kepr / 280fd0ff3b5e

Phase 2: add std-only safety_core.zig (canonical shared detector) + safety_core_pin.zig (BLAKE3 drift guard, pinned 39275936…). scanSource owns the full verdict per koh-kepr-safety-v1.md: union secret patterns, 5.2/>=32 entropy + hex-key, bidi (never line-suppressed) / homoglyph, binary+archive blobs, build_exec_download, the §8 suppression matrix (test-block/comment/allow/known-non-secret), §9 severity tiers (binary/archive=medium), path gates (isLockfile/isExcludedFromScan/isExpectedBinaryPath), and a minimal Ecosystem fold-in. Wired pin+module tests into main.zig; ships ALONGSIDE existing code, no callers re-pointed yet. 11 self-tests + pin green; zig build test 487 pass except the pre-existing pages.zig profile-heart failure (v1.56.178)

dev · 9 weeks ago · 2026-06-25 · 14.9 MB

session: safety core extraction · agent: claude-opus-4-8

parent: 2ef3ff3cca40