Tier-B test-fixture suppression list. Loaded from the bundled
crates/cli/data/suppressions/test-fixtures.toml via include_str!
at build time; previously hardcoded in orchestrator.rs as a chain
of cred == concat!("sk_", "live_", …) branches. Moving the data
out of code lets a user contribute a new suppression without
re-compiling, lets the differential bench harness honour the same
list, and lets users opt out entirely via
--no-suppress-test-fixtures.
Number of sources that failed entirely — produced ZERO chunks AND
errored. A source the user explicitly requested (e.g. --github-org,
--git-diff, --url) that yields nothing because the fetch failed means
that scan never ran, even if a co-requested filesystem source succeeded.
run() fails closed when this is non-zero and there are no findings, so a
failed remote scan is not masked by a clean local one (the more precise
successor to the SOURCE_ERRORS && TOTAL_CHUNKS==0 global check). A
partial failure — a tree with some unreadable files that still produced
chunks — does NOT count: that source produced data.
Set to true if the scanner thread panicked during scan_sources.
Read at the end of run() so a crashed scanner exits with a
non-zero code instead of silently reporting “no findings, all
clean” - that was the prior behavior and would mislead any
caller piping keyhog into CI as a gate.
Number of source-read errors (a source yielded Err instead of a chunk).
Read at the end of run(): if a scan produced ZERO chunks AND a source
errored, the requested scan never actually ran (e.g. --git-history /
--git-diff on a non-repo, a bad ref, or an unreachable remote), so we
must NOT print “no findings, all clean” and exit 0 — that would tell a CI
gate the tree is clean when nothing was scanned (KH-GAP-096). Same intent
as SCANNER_PANICKED, for the source-failure path.