nx_secret_scan.nx

nx_secret_scan.nx -- the team's PLAINTEXT-CREDENTIAL scanner (Sentinel lane; the DETECT half of secret self-management -- nx_secret_cli is the STORE half, nx_security_sentinel ESCALATES). What it does, every run: 1. Walks a DATA-DRIVEN root table (repo root depth-1, bench/ops, runtime/_hdl_build, _offc). 2. For each regular TEXT file (binary = NUL byte in first 512B -> skipped; >4MiB capped), counts occurrences of a DATA-DRIVEN credential-pattern table. The quote-bearing patterns are ASSEMBLED AT RUNTIME (byte append) so this source never matches itself; files whose NAME contains "secret_scan" are skipped for the same reason. 3. Each finding -> one line to stdout + one ISSUE line with marker PLAINTEXT-SECRET appended to knowledge/status/issues_durable.log (the signal stream nx_security_sentinel watches -- its PLAINTEXT-SECRET row escalates to PM; resolve via SENTINEL-RESOLVE after migration). 4. Appends one SECRET-SCAN verdict line to knowledge/status/secret_scan.log. Exit 0 = clean, 1 = findings (re-runnable gate: clean tree MUST exit 0). Adding coverage = adding a pattern row or a root row (build intelligence, never strip). The FIX for a finding is never "delete the script" -- it is migration to the vault path: _offc/nx_secret_cli.elf get <name> -> /tmp/nxsecret.out (see _nx_vault_ssh.sh for the shape). license_tier: ORIGINAL