# KeyHog repository dogfood policy (normal operator lane).
#
# Every entry carries `reason=` and `approved_by=` inline metadata, the
# governance trailer `keyhog_core::Allowlist` parses. `tests/dogfood/suppression_audit.py`
# fails the build when an entry lacks either field, when a literal `path:`
# entry stops resolving (a rename or module split silently voids it), and it
# reports every `hash:` entry that suppressed nothing.
#
# Two lanes consume repository policy, and they publish separate coverage
# manifests so neither can quietly omit a path:
#   * this file            - `tests/dogfood/repository_scan.sh` (operator policy)
#   * keyhogignore.strict  - `tests/dogfood/strict_scan.sh` (strict repository policy,
#                            scans detectors/, examples, baselines, generators, and
#                            workflow YAML that this lane excludes wholesale)
#
# Do not paste literal credential shapes into a comment here. This file is
# itself scanned by both lanes.

# --- Generated and external trees -------------------------------------------
# `reason=transient:` marks a path that is generated, gitignored, or an
# external corpus dropped in the tree. The auditor does not require these to
# exist; every other literal path must resolve.
path:.internal/; reason="transient: private internal notes and requirement ledgers, gitignored"; approved_by="keyhog-maintainers"
path:target/; reason="transient: cargo build output, gitignored"; approved_by="keyhog-maintainers"
path:site/; reason="transient: docs site regenerated from detectors/*.toml on every build; embeds each detector's example token"; approved_by="keyhog-maintainers"
path:ml/; reason="transient: model training scratch and datasets, not shipped source"; approved_by="keyhog-maintainers"
path:tools/secretbench/; reason="transient: retired SecretBench tree; only regenerable corpora and result dumps remain on disk"; approved_by="keyhog-maintainers"
path:benchmarks/corpora/; reason="transient: generated mirror corpora, reproducible with `make -C benchmarks mirror`, full of synthetic secret-shaped fixtures"; approved_by="keyhog-maintainers"
path:benchmarks/results/; reason="transient: per-run RunResult JSONs, reproducible with `make -C benchmarks bench`"; approved_by="keyhog-maintainers"

# --- Reviewed non-text release assets ---------------------------------------
# The default filesystem source does not scan their bytes as text, so dogfood
# names them explicitly instead of reporting an incomplete clean scan.
path:crates/scanner/data/english_bigram_logprob.bin; reason="reviewed binary model blob; not scanned as text, named explicitly so the lane never reports an incomplete clean"; approved_by="keyhog-maintainers"
path:crates/scanner/data/cl100k_base.tiktoken; reason="reviewed tokenizer rank table; vocabulary data is not source content and contains 489 high-entropy token fragments under the portable Action build"; approved_by="keyhog-maintainers"
path:crates/scanner/src/weights.bin; reason="reviewed binary ML weight blob; not scanned as text, named explicitly so the lane never reports an incomplete clean"; approved_by="keyhog-maintainers"
path:docs/assets/keyhog-banner.svg; reason="reviewed docs banner asset; not scanned as text, named explicitly so the lane never reports an incomplete clean"; approved_by="keyhog-maintainers"

# --- Documentation that quotes findings --------------------------------------
path:CHANGELOG.md; reason="release notes quote example credentials verbatim; documentation about findings, not live material"; approved_by="keyhog-maintainers"
path:docs/src/workflows/github-action.md; reason="the file documents exact Action version pins of this public repository; generic entropy reads a pinned release tag as a credential-shaped token"; approved_by="keyhog-maintainers"

# --- Test, fixture, and demo trees -------------------------------------------
# These trees carry exact positive and negative credential examples by design.
# The STRICT lane scans the fixture-heavy subset of them under an explicit
# fixture policy; see tests/dogfood/keyhogignore.strict.
path:demo/; reason="demo fixtures embed fake credentials so the TUI recording has content to scan"; approved_by="keyhog-maintainers"
path:crates/scanner/tests/fixtures/detector_execution_policy_utf8/; reason="regression fixture embeds fabricated passwords from the source that reproduced a UTF-8 span crash"; approved_by="keyhog-maintainers"
path:crates/core/tests/; reason="test fixtures carry exact positive and negative credential examples that prove detector behavior"; approved_by="keyhog-maintainers"
path:crates/cli/tests/; reason="test fixtures carry exact positive and negative credential examples that prove detector behavior"; approved_by="keyhog-maintainers"
path:crates/scanner/tests/; reason="test fixtures carry exact positive and negative credential examples that prove detector behavior"; approved_by="keyhog-maintainers"
path:crates/sources/tests/; reason="test fixtures carry exact positive and negative credential examples that prove detector behavior"; approved_by="keyhog-maintainers"
path:crates/verifier/tests/; reason="test fixtures carry exact positive and negative credential examples that prove detector behavior"; approved_by="keyhog-maintainers"
path:crates/cli/benches/; reason="benchmark fixtures carry exact credential examples that prove detector behavior"; approved_by="keyhog-maintainers"
path:crates/core/benches/; reason="benchmark fixtures carry exact credential examples that prove detector behavior"; approved_by="keyhog-maintainers"
path:crates/scanner/benches/; reason="benchmark fixtures carry exact credential examples that prove detector behavior"; approved_by="keyhog-maintainers"
path:crates/verifier/benches/; reason="benchmark fixtures carry exact credential examples that prove detector behavior"; approved_by="keyhog-maintainers"
path:benchmarks/bench/tests/; reason="scorer tests carry exact credential examples that prove scoring behavior"; approved_by="keyhog-maintainers"
path:tests/dogfood/; reason="the dogfood lane's own fixtures and planted-secret probes live here"; approved_by="keyhog-maintainers"
path:tests/install/fixtures/install_from_local_build_posix.sh; reason="installer exercise decodes synthetic credentials so the freshly installed binary can prove detector coverage end to end"; approved_by="keyhog-maintainers"
path:crates/cli/data/suppressions/test-fixtures.toml; reason="the file's purpose is to enumerate known-public sample credentials so keyhog can suppress them by hash"; approved_by="keyhog-maintainers"
path:crates/scanner/examples/; reason="detector probe examples carry sample credentials by design; the strict lane scans them under an explicit fixture policy"; approved_by="keyhog-maintainers"
path:detectors/; reason="detector definitions carry example tokens by design; the strict lane scans them and currently reports zero findings"; approved_by="keyhog-maintainers"
path:benchmarks/baselines/; reason="committed differential baselines are keyhog's own redacted output plus TP/FP/FN comparison tables that quote surfaced shapes; the strict lane scans them under a redaction-aware policy"; approved_by="keyhog-maintainers"
path:benchmarks/generators/; reason="mirror generators assemble synthetic credentials at runtime to build benchmark fixtures; the strict lane scans the generator source"; approved_by="keyhog-maintainers"
path:.github/workflows/integration-smoke.yml; reason="the workflow base64-encodes planted vendor-doc fixtures so the runner can prove the scanner finds them; the strict lane scans workflow YAML by hash instead"; approved_by="keyhog-maintainers"

# --- Fixture-scoped hashes replacing former source-path suppressions ---------
# KH-576: `path:` entries hid whole production source files because they
# contain doc-comment fixtures. Measured on the release-fast build across the
# default, --no-decode, --fast, --precision, --deep, --no-default-excludes, and
# --git-history presets, four of those files (decode/reverse.rs,
# suppression/path_filter.rs, hosted_git/sanitize.rs, suppression/shape/canonical.rs)
# surface nothing at all, so their path entries are gone. The rest are scoped to
# the exact fixture value, which keeps the surrounding file scanned and fails the
# lane on any second credential planted in it.
hash:e51274cf409418544734e68fef141a841ca58b82a4d7e61f41b2ed638abfd902; reason="GPU ML-scorer warm sample; vendor example token used only to touch the feature extractor; measured entropy-api-key at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/scanner/src/gpu/backend/execution.rs:755; surfaced by preset(s) decode,deep,nodecode,noexcl"; approved_by="keyhog-maintainers"
hash:94ba8206be4dd790b4d3243a600904b91e210b7a3940f285559631d2079f0145; reason="shape-classifier accept fixture; measured entropy-token at crates/scanner/src/suppression/shape/canonical.rs:273 under --deep only"; approved_by="keyhog-maintainers"

# --- Reviewed fixtures, provenance generated from measurement -----------------
# Each `reason=` below records the detector, source location, and presets that
# actually surfaced the value on the release-fast build (2026-08-04). Regenerate
# with tests/dogfood/suppression_audit.py after any detector or fixture change.
hash:0edfda193f931b8c1c9c1a1db3b27576e70dd343cf943b5d22aacd5b63cb0090; reason="fabricated known-positive AWS key planted in the differential-bench smoke check; measured aws-access-key at /media/mukund-thiru/SanthData/Santh/software/keyhog/.github/workflows/differential-bench.yml:196; surfaced by preset(s) decode,deep,fast,nodecode,noexcl,precision"; approved_by="keyhog-maintainers"
hash:48d2a5bbcf422ccd1b69e2a82fb90bafb52384953e77e304bef856084be052b6; reason="leetspeak placeholder in the parse_env doc comment illustrating inline-comment stripping; measured generic-keyword-secret at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/scanner/src/structured/parsers/env.rs:21; surfaced by preset(s) decode,deep,fast,nodecode,noexcl"; approved_by="keyhog-maintainers"
hash:01c2c0cfbc4247225dbbe5fdbf59cecb4abdc6a1c6d78b7ff0c7a5b968fb40b2; reason="canonical vendor-docs AWS example reused by the action E2E and the GPU warm sample; measured aws-access-key at .github/workflows/action-e2e.yml:206; surfaced by preset(s) decode,deep,fast,hist,nodecode,noexcl,precision"; approved_by="keyhog-maintainers"
hash:f6dc8f29e382dcc29478e74e5419e82c8d03453461b06224b9f8d573cc2bd79f; reason="canonical vendor-docs AWS secret quoted in the detection guide; measured aws-secret-access-key at /media/mukund-thiru/SanthData/Santh/software/keyhog/.git/lfs/objects/1e/03/1e0315e324a88b4eca0fdb7d8b6811716c37a25a0d77fc673f4067f38f1b3231:7; surfaced by preset(s) decode,deep,fast,nodecode,noexcl,precision"; approved_by="keyhog-maintainers"
hash:7b85310a29300230c865bc48ca1836f15b81bd50ac85e8c0785e8145e98ff175; reason="fleet-wide fabricated GitHub classic PAT fixture with a valid CRC, exactly 36 chars so its value hash is stable; measured github-classic-pat at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/cli/src/subcommands/calibrate_autoroute.rs:66; surfaced by preset(s) decode,deep,fast,nodecode,noexcl,precision"; approved_by="keyhog-maintainers"
hash:386de3e7c99e0ae3152c54d0a80c5d2d138255916a37810a4c8f7a093331fc9b; reason="suppression API doc-comment example; measured rabbitmq-credentials at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/scanner/src/suppression/api.rs:243; surfaced by preset(s) decode,deep,fast,nodecode,noexcl"; approved_by="keyhog-maintainers"
hash:3bcba6dd69a4df503b7a555cd53620c567e3eca4ff4a4c9ab98df6d2d3620a73; reason="generic assignment shape doc-comment example; measured generic-keyword-secret at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/scanner/src/generic_assignment_shape.rs:19; surfaced by preset(s) decode,deep,fast,nodecode,noexcl"; approved_by="keyhog-maintainers"
hash:40769d9505fadf9d959e05cee5c792f9fb2f8772e1aabfabe248d477e0421aa7; reason="cloud source redaction fixture; measured entropy-token/generic-keyword-secret at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/sources/src/cloud/mod.rs:752; surfaced by preset(s) decode,deep,nodecode,noexcl,precision"; approved_by="keyhog-maintainers"
hash:4d72588105763b14841eb916a556a251ed6d9e2f00ba7a86ac5673836a1bfc4e; reason="cross-OS dogfood script planted probe value; measured entropy-token at /media/mukund-thiru/SanthData/Santh/software/keyhog/scripts/dogfood-all-os.sh:112; surfaced by preset(s) deep"; approved_by="keyhog-maintainers"
hash:7e3d5eecdd34a230a81b2bee3bf4fad0cb002fef74c1929b05147efc0030382a; reason="demo application fixture credential; measured stripe-secret-key at /media/mukund-thiru/SanthData/Santh/software/keyhog/.git/lfs/objects/17/5f/175f66c0f81bfe216c43640f3b747c64b552c0cfa2d2992cc515018bfd85f65a:16; surfaced by preset(s) decode,deep,fast,nodecode,noexcl,precision"; approved_by="keyhog-maintainers"
hash:81475fe7907ae1818130c48c21a8d632f083a0337fed43e825e21b94566e38ba; reason="PowerShell installer checksum-shaped constant; measured entropy-token at /media/mukund-thiru/SanthData/Santh/software/keyhog/install.ps1:1524; surfaced by preset(s) deep"; approved_by="keyhog-maintainers"
hash:83eee1420adf36ee9cfe736087c997f6e83c1acea1541b9954d99b0544efe182; reason="token-randomness suppression doc-comment example; measured generic-password at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/scanner/src/suppression/token_randomness.rs:8; surfaced by preset(s) decode,deep,fast,nodecode,noexcl,precision"; approved_by="keyhog-maintainers"
hash:9e5ae7f2f2af222eb3c78a7226871124ed1af7ebd9804650e077c38d24f1a235; reason="entropy keyword table doc-comment example; measured generic-keyword-secret at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/scanner/src/entropy/keywords.rs:444; surfaced by preset(s) decode,deep,fast,nodecode,noexcl"; approved_by="keyhog-maintainers"
hash:a1592ac7ce1a434b7274b09d15bd59e1c96e35ba02e80eb33182f4c353713e0b; reason="suppression API doc-comment example; measured rabbitmq-credentials at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/scanner/src/suppression/api.rs:678; surfaced by preset(s) decode,deep,fast,nodecode,noexcl"; approved_by="keyhog-maintainers"
hash:af047096c2b37a7dcea19eff5cff7e29639a5e65be6142e43aa5fc7f537007f5; reason="autoroute calibration probe sample; measured entropy-token at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/cli/src/subcommands/calibrate_autoroute.rs:71; surfaced by preset(s) deep"; approved_by="keyhog-maintainers"
hash:c90f315ef13ef88951f5bb6426a7ea05b7974368374b0398bb0ed9e8840f0391; reason="cross-OS dogfood script planted probe value; measured aws-access-key at /media/mukund-thiru/SanthData/Santh/software/keyhog/scripts/dogfood-all-os.sh:120; surfaced by preset(s) decode,deep,fast,nodecode,noexcl,precision"; approved_by="keyhog-maintainers"
hash:c92417ab6c54df83e568fc6a7c984ad9790331d9ddaa9322e728b135d110a668; reason="core config doc-comment example; measured generic-password at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/core/src/config.rs:58; surfaced by preset(s) decode,deep,fast,nodecode,noexcl"; approved_by="keyhog-maintainers"
hash:d0e5167351768a459206fa4777f359436ca276599c31c5346e4d6264f7dfff4f; reason="scanner testing facade fixture; measured generic-keyword-secret at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/scanner/src/testing.rs:763; surfaced by preset(s) decode,deep,fast,nodecode,noexcl,precision"; approved_by="keyhog-maintainers"
hash:51d2a659f0940c6e7dce3fc11c5df329aff93212408a5a4a2a47124df1964be0; reason="release-profile match-extent variant of the token-randomness doc-comment example; measured generic-keyword-secret at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/scanner/src/suppression/token_randomness.rs:8; surfaced by preset(s) decode,deep,fast,nodecode,noexcl"; approved_by="keyhog-maintainers"
hash:03dea4c01ecc3d1dbab52f9efd5c4e2c2f888a6a0c9432b2ace8016693be31bc; reason="CLI password-flag documentation example in the spec; measured cli-password-flag at /media/mukund-thiru/SanthData/Santh/software/keyhog/crates/core/src/spec.rs:1109; surfaced by preset(s) deep,fast"; approved_by="keyhog-maintainers"
hash:6ff532f01420d686d69b79f6aa500656d91e2acbc9fdc3b1f2dd09b56be3aaf2; reason="CLI password-flag documentation example in the detection guide; measured cli-password-flag at /media/mukund-thiru/SanthData/Santh/software/keyhog/docs/src/detection.md:262; surfaced by preset(s) decode,deep,fast,nodecode,noexcl"; approved_by="keyhog-maintainers"
hash:17a0fc073490eff77d13c8d89df03d57c0768bfd286f2d2e4052f72894dac39f; reason="detector guide documentation example; measured entropy-token at /media/mukund-thiru/SanthData/Santh/software/keyhog/docs/src/detectors.md:387; surfaced by preset(s) decode,deep,nodecode,noexcl"; approved_by="keyhog-maintainers"
hash:34355e0e1382e75703841bd426f79d7262518ca513a87767503f5786741dd4eb; reason="pinned action commit id in action.yml; measured entropy-token at /media/mukund-thiru/SanthData/Santh/software/keyhog/action.yml:264; surfaced by preset(s) deep"; approved_by="keyhog-maintainers"
hash:6f51d59249d3572763961fb02371c80e2ab8dce0caa1877393e25c2b3f07e0e9; reason="generated source-contract test template value; measured generic-keyword-secret at /media/mukund-thiru/SanthData/Santh/software/keyhog/scripts/generate_source_contract_tests.py:114; surfaced by preset(s) decode,deep,fast,nodecode,noexcl"; approved_by="keyhog-maintainers"
hash:a47a2ee957d9f3aa349ceb0ceb4ecf5d221023181176beef222e0a58fe16c17b; reason="generated source-contract test template value; measured postgresql-connection-string at /media/mukund-thiru/SanthData/Santh/software/keyhog/scripts/generate_source_contract_tests.py:104; surfaced by preset(s) decode,deep,fast,nodecode,noexcl"; approved_by="keyhog-maintainers"
hash:48d076f42d07588a5d2db7cf2542b8e310a8027bcd590decdcc1bf4bf924cbba; reason="bounded decompiler-output fixture generates indexed synthetic AWS access-key shapes; measured aws-access-key at crates/sources/src/binary/analyzers/tests.rs:295 by the portable Action build"; approved_by="keyhog-maintainers"
hash:d7d12ecfbe43df4deab9673e592a317d66e16f7bc337d8003da5da5a08decd71; reason="canonical performance workload canary used to generate deterministic secret-scanning inputs; measured github-classic-pat at benchmarks/bench/workload_fixtures.py:19 by the portable Action build"; approved_by="keyhog-maintainers"

hash:c51a2994c021a49f77b06842b74fd2ed8daa15d312eb93e99049552be6b8b6e0; reason="measured entropy-api-key at docs/src/guides/authoring-detectors.md:222; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:ee6a6a13bdbb26b6abb597b4264c22db93ad166a6b80196a8592596e50bf3b96; reason="measured entropy-api-key at docs/src/guides/authoring-detectors.md:50; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:3dadd105baf8cf41097f50bf39aa464f52eafe23940c3368e85053c5ff49b246; reason="measured entropy-token at docs/src/guides/triage-feedback.md:81; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:bd952ccd2d22f82ace35c4f149144d14834e00c71572a462ea8db3cf99da7aed; reason="measured entropy-token at docs/src/workflows/github-action.md:266; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:c5123af85e3a7d4b6b28fe69fc3936ce4d72cba1d0c33c101f45bccb875917f8; reason="measured entropy-token at docs/src/guides/triage-feedback.md:83; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:024f2c7cb0a2a85c66624d342ee6575a91e1454c892207fa1d232e49a546daf6; reason="measured entropy-token at .github/PULL_REQUEST_TEMPLATE/integration.md:103; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:05ef1b47ccd2faaf0f7ceaec0e18f6ab5b09c86f713637ed060da0adc8abb2c0; reason="measured entropy-token at benchmarks/README.md:270; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:0b1dc4b085965f63891b7d7aaab2a2b980c9988b618a9d0f53a5c231491819d8; reason="measured entropy-token at docs/src/reference/env.md:115; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:0cc150264cd5752cada0e46915df4907067c3753984debdbc95fe04c715ac5ae; reason="measured entropy-token at docs/src/reference/env.md:114; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:12a7fa1c357b3255a079288c164fedd8cf62bb557a08addd0fc47c7b281d261e; reason="measured entropy-token at rules/multiline_secret_prefixes.toml:1; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:167462495835c186586ef7cff0803a90715b752d7dce988ab1fe3a2d520b2f67; reason="measured entropy-token at docs/src/install.md:40; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:1bb87e07be9e52fc0dca53a1c0718fac23e8b4202b9c346e12f075762507a544; reason="measured entropy-token at README.md:672; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:1ee73df0604cc074328674cd48d8866f7ec0bc614c54eb6942b071b3740d61ae; reason="measured entropy-token at docs/src/reference/configuration.md:571; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:3bf49ad54091b14000061646cdee3d4fdcc26f1dad68afab55be10f8bfdda50c; reason="measured entropy-token at docs/src/reference/cli.md:751; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:3e2b79991edc31327485b9a79dbc4fd4c232d6f5eeccda1909761898b3a4f998; reason="measured entropy-token at docs/src/verification.md:40; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:4167c1203bda07a1027b48912beeb86c2578129a472e8269987280479a05c5bb; reason="measured entropy-token at benchmarks/reports/readme-matrix.json:46; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:450638104c2cccb481807e49464c63732394bda593a30472ce5f105dad3e490e; reason="measured entropy-token at docs/src/reference/coverage-truth.md:136; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:45f3185fb6bffac2d4320ebe5cbf9296b111310415a036d0cbc1af7380c82834; reason="measured entropy-token at benchmarks/README.md:114; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:46d077eca2c15779ec3d4ac85096ee5ae54d374dbea94931b189237b77c272b9; reason="measured entropy-token at action.yml:248; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:4eb5b8139f7e512255a58c785cc22fdf69bf6f59712995ce61841db72d2d4fa1; reason="measured entropy-token at benchmarks/profile-gates/budgets.toml:29; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:58eab2ace54aa00bdbfb9150082a31b9277700303ee17b25ba4fb08de1b5c908; reason="measured entropy-token at benchmarks/bench/workload_fixtures.py:368; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:5c31201fc382b51dbae0f100f58c50f674dbad4ca3a9bbf9bfe5bb8fcbbff774; reason="measured entropy-token at benchmarks/reports/readme-matrix.json:46; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:60f0de21dac3d93c07d551d7fe7cef28bf5ea7471a156023f631c8c5df4bff59; reason="measured entropy-token at install.ps1:786; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:6548958bb8cb9a36f8f0ae6adb6cc4a9db570a5ead35c6bf7c308de02328e968; reason="measured entropy-token at README.md:166; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:65e462e21a9f158f6cf7460ffe1214dd20c51d2c03f6bd3b18bcc6cd33a9fc58; reason="measured entropy-token at docs/src/reference/env.md:62; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:66accf9a3415d85a3d89a3ce6880b22b609e53d17397197399614535f60bf82a; reason="measured entropy-token at action.yml:630; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:6a9f0ee836dac46b10955285ac2a29252f8398d812c9ff88c46a53c097775a12; reason="measured entropy-token at docs/src/verification.md:48; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:6b2847f36c25c1e9a06f81c8b2b41f7dba82fe529d30178d84775d89eef6f199; reason="measured entropy-token at docs/src/reference/configuration.md:78; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:73b7cdadbb37ccdf48413b07cdb41c7aaafe36657f2c0b839a24d1b941445c3f; reason="measured entropy-token at docs/src/install.md:50; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:740ca0a094f9643e1b41eb744a78bb884c1d9e0fc7ceec460bb8de4be8240b54; reason="measured entropy-token at benchmarks/access/REQUEST_TEMPLATE.md:22; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:7e09794f0bd14b84132670a508cea591de01e413ff000be3d49491d8df3eb5b4; reason="measured entropy-token at docs/src/detectors.md:154; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:7ed9dc377c003e3c63d343ce049df896e8165fe187321ad84f8696db1ca077b7; reason="measured entropy-token at action.yml:248; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:892b95376741aa683634a0a79391a340b7dbb7ed9b5ee29ea14eea560afbe6b6; reason="measured entropy-token at docs/src/reference/env.md:64; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:8c11a840a82591fb03206d6337d32592fd9ab44e6a8b0e6dea587055f9039c5a; reason="measured entropy-token at benchmarks/README.md:408; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:90aa47981927e98241a86b53c9815f2401000b718a1a6248ebe563a98a0bfdd8; reason="measured entropy-token at install.ps1:223; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:94008978aaf4c00c8f322693875c3f5316052c754dbfdfc3df8d0939efb3fd77; reason="measured entropy-token at install.ps1:9; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:982a0c036fee52edeab7800086509cf07887fb6be82d44ad129ed31642a3144b; reason="measured entropy-token at benchmarks/reports/cross-device.md:10; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:9b4f3a2f3224aaede9c59c2e4934e0c9c309669bb3939b5e18597ca89abb8c5e; reason="measured entropy-token at docs/src/reference/configuration.md:94; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:a225bd6a1bdd7431232d3d57985d78d76a722b433be514581ef2c0d7b16f982f; reason="measured entropy-token at docs/src/reference/cli.md:752; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:a9a24397096f5a8f4764868a6eba9f064e45f781b4d65b6da8f0a8605c0f0986; reason="measured entropy-token at docs/src/detectors.md:290; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:b7885556a8181fa9104cb43765140036d8595044951b51fe897a337e8873e12c; reason="measured entropy-token at docs/src/guides/system-wide-triage.md:44; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:c10ab0861eb37cea9471ac668b60d99de01939575cbb42bac566134c5bd24880; reason="measured entropy-token at benchmarks/profile-gates/budgets.toml:30; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:c3fe249fe73091a17d6638fe1341e7bd0bcc3466ce52323c0688e83e2463a4ab; reason="measured entropy-token at .github/PULL_REQUEST_TEMPLATE/integration.md:100; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:d23d83f01309521451793183ceb0cb9e0708f3682d915b8d26cb16e0a97021b0; reason="measured entropy-token at docs/src/reference/exit-codes.md:259; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:d27bf8167f309f0bb9d0944922c1598979266294da81face05db49f21285a262; reason="measured entropy-token at docs/src/reference/coverage-truth.md:345; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:d3429a210c8f7a6326a64e0875f5f2bd35fc9f1b69f6b265b1ab87867b34ca3e; reason="measured entropy-token at install.ps1:8; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:d3a792a781ce9aa8ca38cd829e48586c6d2bdaa39a967f6ac76fe94c1f6f02e8; reason="measured entropy-token at action.yml:602; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:d410dab548a20520b727195abb67bd72ffdb4432112fde70ec4fad76cd1802fd; reason="measured entropy-token at benchmarks/README.md:596; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:d4324ee360d315e60a6e2d00d7d5f761c0b329b6610dc73dccc23d1a99f762d1; reason="measured entropy-token at docs/src/introduction.md:23; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:e32ced7e6e5359aa801cc7e9091ec2461f1058ff2dece204a0bf441910bb4a30; reason="measured entropy-token at docs/src/detectors.md:155; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:e81a72ba519095485bbd127c535c269db01fcfa0e586616c1a48e0cd7e607219; reason="measured entropy-token at docs/src/first-scan.md:55; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:f451c1d0051429e67ace0fafa0eb7d7f7ba2223a2da26129ed05f240c57e2a93; reason="measured entropy-token at docs/src/detectors.md:152; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:880597576640d4b220fbb50c2e9f2744d695675c4bec84582b85a1b18455edec; reason="measured generic-password at docs/src/reference/cli.md:130; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"

hash:007c5d069b32e72e1ce3e193031057b67f50b527a85d342d03d0255cf9e3ee5d; reason="measured entropy-token at docs/src/install.md:41; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:0a5663327c14aa334982f7645b1fb4583188bd8285007805e110323774890646; reason="measured entropy-token at docs/src/install.md:43; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:1f87d48a8b32605429742a4112a699e41375b497e144567869481e35c68add62; reason="measured entropy-token at docs/src/install.md:42; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:b413c75a9a8537de4da3cfdc6463ed9cfedfa8164a28e990d58f7ac0f862799e; reason="measured entropy-token at action.yml:278; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:ba33701f26ae9a0757aae5ec889ffda063ab1fa2f228b96881f347cfa37e3497; reason="measured entropy-token at README.md:165; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:c8dd2f89f4777084ad0bef0087a1dbcfd20576cf84a164f955e623a14494fb6e; reason="measured entropy-token at action.yml:646; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:dfa4628f0d0475b7209644850dbe6a84e9aa3771d986f3daf0870051e1f775f6; reason="measured entropy-token at benchmarks/bench/workload_fixtures.py:368; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:3dadd105baf8cf41097f50bf39aa464f52eafe23940c3368e85053c5ff49b246; reason="measured entropy-token at docs/src/guides/triage-feedback.md:81; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"
hash:c5123af85e3a7d4b6b28fe69fc3936ce4d72cba1d0c33c101f45bccb875917f8; reason="measured entropy-token at docs/src/guides/triage-feedback.md:83; reviewed documentation or fixture example"; approved_by="keyhog-maintainers"

# --- Retained but unproven on this build --------------------------------------
# These suppressed nothing under the seven presets measured on the release-fast
# build. Each is attributed to a build profile or source class this lane cannot
# reproduce (portable/ci feature sets, full-feature match extents, git-history
# reassembly). tests/dogfood/suppression_audit.py lists them in the coverage
# manifest on every run, so removing one is a reviewable one-line change once
# the owning lane confirms it no longer fires.
hash:cd4ec61c827fc8c3a353af7120ac63c5bef265098aee80c1ff7343351261d723; reason="portable profile: compiled entropy-shape schema identifier"; approved_by="keyhog-maintainers"
hash:344dc4f586722e2e1323ac25126560a99ceeab70bcd1ccaafe71ff6bf021214e; reason="portable profile: compiled entropy-shape fixture"; approved_by="keyhog-maintainers"
hash:018acf26a85dc73866457d9a300f869e12bedde7f914da83e968f373ea51edd6; reason="portable profile: compiled entropy-shape fixture"; approved_by="keyhog-maintainers"
hash:01cd02801a282dba08936c1e82be733ed3162be91ffc612a9b2f3f4dc71738d5; reason="portable profile: compiled entropy-shape fixture"; approved_by="keyhog-maintainers"
hash:0c7452eae2c395928b523b6210e5ea990d2ee6bd669000d625a136e66421e794; reason="portable profile: compiled entropy-shape fixture"; approved_by="keyhog-maintainers"
hash:12ce53f6ad499aa544f564af18b4ca5a89dc2c344b469c8a13e5b0391492f6cf; reason="portable profile: compiled entropy-shape fixture"; approved_by="keyhog-maintainers"
hash:69a41ab0cf091f8e235971a5ca2c9a87903b6ea5140e46e1e93b39cd0774b7b3; reason="portable profile: compiled entropy-shape fixture"; approved_by="keyhog-maintainers"
hash:a9cc88ae40c24836445557c37b68a3e2315f87c987cdea775340f2c4b7e2a125; reason="portable profile: compiled entropy-shape fixture"; approved_by="keyhog-maintainers"
hash:bb14a019aa4c82e5bea68cbc8b9e5fb883a3e2c0d3efe2c325a8fece571dd689; reason="portable profile: compiled entropy-shape fixture"; approved_by="keyhog-maintainers"
hash:fc08c0cb4a82a61de3377cb7cb0cfe57659a1ead7383b9a1e02eae6dcf7ce3dc; reason="portable profile: compiled entropy-shape fixture"; approved_by="keyhog-maintainers"
hash:d9c9e7d9e365ee56490fc4c5e8fe8bc644d4dad08fe4f06c297a0870ad679cd4; reason="portable profile: compiled entropy-shape fixture"; approved_by="keyhog-maintainers"
hash:2740fd3a1b7915193d321b03feaf37b30e1c17047c24a4792f01a2302993d407; reason="full-feature release profile: alternate generic match extent of a reviewed fixture"; approved_by="keyhog-maintainers"
hash:3f8ec5354f76a97577c5d9df9c7416531ce180af7398c73835a032e9b45f3a35; reason="full-feature release profile: alternate generic match extent of a reviewed fixture"; approved_by="keyhog-maintainers"
hash:66c3ea8e09ca94ad6b2ca29a345abdb1ab2a1e8169fd503dc3d4ccc240510c56; reason="full-feature release profile: alternate generic match extent of a reviewed fixture"; approved_by="keyhog-maintainers"
hash:d6b553681259ec813fafc35b4a3536a6672d84cd1bec7688596f1f5b4c3b3570; reason="full-feature release profile: alternate generic match extent of a reviewed fixture"; approved_by="keyhog-maintainers"
hash:3f0911f20f6b9854e34b43ad05470a9075d1c6a99b65ab82f03cce4201ee9f4a; reason="all-X synthetic AWS placeholder driving the degenerate-repeat suppression tests; defense in depth across supported builds"; approved_by="keyhog-maintainers"
hash:57028a916a4ba4e7abfc8318ff8774852c5f4264ece9cfab01b97004ab56e3ae; reason="synthetic AWS split-credential reassembly fixture; the derived multiline value differs from the inline-ignored source value"; approved_by="keyhog-maintainers"
hash:3301c53957d9fa995b5ac610c71ba113ec0f41615a0e215c1b119181c34d6b7d; reason="engine WARM_SAMPLE synthetic concat that warms lazy-regex DFA caches; contains secret shapes by construction"; approved_by="keyhog-maintainers"
hash:26e4e47b31d8cefa746fc6bb298ad3f846e293c9c10243418d28b747155e1207; reason="AWS shape reassembled from a git-history decode-through buffer attributed to crates/verifier/src/verify/aws.rs; no such value exists in that file"; approved_by="keyhog-maintainers"

# --- Historical blobs surfaced by the git-history lane -------------------------
# tests/dogfood/history_scan.sh scans the last N commits, so these values live in
# blobs that are no longer in the working tree. Each is a documentation example,
# a test fixture, or an engine warm sample from an older revision of a file that
# still carries the same reviewed material today. None was ever a live credential.
hash:208809266b21eea32c2aa498ae43d863cc37f284e93328fd15329c718b0e28bc; reason="historical blob only; measured entropy-token at docs/src/reference/env.md:96 in commit 5b6fe65bddab"; approved_by="keyhog-maintainers"
hash:33e6235fbc9cb6f13013eda71c49a40130069a94dd8dc1b66cf190903193af9b; reason="historical blob only; measured generic-keyword-secret at crates/cli/src/daemon/protocol.rs:458 in commit 181b29a4125c"; approved_by="keyhog-maintainers"
hash:4794fa06d0a17b24225af749dadcd3b75c0950f258ec8fdae9da89a69bf6f783; reason="historical blob only; measured generic-secret at crates/scanner/src/gpu/backend/execution.rs:547 in commit ad76d87d9612"; approved_by="keyhog-maintainers"
hash:6c2a2d4e9552a9fea567cda5c78e7e437b72e58f5ea0d71460f0eb017f3f9e75; reason="historical blob only; measured cli-password-flag at crates/cli/src/orchestrator/dispatch/backend/tests.rs:186 in commit 181b29a4125c"; approved_by="keyhog-maintainers"
hash:71178fb38256667000368feb9847ea74f35140026f6c1dc788f2a77f15de1089; reason="historical blob only; measured aws-access-key at scripts/prerelease.sh:392 in commit 7d1ead15a9e2"; approved_by="keyhog-maintainers"
hash:713a9648f0089c753a8253a4078d72d5bd271a3ccfccada9098ad13f6fe4820f; reason="historical blob only; measured generic-keyword-secret at crates/core/src/report/gitlab_sast.rs:175 in commit 181b29a4125c"; approved_by="keyhog-maintainers"
hash:94b9b7f8b35f61bbec1125726f7a794010497975d7f69ce6d0dcb43b7a5913db; reason="historical blob only; measured github-classic-pat at docs/src/first-scan.md:24 in commit 181b29a4125c"; approved_by="keyhog-maintainers"
hash:ae83b1e9e6269ca7248db0b20d99a9bea90f2b78b47bb6b8013e2a386869da3c; reason="historical blob only; measured generic-secret at crates/scanner/src/ml_scorer/service_vocab.rs:7 in commit 181b29a4125c"; approved_by="keyhog-maintainers"
hash:cffe607065e2f7a6599bd2e36471e4196fa8e4c0335a081ee2ae798f08c27a2a; reason="historical blob only; measured entropy-token at docs/src/reference/env.md:95 in commit 5b6fe65bddab"; approved_by="keyhog-maintainers"
hash:e4b78f83e32d6ea27cfde4144bf090c52c6191af4662e75b2fb5f99fd2fe7435; reason="historical blob only; measured slack-bot-token at crates/scanner/src/gpu/backend/execution.rs:537 in commit 181b29a4125c"; approved_by="keyhog-maintainers"
