# Reviewed noncredential schema declaration and deterministic test inputs only.
[extend]
useDefault = true
[[allowlists]]
description = "Pydantic enrollment secrets container declaration, no secret value"
paths = ['backend/app/schemas/enrollment\.py$']
regexTarget = "line"
regexes = ['secrets: EnrollmentSecretsV1 = EnrollmentSecretsV1\(\)']
condition = "AND"
targetRules = ["generic-api-key"]
[[allowlists]]
description = "Synthetic noncredential test encryption key and idempotency/reason fixtures"
paths = ['backend/tests/test_(repopulse_adoption_runner|deployment_control_plane|enrollment_plane|mcp_rag_n8n_integrations)\.py$']
regexTarget = "line"
regexes = ['appops-test-key-with-at-least-32-bytes', 'apply-wsbc-(direct|evidence)-0001', 'enroll-wsbc-(interrupted|compensate)-0001', 'N8N-REASON-SYNTHETIC']
condition = "AND"
targetRules = ["generic-api-key"]
[[allowlists]]
description = "Synthetic forge bootstrap idempotency race fixture only"
paths = ['backend/tests/test_forge_bootstrap_apply\.py$']
regexTarget = "line"
regexes = ['^\s*key = "forge-integrity-race-0001"\r?$']
condition = "AND"
targetRules = ["generic-api-key"]
[[allowlists]]
description = "Synthetic Forge OIDC API secret-key setting fixture only"
paths = ['backend/tests/test_forge_oidc_api\.py$']
regexTarget = "line"
regexes = ['^\s*monkeypatch\.setattr\(settings, "secret_key", "forge-oidc-api-secret-key-material-0123456789"\)\r?$']
condition = "AND"
targetRules = ["generic-api-key"]
[[allowlists]]
description = "Synthetic Forge secret-delivery secret-key setting fixture only"
paths = ['backend/tests/test_forge_secret_delivery\.py$']
regexTarget = "line"
regexes = ['^\s*monkeypatch\.setattr\(settings, "secret_key", "delivery-test-secret-key-material-0123456789"\)\r?$']
condition = "AND"
targetRules = ["generic-api-key"]
[[allowlists]]
description = "Synthetic MCP apply idempotency fixture only"
paths = ['backend/tests/test_mcp_rag_n8n_integrations\.py$']
regexTarget = "line"
regexes = ['^\s*\{"plan": profile, "idempotencyKey": "forge-mcp-apply-0001"\},\r?$']
condition = "AND"
targetRules = ["generic-api-key"]
[[allowlists]]
description = "Exact synthetic Forge route-stage API idempotency values"
paths = ['backend[/\\]+tests[/\\]+test_forge_route_stage_api\.py$']
regexTarget = "secret"
regexes = ['^forge-route-api-0001$', '^forge-route-api-0002$', '^forge-route-api-duplicate-01$', '^forge-route-api-duplicate-02$']
condition = "AND"
targetRules = ["generic-api-key"]

[[allowlists]]
description = "Exact synthetic Forge route-stage service idempotency values"
paths = ['backend[/\\]+tests[/\\]+test_forge_route_stage_service\.py$']
regexTarget = "secret"
regexes = ['^route-stage-key-0001$', '^route-stage-key-0002$', '^route-stage-key-0003$', '^route-stage-key-0004$', '^route-stage-key-0005$', '^route-stage-key-0006$']
condition = "AND"
targetRules = ["generic-api-key"]