Fix Proof Before Action placeholder credential staging

[saagpatel]

Summary

Closes the remaining Proof Before Action placeholder credential staging bypasses found in the commit-scoped security scan, while preserving legitimate external placeholder workflows.

Changes

• Parse sensitive authorization/cookie headers as whole staged values instead of accepting only the first quoted segment.
• Reject shell-adjacent literal material appended to placeholder authorization headers.
• Cross-check staged local placeholder variables against literal credential assignments across the staged subject tree, including alternate shell/YAML quoted assignment forms.
• Allow legitimate external placeholders such as GitHub Actions ${{ github.token }} and structured JSON Authorization: Bearer $VAR headers without turning them into safety claims.
• Stabilize the stdio timeout cleanup test so it actually exercises a spawned process before timeout cleanup.
• Document the security repair under [Unreleased].

Checklist

• Canonical verifier passes (uv run pytest, uv run ruff check, uv run mypy .)
• Security implications considered — does this change affect risk scoring, threat detection, config parsing, or output that feeds into AI systems? If yes, describe the implications below.
• CHANGELOG.md updated under [Unreleased]
• New or changed behavior is documented (README, docstrings, or both)

Security implications

This tightens Proof Before Action's staging boundary. Unknown, stale, masked, unmatched, unobservable, or syntactically suspicious evidence still does not become a safety claim: placeholder headers are accepted only when the effective sensitive value is the placeholder, and local placeholder variables are rejected if staged text defines them as literal credential material. The repair remains local-first and does not add network, package publication, release, or deployment authority.

Security limitations that remain intentional: Proof Before Action is still a bounded evidence collector, not a general sandbox; clean final-state filesystem/database/network evidence can remain unknown; synthetic fixture strings in tests are not evidence of real credential material.

Codex Security diff scan bca792dc-48ac-46f8-934d-b0ceaeca4fe6 reported one low finding at scanned revision c84528d8900ed393e789df2c5a5bc5048bbe302a for neutral placeholder variable assignment. Current PR head 65bd13a6f73fee0b9de7c22a3289beb79b5053f1 adds the targeted repair and focused regression tests for that finding.

Test plan

• uv sync --dev --locked -> pass
• uv run pytest -q -> 1051 passed
• uv run pytest tests/test_proof_before_action.py -q -> 154 passed
• uv run pytest tests/test_connector.py -q -> 27 passed
• uv run pytest tests/test_proof_before_action.py::test_placeholder_authorization_header_rejects_alternate_literal_assignment_syntax tests/test_proof_before_action.py::test_placeholder_authorization_header_rejects_same_file_literal_assignment tests/test_proof_before_action.py::test_placeholder_authorization_alias_cycle_is_staged -q -> 11 passed
• uv run ruff check . -> pass
• uv run ruff format --check . -> pass
• uv run mypy . -> pass
• uv lock --check -> pass
• uv run python scripts/verify_release.py -> release metadata verified for 2.5.0
• uv build --clear && uv run python scripts/verify_release.py --commit 65bd13a6f73fee0b9de7c22a3289beb79b5053f1 --dist-dir dist -> pass; wheel and sdist verified
• Real CLI workflow: proof-before-action inspect emitted JSON with expected v1 unknown verdict and capsule root b192706a51b175038a1a8cd9ca19ab86a926af2184c33ef16965345d60e804c5; capsule contained capsule.json, capsule-index.json, and offline report.html; proof-before-action verify returned valid: true and authority: anchored with expected subject commit, producer commit, schema, and root hash.
• Tamper detection: modified comparison verdict in a disposable capsule copy; verify exited 1 with artifact_tampered, capsule_noncanonical, comparison_mismatch, payload_tampered, and report_projection_mismatch.
• Failure path: wrong pinned image ID blocked before observation with JSON ok: false, inspection_blocked, exit 2.
• Diff hygiene: git diff --check origin/main..HEAD passed; diff secret/private-path pattern scan found no matches.
• Docker residue check: no Proof Before Action labeled containers or images remained.

Related issues

N/A

[github-actions]

Agent Permission Diff

• Base: 7522a91e407d0f06c6ecaac58b2f610ca223f043
• Head: 65bd13a6f73fee0b9de7c22a3289beb79b5053f1
• Findings: 0
• Gate findings: 0
• Acknowledged findings: 0
• Permission changes: 0
• Gate: pass in observe mode
• Fail on: critical
• Exit code: 0

Gate Decision

No findings were produced.

Findings

No agent-facing permission findings.