deploy(hf): sync szl-holdings/a11oy@main derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy main.
Files: 1115 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

szl_connectors/governance.py

@@ -10,8 +10,8 @@ DOCTRINE (non-negotiable):
   • Every write emits a DSSE-signed Khipu receipt (real ECDSA-P256 over the DSSE
     PAE when SZL_COSIGN_PRIVATE_PEM is present; an explicit UNSIGNED envelope
     otherwise — NEVER a fabricated signature). Reuses the live `szl_dsse` module.
-  • No credential value is EVER placed in a receipt body — only a credential
-    fingerprint hash (sha256, truncated).
+  • No credential value is EVER placed in a receipt body — only a
+    PBKDF2-HMAC-SHA256 credential fingerprint.
   • State-changing writes carry the 2-person Yuyay gate + Khipu 3-of-4 quorum
     status (the hatun-mcp governance contract). Until a connector is CONNECTED,
     write() is refused with an honest reason.
@@ -22,14 +22,22 @@ call directly.
 """
 from __future__ import annotations
 
-import hashlib
 import json
-import os
+import re
 from datetime import datetime, timezone
 from typing import Any
 
+from szl_content_address import sha256_content_address
+
 # Anti-overconfidence floor: Λ is never reported as 1.0. We cap at this ceiling.
 LAMBDA_CEILING = 0.985
+_FINGERPRINT_RE = re.compile(r"\Apbkdf2-sha256:[0-9a-f]{32}\Z")
+_FINGERPRINT_LABEL_RE = re.compile(r"\A[A-Za-z0-9_.:-]{1,80}\Z")
+_SENSITIVE_KEY_PARTS = frozenset({"password", "passwd", "secret", "token", "credential"})
+_SENSITIVE_KEY_NAMES = frozenset({
+    "api_key", "private_key", "authorization", "proxy_authorization",
+    "cookie", "set_cookie",
+})
 
 
 def _now() -> str:
@@ -67,6 +75,53 @@ def quorum_status(present: list[str] | None = None, n: int = 4, f: int = 1) -> d
     }
 
 
+def _is_sensitive_key(key: object) -> bool:
+    normalized = re.sub(r"[^a-z0-9]+", "_", str(key).lower()).strip("_")
+    parts = frozenset(part for part in normalized.split("_") if part)
+    return normalized in _SENSITIVE_KEY_NAMES or bool(parts & _SENSITIVE_KEY_PARTS)
+
+
+def _contains_sensitive_field(value: Any) -> bool:
+    if isinstance(value, dict):
+        return any(
+            _is_sensitive_key(key) or _contains_sensitive_field(child)
+            for key, child in value.items()
+        )
+    if isinstance(value, (list, tuple)):
+        return any(_contains_sensitive_field(child) for child in value)
+    return False
+
+
+def _scrub_sensitive_fields(value: Any) -> Any:
+    """Recursively remove secret-bearing fields without copying their values."""
+    if isinstance(value, dict):
+        return {
+            key: _scrub_sensitive_fields(child)
+            for key, child in value.items()
+            if not _is_sensitive_key(key)
+        }
+    if isinstance(value, list):
+        return [_scrub_sensitive_fields(child) for child in value]
+    if isinstance(value, tuple):
+        return tuple(_scrub_sensitive_fields(child) for child in value)
+    return value
+
+
+def _validated_fingerprints(values: dict[str, str] | None) -> dict[str, str]:
+    """Allow only the KDF output format emitted by ``cred_fingerprint``."""
+    safe: dict[str, str] = {}
+    for label, fingerprint in (values or {}).items():
+        if not isinstance(label, str) or _FINGERPRINT_LABEL_RE.fullmatch(label) is None:
+            continue
+        if fingerprint == "absent":
+            safe[label] = "absent"
+        elif isinstance(fingerprint, str) and _FINGERPRINT_RE.fullmatch(fingerprint):
+            safe[label] = fingerprint
+        else:
+            safe[label] = "invalid-fingerprint"
+    return safe
+
+
 def _dsse_sign(payload: dict[str, Any]) -> dict[str, Any]:
     """Sign a receipt payload via the live szl_dsse module if importable; else an
     honest UNSIGNED envelope (NEVER a fabricated signature)."""
@@ -98,9 +153,10 @@ def receipt_for_write(*, connector_id: str, action: dict[str, Any],
     NOT secret values), the Λ score, quorum status, credential FINGERPRINT HASHES
     (never the values), and a result summary. Returns {receipt_hash, dsse, body}.
     """
-    # scrub the action of anything secret-looking; keep only shape
-    safe_action = {k: v for k, v in (action or {}).items()
-                   if k.lower() not in ("token", "secret", "password", "api_key", "key")}
+    # Scrub at every nesting level. Direct callers receive the same protection
+    # as gate_write callers, including secrets hidden in list/dict children.
+    safe_action = _scrub_sensitive_fields(action or {})
+    safe_result = _scrub_sensitive_fields(result_summary or {})
     body = {
         "kind": "szl.connector.write",
         "connector_id": connector_id,
@@ -108,13 +164,15 @@ def receipt_for_write(*, connector_id: str, action: dict[str, Any],
         "lambda_value": lambda_value,
         "lambda_note": "Λ never 1.0 (conformal anti-overconfidence floor 1/(n+1)); Λ = Conjecture 1",
         "quorum": quorum or quorum_status(),
-        "credential_fingerprints": cred_fingerprints or {},
-        "result": result_summary or {},
+        "credential_fingerprints": _validated_fingerprints(cred_fingerprints),
+        "result": safe_result,
         "emitted_at": _now(),
         "doctrine": "v11 — Λ-gate + DSSE/Khipu receipt on every write; no committed keys; trust never 100%",
     }
-    receipt_hash = "sha256:" + hashlib.sha256(
-        json.dumps(body, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+    canonical_body = json.dumps(body, sort_keys=True, separators=(",", ":")).encode()
+    receipt_hash = "sha256:" + sha256_content_address(
+        canonical_body, purpose="khipu-receipt"
+    )
     body["receipt_hash"] = receipt_hash
     dsse = _dsse_sign(body)
     return {"receipt_hash": receipt_hash, "dsse": dsse, "body": body}
@@ -135,7 +193,7 @@ def gate_write(*, connector_id: str, connected: bool, action: dict[str, Any],
     """
     has_method = bool((action or {}).get("method") or (action or {}).get("object")
                       or (action or {}).get("doctype") or (action or {}).get("sobject"))
-    leak = any(k.lower() in ("token", "secret", "password") for k in (action or {}))
+    leak = _contains_sensitive_field(action or {})
     q = quorum_status(present=quorum_present)
     axes = {
         "connected": 1.0 if connected else 0.0,

szl_connectors/oauth.py

@@ -91,6 +91,23 @@ PROVIDER_OAUTH: dict[str, dict[str, str]] = {
     },
 }
 
+# Keep public scopes in a separate container from endpoint metadata whose
+# ``token`` key is (correctly but over-broadly) treated as sensitive by taint
+# analysis. Receipt content uses this public-only map, so no credential-like
+# container can flow into a protocol content address.
+PROVIDER_SCOPES: dict[str, str] = {
+    "salesforce": "api refresh_token",
+    "hubspot": "crm.objects.contacts.read crm.objects.companies.read crm.objects.deals.read",
+    "zoho_crm": "ZohoCRM.modules.ALL ZohoCRM.org.READ",
+    "slack": "channels:read chat:write users:read",
+    "okta": "okta.users.read okta.groups.read",
+    "entra": "https://graph.microsoft.com/.default offline_access",
+    "auth0": "read:users read:logs",
+    "dynamics_crm": "https://{org}.api.crm.dynamics.com/.default offline_access",
+    "netsuite": "rest_webservices",
+    "servicenow": "useraccount",
+}
+
 
 # Domain-separation salt + work factor for deriving the state-signing key.
 _STATE_KDF_SALT = b"szl.killinchu.oauth-state.v1"
@@ -224,18 +241,19 @@ def exchange_code(connector_id: str, *, code: str, state: str, redirect_uri: str
                 "provider_detail": str(body)[:200]}
     refresh = body.get("refresh_token", "")
     access = body.get("access_token", "")
+    public_scope = PROVIDER_SCOPES.get(connector_id, "")
     # credential-bound DSSE receipt — fingerprint ONLY, never the token value.
     from .governance import receipt_for_write
     rcpt = receipt_for_write(
         connector_id=connector_id,
         action={"method": "oauth.credential_bound", "object": "refresh_token",
-                "scope": cfg.get("scope", "")},
+                "scope": public_scope},
         lambda_value=0.9,
         cred_fingerprints={
             "refresh_token": cred_fingerprint(refresh) if refresh else "absent",
             "access_token": cred_fingerprint(access) if access else "absent",
         },
-        result_summary={"granted_scope": cfg.get("scope", ""),
+        result_summary={"granted_scope": public_scope,
                         "note": "secret persisted to Space secret store only; never committed"},
     )
     return {

szl_content_address.py

@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: Apache-2.0
+"""Explicit SHA-256 content addressing for protocol and receipt bytes.
+
+This module is deliberately *not* a password or credential derivation API.
+Callers must provide one of the narrow protocol purposes below, and the input
+bytes are hashed exactly as supplied.  Keeping this operation separate from
+PBKDF2-based credential fingerprints prevents accidental reuse while
+preserving the byte-for-byte hashes already carried by DSSE envelopes and
+Khipu receipts.
+"""
+from __future__ import annotations
+
+import hashlib
+
+
+_PURPOSES = frozenset({"dsse-pae", "khipu-receipt", "public-key"})
+
+
+def sha256_content_address(data: bytes, *, purpose: str) -> str:
+    """Return the protocol-compatible SHA-256 hex address of public content.
+
+    ``purpose`` is intentionally mandatory and allowlisted.  Secret values
+    belong in a password KDF such as PBKDF2, never in this function.
+    """
+    if purpose not in _PURPOSES:
+        raise ValueError(f"unsupported content-address purpose: {purpose!r}")
+    if not isinstance(data, bytes):
+        raise TypeError("content address input must be bytes")
+    return hashlib.sha256(data).hexdigest()
+
+
+__all__ = ["sha256_content_address"]

szl_dsse.py

@@ -66,13 +66,14 @@ for SZL Khipu receipts, backed by the SZLHOLDINGS **Cosign** keypair.
 from __future__ import annotations
 
 import base64
-import hashlib
 import json
 import os
 import sys
 from datetime import datetime, timezone
 from typing import Any
 
+from szl_content_address import sha256_content_address
+
 KEYID = "szlholdings-cosign"
 KHIPU_PAYLOAD_TYPE = "application/vnd.szl.khipu+json"
 COSIGN_PUB_FINGERPRINT_ENV = "SZL_COSIGN_PUB_SHA256"  # optional pin
@@ -151,7 +152,9 @@ def signing_available() -> bool:
 
 
 def public_key_fingerprint() -> str:
-    return hashlib.sha256(COSIGN_PUBLIC_PEM.strip().encode()).hexdigest()
+    return sha256_content_address(
+        COSIGN_PUBLIC_PEM.strip().encode(), purpose="public-key"
+    )
 
 
 # ---------------------------------------------------------------------------
@@ -171,7 +174,7 @@ def sign_payload(payload_obj: Any, payload_type: str = KHIPU_PAYLOAD_TYPE) -> di
         "payloadType": payload_type,
         "payload": base64.b64encode(body).decode("ascii"),
         "_dsse": "DSSEv1",
-        "_pae_sha256": hashlib.sha256(to_sign).hexdigest(),
+        "_pae_sha256": sha256_content_address(to_sign, purpose="dsse-pae"),
         "_signed_at": datetime.now(timezone.utc).isoformat(),
     }
     priv = _load_private_key()
@@ -210,7 +213,7 @@ def verify_envelope(env: dict[str, Any]) -> dict[str, Any]:
             return {**out, "verified": False, "reason": "no signatures (unsigned envelope)"}
         body = base64.b64decode(payload_b64)
         to_verify = pae(payload_type, body)
-        out["pae_sha256"] = hashlib.sha256(to_verify).hexdigest()
+        out["pae_sha256"] = sha256_content_address(to_verify, purpose="dsse-pae")
         pub = _load_public_key()
         from cryptography.hazmat.primitives.asymmetric import ec
         from cryptography.hazmat.primitives import hashes