feat(secrets): redact server credentials from everything a mission records, and from the judge

The live canary run (01a0cf3d) proved the push refusal — push refused, patch redacted, delivery.secret_blocked, no branch on the forge — and found the next leak: the judge QUOTED the canary verbatim in its verdict, which is stored, shown in the UI and written into the repo's project memory for later missions. - mission_events::record (the one insert path) scrubs every event's detail and target: tool output such as a printenv, prompts, verdict events - the verdict's reason, guidance, check outputs and plan are scrubbed before being stored or remembered - the evidence sent to the judge, and each check's output before the judge model reads it, are scrubbed — the judge is another company's model Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
2026-09-23 12:12:25 -05:00
parent a86bd7272d
commit 4602e9b896
4 changed files with 78 additions and 4 deletions
@@ -366,7 +366,10 @@ impl Sandbox {
                    ran: true,
                    refused: false,
                    exit_code: out.exit_code,
-                    evidence: clamp_output(&body),
+                    // Scrubbed BEFORE the judge sees it: the judge is another
+                    // company's model, and `cat` on an agent's file would
+                    // otherwise send a leaked credential to it.
+                    evidence: crate::delivery_secrets::scrub(&clamp_output(&body)).into_owned(),
                }
            }
        }