# Secret-boundary inspection formation

```yaml
collaboration_account:
  id: "prototype-exemplars.skill-use.secret-boundary-inspection.2026-08-26"
  observed_on: "2026-08-26"
  standing: "portable contract formed and received by the populated successor"
  work_surface: "repository, exact-index, local-history, and generated-artifact secret-material observation"
  source_state: "successor settlement commit 607b5da17ecfdb312c9df6dfc61b53c8bcf5a171"
  routes:
    secret_boundary_inspection: "create_now"
    externalized_reference_materialization: "observe_hold"
  next_return: "after a real finding or changed engine, configuration, and scope behavior"
```

## Working moment

Issue #188 moved a broad secret-scanning question into one executable repository
boundary. The accepted implementation pins Betterleaks, verifies release assets,
creates a fresh synthetic canary for every mode, observes the working tree and
ignored material, materializes the exact proposed index, scans diff-visible
history across locally available refs, and accepts a contained generated
artifact. The wrapper keeps raw scanner reports and diagnostics ephemeral and
returns only a narrow, allowlisted receipt.

Focused tests and live clean observations established implementation behavior.
Human review and acceptance of retained pull request #189 supplied an
independent decision signal. Successor pull request #15 then received the
assembled repository, installed the pinned scanner, and returned its own clean
canary, tree, index, and locally available history receipt. Settlement commit
`607b5da17ecfdb312c9df6dfc61b53c8bcf5a171` repeated the complete boundary
under successor-owned package, configuration, and installer identity.

## Formation decision

`collaboration-accounting` selects `create_now` for
`secret-boundary-inspection`. The catalog did not yet own the distinct job of
joining detector liveness, a generated canary, scope identity, sensitive report
handling, a safe receipt, and receiving-repository re-observation at one
handoff boundary. The successor return now supplies the contract's first
materially different receiving use.

The resulting skill remains instruction-only. Repository scripts, tests,
configuration, and the durable secret-material boundary continue to define
executable behavior. The skill adds no publication gate, standing scanner
service, permissions layer, credential-validation authority, or generalized
change model. It makes the existing observation easier to request and carry
into the named successor receiver.

`externalized-reference-materialization` remains at `observe_hold`. The
dependency-free materializer already has clear commands, tests, README routes,
and a receiving issue. Its next materially different delivery use can reveal
whether any portable judgment remains after ordinary build-time configuration
and source-boundary guidance do their work.

## Transfer boundary

The formed contract can transfer the following judgments:

- prove the selected detector path with a newly generated non-issued canary
  before interpreting a clean result;
- keep tree, exact index, locally available history, and named artifact scopes
  distinct;
- treat raw reports, diagnostics, paths, messages, and fingerprints as
  sensitive input while durable receipts remain narrowly allowlisted;
- pause only the affected handoff when a finding appears and route credential
  response to its existing owner; and
- require a receiving repository to observe its own assembled material.

It does not transfer a universal tool ranking, provider validity claim,
publication decision, ancestry proof, exhaustive Git-object assertion, or
authority to rotate credentials or rewrite history.

## Return condition

Return after a real finding tests the information diet and response order, or
an engine, configuration, clone, platform, or artifact difference changes a decision.
Revise the skill only for residue that would improve another material use. If
the receiving commands and repository ground carry the job without distinct
instruction yield, retain the executable affordance and let the portable
contract rest.