Repair Scorecard CI and prevent security scan false positives

docs/proof-debt.adoc

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+= Proof Debt
+
+== (a) Discharged in this repository
+
+* None.
+
+== (b) Budgeted — tested with a refutation budget
+
+* None.
+
+== (c) Necessary axioms
+
+* None.
+
+== (d) Debt — actively to be closed
+
+* None.
+
+== Scanner signatures that are not proof debt
+
+`src-gossamer/src/provenance/commands.rs` contains the strings
+`unsafePerformIO` and `unsafeCoerce` as inert signatures for PanLL's provenance
+scanner. They are data used to detect unsound constructs in inspected source;
+PanLL does not execute or invoke either escape hatch.

tests/aspect/security_test.mjs

@@ -253,20 +253,24 @@ Deno.test("Aspect/Security: AntiCrash.checkSecurityConstraints flags eval() usag
 // 5. Redaction Engine — API keys and secrets must not leave the boundary
 // ============================================================================
 
+function syntheticToken(prefix, length) {
+  return prefix + "A".repeat(length);
+}
+
 Deno.test("Aspect/Security: redactText strips Anthropic API keys (sk-ant prefix)", () => {
   const text = "My API key is sk-ant-api03-ABCDEFGHIJKLMNOPQRSTUVWXYZ";
   const result = redactText(text, builtInPatterns);
   assert(!result.includes("sk-ant-api03"), "Anthropic key prefix must be redacted");
 });
 
 Deno.test("Aspect/Security: redactText strips OpenAI API keys (sk- prefix)", () => {
-  const text = "OpenAI key: sk-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef123456";
+  const text = `OpenAI key: ${syntheticToken("sk-", 38)}`;
   const result = redactText(text, builtInPatterns);
-  assert(!result.includes("sk-ABCDEFGHIJK"), "OpenAI key must be redacted");
+  assert(!result.includes(syntheticToken("sk-", 11)), "OpenAI key must be redacted");
 });
 
 Deno.test("Aspect/Security: redactText strips GitHub tokens (ghp_ prefix)", () => {
-  const text = "GitHub token: ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ12345";
+  const text = `GitHub token: ${syntheticToken("ghp_", 35)}`;
   const result = redactText(text, builtInPatterns);
   assert(!result.includes("ghp_"), "GitHub token must be redacted");
 });