Whether text, normalized as the “Private key block” rule sees it,
holds a private-key header with no private-key END after it: the rule’s
match would continue in the text that follows.
Redacts text bound for the model (tool output). Only this entry point
counts toward the value surface: persistence passes (redact_text) keep
secrets out of files, not out of the model context, and an already
redacted [REDACTED:…] marker never matches again, so nested passes over
one output do not double count.
#718: redact_text with subtractive user patterns from
[secret_detection].exclude_patterns — a match covered by any exclude
regex is kept verbatim, so known-safe naming conventions can be carved out
without disabling secret detection wholesale.
Apply caller-supplied policy redaction patterns on top of the built-in
secret rules: each regex match becomes [REDACTED:<label>]. Returns the
transformed text and the number of redactions applied (for audit counts).
Run release with key known as the Ed25519 PUBLIC key a package
signature has just been verified with. Inside, the built-in “Generic long
secret” rule — and only that rule — does not read the member
"signer_public_key":"<key>" (a bundle) or "public_key":"<key>" (a
package manifest’s signature) as a secret: a public key is none, and the
rule fires on it only because a 64-digit value follows a name ending in
key. Every other rule, every configured pattern, every policy pack and
the gateway still see the original text with the real key in it and
decide as always. A key that is not 64 lowercase hex digits exempts
nothing.