Module opaque_reasoning 

Write-time SHAPE detector for provider-returned opaque reasoning payloads.

Why this exists (arXiv:2608.09867)

arXiv:2608.09867 (2026-08-10) showed that provider-returned encrypted reasoning blocks — the opaque reasoning / redacted_thinking payloads some model APIs hand back — carry no session, user, or model binding, and that of 315,320 such blocks scraped from public repositories, 367 leaked PII artifacts and 182 leaked credentials. Any agent that REMEMBERs a raw assistant turn is now plausibly persisting one of those blocks into a durable, shareable store — where it can later be recalled or shared without anyone realizing a credential rode along inside an opaque blob.

So on the write path we flag content that has the shape of such a payload and record the flag on the write’s provenance (see crate::model::write_provenance::WriteFlag). The write is not rejected — a memory database that silently drops writes is worse than one that stores a flagged write you can later revoke by principal or session.

What this deliberately does NOT do

Shape detection only. We never decode. This module does not base64-decode, decompress, JSON-parse the inner payload, or otherwise attempt to look inside the blob, and it takes no dependency that could (no base64, no crypto, no decompression crate). Two reasons: (1) decoding a provider-encrypted block could require pulling in a parser/crypto surface that becomes its own attack surface on untrusted input, and (2) materializing the decoded bytes would risk surfacing the very secret we are trying to avoid touching. We match a shape and record that we matched it. A positive flag does NOT prove the payload contains a secret — it means the content looks like an opaque provider reasoning payload, which is worth being able to find and revoke later.

Functions

detect

Detect whether content has the shape of a provider-returned opaque reasoning payload. Returns a short, human-readable reason for the match (for logging / the flag audit trail), or None. Shape only — this never decodes the content and a match does not prove a secret is present.