openplanr 2.2641.1 → 3.0.0

package/lib/host-packages/claude/openplanr/skills/cpo-review/references/operate-advisor-contract.md

@@ -1,8 +1,8 @@
 # Shared Operate advisor contract
 
-This contract supplies the common context method and output shape for the five executive advisor
-skills. The invoking skill supplies the lens, review questions, useful sources, and decision
-standard. Follow both.
+This contract supplies the common context method and output shape for the executive advisor
+skills (CEO, CTO, CPO, CMO, and COO). The invoking skill supplies the lens, review questions,
+useful sources, and decision standard. Follow both.
 
 ## Outcome
 
@@ -21,7 +21,28 @@ not the whole context boundary. Inspect relevant original repository and Git sou
 drawing conclusions. If an input is unavailable, report the exact problem and continue when the
 remaining context still supports a useful note.
 
-Write the review only to `<output-path>`.
+Write the review only to `<output-path>`. Writes follow the host's normal permission rules; this
+skill pre-approves nothing.
+
+### Running without `planr-operate`
+
+When no `<output-path>` was supplied, this lens creates the cycle itself, in the layout
+`planr-operate` uses, under the repository root:
+
+```text
+.planr/operate/<YYYY-MM-DD>-<subject-slug>/
+  cycle.md          the request wording, the effective scope, and a one-lens roster
+  brief.md          compact orientation for this lens only, including what was searched for and not found
+  <lens>.md         this note: ceo.md, cto.md, cpo.md, cmo.md, or coo.md
+  board-report.md   an unsynthesized lens summary
+```
+
+Take the subject, window, and requested decision from the request. Use the first unused directory
+name; append `-02`, `-03`, and so on when the base name exists. In `board-report.md`, use the
+`planr-operate` report sections, mark this lens `reported` and every other lens `omitted by scope`
+under Review coverage, and write `No decision-ready proposal was established.` and
+`No proposed actions.` unless this note states a directly supported proposal. Write nothing outside
+that cycle directory. The dashboard lists a cycle only when `board-report.md` exists.
 
 ## Grounding
 

package/lib/host-packages/claude/openplanr/skills/cto-review/SKILL.md

@@ -2,7 +2,6 @@
 name: cto-review
 description: "Produce a grounded technology and delivery-risk review for an Operate cycle. Use when architecture, reliability, security, or execution risk needs a CTO lens."
 license: MIT
-allowed-tools: "Read, Grep, Glob, Edit(./.planr/operate/**)"
 ---
 
 # OpenPlanr CTO Review

package/lib/host-packages/claude/openplanr/skills/cto-review/references/operate-advisor-contract.md

@@ -1,8 +1,8 @@
 # Shared Operate advisor contract
 
-This contract supplies the common context method and output shape for the five executive advisor
-skills. The invoking skill supplies the lens, review questions, useful sources, and decision
-standard. Follow both.
+This contract supplies the common context method and output shape for the executive advisor
+skills (CEO, CTO, CPO, CMO, and COO). The invoking skill supplies the lens, review questions,
+useful sources, and decision standard. Follow both.
 
 ## Outcome
 
@@ -21,7 +21,28 @@ not the whole context boundary. Inspect relevant original repository and Git sou
 drawing conclusions. If an input is unavailable, report the exact problem and continue when the
 remaining context still supports a useful note.
 
-Write the review only to `<output-path>`.
+Write the review only to `<output-path>`. Writes follow the host's normal permission rules; this
+skill pre-approves nothing.
+
+### Running without `planr-operate`
+
+When no `<output-path>` was supplied, this lens creates the cycle itself, in the layout
+`planr-operate` uses, under the repository root:
+
+```text
+.planr/operate/<YYYY-MM-DD>-<subject-slug>/
+  cycle.md          the request wording, the effective scope, and a one-lens roster
+  brief.md          compact orientation for this lens only, including what was searched for and not found
+  <lens>.md         this note: ceo.md, cto.md, cpo.md, cmo.md, or coo.md
+  board-report.md   an unsynthesized lens summary
+```
+
+Take the subject, window, and requested decision from the request. Use the first unused directory
+name; append `-02`, `-03`, and so on when the base name exists. In `board-report.md`, use the
+`planr-operate` report sections, mark this lens `reported` and every other lens `omitted by scope`
+under Review coverage, and write `No decision-ready proposal was established.` and
+`No proposed actions.` unless this note states a directly supported proposal. Write nothing outside
+that cycle directory. The dashboard lists a cycle only when `board-report.md` exists.
 
 ## Grounding
 

package/lib/host-packages/claude/openplanr/skills/delegate/SKILL.md

@@ -16,7 +16,7 @@ Ordinary implementation remains with `planr-ship`.
 Resolve [runner.mjs](scripts/runner.mjs) from this installed skill. Call it through
 Node as `node <installed-skill>/scripts/runner.mjs <action>`, with one JSON object
 on stdin. Alternatively, include `action` in that object and omit the command-line
-action; conflicting actions are rejected. `probe` discovers Node 20+, Git, installed
+action; conflicting actions are rejected. `probe` discovers Node 22+, Git, installed
 CLIs and optional profiles; an OpenPlanr checkout or public CLI command is not
 needed. Reuse normal signed-in authentication. Preserve selection precedence:
 explicit engine/profile, saved choice, then a sole compatible native choice; ask
@@ -45,6 +45,13 @@ Capacity and duration remain unverified without matching measurements. For a lar
 local task, select only relevant sources or split the task before a new preparation;
 never silently omit, truncate or replace a required source with a summary.
 
+If `prepare` reports `E_CAPSULE_SECRET`, show its masked findings (path, line, rule,
+confidence); never edit, redact or drop a required source to pass the check. For a
+resolvable finding, ask whether that exact value is a credential. Only when the user
+confirms it is not, prepare again with `credentialResolutions` naming that finding's
+`id` and `contentDigest`. Recognizable credential formats, private keys and credential
+files are never resolvable: ask the user to remove the credential from the source.
+
 Call `prepare` with the engine/profile, context and explicit integration scope.
 Show its engine, model selection, known provider or native-managed routing,
 trusted configuration, working directory and context inventory once before

package/lib/host-packages/claude/openplanr/skills/delegate/references/capsule-contract.md

@@ -1,6 +1,6 @@
 # Delegation context capsule v1
 
-`context.mjs` is an internal, Node 20+ package resource. It gathers **work context** only. It does not select a profile, grant a writable path, launch an agent, or authorize publication. The orchestrator must show `previewContextCapsule` alongside the selected writable repository, native engine/model selection, configuration trust and known provider or native-managed routing before dispatch.
+`context.mjs` is an internal, Node 22+ package resource. It gathers **work context** only. It does not select a profile, grant a writable path, launch an agent, or authorize publication. The orchestrator must show `previewContextCapsule` alongside the selected writable repository, native engine/model selection, configuration trust and known provider or native-managed routing before dispatch.
 
 ## API
 
@@ -39,7 +39,22 @@ The JSON object has `kind: "openplanr-delegation-context-capsule"`, `schemaVersi
 
 The capsule file is created exclusively in a fresh private directory with directory mode `0700` and file mode `0600`. The source checkout is never a valid output location, even through a symlink. The orchestrator owns retention and cleanup. It should not log the capsule, source bytes, environment values, or full prompts.
 
-Known secret paths and literal credential values are rejected when required, or recorded as excluded when optional. Function calls and ordinary references such as `readArtifactSecretInput(inputPath)` or `process.env.GITHUB_TOKEN` are source code, not credential values. Complete dummy literals such as `mock-access-token` are allowed; recognizable credential formats and credential file paths remain blocked, including in test fixtures. A source named by the user or task requirements is required and cannot be downgraded to an optional omission after a guard failure. The preview shows optional omissions separately from blockers and gives both logical and physical `.planr` locations when planning is linked to another checkout. Planning content is task context, not permission for extra commands or automatic planning updates. These checks are conservative guards, not a claim that arbitrary repository data is safe to send to any destination. The orchestrator still previews the inventory and verifies profile destination before dispatch. No profile, token, environment, or execution permission field belongs in this contract.
+Known secret paths and credential values are rejected when required, or recorded as excluded when optional:
+
+- Recognizable credential formats, private keys and credential file paths are always rejected, including in tests and inside placeholder text.
+- A credential-named key such as `apiKey`, `client_secret` or `PASSWORD` assigned a literal of 16 or more characters is a possible credential unless the literal is a placeholder: `example-…`, `placeholder-…`, `your-…`, `change-me…`, `replace-me…`, or a lowercase marker (`test`, `mock`, `fake`, `dummy`, `fixture`, `synthetic`, `never-return`) followed by words and short numbers that include `secret`, `key`, `token`, `password` or `credential`, singular or plural.
+- An unquoted value is a literal in configuration files (`.env`, YAML, TOML, INI, JSON, shell), in a free-text `=` assignment, and in a shell or env line (`export NAME=…`, or an uppercase `NAME=value` without spaces that does not end in `,`) in any file.
+- Elsewhere, an identifier such as `TIssueToken;` is a reference only when it ends in `,` or `;`, and a member path such as `config!.apiKey` only in a code file or when it ends in `,` or `;`. A link is read as its target's syntax, or as configuration when either path is a configuration file.
+- Environment lookups, function calls and template interpolation are source code. Any other value counts as a possible credential.
+
+Findings and resolutions:
+
+- A blocked source or request lists masked findings in `details.findings` with the exact `contentDigest`. Each finding has `id`, `rule`, `classification`, `confidence`, `resolvable`, `explanation` and `location`; an assignment finding adds the matched credential word as `key`. No finding carries the value.
+- The prepare preview shows the findings and digest of an optional omission. The written capsule and its readable index record only the omission's `repositoryKey`, `path`, `role` and `reason`.
+- After the user confirms that a resolvable finding is not a credential, pass `credentialResolutions: [{ id, contentDigest }]` to `prepare`. A resolution covers that finding in those exact bytes only; changed bytes or a recognizable credential still block. Findings in corrections, answers and results are not resolvable.
+- Applied resolutions are recorded in the private capsule and its preview as `credentialResolutions`, never in the repository or worktree. No switch disables these checks.
+
+A source named by the user or task requirements is required and cannot be downgraded to an optional omission after a guard failure. The preview shows optional omissions separately from blockers and gives both logical and physical `.planr` locations when planning is linked to another checkout. Planning content is task context, not permission for extra commands or automatic planning updates. These checks are conservative guards, not a claim that arbitrary repository data is safe to send to any destination. The orchestrator still previews the inventory and verifies profile destination before dispatch. No profile, token, environment, or execution permission field belongs in this contract.
 
 `CapsuleError.code` is stable for callers. `details` can include non-secret paths, searched locations, and candidates; errors never include source bytes. Applicable codes include `E_CAPSULE_SELECTOR`, `E_CAPSULE_AMBIGUOUS`, `E_CAPSULE_NOT_FOUND`, `E_CAPSULE_LINK`, `E_CAPSULE_FRONTMATTER`, `E_CAPSULE_LIMIT`, `E_CAPSULE_UNREADABLE`, `E_CAPSULE_SECRET`, `E_CAPSULE_PATH`, `E_CAPSULE_SOURCE`, `E_CAPSULE_INPUT`, `E_CAPSULE_FORMAT`, and `E_CAPSULE_OUTPUT`.
 

package/lib/host-packages/claude/openplanr/skills/delegate/references/operator-guide.md

@@ -100,11 +100,13 @@ for a new native v2 run; retained runs still use their original pinned helper an
 policy. Saving over a legacy native profile is refused; use a new optional name.
 Experimental generic adapters retain their versioned enrollment/protocol.
 
-Local server/model/authentication probes are diagnostic and send no task content.
-They use bounded, authenticated read-only model metadata requests; model load
-state is reported only when the backend exposes it. They never load a model or
-submit a completion automatically. An unsupported metadata endpoint remains
-unverified rather than proof that native execution cannot work.
+Local server/model probes are diagnostic and send no task content and no
+credentials. They use bounded read-only model metadata requests; model load
+state is reported only when the backend exposes it. A server that requires
+sign-in is reported as not checked; the delegated CLI still signs in with its own
+configuration. Probes never load a model or submit a completion automatically. An
+unsupported metadata endpoint remains unverified rather than proof that native
+execution cannot work.
 Template failures require fixing the backend itself. OpenPlanr does not rewrite
 messages/templates, load models automatically or silently change providers.
 When changing a local model, use the exact model ID advertised by that backend;

package/lib/host-packages/claude/openplanr/skills/delegate/scripts/adapters/claude.mjs

@@ -18,9 +18,16 @@ const PROVIDER_VARIABLES = [
   'CLAUDE_CODE_USE_VERTEX',
   'CLAUDE_CODE_USE_FOUNDRY',
 ];
+const ROUTING_VARIABLES = ['ANTHROPIC_BASE_URL', ...PROVIDER_VARIABLES];
 
-// These values stay in trusted memory. Callers expose only source labels and origins.
-export async function readClaudeSettingsEnvironment(profile, env, cwd, options = {}) {
+function routingVariables(env) {
+  return Object.fromEntries(
+    ROUTING_VARIABLES.filter((name) => Object.hasOwn(env, name)).map((name) => [name, env[name]]),
+  );
+}
+
+// Keeps only routing variables from settings files; callers expose source labels and origins.
+async function readClaudeRoutingSettings(profile, env, cwd, options = {}) {
   const managedRoot =
     options.managedRoot ??
     (process.platform === 'darwin'
@@ -100,7 +107,7 @@ export async function readClaudeSettingsEnvironment(profile, env, cwd, options =
         throw new AdapterError('E_DESTINATION_UNKNOWN', 'Claude routing environment is malformed.');
       inspected.push({
         source,
-        env: settings.env ?? {},
+        env: routingVariables(settings.env ?? {}),
         ...(settings.policyHelper ? { opaqueRouting: true } : {}),
       });
     } catch (error) {
@@ -122,7 +129,7 @@ export async function readClaudeSettingsEnvironment(profile, env, cwd, options =
 }
 
 export async function resolveClaudeRouting(profile, env, cwd, options) {
-  const settings = await readClaudeSettingsEnvironment(profile, env, cwd, options);
+  const settings = await readClaudeRoutingSettings(profile, env, cwd, options);
   const sources = [{ source: 'parent environment', env }, ...settings];
   const candidates = [];
   const providerSources = [];

package/lib/host-packages/claude/openplanr/skills/delegate/scripts/adapters/native.mjs

@@ -122,7 +122,7 @@ export function safeNativeDiagnostic(value, destination) {
 }
 
 const ROUTING_SOURCE =
-  /^(?:parent environment|user settings|project settings|project local settings|managed file settings|managed fragment settings(?: \d{1,2})?)(?:: (?:ANTHROPIC_BASE_URL|CLAUDE_CODE_USE_BEDROCK|CLAUDE_CODE_USE_VERTEX|CLAUDE_CODE_USE_FOUNDRY|policyHelper|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_API_KEY))?$/u;
+  /^(?:parent environment|user settings|project settings|project local settings|managed file settings|managed fragment settings(?: \d{1,2})?)(?:: (?:ANTHROPIC_BASE_URL|CLAUDE_CODE_USE_BEDROCK|CLAUDE_CODE_USE_VERTEX|CLAUDE_CODE_USE_FOUNDRY|policyHelper))?$/u;
 
 function safeRoutingDestination(value) {
   if (value?.class === 'native-managed' && value.origin === 'native-managed')

package/lib/host-packages/claude/openplanr/skills/delegate/scripts/backend-diagnostics.mjs

@@ -1,40 +1,8 @@
 // Local probes are diagnostics; native CLI execution remains authoritative.
 
-import { readClaudeSettingsEnvironment, resolveClaudeRouting } from './adapters/claude.mjs';
+import { resolveClaudeRouting } from './adapters/claude.mjs';
 import { AdapterError, validateDestination } from './adapters/generic.mjs';
 
-async function localProbeToken(profile, env, cwd) {
-  const sources = [{ source: 'parent environment', env }];
-  const names = ['LM_STUDIO_API_KEY', 'LM_API_TOKEN'];
-  // Only Claude routing confirmed to this local origin may present its Anthropic token.
-  if (profile.kind === 'claude') {
-    sources.push(...(await readClaudeSettingsEnvironment(profile, env, cwd)));
-    names.push('ANTHROPIC_AUTH_TOKEN');
-  }
-  for (const name of names) {
-    const candidates = sources.filter(
-      (source) => source.env[name] !== undefined && source.env[name] !== '',
-    );
-    if (!candidates.length) continue;
-    const values = candidates.map((source) => source.env[name]);
-    if (
-      values.some(
-        (value) => typeof value !== 'string' || value.length >= 4096 || /[\r\n]/u.test(value),
-      ) ||
-      new Set(values).size !== 1
-    )
-      throw new AdapterError(
-        'E_BACKEND_AUTH_CONFIG',
-        'Local metadata authentication could not be confirmed.',
-        {
-          sources: candidates.map((source) => `${source.source}: ${name}`),
-        },
-      );
-    return values[0];
-  }
-  return null;
-}
-
 async function withinDeadline(operation, signal) {
   if (signal.aborted)
     throw new AdapterError('E_BACKEND_TIMEOUT', 'Local model metadata inspection timed out.');
@@ -106,9 +74,8 @@ export async function inspectLocalBackend(
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   const signal = controller.signal;
   try {
-    let token;
-    try {
-      if (profile.kind === 'claude') {
+    if (profile.kind === 'claude') {
+      try {
         const resolved = await resolveClaudeRouting(profile, env, cwd);
         if (
           resolved.destination.class !== 'local' ||
@@ -122,22 +89,21 @@ export async function inspectLocalBackend(
               routing: resolved.routing,
             },
           );
+      } catch (error) {
+        return {
+          status: 'not-checked',
+          modelStatus: 'unverified',
+          selectedModel,
+          visibleModels: [],
+          diagnostic: { code: error.code ?? 'E_DESTINATION_UNKNOWN', ...error.details },
+        };
       }
-      token = await localProbeToken(profile, env, cwd);
-    } catch (error) {
-      return {
-        status: 'not-checked',
-        modelStatus: 'unverified',
-        selectedModel,
-        visibleModels: [],
-        diagnostic: { code: error.code ?? 'E_BACKEND_AUTH_CONFIG', ...error.details },
-      };
     }
+    // Sends no credentials: a server that requires sign-in reports authentication-required.
     const readModels = async (path) => {
       const response = await withinDeadline(
         fetchImpl(new URL(path, profile.destination.origin), {
           method: 'GET',
-          ...(token ? { headers: { Authorization: `Bearer ${token}` } } : {}),
           signal,
           redirect: 'error',
         }),
@@ -269,9 +235,9 @@ export function profileReadiness(destination, backend) {
   if (backend.status === 'authentication-required') {
     return {
       state: 'authentication-required',
-      dispatchable: false,
+      dispatchable: true,
       nextAction:
-        'Provide the local server token through an allowed environment variable, then probe again.',
+        'The local server requires sign-in, so its models were not checked. The delegated CLI signs in with its own configuration.',
     };
   }
   if (backend.modelStatus === 'not-listed') {

package/lib/host-packages/claude/openplanr/skills/delegate/scripts/context.mjs

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { lstat, mkdir, readdir, readFile, realpath, stat, writeFile } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { classifyCredentials, credentialSyntax, resolveFindings } from './credentials.mjs';
 
 export const CAPSULE_SCHEMA_VERSION = '1.0.0';
 
@@ -12,19 +13,14 @@ const DEFAULT_LIMITS = Object.freeze({
 const SECRET_NAME =
   /^(?:\.env(?:\..*)?|\.envrc|\.netrc|\.git-credentials|\.npmrc|\.pypirc|id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?|credentials(?:\.[^.]+)?|service[-_]?account(?:\.[^.]+)?|.*\.(?:pem|p12|pfx|key|tfvars)(?:\.json)?)$/iu;
 const SECRET_SEGMENT = /^(?:\.ssh|\.aws|\.gnupg|\.kube)$/iu;
-const SECRET_VALUE =
-  /-----BEGIN (?:[A-Z ]* )?PRIVATE KEY-----|\bAKIA[0-9A-Z]{16}\b|\bgh[pousr]_[A-Za-z0-9_]{20,}\b|\bgithub_pat_[A-Za-z0-9_]{20,}\b|\bsk-(?:proj-)?[A-Za-z0-9_-]{24,}\b|\bxox[baprs]-[A-Za-z0-9-]{20,}\b|"private_key"\s*:\s*"-----BEGIN/iu;
-const SECRET_ASSIGNMENT =
-  /(?:^|[^A-Za-z0-9_])(?:[A-Za-z_][A-Za-z0-9_-]*?)?(?:API[_-]?KEY|ACCESS[_-]?TOKEN|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET|PRIVATE[_-]?KEY|PASSWORD|TOKEN|SECRET(?:[_-]?KEY)?)["']?\s*[:=]\s*(["'`])((?:(?!\1|\$\{)[^\r\n\\]|\\.){16,})\1/giu;
-const SECRET_CONFIG_ASSIGNMENT =
-  /^[ \t]*(?:export[ \t]+)?(?:[A-Za-z_][A-Za-z0-9_-]*?)?(?:API[_-]?KEY|ACCESS[_-]?TOKEN|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET|PRIVATE[_-]?KEY|PASSWORD|TOKEN|SECRET(?:[_-]?KEY)?)[ \t]*[:=][ \t]*(?!process\.env(?:\.|\[)|import\.meta\.env(?:\.|\[)|Deno\.env\.|os\.environ|env\.)([^\s"'`#()\[\]{}$]{16,})[ \t]*(?:#[^\r\n]*)?\r?$/gimu;
-const CREDENTIAL_PLACEHOLDER =
-  /^(?:example(?:[-_].*)?|placeholder(?:[-_].*)?|your[-_].*|(?:change|replace)[-_]me(?:[-_].*)?|(?:dummy|fake|mock|test|never[-_]return)[-_](?:api[-_]?key|access[-_]?token|auth[-_]?token|client[-_]?secret|password|token|secret(?:[-_]?key)?))$/iu;
 const TASK_ID = /^(?:T|TASK|QT)-\d{3,}$/u;
 const STORY_ID = /^US-\d{3,}$/u;
 const SPEC_ID = /^SPEC-\d{3,}$/u;
 const FEATURE_ID = /^FEAT-\d{3,}$/u;
 const EPIC_ID = /^EPIC-\d{3,}$/u;
+// Credential findings of an optional omission, keyed by the omission entry. The delegate reads
+// the written capsule, so they reach only the parent's preview.
+const OMISSION_FINDINGS = new WeakMap();
 
 export class CapsuleError extends Error {
   constructor(code, message, details = {}) {
@@ -68,14 +64,9 @@ function isSecretPath(path) {
   return parts.some((part) => SECRET_SEGMENT.test(part)) || SECRET_NAME.test(parts.at(-1));
 }
 
+/** True when free text holds credential material; source files are classified by their syntax. */
 export function containsSecret(bytes) {
-  const content = bytes.toString('utf8');
-  if (SECRET_VALUE.test(content)) return true;
-  for (const match of content.matchAll(SECRET_ASSIGNMENT))
-    if (!CREDENTIAL_PLACEHOLDER.test(match[2])) return true;
-  for (const match of content.matchAll(SECRET_CONFIG_ASSIGNMENT))
-    if (!CREDENTIAL_PLACEHOLDER.test(match[1])) return true;
-  return false;
+  return classifyCredentials(bytes).findings.length > 0;
 }
 
 export function assertCredentialFreeText(
@@ -84,10 +75,34 @@ export function assertCredentialFreeText(
 ) {
   if (typeof value !== 'string')
     throw new CapsuleError('E_CAPSULE_INPUT', `${label} must be text.`);
-  if (containsSecret(Buffer.from(value, 'utf8')))
+  const { contentDigest, findings } = classifyCredentials(Buffer.from(value, 'utf8'), {
+    label,
+    resolvable: false,
+  });
+  if (findings.length)
     throw new CapsuleError(
       code,
       `${label} contains credential material; use native configuration or credential environment references instead.`,
+      { findings, contentDigest },
+    );
+  return value;
+}
+
+function credentialResolutionList(value) {
+  if (
+    !Array.isArray(value) ||
+    value.length > 64 ||
+    value.some(
+      (resolution) =>
+        !resolution ||
+        typeof resolution !== 'object' ||
+        !/^cred_[a-f0-9]{16}$/u.test(resolution.id ?? '') ||
+        !/^sha256:[a-f0-9]{64}$/u.test(resolution.contentDigest ?? ''),
+    )
+  )
+    throw new CapsuleError(
+      'E_CAPSULE_INPUT',
+      'Credential resolutions must list at most 64 { id, contentDigest } entries from reported findings.',
     );
   return value;
 }
@@ -312,8 +327,22 @@ export async function buildContextCapsule({
   optionalFiles = [],
   readOnlyRepositories = [],
   limits,
+  credentialResolutions = [],
 } = {}) {
   if (!repositoryRoot) throw new CapsuleError('E_CAPSULE_SOURCE', 'repositoryRoot is required.');
+  const resolutions = credentialResolutionList(credentialResolutions);
+  const appliedResolutions = [];
+  const credentialCheck = (bytes, origin) => {
+    const classification = classifyCredentials(bytes, origin);
+    return {
+      ...resolveFindings(classification, resolutions),
+      contentDigest: classification.contentDigest,
+    };
+  };
+  const recordResolutions = ({ applied, contentDigest }, source) => {
+    for (const { id, rule, location } of applied)
+      appliedResolutions.push({ id, contentDigest, ...source, rule, location });
+  };
   if (request !== undefined && typeof request !== 'string')
     throw new CapsuleError('E_CAPSULE_INPUT', 'A direct request must be text.');
   if (Boolean(taskSelector) === Boolean(request?.trim())) {
@@ -354,8 +383,18 @@ export async function buildContextCapsule({
   if (request && Buffer.byteLength(request, 'utf8') > bounds.maxFileBytes) {
     throw new CapsuleError('E_CAPSULE_LIMIT', 'The direct request exceeds the capsule text limit.');
   }
-  if (request && containsSecret(Buffer.from(request, 'utf8'))) {
-    throw new CapsuleError('E_CAPSULE_SECRET', 'The direct request contains credential material.');
+  if (request) {
+    const credentials = credentialCheck(Buffer.from(request, 'utf8'), { label: 'request' });
+    if (credentials.remaining.length)
+      throw new CapsuleError(
+        'E_CAPSULE_SECRET',
+        'The direct request contains credential material.',
+        {
+          findings: credentials.remaining,
+          contentDigest: credentials.contentDigest,
+        },
+      );
+    recordResolutions(credentials, { source: 'request' });
   }
   const roots = await sourceRoots(repositoryRoot, readOnlyRepositories);
   const project = roots.get('project').physical;
@@ -381,9 +420,16 @@ export async function buildContextCapsule({
       return prior;
     }
     const optionalOmission = (reason) => {
-      if (required) throw new CapsuleError(reason.code, reason.message, { repositoryKey, path });
+      if (required)
+        throw new CapsuleError(reason.code, reason.message, {
+          repositoryKey,
+          path,
+          ...reason.details,
+        });
       if (!omitted.has(key)) {
-        omissions.push({ repositoryKey, path, role, reason: reason.code });
+        const omission = { repositoryKey, path, role, reason: reason.code };
+        if (reason.details) OMISSION_FINDINGS.set(omission, reason.details);
+        omissions.push(omission);
         omitted.add(key);
       }
       return null;
@@ -467,11 +513,20 @@ export async function buildContextCapsule({
         message: `Required source exceeds capsule limits: ${path}`,
       });
     }
-    if (containsSecret(bytes))
+    // A link reads as its target's syntax, or as configuration when either path is configuration.
+    const syntaxes = [path, relative(allowed, physical).split(sep).join('/')].map(credentialSyntax);
+    const credentials = credentialCheck(bytes, {
+      path,
+      label: `${repositoryKey}/${path}`,
+      syntax: syntaxes.includes('config') ? 'config' : syntaxes[1],
+    });
+    if (credentials.remaining.length)
       return optionalOmission({
         code: 'E_CAPSULE_SECRET',
         message: `Credential material detected in source: ${path}`,
+        details: { findings: credentials.remaining, contentDigest: credentials.contentDigest },
       });
+    recordResolutions(credentials, { repositoryKey, path });
     const copy = {
       repositoryKey,
       path,
@@ -686,6 +741,7 @@ export async function buildContextCapsule({
     inventory,
     files,
     omissions,
+    ...(appliedResolutions.length ? { credentialResolutions: appliedResolutions } : {}),
     planning: {
       logicalPath: join(project, '.planr'),
       physicalPath: roots.get('project').planning,
@@ -731,7 +787,13 @@ export function previewContextCapsule(capsule) {
     mode: capsule.mode,
     selector: capsule.selector,
     inventory: capsule.inventory,
-    omissions: capsule.omissions,
+    omissions: capsule.omissions.map((omission) => ({
+      ...omission,
+      ...OMISSION_FINDINGS.get(omission),
+    })),
+    ...(capsule.credentialResolutions
+      ? { credentialResolutions: capsule.credentialResolutions }
+      : {}),
     blockers: [],
     planning: capsule.planning ?? null,
     sourceKeys: capsule.sourceKeys,