bxcore, gatewayd, loopd: the secret store moves to bxcore::secrets

Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>

docs/dependencies.md

@@ -11,7 +11,7 @@ Every external crate has a row here. `scripts/check-dep-docs.sh` enforces it.
 | `emsha` | 1.0.4 | `bxcore` | SHA-256. Written by the owner; no dependencies, no `unsafe`. Checked against `sha256sum` on 3,204 inputs. |
 | `rustls` | 0.23.45 | `gatewayd` | TLS to Mattermost over the tailnet (M4a, owner's decision). `default-features = false` with `ring`, `std`, `tls12`. With its dependencies on Linux: `ring` (Apache-2.0 AND ISC; builds C and assembly), `rustls-webpki` and `untrusted` (ISC), `rustls-pki-types`, `subtle` (BSD-3-Clause), `zeroize`, `once_cell`, `getrandom`, `libc`, `cfg-if`. Apache-2.0 OR ISC OR MIT. |
 | `rustls-native-certs` | 0.8.4 | `gatewayd` | The host's trusted certificates, so a CA installed on the host is trusted too; adds `openssl-probe`. Apache-2.0 OR ISC OR MIT. |
-| `zeroize` | 1.9.0 | `gatewayd` | Wipes a secret's memory when it is dropped (`Secret`). Already a dependency of `rustls`. Apache-2.0 OR MIT. |
+| `zeroize` | 1.9.0 | `bxcore`, feature `secrets` (enabled by `gatewayd`; never by `loopd`) | Wipes a secret's memory when it is dropped (`Secret`). Already a dependency of `rustls`. Apache-2.0 OR MIT. |
 | `rusqlite` | 0.40.2 | `memoryd` from M5a | The full-text index (`index/memory.sqlite3`, FTS5), disposable and rebuilt from files. Feature `bundled`: `libsqlite3-sys` compiles SQLite from source with FTS5 on, so no system SQLite is needed. With its dependencies: `libsqlite3-sys` (MIT; build: `cc`, `pkg-config`, `vcpkg`), `hashlink`, `hashbrown`, `foldhash` (Zlib, added to `deny.toml` for it), `fallible-iterator`, `fallible-streaming-iterator`, `smallvec`, `bitflags`. MIT. |
 
 ## Ported code

docs/implementer-log.md

@@ -6,6 +6,7 @@ reviewer adds findings under "Reviews" once per milestone.
 
 | Task | Date | Status | Gate runs | First gate | Deviations | Notes | Model |
 |---|---|---|---|---|---|---|---|
+| M5b/02-secrets-move | 2026-09-26 | done | 1 | pass | none | Copied the given files from `docs/plans/M5b/files/`: `bxcore/src/secrets.rs`, `bxcore/tests/{secrets,secrets_race}.rs`, `bxcore/tests/support/tmp.rs`, `loopd/tests/no_secrets.rs`, and new versions of `gatewayd/tests/{config,mm_edit,mm_rest}.rs` and `support/gateway.rs` (only an import changes in each). `bxcore/Cargo.toml`: `zeroize` becomes optional, `[features] secrets = ["dep:zeroize"]`, and two `[[test]]` entries with `required-features = ["secrets"]` so the two files run only when the feature is on; `bxcore/src/lib.rs` doc comment renamed, and `#[cfg(feature = "secrets")] pub mod secrets;` inserted between `memory` and `sha1`. `gatewayd/Cargo.toml`: `bxcore` gains `features = ["secrets"]` and its own `zeroize` dependency is dropped; `gatewayd/src/lib.rs` loses `pub mod secrets`. `gatewayd/src/config.rs` imports `SecretSpec`/`SecretSource` from `bxcore` and drops the two types plus `impl SecretSpec::source` (still called through the import via `problem` and `token_source`). `gatewayd/src/main.rs` imports `bxcore::secrets`, passes `"gatewayd"` as `role` to `load`, and uses the `let env = |k: &str| std::env::var_os(k);` closure; `gatewayd/src/mm/rest.rs` and `serve/mod.rs` import `Secret` from `bxcore`. `git rm`'d `gatewayd/src/secrets.rs` and its two secret tests. `docs/dependencies.md` lists `zeroize` under `bxcore`, feature `secrets` (enabled by gatewayd, never by loopd). Step 2 showed exactly the named E0432 failures and the two named `no_secrets` failures; after the edits `cargo test -p bxcore --features secrets` (11 in `secrets`, 5 in `secrets_race`), `cargo test -p bxcore` skips them, all four `no_secrets` pass, and `cargo test -p gatewayd` passes including `main`. Step 7 greps/trees as expected (no `zeroize`/`crate::secrets`/`gatewayd::secrets` in gatewayd, `loopd` does not enable the feature, `gatewayd` does, `loopd` builds alone, only `no_secrets.rs` untracked, nothing changed in the other crates). `cargo fmt --all`; `make gate` printed `gate: ok` with 963 tests (956 before; the 13 gatewayd secret tests moved into bxcore, plus 3 new in `bxcore/tests/secrets.rs` and 4 new in `loopd/tests/no_secrets.rs`, +7 net). `zeroize` moved from gatewayd to bxcore, so `Cargo.lock` changed. | ornith-1.5-35b-a3b |
 | M5b/01-invalid-arguments-detail | 2026-09-26 | done | 1 | pass | none | Copied the 13 given files from `docs/plans/M5b/files/` (two new: `bxcore/tests/fixtures/wire/tool_response_denied_detail.json` and `brokerd/tests/invalid_detail.rs`; new versions of `bxcore/tests/wire.rs` and `strict.rs`; new versions of `brokerd/tests/{admin,broker,broker_pending,courier,ledger,serve}.rs` where `broker.rs`/`serve.rs` are the `-task01` files; new versions of `loopd/tests/{broker_port,tools,turn_broker}.rs`); step 2 showed exactly the named failures (`strict::envelopes_reject_unknown_keys_at_every_depth` on the new fixture, two `E0559` in `wire`, and ten non-compiling brokerd/loopd test targets with the named error kinds). Made all the edits exactly as the task gives: `bxcore/src/wire.rs` `ToolResponse::Denied` gains `detail: Option<String>` with the skip/serde attributes; `brokerd/src/args.rs` adds `MAX_DETAIL=300` and `ArgsError::detail` (control chars and U+2028/U+2029 -> space, cut to 300 chars); `brokerd/src/policy/mod.rs` `Denial` gains `detail`, `Denial::new` sets `None`, `decide` sets it for `InvalidArguments` only, the two `DeniedByGrant` arms set `None`; `brokerd/src/ledger/mod.rs` `Decided::Denied` now holds a `Denial` (every arm rebuilt through `Denial::new` except the `RecordPayload::Denial` arm which passes the `Denial` through); `brokerd/src/broker.rs` `handle` sends the denial's detail, the two `pending` arms send `None`; `loopd/src/tools.rs` adds `denial_message(reason, detail)` before `FakeTools` and `FakeTools::call` sends `detail: None`; `loopd/src/turn.rs` imports `denial_message` and reads `detail` into it, the `TurnEvent::ToolDenied` event keeping only the reason. Did not touch `gatewayd`, `bxctl` or `bxcore/src/audit.rs`. `cargo fmt --all`; `cargo test -p bxcore -p brokerd -p loopd` every suite passes (including the eight `invalid_detail` tests); step 6 `grep -rn "Decided::Denied(DenyReason"` prints nothing and `git diff --stat -- crates/gatewayd crates/bxctl crates/bxcore/src/audit.rs` prints nothing; `cargo test --workspace` reports 955 passed and the gate's separate loopd `end_to_end` ignored test adds 1, for 956 total. No new dependency, so `Cargo.lock` is unchanged. | ornith-1.5-35b-a3b |
 | M5a/22-plain-note-answers | 2026-09-25 | done | 1 | pass | none | The edits are all in `crates/memoryd/src/edit.rs` and match the task exactly. Replaced the `SAVED_AS_NOTE` const with a `saved_as_note(file)` fn ("not added to {file.name()}: this session has read untrusted content, so it was saved in notes.md as an untrusted note") plus the `NOTED` const "saved in notes.md" and `NOTED_UNTRUSTED` const "saved in notes.md, marked untrusted: this session has read untrusted content"; the `format!` string stays one line past 100 chars and `cargo fmt` left it so. Updated the comment in `apply` ("replaced by saved_as_note(file)") and the `answer:` line (`saved_as_note(file)`). In `noted` replaced the two string literals with `NOTED_UNTRUSTED`/`NOTED`. Copied the new `crates/memoryd/tests/edit.rs` and `serve.rs` from `docs/plans/M5a/files/` (not the `-task06`/`-task10` versions). Step 2 showed exactly the four named tests failing (`a_note_is_labelled_by_the_session` and `an_untrusted_session_can_take_notes_but_not_change_identity` in edit, `an_untrusted_session_writes_notes_not_identity` and `review_holds_identity_writes_but_not_notes` in serve); after the edits the step-2 command and `cargo test -p memoryd` every suite pass; `make gate` printed `gate: ok` with 944 tests, unchanged; `grep -rn SAVED_AS_NOTE crates/` prints nothing. No new dependency, so `Cargo.lock` is unchanged. | Ornith-1.5-35B-A3B |
 | M5a/21-session-follows-result | 2026-09-25 | done (by the design model) | many | fail | The session added and then deleted diagnostic test files (`crates/bxctl/tests/zz_diag.rs`, `zz_diag2.rs`) and ran about 80 minutes of experiments instead of stopping when a test outside the task failed, as the task says. | The session's edits match the task file exactly and the copied `ledger_label.rs` is identical to the plan's; step 2 showed the two named tests failing, and after the edits `ledger_label`, `cargo test -p brokerd` and `-p bxctl` passed. The gate then failed in `bxctl`'s `args_os` with `NotFound`. The cause was the design model's: its reference worktree for tasks 21 and 22 shared this `target/` through a symlink, so test binaries built there had the worktree's absolute paths compiled in (`CARGO_BIN_EXE_*`, `CARGO_MANIFEST_DIR`), and Cargo, whose freshness check does not include the workspace's absolute path, kept them after the worktree was deleted. After `cargo clean`, `make gate` printed `gate: ok`, 944 tests. The owner stopped the run. | Ornith-1.5-35B-A3B (the session); design model (the commit) |