Merge remote-tracking branch 'origin/main' into codex/proof-stack-merge-20260907

Author: Arena Agent

.machine_readable/descriptiles/PLAYBOOK.a2ml

@@ -19,7 +19,7 @@ last-updated = "2026-04-11"
 # 4. Run `just security` to audit for vulnerabilities
 
 [release-process]
-# 1. Update version in .machine_readable/descriptiles/STATE.a2ml and .machine_readable/descriptiles/META.a2ml
+# 1. Update version in .machine_readable/descriptiles/STATE.a2ml and META.a2ml
 # 2. Run `just release-preflight` (validate + quality + security + maint-hard-pass)
 # 3. Tag and push
 

bots/cipherbot/src/analyzers/infra.rs

@@ -174,15 +174,6 @@ impl Analyzer for InfraAnalyzer {
 mod tests {
     use super::*;
 
-    fn synthetic_hardcoded_credential() -> String {
-        [
-            "password = \"",
-            "synthetic-test-value",
-            "\"",
-        ]
-        .concat()
-    }
-
     #[test]
     fn test_detect_latest_tag() {
         let analyzer = InfraAnalyzer;
@@ -195,7 +186,7 @@ mod tests {
     #[test]
     fn test_detect_hardcoded_cred() {
         let analyzer = InfraAnalyzer;
-        let content = synthetic_hardcoded_credential();
+        let content = format!(r#"password = "{}""#, "x".repeat(12));
         let usages = analyzer.analyze_content(Path::new("infra/main.tf"), &content);
         assert!(!usages.is_empty(), "Should detect hardcoded credential");
         assert_eq!(usages[0].status, CryptoStatus::Reject);
@@ -213,7 +204,7 @@ mod tests {
     #[test]
     fn test_skip_non_infra_file() {
         let analyzer = InfraAnalyzer;
-        let content = synthetic_hardcoded_credential();
+        let content = format!(r#"password = "{}""#, "x".repeat(12));
         let usages = analyzer.analyze_content(Path::new("src/main.rs"), &content);
         assert!(usages.is_empty(), "Should skip non-IaC files");
     }