@getbourdon/conformance 0.8.0 → 0.9.0

package/fixtures/leak_cases.json

@@ -20,7 +20,7 @@
         "known_entities": [
           {
             "name": "API",
-            "summary": "the service_role key for supabase",
+            "summary": "service_role = hunter2hunter2 for supabase",
             "visibility": "team"
           }
         ]
@@ -40,7 +40,7 @@
             "date": "2026-06-20",
             "files_touched": [
               "src/app.ts",
-              "config/.env"
+              "config/.env:PASSWORD=supersecretvalue"
             ]
           }
         ]
@@ -58,7 +58,7 @@
         "agent": {
           "id": "x",
           "type": "code-assistant",
-          "role_narrative": "rotate the api_key before every deploy"
+          "role_narrative": "rotate the api_key=hunter2hunter2 before every deploy"
         }
       },
       "expected_findings": [
@@ -73,7 +73,7 @@
       "manifest": {
         "capabilities": [
           "state_db",
-          "the bearer token is read from .env"
+          "the bearer token is QXp9-not-a-real-key"
         ]
       },
       "expected_findings": [

package/fixtures/manifest.json

@@ -1,18 +1,18 @@
 {
   "_doc": "Index of cross-impl parity fixtures. conformance_version bumps on any fixture change (patch=added cases, minor=new family, major=changed expected-output = a reviewed behavior change). Python is the oracle; this file is generated by tools/gen_conformance.py.",
-  "conformance_version": "5.1.0",
+  "conformance_version": "6.0.0",
   "produced_against": {
-    "bourdon_version": "0.24.0"
+    "bourdon_version": "0.25.0"
   },
   "fixtures": [
     {
       "path": "redaction_battery.json",
-      "sha256": "dc648b86445165a11f5fd25b7f8c7b7144d3abcaf6bf602ae5eceb60ffe856a2",
+      "sha256": "31f7a1903ec70659f23b3062040776adad54dadaee763c296018100cd439178e",
       "producer": "tools/gen_conformance.py::redaction_battery"
     },
     {
       "path": "leak_cases.json",
-      "sha256": "c1a221aa35b2d6a82845ce76fa3885f0187b24a67c37711d9f6f4f6c8cfedc03",
+      "sha256": "78580fd6e81243538af0e202ac2b84b7b4421353836119a1b8f6f516a90d134c",
       "producer": "tools/gen_conformance.py::leak_cases"
     },
     {
@@ -102,7 +102,7 @@
     },
     {
       "path": "merge_vectors.json",
-      "sha256": "9a1d105d6c2b0bc00e419b318ae4d802457241cca0cbbe87f1a87c529a11e923",
+      "sha256": "74322ae0460fb38331ee47e252d10f64e7c2c31254ae814381b852ab2510b110",
       "producer": "tools/gen_conformance.py::merge_vectors"
     },
     {
@@ -447,7 +447,7 @@
     },
     {
       "path": "native_stores/hermes/store/.hermes/memories/memory.md",
-      "sha256": "45c32c828e96353b409204eeeda1df7b89f75699ec46bffff32df6d3c9781804",
+      "sha256": "6a0726d27419af63b5713a3314dbaab64ef2fa5b9d310d2e2d3332f07516833c",
       "producer": "tools/gen_conformance.py::native_stores"
     },
     {
@@ -492,7 +492,7 @@
     },
     {
       "path": "native_stores/claude_code/store/knowledge_graph/memory.jsonl",
-      "sha256": "544f1d0a609272614bd351003859eec31b8beb7874324bb0b8148fac5149f885",
+      "sha256": "624f5d9ccd73456695fc7a91a5811c358b292f52cc1ea2e3ceff7674c338e3e3",
       "producer": "tools/gen_conformance.py::native_stores"
     },
     {
@@ -502,7 +502,7 @@
     },
     {
       "path": "native_stores/github_copilot/cache/github-copilot/payload.json",
-      "sha256": "2e9a1f6d19927417bd78bbdfa4260d11ea4b258f5e2a471549de460c433d3aaa",
+      "sha256": "5b922bb2d150ee05c92d92c867274e2a8569d5f2810e5c806cffb4cd0765e7f7",
       "producer": "tools/gen_conformance.py::native_stores"
     },
     {

package/fixtures/merge_vectors.json

@@ -165,7 +165,7 @@
         {
           "date": "2026-08-01",
           "cwd": "/w",
-          "project_focus": "OXbeat"
+          "project_focus": "Pennant"
         }
       ],
       "expected": {
@@ -175,7 +175,7 @@
             "cwd": "/w",
             "project_focus": [
               "Bourdon",
-              "OXbeat"
+              "Pennant"
             ]
           }
         ],

package/fixtures/native_stores/claude_code/store/knowledge_graph/memory.jsonl

@@ -1,3 +1,3 @@
 {"type":"entity","name":"Zephyr","entityType":"project","observations":["File conversion app."]}
-{"type":"entity","name":"SecretCreds","entityType":"concept","observations":["the service_role key for supabase"]}
+{"type":"entity","name":"SecretCreds","entityType":"concept","observations":["service_role=hunter2hunter2 for supabase"]}
 {"type":"relation","from":"Zephyr","to":"Bourdon","relationType":"uses"}

package/fixtures/native_stores/github_copilot/cache/github-copilot/payload.json

@@ -11,7 +11,7 @@
         "repository_url": "https://api.github.com/repos/ryan/bourdon"
       },
       {
-        "title": "Rotate the service_role key in CI",
+        "title": "Rotate service_role=hunter2hunter2 in CI",
         "number": 9,
         "updated_at": "2026-06-18T10:00:00Z",
         "repository_url": "https://api.github.com/repos/ryan/bourdon"

package/fixtures/native_stores/hermes/store/.hermes/memories/memory.md

@@ -1,2 +1,2 @@
 - Project uses pytest with xdist
-- The bearer token is stored in .env
+- The bearer token is hunter2.hunter2

package/fixtures/redaction_battery.json

@@ -19,28 +19,42 @@
     },
     {
       "fragments": [
-        "uses a bearer token to authenticate"
+        "password: correcthorsebatterystaple"
       ],
       "expect_redacted": "[redacted credential-like text]",
       "expect_contains_secret": true
     },
     {
       "fragments": [
-        "the service_role key for supabase"
+        "client_secret=hunter2hunter2"
       ],
       "expect_redacted": "[redacted credential-like text]",
       "expect_contains_secret": true
     },
     {
       "fragments": [
-        "stripe secret rotated today"
+        "\"password\": \"hunter2hunter2\""
       ],
       "expect_redacted": "[redacted credential-like text]",
       "expect_contains_secret": true
     },
     {
       "fragments": [
-        "the keystore password lives in .env"
+        "--password=hunter2hunter2"
+      ],
+      "expect_redacted": "[redacted credential-like text]",
+      "expect_contains_secret": true
+    },
+    {
+      "fragments": [
+        "PASSWORD=supersecretvalue"
+      ],
+      "expect_redacted": "[redacted credential-like text]",
+      "expect_contains_secret": true
+    },
+    {
+      "fragments": [
+        "SUPABASE_SERVICE_KEY=hunter2hunter2"
       ],
       "expect_redacted": "[redacted credential-like text]",
       "expect_contains_secret": true
@@ -195,6 +209,61 @@
       "text": "Bourdon recognition-first runtime layer is the core promise",
       "expect_redacted": "Bourdon recognition-first runtime layer is the core promise",
       "expect_contains_secret": false
+    },
+    {
+      "text": "uses a bearer token to authenticate",
+      "expect_redacted": "uses a bearer token to authenticate",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "the service_role key for supabase",
+      "expect_redacted": "the service_role key for supabase",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "stripe secret rotated today",
+      "expect_redacted": "stripe secret rotated today",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "the keystore password lives in .env",
+      "expect_redacted": "the keystore password lives in .env",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "Add password reset to the console",
+      "expect_redacted": "Add password reset to the console",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "Fixed the password reset email template",
+      "expect_redacted": "Fixed the password reset email template",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "Updated .env with the new port",
+      "expect_redacted": "Updated .env with the new port",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "Rotated the keystore for the Android release",
+      "expect_redacted": "Rotated the keystore for the Android release",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "Reviewed the service_role RLS policy",
+      "expect_redacted": "Reviewed the service_role RLS policy",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "Shipped api_key rotation tooling",
+      "expect_redacted": "Shipped api_key rotation tooling",
+      "expect_contains_secret": false
+    },
+    {
+      "text": "the password is rotated monthly",
+      "expect_redacted": "the password is rotated monthly",
+      "expect_contains_secret": false
     }
   ],
   "case_variants": [

package/fixtures.pin.json

@@ -1,5 +1,5 @@
 {
   "_doc": "The recorded fixture pin. CI and the package tests assert the vendored fixtures/manifest.json hashes to exactly this value, so the fixture set in any build is provably the reviewed one. Refresh via the re-pin ritual in README.md.",
-  "conformance_version": "5.1.0",
-  "manifest_sha256": "cae79332b62523f48d9f306ddb74a9271ffceccda13f43ed3eeafc713c2b81bd"
+  "conformance_version": "6.0.0",
+  "manifest_sha256": "73bd51d8a6d2a82b32b0b249a6e6c16c6491f9dc0148d020e9e020efb1eb49eb"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getbourdon/conformance",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Language-neutral cross-implementation parity fixtures for Bourdon. Python (pip install bourdon) is the oracle; the @getbourdon/* TypeScript mirror asserts against these exact bytes.",
   "license": "Apache-2.0",
   "type": "module",