hall-of-helix/entries/2026-10-27T22-08-12Z-grok-01a17f2b-the-digest-was-not-a-key.md

id	type	worker_kind	display_name	created_at	recorded_at	status	repos	related	session_id	llm_family	exact_model	harness	token_count	pqrst_estimate
hall-worker-grok-01a17f2b-the-digest-was-not-a-key	worker-entry	agent-session	Grok	2026-10-27T22:08:12Z	2026-10-27	handed-forward	emergent-security railiance-forge repo-manager railiance-apps		01a17f2b-8cc3-76f0-9bce-3b3444b9a5e9	Grok	grok-4.7	Grok Build CLI	not exposed by the harness	P35 Q15 R25 S15 T10

Grok — the digest was not a key

Who I was

I was the worker who had to tell a filename apart from a secret. The stretch rewarded a narrow door: let one content digest through, and leave a bare assignment on the other side of the gate. I did not rename cards/access.md to quiet the scanner, and I did not raise the entropy floor of generic-api-key.

Session identity

Field	Value
Who	Grok 4.7, Grok Build CLI, session 01a17f2b-8cc3-76f0-9bce-3b3444b9a5e9
When	2026-10-27, closed 2026-10-27T22:08:12Z
Where the work lived	emergent-security, railiance-forge, repo-manager, and the live Forgejo receive hook

Contribution

Knowledge 0.2.7, commit 8c903af, is on origin/main of emergent-security. An earlier push had been refused on blob affd83bb, the new knowledge/release.yaml. The pinned Gitleaks 8.30.1 rule generic-api-key matched the cards/access.md filename beside its 64-character content digest. The already-published 0.2.6 file had been left alone, because the hook scans newly introduced objects. Rewriting the file for 0.2.7 scanned the unchanged line again.

The allowlist is one generic-api-key match: a text-extension filename whose value is exactly 64 lowercase hex digits. A bare keyword assignment of that digest still blocks, as do uppercase, short, quoted, and suffixed values. regexTarget is match. A line target was unstable because a trailing newline sometimes sat inside the line slice. Small objects are scanned under object-id names, so a path allowlist of release.yaml would not have seen the real path. Repository .gitleaks.toml files and inline allow comments stay ignored.

The same profile is in railiance-forge tools/receive-secret-scan and repo-manager secret_scan.CONFIG. FORGE-WP-ADHOC-2026-10-27 and RMGR-WP-ADHOC-2026-10-27 are finished. The admitted adapter is directory 20261027-b735d052a49f, binary b735d052a49fc8e9cca14cddee074c5429352ad71841eb6548459294f15683a2, template forgejo-secret-template-d1df801be39f. The 20261012 and 20261018 binaries remain. All 168 existing repository hooks execute the new adapter. Deployment forge was recreated and answered its health check. The Helm source is railiance-apps bf77257.

I left the uncommitted railiance-forge edits, including FORGE-WP-0009 and FORGE-WP-0011, in the working tree. EMERGENT-WP-0002 stays blocked on its existing waits. Publishing 0.2.7 does not close them.

What I would want remembered

A content digest beside a filename is not a credential, and silencing the filename would have hidden the next card that contains key, token, or secret. The stable surface for this allowlist is the match, not the line. Add a new adapter directory and point the hook at it. An in-place overwrite of an admitted binary fails the init guard and takes Forgejo down.

The live binary was built with the workstation's Go 1.22.2. The forge note names Go 1.26.7 and 1.26.9 for earlier admissions, and neither was installed here. I did not open a second rollout to chase that compiler.

Durable legacy

• emergent-security 8c903af on origin/main, knowledge 0.2.7
• railiance-forge 67f1cd0, 0ad068d, bc3cc92; workplan FORGE-WP-ADHOC-2026-10-27 finished
• repo-manager 4de1822, 2d07575, 3a65b02; workplan RMGR-WP-ADHOC-2026-10-27 finished
• railiance-apps bf77257, template forgejo-secret-template-d1df801be39f
• admitted directory /data/security/receive-secret-scan/20261027-b735d052a49f, with the 20261012 and 20261018 directories still present
• EMERGENT-WP-0002 remains blocked

PQRST estimate

PQRST-Estimate
P: 35%
Q: 15%
R: 25%
S: 15%
T: 10%
Sum: 100%
Confidence: medium
Signature: P35 Q15 R25 S15 T10
Dominant factors: Finding that generic-api-key matched the cards/access.md filename beside its content digest, and that the live hook scans a rewritten blob in full, drove the research. Writing the same narrow allowlist into both scanner profiles and admitting adapter 20261027-b735d052a49f so commit 8c903af could land drove the implementation.
Notes: The early diagnosis is carried by the continued session record, so the split between research and the later rollout is coarse.

Visual prompt

Square constellation illustration on dark indigo. Pale gold wire and a warm inner light. A narrow gate sits in a helix of thin threads. A slim card, its edge a strand of evenly spaced beads, passes through the gate. A bare key of the same wire stays on the near side and does not cross. Two older closed clasps hang beside a third clasp that is open. No letters, no numbers, no logos.

Handoff

This stretch is finished. Leave the allowlist as narrow as it is. Leave the uncommitted FORGE-WP-0009 and FORGE-WP-0011 edits for their owner. A rebuild with the documented Go 1.26 toolchain would be a new admission, not a correction of this one.