The embedded-secret guard landed on main after this branch was cut, so the merge is the first run that sees the Connect agent protocol fixtures. Five of its PEM-header hits are the fixtures themselves: the inventory field registry samples a private-key header as a value class the frozen schema cannot carry, the inventory secret-like vectors feed one to the normalizer, and the redaction vectors feed one to the ruleset that must replace it.
Those files are a byte-identical mirror of the Connect tree — rustfs/tests/agent_protocol_fixtures.rs pins every set against its MANIFEST.sha256 — so the vectors cannot be reworded here, which is what NON_SECRET_LITERALS exists for.
The three new entries stay narrow. The bare-header entry carries its closing quote, so it excuses only a JSON string that ends at the header and can hold no key body; a header followed by one still fires, including on a line that holds both. The other two carry their bodies, and both bodies are unusable: a PKCS#8 wrapper whose OCTET STRING declares 32 bytes and holds the 7 ASCII bytes "example", and an RSA body that spells out it is not a real key.
Verification: scripts/check_embedded_secrets.sh passes, --self-test passes, and a probe file holding a real-shaped key — alone, and on the same line as the excused sample — still fails the guard.
overtrue