Emi Griffith 7ed375f32e key-gaps: the key regex was blind to digits, inventing missing secrets ... `grep -oE "^[A-Z_]+="` cannot match a key name containing a digit. This estate has exactly six such names — all the *_S3_* keys — so a prod audit returned 26 keys against 32 real ones, and reported the S3 and lake credentials as missing from both live hosts. They were present the whole time. The phantom was independently reproduced twice by re-running the same pattern, which is what made it convincing, and it was briefly recorded as one of two root causes of the lake being unqueryable (#56). That issue has one cause: the missing duckdb-lake image. An audit that under-reports is worse than no audit. A missing-secret finding sends someone to provision a credential that already exists, and in a rotation tool it would justify writing over one. Fixed to `^[A-Z][A-Z0-9_]*=` in both the skill and key_gaps.py's docstring. The match still stops at the `=`, so no value is read — that property is the reason this grep exists rather than a parser. Centralis's secrets_gaps carried the same bug and is fixed separately, with a regression test. Claude-Session: https://claude.ai/code/session_0182KTMrsTHJc3TcewCatJFY		2026-07-24 15:57:15 -07:00
..
city-resolver@1b862aa049	key-gaps: the key regex was blind to digits, inventing missing secrets	2026-07-24 15:57:15 -07:00
thermograph-mentions@ce4350c64e	key-gaps: the key regex was blind to digits, inventing missing secrets	2026-07-24 15:57:15 -07:00