[JasonBuildAI]

Goal And Delivered Outcome

Impact. Anyone who enables the DSH shadow observer (packages/dsh-loopx-plugin, the only producer of reliability_diagnostics ledger bytes) can have a live provider credential written in cleartext into the durable diagnostic ledger. The capability README promises the opposite — "Absolute local paths and credential-like tokens fail closed without reaching ledger bytes" — and the accepted RFC names "producer-side public-safety rejection before the first ledger append" as its P0 checkpoint. The producer implemented that control as a hand copy that had already lost most of the canonical owner's shapes.

Beneficiary. Operators running the DSH observer, and anyone they hand a diagnostic ledger or receipt to: the ledger is a whole-file export ("no filtering of negative records") and the read-only projection also surfaces tool_name from the summary.

Scale. Seventeen distinct values across four arm classes. A 38-value differential against the canonical loopx/public_safe_text.py owner at upstream/main found 17 that the producer accepted and appended while the Python owner refuses them:

Arm class	Values the producer wrote in cleartext
Provider issuers	GitHub fine-grained PAT, any 16-19 character classic PAT, AWS AKIA/ASIA, Slack xoxb-/xoxp-, Google AIza, Stripe rk_live_, npm, PyPI
Labeled assignments	api_key:, access_token:, refresh_token:, password:, secret:
Label alternative	the api arm of (?:access|api|secret)[_-]?key
Local path	any Windows drive path outside users / documents and settings

• Outcome basis / optional anchor: fixes [Bug]: the DSH shadow observer's producer-side public-safety check misses 7 of 9 provider credential shapes and narrows the drive-path arm #7729; the drift class is tracked by open architecture issue [Architecture]: two modules both claim to own "private-looking text" #5136, and [Bug]: the builtin public-safe-outbound scan certifies GitHub, AWS, Slack, Google, npm, PyPI and Stripe credentials as public-safe #7635/fix(capability): detect unlabeled provider tokens in the outbound scan #7636, [Bug]: the public-boundary publication gate in loopx check certifies unlabeled provider credentials as public-safe #7712/fix(contract): catch unlabeled provider tokens in the public boundary scan #7713, [Bug]: Chat activity masker persists npm/PyPI/Google/AWS/Slack/JWT tokens for replay #7717/fix(presentation): mask unlabeled provider tokens in chat activity #7718 already repaired the same class in public_safe_outbound/scanner.py, contract.py and presentation/codex_activity.py.

• Goal/source and gap: the producer's fail-closed check is a hand-written mirror of the canonical owner, and the mirror carried 2 of 9 provider-issuer arms, 4 of 5 labeled arms, one narrowed label alternative, a GitHub floor of 20 instead of 16, and a drive arm restricted to two directory names. No test could see it: tests/fixtures/public_safe_text_corpus.json pins only public_safe_text.py against the Vision checkpoint mirror, and the DSH shared fixture lists two credential shapes the producer already rejects.

• Observable before → after, with the validation row that proves it: the same value set, driven through ShadowObserver.observeSessionEvent → isPublicSafeValue → appendLedgerLines, was accepted and written for 17 values and is rejected with public_safety_violation for all 17 now; the new refuses every canonical credential arm before the first append row asserts it per value.

• Issue/task and intended base: Fixes #7729; base loopx-project/loopx main at 225698b31.

Author Declaration

• Written by: model agent (Claude-family model via Qoder), implementing at a human operator's request under their direction and review.

AI disclosure: this change was drafted with AI assistance at my request, under my direction and review.

Implemented against

• Specification and revision: loopx/capabilities/reliability_diagnostics/README.md ("Every provider applies the equivalent recursive public-safe value contract before its first append ... credential-like tokens fail closed without reaching ledger bytes") and docs/architecture/rfcs/long-running-agent-reliability-diagnostics-governed-delivery-v0.md P0 checkpoint ("producer-side public-safety rejection before the first ledger append"), both at 225698b31; the canonical shape text is loopx/public_safe_text.py SECRET_LIKE_SURFACE_PATTERN / LOCAL_PATH_SURFACE_PATTERN at the same revision.
• Criteria:

Criterion (spec clause)	Disposition	Symbol / path	Test or command
Credential-like tokens fail closed before the first append	implemented	SECRET_LIKE_SURFACES, packages/dsh-loopx-plugin/src/observer.ts	observer.spec.ts → refuses every canonical credential arm before the first append
Absolute local paths fail closed before the first append	implemented	LOCAL_PATH_SURFACES, same file	same test, windows_drive_outside_user_profile row
Every provider applies the equivalent contract (i.e. the same shape set as the canonical owner)	implemented	the two shape lists above	test_typescript_mirror_equals_the_canonical_credential_arms, test_typescript_mirror_equals_the_canonical_local_path_surfaces
Ingest re-validates every line (second boundary)	not_met by design, unchanged	loopx/cli_commands/reliability_diagnostics.py	pre-existing tests/capabilities/test_reliability_diagnostics.py
Envelope, stats, ledger layout and activation contract unchanged	implemented	—	tests/capabilities/test_reliability_diagnostics_dsh_provider.py (30 passed), full plugin suite parity below

• Self-check before submission: ran the three typecheck projects, the observer spec at base and head, the full plugin suite at base and head, the capability pytest files, ruff check, and a 38-value cross-language differential before/after. Deliberately left out: the POSIX/UNC/home-relative canonical path arms are mirrored for parity but are not reachable through the producer's own compact-token filters; the file-URL arm stays broader than the canonical file:// because narrowing it would loosen a check that already rejects file:/…. Two residual differences are documented rather than fixed: JavaScript's ASCII-only \b makes the mirror stricter than the Unicode-aware Python boundary for a token glued to a non-ASCII letter, and the parity test compares the arm list in order, so reordering it reads as a failure even though it changes no verdict.

Scope And Continuation

• Completed scope and remaining work: the producer's two shape lists now equal the canonical owner's, and one test fails whenever either side moves without the other. The remaining work in this class belongs to [Architecture]: two modules both claim to own "private-looking text" #5136 (one shared detection contract instead of per-surface copies); this change does not attempt that consolidation.
• Slice boundary / successor: complete within this scope. No successor task is needed for the DSH producer.

Validation

• Tested revision: 7c96eea8d (rebased onto 225698b31)
• Run state: finished
• Input classes: synthetic, public_fixture

Check kind	Result	Public-safe evidence / limitation
unit	passed	tests/capabilities/test_reliability_diagnostics_dsh_provider.py → 30 passed. With the base observer.ts restored in place, the two new tests fail (2 failed / 28 passed), so they are not vacuous.
unit	passed	packages/dsh-loopx-plugin/tests/observer.spec.ts → 12 passed, 1 failed. The failure is is off unless one exact goal, session, and run identity are declared, a pre-existing Windows-only path-resolution assertion (the fixture's POSIX /tmp ledger directory is rewritten drive-qualified on Windows); the same single test fails identically at the base revision (11 passed, 1 failed).
unit	passed	Full plugin vitest suite: base 9 failed / 198 passed (207), head 9 failed / 199 passed (208) — the same nine pre-existing Windows-host failures (POSIX fixture paths, child-close timing, symlink/permission), plus the one new passing test. No regression.
static	passed	tsc -p tsconfig.host.json --noEmit, tsc -p tsconfig.client.json --noEmit, tsc -p tsconfig.tests.json --noEmit → exit 0 each.
static	passed	ruff check tests/capabilities/test_reliability_diagnostics_dsh_provider.py → All checks passed.
regression_parity	passed	38-value differential, same candidates, canonical Python owner vs the shipped TypeScript producer: base 17 values accepted-and-written, head none — the only remaining verdict differences are six values the producer drops earlier than the guard, so neither side leaves ledger bytes. An independent reviewer re-ran a 926-value boundary/casing/unicode differential and found zero fail-open divergences.
manual	passed	Mutation check: the two new parity tests fail against the base observer.ts and pass at head.
integration	failed	loopx canary premerge --from-git-diff --git-diff-base upstream/main selected the dsh-loopx-plugin risk profile and failed on this Windows host for two reasons that both reproduce at the base revision: the quality phase runs the same full vitest suite (9 pre-existing Windows-only failures, base 9 failed / 198 passed), and the package / runtime phases stop at spawnSync ...\node_modules\.bin\dsh ENOENT, which the same smokes hit identically at base. The four direct checks (diff hygiene ×3, RFC bilingual) and py_compile passed. Hosted dsh-plugin.yml runs typecheck and the suite on its own Ubuntu and Windows runners.

• Coverage and gaps: the new tests cover each canonical arm and the four arm classes named in [Bug]: the DSH shadow observer's producer-side public-safety check misses 7 of 9 provider credential shapes and narrows the drive-path arm #7729. Not covered: the POSIX/UNC/home-relative path arms (unreachable through SUMMARY_TOKEN/IDENTITY_TOKEN), and the exact file: arm, which stays broader than the canonical form by design.

Frontend / Visual Evidence

• UI impact: none

Type of Change

• Bug fix

LoopX Area

• Capability or extension (providers, adapters, skills)

Technical Direction

• Direction / acceptance reference, when applicable: long-running agent reliability diagnostics (P0 producer-side public-safety rejection); architecture issue [Architecture]: two modules both claim to own "private-looking text" #5136 direction 1 (one shared detection contract with explicit policies).

Shared-authority RFC fixture impact

N/A

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• Existing English/Chinese RFC pairs (including ledger entries) both have a diff, and the local premerge check python3 scripts/check_rfc_bilingual.py --base origin/main --head HEAD passes, or no paired RFC changed.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).