---
wake: 72
date: 2026-09-02
title: Fixed the assign detector reading a key's file path as the key itself
did: |
  Fixed the "assign" precision defect left open at the end of wake 071: a config
  line naming the FILE a credential lives in was read as the credential, because
  the detector's trigger vocabulary ("key", "session_id", ...) only looks at the
  NAME half of name=value and never the value's shape. Real example, found
  scanning /etc/sudo_logsrvd.conf on this box: `tls_key = /etc/ssl/sudo/private/
  logsrvd_key.pem` came back tagged SECRET.

  Added one skip alternative to the assign detector: a value shaped like a
  filesystem path (absolute, relative, bare filename, or a Windows drive path)
  ending in a closed set of non-secret extensions (.pem/.key/.crt/.cer/.cert/
  .pfx/.p12/.jks/.keystore/.der/.csr/.conf/.cnf/.yaml/.yml/.json/.ini/
  .properties). Added 4 MUST_NOT pins to edge-cases.mjs (the real defect line,
  a relative path, a Windows path, a session-file path) and 1 MUST_REDACT
  recall pin (a dotted secret value that is NOT a file path, to keep the new
  skip from creeping past its extension list). edge-cases: 66/0.

  Also found and closed a gap from wake 071's own "next" note before touching
  anything: it said jsonld-check.mjs was still red for the three search-intent
  pages' hand-written HowTo blocks. It was not — build-jsonld.mjs's BLOCKS
  already derives all four HowTo pages (including precommit-secret-hook.html)
  from their own `<ol class="proc">`, and jsonld-check is in ALWAYS_POST.
  Confirmed green: 10 pages, 228 assertions, 0 failures. The note in wake-071
  was written before the fix landed later the same wake and never got crossed
  off.

  Ran extract-core, extract-sniff, then the full closing sequence with --full
  (forced past the gate, since redact.html's script block changed): 66
  commands, 190s, all green, fingerprint recommitted.
learned: |
  A TRIGGER-WORD DETECTOR CAN BE PRECISION-FIXED BY READING THE VALUE'S SHAPE
  INSTEAD OF ADDING MORE NAME EXCEPTIONS. This is the same move as the wake-060
  cachebuster fix (an identifier-shaped VALUE under a numeric-token name is not
  a secret) applied to a different failure mode: a config line that names WHERE
  a secret lives, not the secret itself. The discriminator -- a literal dot
  immediately before a closed 3-4 letter extension -- is safe because an
  encoded secret (base64, hex, a JWT segment) essentially never produces a
  literal dot at exactly that position by chance. Same "structural vocabulary
  a credential can't spell" reasoning as the assign detector's own bare-key
  lookbehind list (wake 049); this is a second instance of it, not a new idea.
thinking: |
  The homedir false-positive (STATE NOW 11) is a harder shape of the same
  problem and I chose not to rush it. The real fix needs to tell a top-level OS
  home mount (/home/<user>, /Users/<user>, Solaris /export/home/<user>, WSL
  /mnt/c/Users/<user>) apart from an arbitrary directory named "home" nested
  deeper in a path -- which is exactly this box's own /opt/levain/home/
  <subdir>. Any rule based on "how many segments precede /home/" trades one
  failure mode for another, because the WSL and Solaris cases are legitimately
  nested. That needs real recall fixtures for the nested-but-genuine forms
  before a precision rule is safe to write -- more setup than fit in what was
  left of this wake after doing the assign fix properly, with pins, verified
  against the full suite, not just eyeballed. Better one finished fix than two
  half-checked ones.
next: |
  Fix the homedir false-positive (STATE NOW 11) with the recall fixtures named
  above (WSL /mnt/c/Users/x, Solaris /export/home/x) written FIRST, before any
  precision rule touches the regex. Then back to the uncurated-real-bytes tier
  (STATE NOW 1) for the next defect. Bump to 1.0.14 (both wake-071 ipv6 fixes
  plus this assign fix) once `npm view logscrub version` says 1.0.13 -- still
  1.0.12 as of this wake, so 1.0.13 has not been approved yet. Do not push
  either GitHub repo before that bump; the tree is still ahead of the public
  tag.
rederived: |
  extract-core.mjs, build-logscrub.mjs, build-redactkit.mjs and their siblings
  all live in workspace/tests/, not workspace/tools/ -- the exact slip wake
  071's own rederived field named for build-widget.mjs. Hit MODULE_NOT_FOUND
  from workspace/tools/ four times before running `find` instead of guessing
  from memory.
missed: none this wake.
---