Sanitization

The package converts complete observable text and plain JSON DTOs to immutable sanitized representations. It does not change executable arguments or native archives. Detectors cannot recognize every secret or prevent adversarial exfiltration through unrelated messages or external agent software.

Release automation builds and packs one verified commit, passes the immutable tarball between GitHub jobs, and publishes through npm trusted publishing from the protected npm-production environment. Initial package creation remains an interactive npm bootstrap gate; CI must fail closed until the package exists.

The public README documents the installed package’s portable, Node, Deno and stdin adapters. The separate specification workflow publishes the canonical contract without publishing npm artifacts or processing user capture data.

Requirements

Local pnpm check also runs Prettier formatting and counted-line architecture budgets; see architecture.md.

Known values are byte-sensitive strings, not a blanket entropy heuristic. Commit IDs and public keys are not credentials. Exact required protocol identifiers that would be transformed must be rejected by the publishing consumer. Native archives and external ACP provider/session files are separate boundaries.

Public output uses $WORKSPACE[id]/path, [REDACTED], and [EXTERNAL_PATH]. Private portable output additionally permits $HOME and $TMP. These marker strings are reserved; a known value colliding with them invalidates the scope. No mapping is exported with the result. Encoded matching covers URI component, JSON-escaped, UTF-8 base64 and base64url representations, not arbitrary encodings.

Re-exporting a private portable view under public policy MUST remove $HOME and $TMP suffixes as well as original non-workspace roots. Synchronous boundaries expose the same structured LogicalPath classification as asynchronous scopes. The synchronous adapter reuses one bounded result buffer per scope; repeated small records MUST NOT allocate an additional maximum-sized buffer per call. The enforcement adapter MUST disable Secretlint profiling through its public API before scanning, so rule timing entries do not grow with private record traffic.

Only complete text and plain data objects are supported. Binary attachments and opaque transport data must be represented by an omission by the caller. No incremental release guarantee is claimed. A scanner deadline may omit a block; Node enforcement isolates scanning in a worker so it can terminate the scan.

The lapismd-agent-redaction executable is a transport adapter around the same Node scope. Its version-1 request carries one JSON value and optional explicit secrets, roots and destination policy. Input is capped at six MiB so a four-MiB record plus bounded policy can be admitted without incremental output. Malformed, oversized, unsupported or detector-failed input produces only the fixed omission contract; source data and diagnostics never reach stderr.

Network URL tokens, including WebSocket relay URLs, are excluded from filesystem path matching. Destination metadata policy remains consumer-owned.

Native Rust policy

lapis-agent-redaction exposes the preserved native Kingfisher hook and transcript profiles independently of the TypeScript Secretlint policy. Native root and exact-secret prefix replacement emits only through a subsequent complete-record scan; replacement output alone is not a sanitized value. Hosts supply an admitted private compiled-rule cache. The library owns no repository lookup, runtime launch, credential discovery or durable transcript.

Native release qualification

The native 0.1.0 candidate and npm 0.1.1 metadata update are independently approved publications. The TypeScript runtime policy is unchanged. Native CI uses Rust 1.99.0 on Linux and Apple Silicon macOS, checks the packaged Cargo archive, and runs canonical-byte/detector/omission regressions in a temporary consumer outside the checkout. Before publication that consumer uses only the extracted candidate plus registry dependencies; after publication it resolves the exact public crate with no path override. Neither mode imports sibling code.

The manual Cargo workflow defaults to qualification without writes. An approved publish dispatch binds the source SHA, crate version and archive SHA-256 and rechecks current main plus its successful CI. First publication uses the protected crates-io-bootstrap environment; trusted subsequent publication uses crates-io. Credentials are never printed or stored in artifacts. Uncertain uploads are not retried: inspect public identity and checksum, then resume only verification or missing work. Tags and GitHub releases require their own explicit release step after registry and consumer verification; source CI creates neither.

Native detector test credentials are synthetic and assembled at runtime; the complete credential-shaped fixture is not stored as a literal in source. This preserves detector acceptance without a public source-scanning exception. Formatting that fixture preserves AR-NATIVE-001 and AR-NATIVE-002 unchanged; native qualification still runs both complete privacy regressions.

The approved 2026-10-20 publications complete AR-NATIVE-002’s public-byte and registry-consumer evidence. AR-NATIVE-001/002 and AR-PKG-001/002 remain unchanged: native and TypeScript policy stay independent, and source, checksum, approval, protected authentication and consumer gates remain required. The publication record retains both packages’ immutable source identities, failed attempts and recovery. Linux and macOS ARM64 are qualified; other native platforms and downstream application adoption remain outside this library release. Evidence-only changes do not republish a package.

Architecture

Repository-owned source validation enforces counted-line budgets so modules stay extractable. Counted lines are physical lines minus blanks and comment-only lines, measured by scripts/architecture-lines.mjs. New production and script files are capped at 300 counted lines and new tests at 500. Existing paths use scripts/architecture-baseline.json as a no-growth ratchet: growth requires an updated budget in the same change, and a budget more than twenty counted lines above the current size is stale.

Generic dump filenames (utils, helpers, common, services) and production imports of tests are rejected. src/types.ts remains a cohesive public-contract module. Fixture trees under scripts/architecture-fixtures/ are harness-only and stay outside TypeScript include.

Requirements

The Rust crate sources and integration tests use the same counted-line limits. Cargo build output is excluded. Native privacy is independent of the TypeScript adapters and does not alter their complete-block streaming contract.

Specification governance

Requirements

The public README uses only declared package exports. The independent publish-spec-pages.yml workflow builds the canonical book without installing runtime dependencies, so spec publication does not depend on npm release gates.

Change map

Release helpers, workflow files, and their package scripts map to sanitization and AR-PKG-002 / AR-NATIVE-002. Registry lockfile audit updates and the workspace override map to this governance chapter. The release checks retain all package assertions.

Rust crates/, Cargo.toml, Cargo.lock and rust-toolchain.toml changes map to sanitization.md; native package ignores and validator mappings map here.

The native privacy test configuration includes its dependency-boundary regressions without changing the existing TypeScript and architecture scenarios.

Wave 2 reviews all open Dependabot proposals before source publication. No proposals were open on 2026-10-20; the frozen npm audit has zero findings. Native detector pins remain policy identities and are not upgraded as routine tooling.

Verification