test(qa): add contention and secret-detection coverage with CI gates

[Haserjian]

Summary

• Add multi-agent contention simulation tests: same-file claim race, port double-claim, steal-against-fresh-holder, heavy concurrent weave append (50 writers / 16 threads)
• Add secret-detection fixture corpus (6 specimens covering all 7 default private patterns) with parameterized regression tests
• Add content_scan_exempt_globs to classifier policy so synthetic test fixtures and inline-pattern test files don't self-block the PR public-private guard
• Wire new QA slices into three CI workflows: PR gates, nightly simulations, release checks

Supersedes #34 (missing Signed-off-by + incomplete classifier exemption). Supersedes #33 (mixed QA + bridge scope).

Commits

Commit	What
7e6b027	QA slice: test_contention.py, test_secret_detection.py, 6 fixture files, 3 workflow YAMLs
b29332d	Classifier exemption: content_scan_exempt_globs in public_private.py + policy.json for fixtures
d07cda2	Regression test locking the exemption behavior
6f1deb0	Widen exemption to cover inline-pattern test files (test_secret_detection.py, test_public_private.py)

Test plan

• 320 tests passing locally, 1 pre-existing skip
• Contention tests: 4/4 passing (S1, S2, S4, S11)
• Secret detection tests: 11/11 passing
• Exemption regression test: 1/1 passing
• Existing public-private tests: 8/8 passing
• All commits include Signed-off-by trailer
• Diff against main is QA-only (14 files, +517/-1, no bridge code)
• CI: public-private-guard passes with widened exemption
• CI: DCO check passes with sign-off trailers

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds QA coverage and CI hooks to validate AgentMesh’s coordination/provenance behavior under contention and to regression-test content-based private/secret detection (including a policy mechanism to exempt known synthetic fixtures from content scanning).

Changes:

• Added new pytest suites for contention scenarios and secret/sensitive-content detection using fixtures and inline content.
• Extended classify_path() policy to support content_scan_exempt_globs and added a repo policy to exempt synthetic secret fixtures/tests.
• Added/updated GitHub Actions workflows for PR QA slices, nightly simulations, and release checks.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
tests/test_secret_detection.py	New regression tests for content-based private pattern detection using fixtures + inline cases.
tests/test_public_private.py	Adds regression test ensuring content-scan exemptions bypass secret detection.
tests/test_contention.py	New concurrency/contention simulations for claims, stealing, and heavy weave appends.
tests/fixtures/secrets/private_key.pem	Secret-like fixture to exercise private-key detection.
tests/fixtures/secrets/pricing_doc.md	Business-sensitive fixture to exercise pricing detection.
tests/fixtures/secrets/ghp_token.py	Secret-like fixture to exercise GitHub token detection.
tests/fixtures/secrets/edge_ghp_in_comment.py	Secret-like fixture to ensure comment content is scanned.
tests/fixtures/secrets/clean_public.py	Clean control fixture.
tests/fixtures/secrets/aws_key.py	Secret-like fixture to exercise AWS key detection.
src/agentmesh/public_private.py	Adds content_scan_exempt_globs to skip content scanning for matching paths.
.github/workflows/release-agentmesh-check.yml	New release-time build/install/CLI verification + full test run.
.github/workflows/pr-agentmesh-qa.yml	New PR workflow running contention + secret-detection slices.
.github/workflows/nightly-agentmesh-simulations.yml	New nightly workflow running full suite (matrix) + contention slice.
.agentmesh/policy.json	Adds repo policy exemptions so synthetic fixtures/tests don’t trip the public-private guard.

Comments suppressed due to low confidence (1)

src/agentmesh/public_private.py:136

• When content_scan_exempt_globs matches, content scanning is silently skipped, so callers can't tell whether a file was deemed PUBLIC/REVIEW because it was clean vs because scanning was bypassed. Consider appending an explicit reason (e.g., that content scan was skipped due to an exemption) to improve auditability/debugging of classification results.

    content_scan_exempt = _policy_list(cfg.get("content_scan_exempt_globs"))

    rel = _rel_path(path, repo_root)
    reasons: list[str] = []

    if _has_match(rel, private_globs):
        reasons.append("path matches private pattern")

    content_marker = None
    if path.exists() and path.is_file() and not _has_match(rel, content_scan_exempt):
        try:
            text = path.read_text(errors="ignore")
        except OSError:
            text = ""
        content_marker = _content_has_private_marker(text, private_patterns)
        if content_marker:
            reasons.append(f"content matches private pattern: {content_marker}")

---

You can also share your feedback on Copilot code review. Take the survey.

[github-actions]

AgentMesh Lineage Check

Lineage coverage: 1/1 commits (100%)
Witness coverage: 1/1 commits (100%)

Metric	Value
Commits in PR	1
With episode trailer	1
Lineage coverage	100%
Unique episodes	1
Files changed	14
Witness trailers present	1
Witness signatures verified	1
Witness coverage	100%

Commit Details

SHA	Message	Episode
b41e790	test(qa): add contention and secret-detection coverage wi...	ep_019cf5ac9f767b127bf41c8c

Witness Verification Details

SHA	Witness Status
b41e790	VERIFIED

Checked by agentmesh-action | What is lineage coverage?