Module secret_scan 

Output credential-shape sampling — warn-only secret-exposure tripwire.

P-PROV-5/B(c) (2026-09-10, Glama secret-exposure thread): tool outputs can carry credential-shaped strings into logs, journals, and model context. The sampler scans a deterministic 1-in-N fraction of successful dispatch outputs with the ingest path’s high-precision detector (wm_memory::credential_shaped_content) and warns — never blocks, never logs content (matched kind names + byte sizes only). Counters feed the false-positive-rate report that gates any future enforcement, which is an explicit non-goal of this module.

Sampling is counter-deterministic (seen % every == 0), so tests and audits reproduce exactly which dispatches were scanned. every == 0 disables scanning entirely (zero per-dispatch cost beyond one branch).

Structs

SecretSampler

Warn-only sampler over successful dispatch outputs.

Constants

DEFAULT_SAMPLE_EVERY

Default sampling cadence: scan every 100th successful output (~1%).

SAMPLE_EVERY_ENV

Environment knob: WM_SECRET_SCAN_EVERY (0 = off, unset/invalid = DEFAULT_SAMPLE_EVERY).

Functions

parse_every

Parse a cadence value.

Type Aliases

SharedSampler

Shared sampler handle for the dispatch pipeline.