[sectoramen]

Closes #772. Independent of #786/#789/#790: no file in common except CHANGELOG.md (the usual ### 🐛 Bug Fixes heading hunk).

What was wrong

Two enum-valued inputs silently became their default on any unrecognised value, both measured on v2.5.4:

• --redaction-strategy, on --file and --stdin, in a profile, in an explicit --config, or in an auto-discovered .ferret-scan.yaml: anything other than exactly simple, format_preserving or synthetic redacted with format_preserving at exit 0, empty stderr. SIMPLE wrote SSN: ***-**-8901 where simple writes SSN: [SSN-REDACTED] (last four digits, email's first character and domain left in the clear). A typo on the flag threw away a valid strategy: simple in the config. The explicit config's schema trimmed and comma-split, so " simple ", "simple,", "simple,synthetic" and " " passed it and reached a parser that matched none of them. No report named the strategy applied.
• FERRET_PRECOMMIT_EXIT_ON ignored any value outside high, medium, low, none: with one MEDIUM finding, medium blocked the commit (rc 1) and MEDIUM, Medium, LOW let it through (rc 0). A gate failing open on a typo.

Root causes (main@e8c6fe2): redactors.ParseRedactionStrategy had no error return and a default: of format_preserving, called from four sites; the flag was an unvalidated flag.String; validateEnumField was lenient where the parser was exact; detector.go's switch had no default; pkg/scan.ParseStrategy/RedactFile mapped out-of-range values to format_preserving.

What changed (the issue's Resolution 1–9)

1. Exact match only, three strategy names, four exit-on names. No folding, trimming or lists: None/NONE block a HIGH finding today (the gate stays at high) and folding them to none would let that commit through after an upgrade; SIMPLE runs would switch from masked to placeholder output. Refusing keeps every rc-0 run byte-identical. A did you mean "simple"? hint is printed for a case/whitespace variant and the value is still refused.
2. Strict parser redactors.ParseRedactionStrategy(s) (RedactionStrategy, error); RedactionStrategyNames exported; RedactionStrategy.Valid(). The lenient parser is removed, so the compiler found every fallback site.
3. Typed carrier. finalConfiguration.redactionStrategy, parallel.JobConfig.RedactionStrategy and core.ScanConfig.RedactionStrategy are redactors.RedactionStrategy; the worker refuses a value outside the definition and reports it as a redaction failure for the file (nothing written). Zero value stays simple (audit-log integers unchanged).
4. One CLI helper applyRedactionStrategy, called on both entry points right after resolveConfiguration, before any scan, output directory or report. resolveConfiguration records the winning name and its layer; the message names the source: --redaction-strategy, profile "share" redaction.strategy in <path>, or redaction.strategy in <path> (auto-discovered) (Trust-boundary decision for a config discovered inside the scan target: opt-in gating, a THREAT_MODEL entry, and the pre-commit gate that silences the provenance disclosure #293).
5. Unconditional, effective value only. Validated whether or not this run redacts (redaction can be enabled by a config or profile); the stated cost is that a run that does not redact but carries a typo now exits 1.
6. Schema uses the parser's rule for redaction.strategy (validateExactEnumField, defaults and profiles); --format keeps the lenient rule since it already exits 1 downstream. TestRedactionStrategySpellingsAgreeWithTheRedactor pins the two together.
7. FERRET_PRECOMMIT_EXIT_ON: an unknown value is recorded as PrecommitDetector.ConfigError(); in pre-commit mode (--pre-commit-mode or a detected hook) both paths exit 1 before scanning, naming the variable, without "commit blocked" text (gate integrity: three ways the tool reports success on work it did not do (consolidates exit resolver, coverage ledger, --exclude) #667). Outside pre-commit mode the variable is not read. ShouldExitOnFindings keeps its in-code default: with the comment corrected.
8. pkg/scan: ParseStrategyStrict added; ParseStrategy Deprecated: and unchanged. RedactText/RedactFile reject RedactStrategy(7) before writing, as pkg/redact.NewEngine does.
9. Sequencing: resolveConfig returns an error for a pinned ConfigPath that exists and fails the strict load (parse or schema), so ScanText/ScanFile/RedactFile surface it; a missing path keeps the fix(config): name a config discovered in the working directory, and let pkg/scan pin or disable discovery #317 fallback. Without this, tightening the schema turned a pinned config with a custom pattern plus strategy: " simple " from 1 finding into 0 with err=nil.

One deviation from the issue text, stated: core.RedactFile's Strategy: "" keeps its documented meaning (format_preserving). It is an in-process Go API whose empty value means "not set", mirrored by its own tests; any set value that does not match is refused before the output path exists.

Measured, main@e8c6fe2 vs this PR

--file --enable-redaction --redaction-strategy <v>, SSN line of the redacted copy:

value	main	PR
simple	rc 0, SSN: [SSN-REDACTED]	identical
format_preserving	rc 0, SSN: ***-**-8901	identical
SIMPLE	rc 0, ***-**-8901 (format_preserving applied)	rc 1, no output dir, invalid redaction strategy "SIMPLE": valid values are simple, format_preserving, synthetic (did you mean "simple"?) (from --redaction-strategy)
simpel, " simple", bogus	rc 0, ***-**-8901	rc 1, no output dir
--stdin with SIMPLE/bogus	rc 0, 102 bytes redacted under format_preserving	rc 1, 0 bytes on stdout
explicit config " simple ", "simple,", "simple,synthetic", " "	rc 0, format_preserving	rc 1 from the schema
explicit config strategy: simple + --redaction-strategy bogus	rc 0, format_preserving (config discarded)	rc 1
auto-discovered .ferret-scan.yaml strategy: simpel	rc 0, format_preserving	rc 1, (from redaction.strategy in .ferret-scan.yaml (auto-discovered))

--pre-commit-mode, exit code on a MEDIUM-only fixture / a HIGH-only fixture:

FERRET_PRECOMMIT_EXIT_ON	main	PR
unset, "", high	0 / 1	0 / 1
medium, low	1 / 1	1 / 1
none	0 / 0	0 / 0
MEDIUM, Medium, meduim, " medium", LOW, None, NONE, off	0 / 1 (gate stays at high)	1 / 1 before scanning: FERRET_PRECOMMIT_EXIT_ON="MEDIUM" is not one of high, medium, low, none (did you mean "medium"?)
--stdin --pre-commit-mode with MEDIUM	0	1
outside pre-commit mode, MEDIUM	0	0 (no effect)

Golden corpus: UPDATE_GOLDEN=1 changes 0 files. make score: PASS, identical to main. No finding text, line or type changes, so suppression hashes are unchanged.

Tests, and that each fails on main

Test	Pins	On main
cmd TestAnUnusableRedactionStrategyIsRefusedOnEveryChannel	9 refused spellings × --file (rc 1, value + 3 names + source quoted, no output dir, empty stdout), --stdin (0 stdout bytes), explicit config defaults and profile, config-vs-flag precedence, auto-discovered file (message says auto-discovered), unconditional validation; canonical names rc 0 with the v2.5.4 bytes (non-vacuity: simple and format_preserving must differ)	rc 0 everywhere, output dir created, stdout written
cmd TestPreCommitExitOnIsRefusedWhenMisspelled	the 4 names keep 0/1/1/0 and 1/1/1/0; 10 misspellings rc 1 on both fixtures and --stdin, variable named, no "commit blocked", empty stdout; no effect outside pre-commit mode	rc 0 on every misspelling, scan ran
cmd TestEveryEnumValuedInputRejectsAnOutOfDomainValue	the derived class guard (below)	selects 8 inputs, fails on --redaction-strategy and FERRET_PRECOMMIT_EXIT_ON
config_test TestRedactionStrategySpellingsAgreeWithTheRedactor	24 spellings: schema (defaults and profile) and parser agree; "" unset for the schema, refused by the parser	main's schema accepts " simple ", "simple,", "simple,synthetic", " "
redactors TestParseRedactionStrategyIsExact, TestRedactionStrategyValid	the parser table, hints, round-trip with String(), Valid, zero value	new API
parallel TestRedaction_OutOfRangeStrategyIsRefusedNotDefaulted	a job with RedactionStrategy(7) is reported in UnredactedFiles, nothing written; zero value redacts	field was a string
core TestRedactFile_MisspelledStrategyIsRefusedBeforeAnyOutput	simpel/SIMPLE/" simple"/bogus error before the output dir exists; "" default unchanged	wrote format_preserving copies
pkg/scan TestParseStrategyStrict…, TestRedactTextRejects…, TestRedactFileRejects…BeforeWriting, TestASchemaRejectedPinnedConfigPathIsAnError	strict parser, deprecated parser unchanged, RedactStrategy(7) refused without writing, the sequencing guard with an exact-spelling control	new API / silent fallback

The class guard derives its set rather than keeping a list: every flag.String in cmd/main.go whose usage text enumerates values (parsed with go/ast; a strings.Join over a name list counts, which is how --checks is registered) and every FERRET_* row of docs/PRE_COMMIT_INTEGRATION.md's environment table whose options cell lists backticked values. Today that is --checks, --confidence, --disable-ip-types, --format, --redaction-strategy, FERRET_PRECOMMIT, FERRET_PRECOMMIT_EXIT_ON, FERRET_PRECOMMIT_EXIT_ON_FIRST, exactly the eight the issue predicted. Three exemptions carry a reason and fail if their input stops being selected: --disable-ip-types (warns and keeps detecting; the --stdin half is a sibling item), FERRET_PRECOMMIT_EXIT_ON_FIRST (nothing reads it), FERRET_PRECOMMIT (an unrecognised opt-out keeps the gate on).

Compatibility

• rc 1 is the existing usage-error code, so hooks fail closed. The repo's own docs and examples use only canonical values.
• Runs that exit 0 today are byte-identical (canonical names only). Runs with a non-canonical spelling exit 1 where they previously wrote output under a strategy they did not ask for; that is the fix.
• pkg/scan: only callers passing an undefined RedactStrategy constant, or a pinned ConfigPath naming a file that exists and is invalid, see a new error. ParseStrategy is unchanged.
• Audit-log strategy integers unchanged (no renumbering).

Docs

docs/user-guides/README-Redaction.md, docs/user-guides/README-Stdin.md, docs/configuration.md, docs/PRE_COMMIT_INTEGRATION.md (table row), docs/TEAM_SETUP_GUIDE.md, the --redaction-strategy usage text and internal/help/help.go now state the exact-spelling rule and that other values exit 1 naming the source.

Test plan

-- changelog                       RAN — entry present under [Unreleased] (42 line(s)); required because it changes what a release 
1 gofmt                            RAN — clean
1 go vet                           RAN — clean
1 go build                         RAN — ok
2 full suite (-count=1)            RAN — 89 packages ok
3 golden regen                     RAN — 0 files changed
4 redaction                        NEEDS-MANUAL — scan a fixture with --enable-redaction for EVERY strategy; for xlsx/docx read the part INSIDE the zip (grepping the compressed bytes returns 0 and looks like a pass)
5 suppression                      NEEDS-MANUAL — generate with the PARENT binary, apply with YOURS — same-binary round-tripping passes even when the hash inputs changed
6 timing / O(n^2)                  NEEDS-MANUAL — scaling curve at N/2N/4N with a NON-VACUITY floor (assert findings > 0 at every size) and distinct values (identical repeats let a quadratic measure as linear)
7 all 7 formats                    NEEDS-MANUAL — text json yaml csv junit gitlab-sast sarif
8 web / CSP                        N/A — no web/template/asset file touched
10 non-vacuity                     NEEDS-MANUAL — new tests MUST fail on the parent commit; prove it by reverting the production change (or the guard) and re-running
11 cross-platform vet              RAN — linux darwin windows
12 flake (3 repeats)               RAN — ./cmd ./internal/config ./internal/core ./internal/help ./internal/parallel ./internal/precommit ./internal/redactors ./internal/redactors/plaintext ./pkg/scan 
13 race (whole module)             RAN — 89 packages ok
-- -short mode                     FAIL — fails under -short
-- tree clean                      RAN — this run dirtied nothing

• -short FAIL: TestGrowthRatioMissesASparseQuadratic (goldencorpus), the perfguard host flake (8.15x against 8.0 on this Cloud Desktop; CI reads 4.6–5.0x), untouched by this PR. Re-run with output kept: that is the only failure. The full suite, the race run and the 3x flake repeats on every touched package were green.
• 4 redaction: the measured table above covers simple, format_preserving (byte-identical to main) and synthetic (accepted, random output) on --file and --stdin; the refused spellings create no output directory and write 0 bytes on --stdin.
• 5 suppression: N/A for hashes (no finding text/line/type changes; 0 golden files changed). The one hash-adjacent surface, redaction.strategy in a config, is now refused rather than re-hashed.
• 6 timing: N/A, no scanning path changed; the new work is one string comparison per run.
• 7 formats: N/A, no formatter touched; golden regeneration across all 9 outputs changed 0 files.
• 10 non-vacuity: the table above; the three CLI tests fail on main as listed, and the class guard on main selects the same eight inputs and fails on exactly the two this issue is about.

[github-actions]

🔍 Ferret Scan Results

✅ No sensitive data detected in the changed files.

---

🤖 This comment was automatically generated by Ferret Scan

[sectoramen]

Rebased onto main after #786 merged (21ae95d -> 4bf34d4). GitHub flagged the CHANGELOG as conflicting because both sides opened the ### 🐛 Bug Fixes section under [Unreleased]; the bullet now sits after #786's. Everything outside CHANGELOG.md is byte-identical to the previous head (same git patch-id). Build, vet, the touched packages and goldencorpus pass on the rebased head (the only red in repeated runs is TestGrowthRatioMissesASparseQuadratic, which fails at the same rate on unchanged main on this host); CI is re-running.

[github-actions]

🔍 Ferret Scan Results

✅ No sensitive data detected in the changed files.

---

🤖 This comment was automatically generated by Ferret Scan

[github-actions]

🔍 Ferret Scan Results

Gate mode: report — findings are reported here and do not fail this check; a scan that fails or is incomplete still does.

⚠️ Sensitive data detected in 12 scanned file(s):

• High confidence: 4 findings
• Medium confidence: 1 findings

Findings Summary:

File	Type	Confidence	Line
main.go	SSN	HIGH	1709
main.go	SSN	HIGH	3440
stdin.go	PERSON_NAME	HIGH	111
stdin.go	INSURANCE_MEMBER_ID	MEDIUM	116
apply.go	INTELLECTUAL_PROPERTY	HIGH	102

Next Steps:

1. Review the findings above
2. Remove or redact any actual sensitive data
3. Add suppressions for false positives
4. Re-run the scan after making changes

---

🤖 This comment was automatically generated by Ferret Scan