fix(pe3): require a credential-store access shape, not a bare noun

[rodboev]

Summary

PE3 now requires a credential-store operation tied to the matched keyring or keychain noun in Markdown and text prose. Bare descriptive nouns remain clean; actionable reads, writes, mutations, API or CLI commands, fenced content, and code or configuration remain detected.

Root cause

The vocabulary pattern flagged credential-store nouns without requiring an access shape. A nearby-word qualifier could also let benign reading text suppress a later operation.

Diff Notes

• Bound operation matching to the exact noun and its line or clause, including post-noun operations.
• Kept access-policy, API-documentation, CLI-reference, lookup, query, and benign-reading prose clean while preserving actionable operations.
• Centralized shared fence lexemes and logical line-break handling, while keeping analyzer and runner fence walkers separate.

Scope

Limited to PE3 credential-store qualification, shared fence and line handling, and focused regressions. Other PE rules and finding, report, severity, score, recommendation, suppression, and SARIF contracts are unchanged.

Closes #396

[rng1995]

[SkillSpector Review]

Requesting changes for a remaining PE3 false-positive path. The new nearby-word test treats descriptive access terminology as an access action, so ordinary prose can still become a high-severity credential-access finding. Please tighten the relationship between the store noun and an actual read/retrieve/mutation instruction and add a descriptive keyring access policy-style regression.

[rng1995]

[SkillSpector Maintainer Ping]

@rodboev, please address the outstanding PE3 review feedback on this PR. Descriptive prose such as This section documents the keyring access policy. must not become a HIGH credential-access finding merely because access appears near keyring. Please tighten the action relationship, add the requested descriptive-prose regression, resolve the review thread, and reply here when the branch is ready for re-review.

The branch is currently behind main. GitHub reports it as mergeable with no conflicts, but please update it from main, resolve any conflicts that surface during that update, and rerun the required checks.

[mohgupta-ship-it]

Powered by Codex: PR council review result.

This is a triage signal, not a maintainer approval.

• Rating: bugfix
• Confidence: medium-high
• Status read: Changes requested, green checks
• Review method: fresh GitHub metadata/body/files/reviews/checks plus selected diffs; council lenses were spec fit, dead-code/reachability, YAGNI/scope, design/coupling, and code standards/tests.
• Council assessment: Narrows PE3 credential-store detection from bare noun matches toward access-shape matches. Sampled current head appears to address the prior false-positive class, but review remains unresolved.
• Recommended action: Request focused re-review before merge.

[rng1995]

[SkillSpector Review]

Re-review: the PE3 credential-store operation is now tied to the matched noun, descriptive access-policy/control prose stays clean, actionable read/write/exfiltration cases remain detected, the requested regressions are present, and all required checks pass. Approved.

[rng1995]

[SkillSpector Review]

Current-head recheck: the subsequent main merge contains only the already-reviewed #368 CLI fix; the PE3 changes are unchanged, the branch remains conflict-free, and all five required checks pass. Approval stands.