Omar SobhandClaude Opus 5.5
a86bd7272d
Container-tier missions carry model-provider keys in their environment (Claude Code needs its credential; the fallback chain needs GLM and Kimi), the agent has Bash, and no gate rule mentioned them. Delivery is the one exit all work passes through, so it now checks the outgoing diff and commit messages for the EXACT values of every watched secret (verbatim or base64): on a hit the push is refused with the key names recorded, the stored patch — served to the UI — is redacted, and a delivery.secret_blocked event is written. Values never logged. Exact matching, not shapes: text about keys is not flagged. A test pins the watched list to a superset of what containers are given in both auth modes. CLAWMATES_DELIVERY_CANARY (a random non-credential) lets the refusal be proven live without a real key. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>