Security submodule
if.security.secrets.detect
Preview detector module for receipt-backed secrets scanning, redacted findings, and security-signal handoff into coordination and governance lanes.
Status (black/white): preview. Artifacts are published for review; CI-wide always-on enforcement is not claimed.
--redactdefault for retained publish-safe artifacts.--warnfor detection-only gates without blocking flows.--noneonly in controlled benchmark contexts.
if-cli secrets detect --input /path/to/artifacts --out-dir /tmp/scan --warnCross-Module Integration Flow
Detect is one stage in a larger security chain, not a standalone silver bullet.
| Step | Stage | Module | What happens |
|---|---|---|---|
| 1 | Detect | if.security.secrets.detect | scan artifacts for secret-like material with redaction-first outputs |
| 2 | Signal | if.bus | emit public-safe security_signal envelope for downstream review |
| 3 | Coordinate | if.blackboard | track finding, remediation, and ownership as append-only task/signal lineage |
| 4 | Escalate | if.gov | route ambiguous or high-impact findings to triage/council checkpoints |
| 5 | Anchor | if.trace | bind published artifacts to receipt lineage for independent integrity checks |
Claim Boundary
Preview artifacts are real; over-claims are blocked.
Does
Publishes preview benchmarks and usage artifacts
Does not
Claim CI-wide always-on deployment
Does
Supports redaction-first and warn-mode scan outputs
Does not
Claim complete prevention of secret leakage
Does
Integrates into coordination + governance review lanes
Does not
Replace human policy interpretation on ambiguous findings
Does
Can be receipt-bound for integrity verification
Does not
Certify semantic correctness or legal sufficiency