feat(blog): Tracking Secrets Through an Agent Run - #6558
Conversation
Technical post on the resolved-secret provenance system: how a credential is labeled when it resolves into a run, how the label travels through tool calls, sandboxes and durable storage, and where it is checked on the way out. Covers activation-requires-proof, the four egress boundary classes, fail-closed degradation and the named-reason reporting that keeps a refusal explainable, why the length floor beats an entropy floor, and the two production failures that retired the word-boundary tier in favour of one constant. Cover image plus two rendered diagrams: the activation/propagation/projection lifecycle, and which value classes clear the substitution floor. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryLow Risk Overview The post covers activation-by-proof (only secrets actually used in a run are tracked), treating the model as an egress boundary, fail-closed degradation with named refusal reasons, and why an eight-character length floor replaced entropy-based and word-boundary matching after production failures. Reviewed by Cursor Bugbot for commit 3714579. Configure here. |
Greptile SummaryAdds a published technical blog post explaining resolved-secret activation, propagation, egress projection, durable provenance, and the eight-character substitution floor.
Confidence Score: 4/5The content-only PR appears safe to merge after correcting the non-blocking overstatement that every boundary currently fails closed. The post integrates with the blog pipeline and its core matching claims align with implementation, but unknown durable provenance is allowed through by default on configuration-gated memory, table-row, and knowledge surfaces. Files Needing Attention: apps/sim/content/blog/secret-provenance/index.mdx
|
| Filename | Overview |
|---|---|
| apps/sim/content/blog/secret-provenance/index.mdx | Adds schema-valid blog content and metadata, but overstates fail-closed behavior for durable surfaces that are unenforced by default. |
| apps/sim/public/blog/secret-provenance/cover.jpg | Adds the referenced social and cover image with no identified issue. |
| apps/sim/public/blog/secret-provenance/length-floor.png | Adds the referenced length-floor illustration with no identified issue. |
| apps/sim/public/blog/secret-provenance/lifecycle.png | Adds the referenced provenance-lifecycle illustration with no identified issue. |
Reviews (1): Last reviewed commit: "feat(blog): Tracking Secrets Through an ..." | Re-trigger Greptile
The two failures that retired the word-boundary tier were described with the internal variable names they happened to involve, which carry no meaning outside the codebase and read like a bug ticket. They are now described by shape — a small number stored as a retry limit, a feature flag holding false — which is the same lesson in a form a reader recognizes. Style pass over the whole post alongside it: connective tissue between sections rather than cold starts, second person where the reader is being addressed as a builder, and longer explanatory sentences mixed back in among the short declaratives, which had accumulated into a run of pronouncements. Section headings take the descriptive "Topic: Detail" form the executor post uses. No technical claim changed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The note said workspace files refuse an unknown classification and the other surfaces are being brought up to that bar, which described the effect but not the mechanism, and left the impression that strictness is something surfaces gradually earn. It is the other way round. Omitting a surface enforces, so an unreviewed call site refuses by default; naming one is how a surface opts into reporting while enforcement is rolled out. Three sentences, and the design point leads. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Summary
Adds a technical blog post on the resolved-secret provenance system — how a credential is labeled when it resolves into a run, how the label travels through tool calls, sandboxes and durable storage, and where it is checked on the way out.
Content-only: one MDX file and three images. No application code.
Written in the register of the existing
executorandmultiplayerposts — flat engineering explanation, concrete specifics, takeaways for readers building something similar.What it covers:
Type of Change
Testing
Verified through the real blog registry rather than by eye — post is discovered by
getAllPostMeta, MDX compiles viagetPostBySlug, author resolves, 7 FAQ entries parse, andogImageresolves at 1200x675.Accuracy was re-checked against
origin/stagingsource after #6551 landed, since that PR deleted the word-boundary tier and the detect/render matcher mode the draft originally described. Sections describing that machinery were rewritten or removed rather than left stale.Every third-party citation was fetched and confirmed to substantiate the claim made against it, per the sourcing rule in
.claude/rules/landing-seo-geo.md— Denning 1976, Myers & Liskov 1997, Perlperlsec, Yelp detect-secrets, LangSmith and Langfuse masking docs, OWASP LLM02:2025. One claim ("moved from sixth to second") was cut because the linked page does not state it.Reviewers should focus on whether the described semantics still match the code, and on the guarantees table.
Checklist
Screenshots/Videos
Cover plus two generated diagrams, in the existing house style so they sit alongside the executor post's figures:
lifecycle.png— activation → propagation → projection, fanning into the four boundarieslength-floor.png— which value classes clear the eight-character substitution floorNo product screenshots: the trace examples in the post are described rather than captured.
🤖 Generated with Claude Code