fix(ci): redact every sandbox evidence publication sink

[seonghobae]

Problem

The central sandbox wrappers publish child-process output, command metadata, reviewer notes, structured diagnostics, and service log tails as durable review evidence. A verification tool, browser runner, dependency manager, or application process can echo an explicitly allowed credential into any of those fields, creating CWE-532 log disclosure even though the execution environment itself is scrubbed.

Change

• pass ordinary and timeout stdout/stderr through the shared redact_text boundary;
• redact service log tails before publication;
• redact sensitive separate options, --option=value, KEY=value, full Authorization values, bearer/basic values, JWTs, and known provider-token shapes;
• recursively redact credential-shaped JSON string values and object keys;
• parse shell-style command strings without executing them and reconstruct safe evidence;
• redact human-readable command displays, JSON result-envelope commands, and evidence notes;
• replace quadratic assignment rescanning with a bounded forward scan protected by deterministic instrumentation evidence;
• preserve the original execution argv, exit status, line boundaries, non-sensitive diagnostics, timeouts, cleanup, and fail-closed behavior;
• construct credential-shaped test fixtures from fragments so Secret Scan remains authoritative;
• align the central Strix snapshots with the already-reviewed secure aiohttp==3.14.3, cryptography==50.0.0, and compatible pyOpenSSL==26.4.0 closure required by the hard dependency gates;
• update CHANGELOG.md and document the trust boundary, limitations, rollback, and APA 7 standards basis.

Scope

Exactly ten files differ from main:

• CHANGELOG.md
• requirements-strix-ci.txt
• requirements-strix-ci-hashes.txt
• scripts/ci/redact_sensitive_log.py
• scripts/ci/sandboxed_verify.py
• scripts/ci/sandboxed_web_e2e.py
• tests/test_sandboxed_output_redaction.py
• tests/test_redact_json_key_boundary.py
• tests/test_redact_sensitive_log_contract.py
• docs/doctoring/sandboxed-command-log-redaction.md

The two snapshot files are minimum exact-base security alignment, not a functional dependency change for the sandbox wrappers. This clean replacement supersedes broad/noisy #754 and secret-scanner-triggering #756. It deliberately excludes .jules files, unrelated workflow changes, and committed PAT-shaped literals.

Verification contract

Focused regression evidence covers completed and timed-out output, command displays, JSON result fields, evidence notes, service tails, nested JSON values, JSON keys, complete Authorization values, missing/bounded logs, separate/equal sensitive options, assignments, standalone provider tokens, malformed shell quoting, bounded scanning work, ordinary scalar preservation, and direct script execution. Every credential-shaped value is assembled at runtime and must be absent from captured stdout and stderr.

Verification gate

The PR remains draft until exact-head central tests, 100% production statement/branch coverage for the changed surface, production docstrings, Secret Scan, Semgrep, CodeQL, Python Security, dependency review, OSV, Trivy, Security Scan, OpenCode, Noema, CodeRabbit, independent current-head approval, and branch protection pass. No prior-head or superseded-PR result is evidence for this head.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 947fa292-de84-4d1b-ae59-c6f18d0e07cb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by integrated PR #767, which preserves this complete evidence-redaction boundary and adds pre-publication stdout/stderr and service-log resource ceilings, overflow process-group termination, bounded suffix retention, and the combined confidentiality/availability regression suite. Keeping both branches open would duplicate reviews and exact-head security runs. #767 has successful central security, supply-chain, Strix, and CodeRabbit evidence and remains subject to independent approval and branch protection.