Adds structured (name/value pair) and budget (past the node and character
caps) probe classes. Finds 32 guards that pass a secret past the 25000-node
walker budget; recorded in the known-holes baseline, not fixed here (the
root cause is the vendored shared region owned by the sync generator).
Co-Authored-By: RuFlo <ruv@ruv.net>
scripts/probe-mod-guards.mjs bundles each hooks/guard.ts with esbuild and runs a
97-probe corpus through its verdict: invisible/bidi splits, nesting to 5000,
wide/huge inputs, secrets in object keys, encodings, regex-DoS stress timed per
call (50 ms gate), benign look-alikes. Calibrates each guard's real secret
surface first so a miss is a real bypass. A fast subset runs last in
smoke-all-plugins against a known-holes baseline. Findings (4 root causes across
32 guards, no ReDoS/crash/hang) are in v3/docs/validation/mod-guard-probe-2026-10.md.
No plugin code changed.
Co-Authored-By: RuFlo <ruv@ruv.net>
Stuart Kerr