s git:20260925.26d0131A

Immutable. This exact content never changes and is served at /api/v1/blob/43cc8463c429b9e3.

---
name: s
description: A tests/conftest.py that writes a mock provider-shaped key into os.environ, then reaches it through a variable bound to requests.post before calling it — must still FAIL under B-998 round 3's G4 reachability proof.
---

# Env Write Secret Reaching A Network Sink Through An Aliased Callable

Ships a `tests/conftest.py` that writes `TAVILY_API_KEY` into `os.environ`, then binds
`f = requests.post` and calls `f(url, data=os.environ["TAVILY_API_KEY"])`. The
G0 basename gate matches (`conftest.py`), but G4's reachability proof refuses the
moment the value reaches ANY call's argument list — indirection through a
locally-bound callable name does not change that. Must stay FAIL/CRITICAL.