#374 test(proxy): mark output secret scan parity

[Anonymous]

Originally created by: jasperdingg

Slice

• Repo: doberman-core
• Feature / Slice: [#332]
• Plan reference: Issue [#332]

What this PR does

Marks the existing MCP proxy test as the parity proof for blocking credential-bearing tool output and regenerates the parity matrix.

Closes [#332].

Tests added (run in CI)

• Parity test, full suite, lint, formatting, and import checks pass.

Public-release safety (doberman-core only)

• [x] Contains no enterprise/hosted code, proprietary detection, customer data, secrets, or commercial-license code
• [x] Core builds/tests/runs without the enterprise package

Security checklist

• [x] Fails closed on error / uncertainty
• [x] No secrets, full files, or unredacted prompts logged or committed
• [x] No guardrail/learning loosening; test-only change
• [x] Existing BLOCK/AUTH decisions retain reason codes and explanations
• [x] doberman-core does not import doberman_enterprise

Edge cases covered / Deviations from plan / Risks introduced

• Credential-bearing output is blocked and not exposed.
• No production behavior changed.

[Anonymous]

Ticket changed by: fu351

• status: open --> closed

[Anonymous]

Originally posted by: fu351

Merged, and this closes [#332]. What I liked most: you didn't hand-edit the generated table. You added the marker and let the generator produce the cell, so CI's own test_parity_doc_is_current proves the doc matches the markers, which is exactly what that file's "do not edit by hand" header is for. The marker key and host both come from the closed vocabulary in tools/parity/guarantees.py, so a typo would have failed the build instead of shipping quietly.

One note from my side: [#332] asked for a mutation check and the PR body didn't mention one, so I ran it before merging. Neutralizing _scan_output_for_secrets at both call sites in executor.py sends the marked test red; reverted, green again. The cell claims exactly what the test proves, no more.

If you want the next rung on the parity ladder: [#334] (level-4) is the AUTH-deadline auto-deny and timeout-logging pair on Codex. A natural step up from this one, and you clearly have the generator workflow down now.