Seal workflow secrets across agent and sub-workflow handoffs

[ppXD]

Summary

• A workflow secret resolved into an agent.run goal or a flow.subworkflow input was stored in plaintext. It landed in the suspend wait row, agent_run.task_jsonb and the child's workflow_run_request.normalized_payload_json. Viewers read it back as the pending wait, the agent goal and NormalizedPayload. The fix:
  • Every suspend payload is now masked with the node scope's secrets.
  • A task or child payload handed to another run is stored masked, with the exact copy encrypted beside it. Migration 0247 adds two nullable ciphertext columns, and the existing sensitive-payload protector does the encryption.
  • The executor and the child's scope build run from the exact copy, so the platform never runs on a mask.
• The receiving run now treats what it was handed as secret:
  • The agent run's SecretRedactor folds in the task's secret values, inside the credential resolve. Launch, re-attach and the re-opened MCP endpoint therefore rebuild the same fingerprint.
  • The agent.critic scope gets a CaptureRedactor.
  • A child keeps the inherited values as secrets and taints the trigger/input keys that carry them, on both the fresh and the replay scope path. Its records, map snapshots and Terminal guard then treat them like its own.
  • Supervisor spawns and review children are sealed from the ambient node redactor. The supervisor's work-plan goal is masked.
• The run's verdicts on that work no longer carry the value back out:
  • The output critic sees the exact goal, and models restate it. Its rationale, issues and critique are masked with the task's secrets before the executor writes the review.completed beat, the flagged warning event and reviewFeedback (AgentRunExecutor.MaskedVerdict).
  • An acceptance argv such as ["sh","-c","… {{team.X}} …"] still runs exactly. Every executor grade request now carries the task's secrets, and SupervisorAcceptanceGrader masks the evidence text, tail, oracle note and detail before storing the evidence artifact a Viewer can download (SupervisorAcceptanceGrader.MaskedGrade).

Deploy notes

• Drain old workers first. Workers on the previous build do not know the sealed columns. An old executor would launch a sealed agent run from its masked goal. An old engine would run a sealed child with literal [REDACTED] inputs, because it reads only normalized_payload_json. Stop or drain every old engine and agent-executor worker before any new-build worker stages agent runs or sub-workflow children; do not overlap versions.
• No backfill. Rows written before this change carry no ciphertext and keep executing from their public columns, so in-flight waits, agent runs, child runs, reruns and resumes behave exactly as before. Those rows also keep any plaintext they already hold, and Viewers can still read it: agent_run.task_jsonb of earlier secret-bearing goals, pending wait payloads suspended at deploy, earlier child request payloads, and anything already written to events, records, results and evidence artifacts. A one-off backfill is possible. It is safe for pending wait and child request payloads. task_jsonb of terminal agent runs needs care, because the completion composer re-derives contract hashes from it.
• Not covered: supervisor-lane acceptance grades (SupervisorTurnService.Rehydrate) do not carry workflow secrets yet. A supervisor acceptanceChecks argv that resolves a secret would still put it into its own grade evidence.

Test plan

• Unit: full CodeSpace.UnitTests passes (13435 passed, 1 skipped). New coverage:
  • masked verdict sinks (approve and flag) and the pure MaskedVerdict;
  • AcceptanceEvidenceSecretMaskingTests, using the real grader and TestsPassGrader: exact argv executed, stored evidence, tail, note and detail masked, setup-failure prefix and class preserved, no-secret grade byte-identical;
  • every repository lane (branch, patch, multi-repo) passes the task's secrets to the grade;
  • sealer, redactor and taint units.
• Integration, SecretTaintAcrossSuspendsFlowTests (16 cases). Each case runs an all-table + artifact canary sweep (every text/jsonb/bytea column) and checks every Viewer read. Cases include:
  • agent goal, subworkflow inputs, child Terminal guard (path and value), child map, replay of a sealed child, supervisor plan goal;
  • a pre-sealing agent run still executing;
  • a goal-quoting reviewer (approve and flag);
  • acceptance argv carrying a secret: exact-pass, silent, and echo cases, with the Viewer downloading the evidence;
  • a child resumed through its variable-snapshot replay scope (map and Terminal).
• Integration regressions: acceptance/oracle (284 passed, 1 skipped); review, critic, revise, subworkflow and agent executor (411 passed, 10 skipped).
• E2E over HTTP, SecretTaintRunSurfaceE2ETests:
  • an Owner stores secrets and runs agent and child workflows; a Viewer reads every run surface and nothing at rest holds either secret;
  • a reviewed and graded agent run; the Viewer downloads GET /api/artifacts/{evidenceId} and finds only the mask.
• Mutation checks. Each of these makes its tests fail: removing MaskedVerdict, removing MaskedGrade, dropping the local or repository-lane secret wiring, and dropping the replay-path taint union in WorkflowEngine.BuildScopeForReplayAsync.
• Deploy: drain old engine and executor workers before the new build stages work.