fix(ci): route the pip-stderr log lines through the context redactor

[CrysisDeu]

Summary

main is red on Backend Tests shards + Coverage Gate:
test_security_posture.py::TestGateSideLogRedactorSpelling::test_no_new_gate_side_log_line_reads_the_baseline_redactor fails with dashboard/handlers/memory.py: 2 sites, census says 0.

Cross-merge: the pip-stderr redaction (#7283) added two redact_and_truncate log sites to memory.py, and the census ratchet (#7278) landed with a pre-#7283 count. Nothing re-measures the census at merge, so main merged red — same class as #7492's files.py re-measure.

This takes the ratchet's preferred remedy (convert, not re-count): both install-failure warnings now reach their text through redact_log_via_context, so a loaded companion's extra credential regexes apply instead of the OSS baseline. The _PIP_STDERR_LOG_CHARS bound is a slice applied after redaction saw the full decoded stderr, preserving the redact-before-bound invariant. The census entry for memory.py stays at 0, which the scanner now agrees with. The diff is the two call sites plus the import and the constant's comment — memory.py stays in the black baseline untouched.

Pattern harvest

Rule candidate: when two PRs land concurrently and one adds a ratchet whose baseline was measured before the other's sites existed, main merges red with neither PR at fault; a merge-time re-measure of ratchet baselines (or a required merge-queue) is the structural fix. Until then, unblockers should prefer the ratchet's own named remedy (convert the site) over re-counting the baseline, so the debt shrinks instead of being re-legitimized.

Testing

• test/test_security_posture.py — 47 passed (the failing census test now green)
• test/test_handlers_memory_coverage.py — passed (228 total in the combined run)
• black baseline gate / flake8 / isort / mypy clean on the touched file

no linked issue: main-breakage unblocker, same shape as #7492.

[github-actions]

GPT 5.6 Review — ✅ no blocking findings

GPT 5.6 completed its review of a65d80391a57ee7aa36042278c7cba45a2417b01 and found no blocking issues.

This comment is updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] a65d803

False positive or not applicable? A repository writer can comment:
/ai-review override gpt a65d80391a57ee7aa36042278c7cba45a2417b01: <one-sentence reason>

[github-actions]

Design Review (Fable 5) — ✅ PASS

Design-level review of a65d80391a57ee7aa36042278c7cba45a2417b01 — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

Design-Verdict: PASS

Correct unblocker: converts the two sites per the ratchet's own remedy, keeps redact-before-bound, and shrinks the debt instead of re-counting it.

[DESIGN-REVIEWED] a65d803

[github-actions]

Opus 4.8 Review — ✅ no blocking findings

Reviewed a65d80391a57ee7aa36042278c7cba45a2417b01 — this comment is updated in place on each push.

Review details

No findings.

[OPUS-REVIEWED] a65d803

Verdict parsed from the review's SHA-scoped output markers for commit a65d80391a57ee7aa36042278c7cba45a2417b01.

False positive or not applicable? A repository writer can comment:
/ai-review override fable a65d80391a57ee7aa36042278c7cba45a2417b01: <one-sentence reason>

[github-actions]

First Principles Review (Fable 5) — ✅ PASS

Premise-level review of a65d80391a57ee7aa36042278c7cba45a2417b01 — why this exists and whether the shipped surface is the smallest honest version. Updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

I've verified everything I need. The change is exactly what the description claims: two call sites, one import swap, one comment. The conversion target redact_log_via_context pre-exists with 3 other consumers, the slice-after-redaction idiom matches update_provider.py:466-467, redact_and_truncate retains ~12 other consuming modules (so no deletion opportunity), and the census gate's own docstring (test_security_posture.py:219-223) names "calling redact_log_via_context" as the preferred way to clear it — making this the documented remedy, not an invented one. The description explicitly states the structural root cause (no merge-time baseline re-measure) is out of scope and names what's left.

First-Principles-Verdict: PASS

A red-main unblocker that takes the ratchet's own documented remedy — convert the site — instead of re-legitimizing the debt by re-counting.

What this change ships

Intent: get main's Backend Tests green again after two concurrently-merged PRs left the redactor census stale — a FIX.

1. Two pip install-failure log lines now redact through the companion-aware pass, not the OSS baseline — justified (the census gate's named remedy, test_security_posture.py:219-223; unwedges red main).
2. On a companion host whose policy fails to compose, those two lines' text is withheld rather than baseline-redacted — justified (the adopted helper's fail-closed contract, platform/context.py:749-759).
3. The 500-char bound becomes an explicit slice after redaction — justified (same idiom as the existing consumer, update_provider.py:466-467; keeps redact-before-bound).
4. The _PIP_STDERR_LOG_CHARS comment now describes the new spelling — rides along, declared.

Every item is derived: the fix follows the mechanism the ratchet's census docstring prescribes, the helper pre-exists (3 prior consumers: update_provider.py, task_planner.py, name_grant.py — grepped redact_log_via_context\(), no new surface is introduced, and the out-of-scope root cause (no merge-time re-measure of ratchet baselines) is named as such in the description rather than papered over.

[FIRST-PRINCIPLES-REVIEWED] a65d803

[CrysisDeu]

Superseded by #7572, which landed the same conversion first. Closing.