test: one runtime test credential, and a guard against password literals

[TusanHomichi]

Primary Issue

Closes #126

Problem And Outcome

Every integration test file declared its own password. CodeQL's rust/hard-coded-cryptographic-value and rust/cleartext-logging rules then flagged each new test file, turning the PR's CodeQL check red and blocking merge until the alerts were dismissed by hand. This happened on #130 and #139.

After merge, the Rust integration tests hold no password literal outside one allowlisted compatibility fixture. A guard test fails cargo test on a new one.

Changes

• tests/support/mod.rs provides:
  • password(), a per-process value from OS randomness;
  • wrong_password(), fresh_password(), and too_short_password();
  • the shared login and user_with_role helpers that 14 and 12 test crates had each copied;
  • assertion messages that name no user.
• 26 test files moved onto it, for a net of about 490 fewer lines. Test meaning is unchanged; the review checked the auth, reset, recovery, policy, and wrong-password flows.
  • upgrade_compat keeps its argon2 0.5 fixture password, allowlisted by exact path. It again checks a one-character near miss, built at run time.
• tests/no_credential_literals.rs: the guard.
  • Scan contract: stated in the header.
  • Shapes: sensitive bindings, with any non-empty literal in the initializer; fields; JSON keys; JSON inside strings; ("password", "lit") pairs; credential calls, including macros and turbofish.
  • Exemptions: empty literals, so absence and empty-password tests read naturally.
  • Remaining misses: listed in the header, each with its reason.
  • Controls: a 149-case corpus that is checked against the header in both directions.
  • Against the pre-change tests: 38 findings in 26 files.
• docs/development.md: one sentence on where test credentials come from.

Scope

• In scope: the Rust integration tests.
• Out of scope: browser specs (test(e2e): one generated credential for the browser specs, as #126 did for Rust #143) and the production dummy-hash constant (CodeQL alert chore: realign project after ConaryLabs → FieldmouseWorks rename #18, dismissed as a false positive).

Verification

• Candidate revision: c19f940d1019a4908fd6f8f3f0c14e3e6a79fc91 (tree 78221af0).
• Local full proof (verifier role): 7/7 gates in 502 s. 296 Rust tests passed, 0 failed; browser 62/62, on system Chrome 155. Receipt sha256 54782768…. The test count drops because the guard's controls moved into one corpus test.
• Guard bites: the implementer's 11 deliberate mutations each failed on the expected corpus case.
• Near-miss bites: a verifier that ignores the last byte fails the restored near-miss test and passes the previous version.
• CodeQL: this PR's run is the evidence for "no new alert in tests/". The dismissed alerts at the swept locations (Milestone 2 slice 3: enrollment pinning and minimal user creation #19–Stream installation exports instead of assembling the archive in memory #47, records(packet): trainee packets over the export units #50, records(packet): bind signoffs and phase events to the pin timeline in verification #52, web(deps): resolve SvelteKit cookie audit advisory #54, Implement Milestone 1 operable-shell foundation #1–docs(decisions): adopt program-version configuration model #13) are expected to close.
• Listed the exact verification commands run below
• Added or updated tests when behavior changed
• Added or updated an ADR when a durable decision changed (none)
• All fixtures and examples are invented; no real agency data

- scripts/check-guidance-names.sh
- web/: npm ci, npm run check, npm run build
- cargo fmt --check
- cargo clippy --workspace --all-targets -- -D warnings
- cargo test --workspace
- cargo build -p consolebook-server
- web/: npm run e2e (system Google Chrome 155)

Review And Merge Notes

• Independent review (reviewer role, frozen worktree at fc3f7fe): 0 blocking.
  • It probed the guard with 80 synthetic sources.
  • No panic, hang, or wrong line number.
  • Every pattern the old tests used is caught.
  • Three should-fixes, all applied in c19f940: the near miss, the uncaught-shape class plus an honest header, and empty-literal false positives. Nits: wording, symlinks, the unreadable-file path, and mod placement.
• Delta: self-reviewed by the integrator.
• Correction rungs: 1 (no literal exists, from a single support module) and 2 (the guard).
• Authority: the maintainer selected test: one shared invented credential so CodeQL stops re-flagging every test file #126 on 2026-10-15; standing PR permission.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T22:14:57.945843Z	c19f940	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.