fix(ci): secure and bound every sandbox evidence stream

.github/workflows/one-shot-pr767-focus-current-main.yml

@@ -0,0 +1,221 @@
+name: One-shot PR 767 focused current-main rebuild
+
+on:
+  push:
+    branches:
+      - fix/sandboxed-output-resource-bounds
+    paths:
+      - .github/workflows/one-shot-pr767-focus-current-main.yml
+
+permissions:
+  contents: read
+
+concurrency:
+  group: one-shot-pr767-focused-current-main
+  cancel-in-progress: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  focus-and-verify:
+    if: >-
+      github.repository == 'ContextualWisdomLab/.github'
+      && github.ref == 'refs/heads/fix/sandboxed-output-resource-bounds'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      contents: write
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact legacy head
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up current stable Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+
+      - name: Rebuild focused sandbox security slice on protected main
+        env:
+          EXPECTED_HEAD: ${{ github.sha }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          test "$(git rev-parse HEAD)" = "$EXPECTED_HEAD"
+          git fetch --no-tags origin main
+          legacy_tree="$EXPECTED_HEAD"
+          git checkout --detach origin/main
+          git checkout "$legacy_tree" -- \
+            docs/doctoring/sandboxed-command-log-redaction.md \
+            docs/doctoring/sandboxed-output-resource-bounds.md \
+            docs/superpowers/plans/2026-08-05-sandboxed-output-resource-bounds.md \
+            docs/superpowers/specs/2026-08-05-sandboxed-output-resource-bounds-design.md \
+            scripts/ci/bounded_subprocess.py \
+            scripts/ci/redact_sensitive_log.py \
+            scripts/ci/run_opencode_review_model_pool.sh \
+            scripts/ci/sandboxed_verify.py \
+            scripts/ci/sandboxed_web_e2e.py \
+            tests/test_bounded_subprocess.py \
+            tests/test_bounded_subprocess_capture_startup.py \
+            tests/test_bounded_subprocess_contract.py \
+            tests/test_opencode_model_pool_runner.py \
+            tests/test_redact_json_key_boundary.py \
+            tests/test_redact_sensitive_log_contract.py \
+            tests/test_sandboxed_entrypoint_and_cleanup_coverage.py \
+            tests/test_sandboxed_output_redaction.py \
+            tests/test_sandboxed_service_capture_startup.py \
+            tests/test_sandboxed_verify_output_limits.py \
+            tests/test_sandboxed_web_e2e.py \
+            tests/test_sandboxed_web_e2e_branch_contract.py \
+            tests/test_sandboxed_web_e2e_output_limits.py
+
+          cat >.github/workflows/sandboxed-evidence-quality-ci.yml <<'YAML'
+          name: Sandboxed Evidence Quality CI
+
+          on:
+            pull_request:
+              branches: [main]
+              paths:
+                - ".github/workflows/sandboxed-evidence-quality-ci.yml"
+                - "scripts/ci/bounded_subprocess.py"
+                - "scripts/ci/redact_sensitive_log.py"
+                - "scripts/ci/run_opencode_review_model_pool.sh"
+                - "scripts/ci/sandboxed_verify.py"
+                - "scripts/ci/sandboxed_web_e2e.py"
+                - "tests/test_bounded_subprocess*.py"
+                - "tests/test_opencode_model_pool_runner.py"
+                - "tests/test_redact*.py"
+                - "tests/test_sandboxed*.py"
+                - "requirements-opencode-review-ci-hashes.txt"
+            push:
+              branches: [main]
+              paths:
+                - ".github/workflows/sandboxed-evidence-quality-ci.yml"
+                - "scripts/ci/bounded_subprocess.py"
+                - "scripts/ci/redact_sensitive_log.py"
+                - "scripts/ci/run_opencode_review_model_pool.sh"
+                - "scripts/ci/sandboxed_verify.py"
+                - "scripts/ci/sandboxed_web_e2e.py"
+                - "tests/test_bounded_subprocess*.py"
+                - "tests/test_opencode_model_pool_runner.py"
+                - "tests/test_redact*.py"
+                - "tests/test_sandboxed*.py"
+                - "requirements-opencode-review-ci-hashes.txt"
+
+          concurrency:
+            group: sandboxed-evidence-quality-${{ github.event.pull_request.number || github.ref }}
+            cancel-in-progress: true
+
+          permissions:
+            contents: read
+
+          env:
+            FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+          jobs:
+            quality:
+              runs-on: ubuntu-24.04
+              timeout-minutes: 40
+              steps:
+                - name: Harden runner
+                  uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+                  with:
+                    egress-policy: audit
+                - name: Checkout exact head
+                  uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+                  with:
+                    ref: ${{ github.event.pull_request.head.sha || github.sha }}
+                    persist-credentials: false
+                - name: Set up Python
+                  uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+                  with:
+                    python-version: "3.14"
+                    cache: pip
+                    cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+                - name: Install exact hash-locked tooling
+                  run: >-
+                    python -m pip install --disable-pip-version-check --require-hashes
+                    -r requirements-opencode-review-ci-hashes.txt
+                - name: Run focused and repository-wide quality contracts
+                  shell: bash --noprofile --norc -e -o pipefail {0}
+                  run: |
+                    python -m coverage erase
+                    python -m coverage run --branch -m pytest -q
+                    python -m coverage report --show-missing --fail-under=100
+                    python -m interrogate --fail-under=100 scripts/ci
+                    python -m compileall -q scripts tests
+                    bash -n scripts/ci/run_opencode_review_model_pool.sh
+                    git diff --check
+          YAML
+
+          python3 - <<'PY'
+          from pathlib import Path
+
+          changelog = Path("CHANGELOG.md")
+          source = changelog.read_text(encoding="utf-8")
+          entries = (
+              "- Redact credentials from every sandbox command, timeout, service-tail, "
+              "JSON, and review-evidence sink while preserving ordinary diagnostics.\n",
+              "- Bound command and long-running service output, terminate isolated process "
+              "groups on overflow, and emit deterministic resource-limit evidence without "
+              "capping unrelated repository artifacts.\n",
+              "- Add a permanent exact-head quality workflow enforcing 100% production "
+              "statement, branch, and docstring coverage for sandbox evidence controls.\n",
+          )
+          marker = "## [Unreleased]\n"
+          if marker not in source:
+              raise SystemExit("CHANGELOG is missing the Unreleased section")
+          missing = "".join(entry for entry in entries if entry not in source)
+          if missing:
+              source = source.replace(marker, marker + "\n" + missing, 1)
+              changelog.write_text(source, encoding="utf-8")
+          PY
+          rm -f .github/workflows/one-shot-pr767-focus-current-main.yml
+          git diff --check
+
+      - name: Install exact hash-locked tooling
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes
+          -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Verify complete integrated quality contract
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          python -m coverage erase
+          python -m coverage run --branch -m pytest -q
+          python -m coverage report --show-missing --fail-under=100
+          python -m interrogate --fail-under=100 scripts/ci
+          python -m compileall -q scripts tests
+          bash -n scripts/ci/run_opencode_review_model_pool.sh
+          git diff --check
+
+      - name: Publish focused current-main replacement
+        env:
+          EXPECTED_HEAD: ${{ github.sha }}
+          HEAD_BRANCH: ${{ github.ref_name }}
+          PUSH_TOKEN: ${{ github.token }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          remote_head="$(git ls-remote origin "refs/heads/${HEAD_BRANCH}" | cut -f1)"
+          test "$remote_head" = "$EXPECTED_HEAD"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add --all
+          git diff --cached --quiet && { echo "No focused replacement generated" >&2; exit 1; }
+          git commit -m "fix(ci): secure and bound sandbox evidence streams"
+          auth_header="$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 | tr -d '\n')"
+          echo "::add-mask::$auth_header"
+          git -c http.https://github.com/.extraheader="AUTHORIZATION: basic ${auth_header}" \
+            push --force-with-lease="refs/heads/${HEAD_BRANCH}:${EXPECTED_HEAD}" \
+            origin "HEAD:refs/heads/${HEAD_BRANCH}"

.github/workflows/scheduled-security-scan.yml

@@ -90,13 +90,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
         continue-on-error: true
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           category: "/language:${{ matrix.language }}-scheduled"
 
@@ -131,7 +131,7 @@ jobs:
       - name: Upload Trivy SARIF to code scanning
         if: always() && hashFiles('trivy-results.sarif') != ''
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           sarif_file: trivy-results.sarif
           category: trivy-fs-scheduled

CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+All notable changes to the ContextualWisdomLab central GitHub control plane are documented in this file.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versioned releases follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Security
+
+- Upgrade the central Strix dependency snapshots to `aiohttp==3.14.3`, `cryptography==50.0.0`, and the compatible `pyOpenSSL==26.4.0` closure so the hard dependency gates contain no known affected releases.
+- Redact credentials from every sandbox evidence publication sink, including completed and timed-out process output, service log tails, commands, reviewer notes, nested JSON values, and JSON object keys.
+- Continuously drain sandbox child stdout/stderr into fixed-size final-suffix buffers, terminate isolated process groups on overflow, and persist only bounded service evidence so repository output cannot exhaust parent memory or runner log storage before redaction.
+
+### Changed
+
+- Add explicit 1 MiB per-stream command and 4 MiB per-service log budgets, stable output-limit exit code `123`, result-envelope limit evidence, and bounded seek-from-end service tails while preserving timeout `124` and readiness `125` semantics.
+
+### Fixed
+
+- Apply a finite 30-second bound to every normal-path output-reader join, finalize sibling captures before re-raising the first failure, and surface a stuck inherited pipe descriptor as `bounded output drain did not finish` instead of waiting until the outer CI timeout.
+- Require a dash prefix before a sensitive command-line option consumes the following argument, while preserving redaction for `TOKEN=value`, `--token=value`, separate dashed credential options, and provider-shaped values.
+- Prove with a sentinel-file regression that a service-log overflow is detected during readiness and prevents the E2E command from executing.
+- Replace quadratic sensitive-assignment rescanning with a bounded forward scan so one long ordinary diagnostic token cannot cause disproportionate log-processing work.
+- Avoid process-wide file-size limits that would incorrectly constrain coverage databases, compiled assets, archives, and other legitimate repository artifacts unrelated to stdout/stderr evidence.
+
+### Documentation
+
+- Add APA 7 doctoring for the sandbox command/output redaction boundary, structured diagnostics, availability controls, verification evidence, limitations, and rollback requirements.
+- Add APA 7 doctoring for bounded subprocess pipe draining, process-group termination, bounded service evidence, exit-code precedence, realistic flood tests, limitations, and rollback requirements.