LangSmith API keys

• trufflehog 3.97.4
• titus (kingfisher.langchain.1/.2)
• poltergeist
• Reference 1
• Reference 2
• Reference 3
• Reference 4

Graduated arrival contract (#210, registry detector since redact-secret#728; research #219 observed 2026-09-24). LangSmith's own documentation establishes two API-key roles — Personal Access Tokens and workspace/org service keys — their issuance under Settings → API Keys, one-time display and the LANGSMITH_API_KEY / X-API-Key contexts, but states no prefix, length or alphabet. The docs render only masked lsv2_pt_…/lsv2_sk_… forms. The segment grammar lsv2_(pt|sk)_<32 lowercase hex>_<10 lowercase hex> is tool-corroborated: trufflehog 3.97.4's langsmith detector matches exactly that (lowercase only), while Titus/Kingfisher and Poltergeist match the same widths case-insensitively. The provider's own SDK redactor (provider code) is looser — [A-Za-z0-9]{32,} plus any number of _ tails — and is a redaction heuristic, not a format spec. Uppercase hex is therefore neither claimed nor twinned. The legacy ls__ form, LangSmith license keys, SCIM bearer tokens, OAuth access/refresh tokens, the internal X-Service-Key JWT and the uncorroborated deployment keys (sk-*/dep-srv-*) are separate credentials this contract does not claim; none is used as a benign control. gitleaks 8.30.1 has no LangSmith rule, so a gitleaks miss is the expected peer result.