[bolichen97]

Problem / Motivation

Goal: Built-in app tests that only need "some credential" use a fake value the redactor treats as a secret, not an AWS access key ID.

About 20 built-in app test files (under src/kiro_crew/apps/builtins/*/tests) use the AWS documentation key ID as their stand-in for a credential. The redaction design in #22552 moves key IDs to the Identifier tier, which is never redacted. Once that lands, every one of those tests would stop exercising redaction at all.

Why it matters

Without this swap, the key-ID change would have to rewrite these tests in the same PR as the security change, which buries the real behaviour change under thousands of mechanical lines. Done first, the swap is reviewable on its own, and the follow-up PR carries only the tests whose expected result really changes.

Not a goal

• Changing what is redacted. No product code changes here.
• Tests that check key-ID behaviour itself; those change with the key-ID PR.
• The test/ and website/ tests, which test: use a secret-shaped fake credential in redaction tests (1/2) #22736 and test: use a secret-shaped fake credential in redaction tests (2/2) #22737 cover.

What changed (motivation → approach → change)

These app tests used a key ID to mean "a credential", so a tier change for key IDs would silently empty them. Each now uses a GitLab-shaped glpat- fake with the same 16-character body, which every redactor these apps call treats as a secret. This includes the aws_control packaging scan tests, whose fake now matches the scan's vendor-token rule.

This completes the set started by #22736 and #22737; the three touch disjoint files and each passes on main alone.

Backwards compatibility

Compatible: only tests change; nothing a user runs is touched.

Removes nothing: every test keeps its assertion; only the fake input changes.

Tests

Every changed test passes on origin/main with the swap (815 tests).

No test is added, so no determinism proof applies.

Manual verification

N/A - test-only change; the suite is the verification.

Related Issues

Part of #22552

Checklist

• At most two commits (one is the norm), with a Conventional Commits title (feat|fix|docs|style|refactor|perf|test|chore|ci|build|revert: ...)
• Existing tests pass and new tests added for new functionality
• Self-review completed; code follows project style guidelines
• Documentation updated (if applicable)
• No secrets, credentials, or internal references in the diff

[github-actions]

UX Review (Opus 5.5) — ⏭️ skipped

Revision 081d02d13207acbeef59dcd63551514e9be8b31e touches no user-facing surface (no changes under website/ or committed screenshots), so the UX review was skipped. Does not block merge.

[github-actions]

First Principles Review (Opus 5.5) — ⏭️ skipped

Revision 081d02d13207acbeef59dcd63551514e9be8b31e ships no reviewable capability (docs, tests or generated files only), so there is nothing to inventory. Does not block merge.

[github-actions]

Design Review (Opus 5.5) — ✅ PASS

Design-level review of 081d02d13207acbeef59dcd63551514e9be8b31e — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS does not.

Design-Verdict: PASS

Test-only change that swaps in a different fake input. No design-level concerns.

Notes

• Some docstrings now say a glpat- value was "Measured" (e.g. produced c1_wide_m_py_glpat-IOSFODNN7EXAMPLE_d469bc5b), but that was measured with the AKIA value. Either re-measure or drop the word, so the record of what was actually observed stays true.

[DESIGN-REVIEWED] 081d02d

Description read

[DESCRIPTION-READ] 1a5d96983946f5cda9babe5f3ecba08066592c8d45e870e033dc9e6f0cb1211f

That sha256 names everything this verdict read: the PR description, plus the 1 evidence file(s) the workflow collected from it and handed this review. It covers that evidence because the media strip replaces every attachment URL with the same placeholder, so an edit swapping one attachment for another would leave the description's captured text identical while what this review judged changed. Recompute it with .github/scripts/pr-description-capture.sh over the same inputs; if it differs, the description or that evidence changed after this verdict was formed and any finding drawn from either is unproven.

[github-actions]

Opus 5.5 Review — ✅ no blocking findings

Reviewed 081d02d13207acbeef59dcd63551514e9be8b31e — this comment is updated in place on each push.

Review details

No findings.

[OPUS-REVIEWED] 081d02d

Verdict parsed from the review's SHA-scoped output markers for commit 081d02d13207acbeef59dcd63551514e9be8b31e.

False positive or not applicable? A repository writer can comment:
/ai-review override fable 081d02d13207acbeef59dcd63551514e9be8b31e: <one-sentence reason>

[github-actions]

GPT 6.1 Review — ✅ no blocking findings

GPT 6.1 completed its review of 081d02d13207acbeef59dcd63551514e9be8b31e and found no blocking issues.

This comment is updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] 081d02d

False positive or not applicable? A repository writer can comment:
/ai-review override gpt 081d02d13207acbeef59dcd63551514e9be8b31e: <one-sentence reason>

[KiroCrewCaptain]

Tier 1 auto-approve: test (19 files). Criteria: no conflict, no requested changes, security path denylist clean, design-doc gate clean, security checklist all-NO, no reviewer-lane findings, readiness signal fresh for this head SHA, declared category matches the diff. Category: test files only: redaction tests swap their fake credential value for another credential-shaped string; no production code changes.