS_KEY while
  api+keys folds to apikey.
• tests/test_span_redaction.py — 13 credential rows and 17
  counter/non-credential rows, parametrised, plus the end-to-end row through
  span.attributes and to_otel().
• changelog.d/1095-credential-word-suffix.md — one Fixed fragment.

Matching stays component-based: no substring mode, and bare key stays out of
the one-word suffix list, so monkey and sort_key are untouched. secrets is
deliberately not in _CREDENTIAL_COMPONENTS — that set is checked at any
position, so it would turn secrets_scanned into a credential — it is in the
last-position noun set instead, which catches db_secrets and client_secrets
and leaves the counter alone.

Red at live main 09492927

Clean worktree at 09492927f614b5303e54cc3f87b0bb809929e336, with only
tests/test_span_redaction.py copied in:

FAILED tests/test_span_redaction.py::test_a_credential_key_is_dropped[PGPASSWORD]
FAILED tests/test_span_redaction.py::test_a_credential_key_is_dropped[pgpassword]
FAILED tests/test_span_redaction.py::test_a_credential_key_is_dropped[passwords]
FAILED tests/test_span_redaction.py::test_a_credential_key_is_dropped[pgpasswords]
FAILED tests/test_span_redaction.py::test_a_credential_key_is_dropped[db_passwords]
FAILED tests/test_span_redaction.py::test_a_credential_key_is_dropped[db_secrets]
FAILED tests/test_span_redaction.py::test_a_credential_key_is_dropped[client_secrets]
FAILED tests/test_span_redaction.py::test_a_credential_key_is_dropped[CLIENT_SECRETS]
FAILED tests/test_span_redaction.py::test_a_credential_key_is_dropped[api_keys]
FAILED tests/test_span_redaction.py::test_a_credential_key_is_dropped[secret_keys]
FAILED tests/test_span_redaction.py::test_a_credential_key_is_dropped[s3secretkey]
FAILED tests/test_span_redaction.py::test_a_credential_key_is_dropped[AWSSecretAccessKey]
FAILED tests/test_span_redaction.py::test_a_one_word_credential_never_reaches_the_export
13 failed, 29 passed

The export row fails on
assert 'PGPASSWORD' not in {'PGPASSWORD': 'hunter2', 'MAX_TOKENS': 16, 'secrets_scanned': 12}
— the boundary, not only the predicate. AWS_SECRET_ACCESS_KEY is the one
credential row that already passes at main, through the pair rule.

The Lead re-took the same red at 09492927 independently: 13 failed, 29 passed
in 2.22 s, the same rows.

Verification at the tip

Tip SHA: c390e7a

That is 1e82ec620aab6bdd2c4ca04e56d9493850ecbc41 — the build the issue
records — plus one commit, c390e7ae, a forward merge of live main 09492927
into the branch. No rebase, no force-push, and the merge carries no file change
of its own: git diff 09492927 c390e7ae and git diff f5e93335 1e82ec62 are
the same patch (identical sha256), 3 files, +99/−4.

Ran:

• pytest -o addopts="" -q tests/test_span_redaction.py tests/test_memory_spans.py
  at c390e7ae → 48 passed
• the six files that import rsi_telemetry (test_campaign_ops,
  test_loop_kernel, test_memory_spans, test_ops_fabric,
  test_rsi_telemetry, test_span_redaction) at c390e7ae → 85 passed
• tests/test_changelog_fragments.py tests/test_api_reference.py tests/test_repo_hygiene.py at c390e7ae → 76 passed
• full pytest -o addopts="" -q -n 8 at c390e7ae → 7488 passed,
  58 skipped, 21 failed; the 21 are the host legs only — 12
  test_sandbox_container (docker image), 6 test_era_srbench, 2
  test_genesis_example, 1 test_wheel_smoke — the same 21 that fail at
  1e82ec62 and at f5e93335, none in telemetry
• python -m tools.gen_api_docs --check at c390e7ae → docs/api.md is up to date
• python -m tools.changelog_fragments check at c390e7ae → 44 changelog fragment(s) OK
• predicate probe at c390e7ae over the acceptance rows → 13 True / 17 False,
  missed credentials: [], false positives: []

Not run:

• mkdocs build --strict — mkdocs is not installed in this clone's venv;
  CI's build job is the line
• the docker sandbox, test_era_srbench, test_genesis_example and
  wheel-smoke legs — environmental on this host, and unchanged by this branch

Non-goals on the issue, as they stand

• REDISCLI_AUTH and a bare auth component stay False at the tip: auth
  names a mode as often as a credential, and a token-shaped value is still
  redacted wherever it appears. Recorded on the issue as a non-goal.
• Prefixed one-word token spellings stay out: mytoken, xauthtoken,
  GITLABTOKEN, NPMTOKEN are False at the tip. token is not in the
  one-word suffix list because tokens/max_tokens/total_tokens are the
  fix(telemetry): a credential key is matched by component, so tokens/max_tokens stop being dropped from spans #1070 counters. Already True today and unchanged: token, MY_TOKEN,
  authtoken, OAUTH_TOKEN.
• Reachability is the boundary's own gap, not a live leak: no in-tree caller
  records os.environ into span attributes, and every attributes= call site
  passes caller-supplied data.

Size: 3 files, +99/−4 against base 09492927. T2 by
.github/agent/risk-rules.json (agentdescent/**), and under the 250-line cap;
ready for a verdict at this tip, and a PASS naming c390e7ae is what moves it.

Claim-Id: #1095

[HugoXK]

Advisory read at c390e7ae27b2cb9837f45c318e635d484e62ab0f — this is not a counting PASS; .github/agent/review-policy.json counts a Birfy review only, so nothing here moves the gate.

Live state in the same read as the head: state: open, merged: false, draft: false, base 09492927f614b5303e54cc3f87b0bb809929e336, 3 files +99/−4, no labels.

The four holds, measured at the tip

• agentdescent/rsi_telemetry.py:126-127 — the one-word suffix test is guarded by len(parts) == 1; multi-component keys still go through component/noun/pair only, and AWS_SECRET_ACCESS_KEY stays True through (access, key).
• _CREDENTIAL_NOUNS (:73) carries secrets; _CREDENTIAL_COMPONENTS (:66-72) does not, so secrets_scanned stays False.
• The unfolded spelling is always tried: _singular returns (word, word[:-1]) (:97-101) and the pair lookup tests every combination (:103-107).
• The end-to-end row (tests/test_span_redaction.py:221-233) keeps MAX_TOKENS 16 and secrets_scanned 12 in span.attributes and in to_otel(), drops PGPASSWORD, and hunter2 does not appear in the export.

The two break risks, measured

• All nine MEASUREMENT_KEYS rows are False at the tip. token, MY_TOKEN, authtoken, OAUTH_TOKEN are True; mytoken, xauthtoken, GITLABTOKEN, NPMTOKEN are False (the recorded non-goal); monkey, sort_key, auth, REDISCLI_AUTH, access_level, max_new_tokens, total_tokens, status are False.
• Sweep over 9063 string literals from both trees: 22 verdict changes, all credential spellings or fixtures (secrets, abc123secret, invalidapikey); zero True→False; no measurement row moved. apis_key → True, as the issue says.

Tip identity

• c390e7ae is a real merge, parents 1e82ec62 and 09492927, with no file change of its own. sha256(git diff 09492927 c390e7ae) and sha256(git diff f5e93335 1e82ec62) are the same 54859646…1dfed211; 3 files, +99/−4. No rebase and no force-push in it.
• T2 holds: agentdescent/** → T2; 3 files / 103 changed lines under the 12 / 250 caps (.github/agent/risk-rules.json).

Red on main, re-taken here
Clean worktree at 09492927 with only this tip's tests/test_span_redaction.py copied in → 13 failed, 29 passed, the same 12 credential rows plus the export row; the tip alone → 48 passed with tests/test_memory_spans.py.

Ran at c390e7ae:

• tests/test_span_redaction.py tests/test_memory_spans.py → 48 passed
• the six importer files (test_campaign_ops, test_loop_kernel, test_memory_spans, test_ops_fabric, test_rsi_telemetry, test_span_redaction) → 85 passed
• test_changelog_fragments.py test_api_reference.py test_repo_hygiene.py → 76 passed
• keyword selection redact or secret or telemetry or memory_span or manifest or trace_digest or otel → 146 passed
• full serial suite (--ignore=tests/test_docs_links.py) → 7464 passed, 49 skipped, 22 failed, 10 errors; the 21 host legs named in the body plus 11 host-environment rows (15 in the same six files) that fail identically at 09492927 — none in telemetry
• python -m tools.gen_api_docs --check → docs/api.md is up to date; python -m tools.changelog_fragments check → 44 changelog fragment(s) OK
  Not run: mkdocs build --strict (no mkdocs in this clone).

Non-blocking

1. agentdescent/rsi_telemetry.py:111 — the docstring's first line still says "True when a whole component of key names a credential"; the body and the code now also match a one-word suffix. The summary line lags the rule.
2. agentdescent/manifest.py:33-38 — the second, separate _is_secret_key has the same one-word gap: manifest.redact({"PGPASSWORD": "hunter2"}) returns the password unchanged, and s3secretkey, api_keys, db_secrets are False there. Out of this PR's scope (the fix(telemetry): a credential written as one word is still a credential (PGPASSWORD, s3secretkey, client_secrets) #1095 ruling covers rsi_telemetry), so not a finding against this tip; a follow-up candidate if the Lead wants one.

No blocking finding at c390e7ae; the owner's PASS and click are the gate.

[HugoXK]

Birfy — one request: a counting verdict at c390e7ae27b2cb9837f45c318e635d484e62ab0f, the current tip of this PR.

State at that tip: all five test legs green (3.9, 3.10 after one rerun of the flaky row, 3.11, 3.12, 3.13), build green, mergeable_state: clean, base 09492927, 3 files +99/−4, no labels, no auto-merge. The advisory read at the same tip (comment 6893546245) is explicitly not a counting PASS; it found no blocking issue.

No further commit is planned on this tip, so a PASS here will not be voided; if your verdict asks for changes, they land on top and the request repeats at the new tip.

Tier T2 by .github/agent/risk-rules.json (agentdescent/**, 3 files / 103 changed lines). The two non-blocking notes from the advisory read are filed separately (#1099 for the stale docstring summary line, #1100 for manifest.redact), so neither rides this PR.

[HugoXK]

Label state on this PR: agent-pr, bug, area:evolve. Field: labels — reason: the PR was published between two controller runs, and AGENTS.md › Claim, PR, release asks for agent-pr plus the PR's type and area.

What I checked before touching it:

• The controller is the only writer of agent-pr and risk:T* here (AGENTS.md › Controller). It is live — its last plan job ran with CONTROLLER_LIVE: true and AGENT_PAUSE: false — but its 7,37 * * * * schedule has been executing roughly six times a day, not 48, and its last run finished before this PR existed, with controller: live, 0 operation(s), 0 skipped. So no label was skipped or refused; this PR simply has not been reached yet.
• The risk tier for the tip is already on record from the repo's own gate: the risk-tier run for c390e7ae reports risk-gate (report only): PR #1097 tier T2, which matches the body. I am not setting risk:T2 by hand — AGENTS.md › Labels reserves risk:T0…risk:T3 to the controller, never by hand — so it lands at the next controller run.
• agent-pr carries no such restriction, and it is accurate for this branch (agent/1095-credential-suffix, opened by an agent). bug and area:evolve are the type and area this change is: one predicate fix in rsi_telemetry.py, and it mirrors the labels on fix(telemetry): a credential written as one word is still a credential (PGPASSWORD, s3secretkey, client_secrets) #1095. Added for consistency with the two PRs that were judged, not as a nudge.

For the record on the wait: the labels are not what delays a verdict. The last two PRs on this repo carried agent-pr and risk:T3 for 11 h 38 m and 18 h 14 m before Birfy's first verdict on them, and both of those verdicts arrived inside the same minute, as did both of the PASSes that followed. That is a sweep on the reviewer's side, not label-driven pickup, and this PR is younger than the gap between two sweeps.

The one request at c390e7ae stands; I am not posting a second.

[Birfy]

Review (Birfy)

Tip SHA: c390e7a
Ran:

• pytest -o addopts="" -q tests/test_span_redaction.py tests/test_memory_spans.py tests/test_rsi_telemetry.py tests/test_changelog_fragments.py tests/test_api_reference.py tests/test_repo_hygiene.py → 132 passed, 2 skipped
• new tests copied onto merge base 0949292 → 13 failed (the 12 new credential rows plus the export row), as required
• python -m tools.changelog_fragments check → 44 changelog fragment(s) OK
• python -m tools.gen_api_docs --check → docs/api.md is up to date
• CI at this tip → green (build, test 3.9–3.13)
  Not run:
• full local pytest -q — CI already green at this tip
• Ark real-model run — no model path changed
• mkdocs build --strict — docs/ not in this diff
  Findings:
• none
  Verdict: PASS