Mask agent session transcripts and supervisor grade evidence

[ppXD]

Summary

• Session transcripts are masked wherever they are stored. The agent's resumable session transcript is now masked with the run's own redactor: the model key, broker and MCP tokens, and the workflow secrets from AgentTask.WorkflowSecrets.
  • This covers result_jsonb.sessionTranscript and its offload, the mid-run checkpoint artifacts, and the AgentRun resume payload.
  • It applies on the launch path and on the re-attach path (AgentRunExecutor.CaptureSessionTranscriptAsync, ArtifactSessionTranscriptCheckpointer).
  • SessionTranscriptRedaction masks inside JSON values, so every line still parses for --resume. It accepts lone-surrogate escapes. On a line it cannot parse (a torn tail), it also replaces each secret's JSON-escaped forms.
• A warm revise round still gets the exact conversation. It continues the session in-process and its goal only says "continue", so it is handed the session exactly as the agent wrote it. That copy is held in memory beside the masked one and is never written to task_jsonb. Respawns and checkpoint resumes restore the masked copy and re-send the sealed goal.
• The spool is owner-only. The per-run spool is created 0700 at launch, and out.log, err.log and the FIFOs are written 0600. They hold raw, pre-redaction output and were readable by every local user.
• Supervisor grading masks secrets. All nine grade lanes, plus the captured and baseline requests, now receive the unit's sealed workflow secrets and the node-scope secrets. clone-failed, grade-error and patch-apply-failed details are masked too. A secret resolved in an operator-floor or model-authored acceptance argv no longer reaches the evidence artifact or the decision-tape tail.

There are no API, schema or wire changes. Rows written before this change keep what they hold.

Test plan

• Unit: full suite (13676 passed, 1 skipped), including:
  • SessionTranscriptRedactionTests: escaped secrets, a complete line with a lone-surrogate escape, and torn tails in relaxed and ASCII-only escaping.
  • AgentRunExecutorReviseTests: a warm round restores the exact conversation.
  • Tests for spool modes and grade-lane secrets.
• Integration (Postgres):
  • AgentSessionTranscriptMaskingFlowTests, launch and re-attach arms: result_jsonb, the resume payload and the checkpoints are masked.
  • AgentRunReviseLoopFlowTests warm-revision arm: the revision reads its secret from the exact conversation; result_jsonb, the resume payload and both rounds' checkpoints are masked; task_jsonb stays clean.
  • SupervisorGradeEvidenceMaskingFlowTests.
  • Related revise, checkpoint, re-attach, executor, broker and recovery classes: 409 passed.
• E2E: in MaskedSessionResumeE2ETests, both attempts are brokered through the container's model-credential broker, the way a Sandbox:RequireConfinement deployment must launch them. The second attempt resumes from the masked session, the run token the first attempt echoed is masked in it, and the respawn's re-sent goal still carries the secret.
• Mutation checks: each of the following turns a test red:
  • restoring the masked copy into the warm round;
  • leaving the redactor out of the revise round's capture;
  • leaving it out of the re-attach capture;
  • leaving it out of the re-attach checkpoint tick;
  • decoding with Utf8JsonReader.GetString;
  • leaving the escaped forms out of the fallback;
  • capturing the session unmasked (the E2E fails on the echoed run token).
• Sandbox lane in CI (pinned Claude CLI):
  • GoalChannelE2ETests masked-resume arm, root and non-root: the restored turn reaches the model masked, and the re-sent goal still carries the value.
  • SpoolPermissionsE2ETests: the spool is owner-only under bubblewrap.
• Engine lane in CI (Sandbox__RequireConfinement=true, bubblewrap): MaskedSessionResumeE2ETests runs brokered and confined.