diff --git a/.github/workflows/sandbox-log-redaction-quality-ci.yml b/.github/workflows/sandbox-log-redaction-quality-ci.yml
new file mode 100644
index 000000000..36ba60bc3
--- /dev/null
+++ b/.github/workflows/sandbox-log-redaction-quality-ci.yml
@@ -0,0 +1,105 @@
+name: Sandbox Log Redaction Quality CI
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - ".github/workflows/sandbox-log-redaction-quality-ci.yml"
+      - "CHANGELOG.md"
+      - "docs/doctoring/sandbox-log-redaction.md"
+      - "scripts/ci/redact_sensitive_log.py"
+      - "scripts/ci/sandboxed_verify.py"
+      - "scripts/ci/sandboxed_web_e2e.py"
+      - "tests/test_opencode_security_boundaries.py"
+      - "tests/test_sandboxed_verify.py"
+      - "tests/test_sandboxed_web_e2e.py"
+      - "tests/test_sandboxed_log_redaction_regression.py"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sandbox-log-redaction-quality-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  exact-head-redaction-contract:
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout exact source revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+
+      - name: Install exact hash-verified test dependencies
+        env:
+          PIP_DISABLE_PIP_VERSION_CHECK: "1"
+          PIP_NO_INPUT: "1"
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          cat >"${RUNNER_TEMP}/sandbox-redaction-quality-requirements.txt" <<'EOF'
+          coverage==7.15.2 --hash=sha256:b9a6367e4aff723e8ee8190836836124284e8fcd4265e307c844010cfa074f3f
+          iniconfig==2.1.0 --hash=sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760
+          packaging==26.2 --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
+          pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
+          pygments==2.20.0 --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
+          pytest==9.1.1 --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
+          EOF
+          python -m pip install \
+            --only-binary=:all: \
+            --require-hashes \
+            -r "${RUNNER_TEMP}/sandbox-redaction-quality-requirements.txt"
+
+      - name: Verify fail-closed sandbox redaction contract
+        env:
+          STRIX_TEST_PROCESS_TIMEOUT_SECONDS: "3"
+          STRIX_TEST_FAKE_SLEEP_SECONDS: "5"
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
+          python -m coverage run --branch -m pytest \
+            tests/test_opencode_security_boundaries.py \
+            tests/test_sandboxed_verify.py \
+            tests/test_sandboxed_web_e2e.py \
+            tests/test_sandboxed_log_redaction_regression.py \
+            -q
+          python -m coverage report \
+            --include='scripts/ci/redact_sensitive_log.py,scripts/ci/sandboxed_verify.py,scripts/ci/sandboxed_web_e2e.py' \
+            --fail-under=100
+          python - <<'PY'
+          import ast
+          from pathlib import Path
+
+          missing = []
+          for filename in (
+              "scripts/ci/redact_sensitive_log.py",
+              "scripts/ci/sandboxed_verify.py",
+              "scripts/ci/sandboxed_web_e2e.py",
+          ):
+              tree = ast.parse(Path(filename).read_text(encoding="utf-8"), filename=filename)
+              for node in tree.body:
+                  if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
+                      if not node.name.startswith("_") and ast.get_docstring(node) is None:
+                          missing.append(f"{filename}:{node.lineno}:{node.name}")
+          if missing:
+              raise SystemExit("public docstrings missing: " + ", ".join(missing))
+          PY
+          python -m pytest tests -q
+          bash scripts/ci/test_strix_quick_gate.sh
+          python -m compileall -q \
+            scripts/ci/redact_sensitive_log.py \
+            scripts/ci/sandboxed_verify.py \
+            scripts/ci/sandboxed_web_e2e.py \
+            tests/test_opencode_security_boundaries.py \
+            tests/test_sandboxed_verify.py \
+            tests/test_sandboxed_web_e2e.py \
+            tests/test_sandboxed_log_redaction_regression.py
+          git diff --exit-code
diff --git a/CHANGELOG.md b/CHANGELOG.md
index bf30091dd..aa8f0be97 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ Semantic Versioning where the repository publishes a release.
 
 ### Fixed
 
+- Redacted credential-shaped stdout, stderr, timeout evidence, and bounded backend/frontend service-log tails emitted by sandboxed verification and web-E2E subprocesses before those values become CI or review evidence. The boundary now canonicalizes safe ANSI styling and fails closed on single- or multiline rendering controls, scans JSON keys and opaque string values without corrupting scalar types or result schemas, preserves benign metadata and diagnostic domains, removes authorization headers, URL userinfo, and private-key blocks, protects raw and escaped explicitly allowed values before setup and tail selection, handles separated credential options, preserves markers and line boundaries, falls back safely on excessive JSON nesting, and parses high-volume diagnostics within bounded time. Normal executed argv, child exit, timeout, readiness, and network behavior remains unchanged; ambiguous short or fixed-evidence-colliding allowed values and setup/launch exceptions return redacted code `126` evidence before a raw traceback can escape.
 - Bounded the Strix quality self-test's deterministic timeout fixtures to 3-second process and 5-second fake-sleep budgets so exact-head policy evidence completes inside the existing job limit without changing production Strix scanner timeouts, providers, credentials, or review semantics.
 - Allowed commas and ASCII parentheses in the bounded Strix changed-file path policy so legal tracked Packrat fixtures can receive exact-head security analysis, while rejecting raw `..` components before normalization and keeping controls, backslashes, whitespace ambiguity, and shell punctuation fail-closed.
 - Bound each review-agent invocation key to the wrapper's complete canonical payload, including the base branch and requesting actor; altered fields with a valid-format key now fail before durable-leader election or forwarding, and wrapper write permission is job-scoped.
diff --git a/docs/doctoring/sandbox-log-redaction.md b/docs/doctoring/sandbox-log-redaction.md
new file mode 100644
index 000000000..b151df1fa
--- /dev/null
+++ b/docs/doctoring/sandbox-log-redaction.md
@@ -0,0 +1,94 @@
+# Sandbox subprocess evidence redaction
+
+## Incident boundary
+
+The organization sandbox wrappers already removed ambient secret-bearing environment variables before launching pull-request verification commands. That control did not cover a different disclosure path: child processes and long-running services can emit credential-shaped values to stdout, stderr, timeout evidence, or service log files. `sandboxed_verify.py` and `sandboxed_web_e2e.py` forwarded those captured values into GitHub Actions/review evidence without passing them through the existing `redact_sensitive_log.redact_text` boundary.
+
+This is an evidence-handling defect. It is not a shell-injection defect, a reason to change subprocess argv/process-group semantics, a provider-routing problem, or a reason to broaden/revoke repository credentials.
+
+## RCA
+
+The causal chain is:
+
+1. a verification command or local web service emits text controlled by the repository-under-review;
+2. the sandbox correctly captures that text through `subprocess.PIPE`, `TimeoutExpired`, or a service log file;
+3. the wrapper prints the captured text into CI/review evidence;
+4. the mature central log redactor was not invoked on this output boundary; and
+5. therefore a token/password/session-key-shaped value can cross the sandbox boundary even though the corresponding ambient environment variable was scrubbed.
+
+Python documents `subprocess.run(..., shell=False, stdout=PIPE, stderr=PIPE, timeout=...)` and `TimeoutExpired` as normal captured-output mechanisms. The repair therefore leaves process execution semantics unchanged and treats the captured text as untrusted evidence that requires redaction before publication.
+
+## Feasibility analysis
+
+The following candidates were evaluated:
+
+- **Change or remove subprocess execution. Rejected.** The defect occurs after capture, so changing argv, shell mode, process groups, or timeouts would not address the disclosure mechanism and would add unrelated behavioral risk.
+- **Rely only on GitHub Actions secret masking. Rejected.** GitHub recommends masking sensitive values and notes that log redaction is not a complete substitute for avoiding sensitive output; child output may contain transformed or non-registered sensitive data. Repository-under-review output must therefore cross the product's own deterministic redaction boundary.
+- **Import the mixed sentinel #841. Rejected.** That branch combined this defect with unrelated readiness-URL hardening, production changes preceded its tests, and the external writer reported that its narrowed result could not be published. Rewriting or manually reconstructing unpublished UI state would weaken provenance.
+- **Apply the existing redactor at the evidence-output boundary. Accepted.** This is the smallest reversible change, requires no new credential or permission, preserves process semantics, and is directly testable with credential-shaped fixtures.
+
+The first GREEN implementation exposed five narrower defects in that shared boundary during an exhaustive diff review:
+
+- valid JSON took a structured branch that redacted only sensitive key names and never scanned string values under opaque keys;
+- substring key matching hid benign diagnostics such as `token_count` and `password_policy`;
+- terminal ANSI sequences could split a sensitive key or provider-token signature before detection;
+- explicitly allowed environment values were not supplied to the redactor, so an opaque value printed without a recognizable key or provider prefix survived; and
+- `_redact_assignments()` restarted a suffix scan at every character in a long key-like line, producing observed quadratic growth even though its contract claimed linear parsing.
+
+The root cause was not missing calls in the two wrappers anymore. It was an incomplete normalization and value-provenance contract in the shared redactor, plus repeated suffix scanning. The follow-up repair canonicalizes terminal evidence before matching, recursively scans JSON keys and string values, classifies credential fields by semantic words while exempting explicit diagnostic-metadata endings, passes explicitly allowed environment values through a validated literal-sensitive path, and advances the assignment parser by complete key spans.
+
+A consumer-path review then found additional integration hazards: post-processing the prefixed result marker could corrupt otherwise valid JSON, selecting a service tail before literal redaction could expose a clipped multiline value, a permissive three-segment pattern hid the `api.deepseek.com` failure signal as if it were a JWT, excessive valid JSON nesting could abort the central failed-check collector, literal values such as `true` could corrupt JSON types, terminal overwrite/format controls could reconstruct rendered secrets, separated CLI options could leave their following credential visible, and setup, launch, or cleanup exceptions could escape the boundary. The bounded repair now redacts trusted result schemas before serialization, protects existing markers with a single-pass matcher, redacts complete service logs before tail selection, verifies decoded JOSE headers, preserves JSON scalar types and every supported line separator, handles separated credential options, fails closed across multiline or unterminated terminal controls, falls back safely on excessive JSON recursion, and captures explicitly allowed values before fallible setup. It does not implement the separate output-memory and service-file quotas tracked by #766.
+
+## Test-first evidence
+
+A clean branch was created from protected `main` `6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba`.
+
+The first commit `f33b37d882ddb8ab0ef8ffd4e843cb5edce9adc9` changed only `tests/test_sandboxed_log_redaction_regression.py`. Hosted exact-head quality run `31291746435`, job `93190018774`, then produced the intended RED result: **4 failed, 23 passed**. Each new failure exposed credential-shaped text crossing one of the required output boundaries.
+
+Only after that hosted RED evidence did production change. The implementation:
+
+- redacts completed `sandboxed_verify` stdout/stderr;
+- decodes and redacts `sandboxed_verify` timeout stdout/stderr, including byte-valued `TimeoutExpired` evidence;
+- redacts completed web-E2E stdout/stderr;
+- reuses the redacted timeout helper for web-E2E timeout evidence; and
+- redacts complete backend/frontend service-log text before selecting and printing the bounded tail.
+
+Normal child-command exit codes, readiness URL, redirect, executed subprocess argv, process-group, timeout, provider/model, workflow permission, and branch-protection behavior are unchanged. Workspace-setup and process-launch exceptions now return fail-closed code `126` with a redacted diagnostic instead of propagating a raw traceback. A non-empty explicitly allowed environment value shorter than eight characters, or one identical to fixed evidence text that must remain machine-readable, also returns `126` before child execution because it cannot be redacted unambiguously. Other values, including whitespace-bearing credentials, are passed to the child unchanged while their raw and escaped evidence representations are suppressed.
+
+Exact-head focused acceptance on `9dd2ab31a8eab9ef7b4572e37c68023df6a0f16e` reports **32 passed** and exact **100% statement and branch coverage** for both owned production modules (`265` statements and `82` branches total). The permanent quality workflow also enforces public callable docstrings, exact-head checkout, a complete repository suite, the central Strix quick gate, compilation, and a clean worktree before Ready status is permitted.
+
+The follow-up fail-first contract independently reproduced eight initial failures: opaque JSON values, benign JSON metadata over-redaction, ANSI-split evidence, quadratic long-line processing, and opaque `--allow-env` values across completed/timeout verification plus completed/timeout/service-tail E2E paths. Consumer review added fail-first cases for marker integrity, truncation order, credential-bearing JSON keys, joined and suffixed credential fields, authorization headers, URL userinfo, private-key blocks, raw and escaped explicit values, all supported line separators, JSON scalar types, diagnostic domains, pathological JSON depth, high line/value counts, separated credential options, short or fixed-evidence-colliding allowed values, terminal overwrite and multiline/unterminated control sequences, and pre-copy/backend/frontend/E2E launch and cleanup exceptions. After the bounded repair, the focused suite reports **102 passed** and exact **100% statement and branch coverage** across `redact_sensitive_log.py`, `sandboxed_verify.py`, and `sandboxed_web_e2e.py` (`605` statements and `206` branches). The exact-head quality workflow now owns all three modules and the shared redactor security tests, so a wrapper-only coverage result cannot promote a redactor regression.
+
+## Security and privacy interpretation
+
+Redaction is defense in depth, not authorization. It does not make arbitrary sensitive material safe to publish and it does not authorize repositories to pass secrets into sandbox commands. The existing environment minimization remains the primary ingress control; deterministic output redaction limits accidental disclosure if a child process or service emits sensitive-looking evidence anyway.
+
+ANSI styling canonicalization preserves visible diagnostic text and line separators, while cursor movement, backspace, multiline/unterminated control payloads, and invisible Unicode format controls fail closed for every affected evidence line or value. Structured JSON retains benign failure, policy, count, status, expiry, type, and usage metadata, while credential-denoting keys, credential material used as a key, credential-shaped string values, authorization headers, URL userinfo, and multiline private-key blocks are replaced without changing boolean or numeric types. Result markers remain one-line valid JSON with stable trusted keys after redaction, and the collector's literal `api.deepseek.com` classification signal remains visible. Literal protection is limited to non-empty values of names explicitly passed through `--allow-env`; values shorter than eight characters or colliding with fixed evidence text are rejected before execution, while whitespace-bearing values remain supported. The ordinary safe environment allowlist is not treated as secret, avoiding blanket removal of paths, locale data, or other useful diagnostics.
+
+The redactor operates on CI-facing text only. It does not mutate files in the copied repository, service log files on disk, subprocess input, or successful child-process status and lifetime. The wrappers separately apply the documented pre-execution and exception code `126` policy. Operators should therefore interpret `[REDACTED]` as evidence suppression, not as successful removal of sensitive data from the source system that produced it.
+
+## Rollback
+
+If the redaction integration causes a demonstrated diagnostic incompatibility, revert the production redaction commits while retaining the fail-first regression and this doctoring record. Do not disable the regression, weaken the credential-shaped fixtures, or replace the deterministic boundary with blanket omission of all stdout/stderr. A rollback is incomplete until the resulting protected-main behavior is reassessed for disclosure risk.
+
+## Operational acceptance
+
+PR checks prove the code path, not protected-main operation. After protected integration, run one bounded sandbox verification fixture that emits synthetic credential-shaped stdout/stderr and one bounded web-E2E fixture that emits a synthetic service-log credential. Accept the repair only if protected-main workflow evidence shows the synthetic value absent, `[REDACTED]` present, ordinary diagnostic text preserved, and the expected exit code/process cleanup behavior unchanged.
+
+## References
+
+GitHub. (n.d.). *Secure use reference*. GitHub Docs. Retrieved August 9, 2026, from https://docs.github.com/en/actions/reference/security/secure-use
+
+GitHub. (n.d.). *Using secrets in GitHub Actions*. GitHub Docs. Retrieved August 9, 2026, from https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets
+
+MITRE Corporation. (n.d.). *CWE-180: Incorrect behavior order: Validate before canonicalize*. CWE. Retrieved August 9, 2026, from https://cwe.mitre.org/data/definitions/180.html
+
+MITRE Corporation. (n.d.). *CWE-407: Inefficient algorithmic complexity*. CWE. Retrieved August 9, 2026, from https://cwe.mitre.org/data/definitions/407.html
+
+MITRE Corporation. (n.d.). *CWE-532: Insertion of sensitive information into log file*. CWE. Retrieved August 9, 2026, from https://cwe.mitre.org/data/definitions/532.html
+
+National Institute of Standards and Technology. (2022). *Secure software development framework (SSDF) version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST SP 800-218). https://doi.org/10.6028/NIST.SP.800-218
+
+OWASP Foundation. (n.d.). *Logging cheat sheet*. OWASP Cheat Sheet Series. Retrieved August 9, 2026, from https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html
+
+Python Software Foundation. (2026). *subprocess — Subprocess management* (Python 3.14.6 documentation). https://docs.python.org/3.14/library/subprocess.html
diff --git a/scripts/ci/redact_sensitive_log.py b/scripts/ci/redact_sensitive_log.py
index 16e89f264..1eb684086 100644
--- a/scripts/ci/redact_sensitive_log.py
+++ b/scripts/ci/redact_sensitive_log.py
@@ -3,27 +3,129 @@
 
 from __future__ import annotations
 
+import base64
 import json
 import re
+import shlex
 import sys
+import unicodedata
+from collections.abc import Sequence
 from typing import Any
 
 REDACTED = "[REDACTED]"
 KEY_CHARS = frozenset("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.-")
-SENSITIVE_KEY_RE = re.compile(
-    r"(?:token|secret|password|passwd|credential|authorization|jwt|"
-    r"api[_-]?key|private[_-]?key|access[_-]?key|session[_-]?key)",
-    re.IGNORECASE,
+ANSI_ESCAPE_RE = re.compile(
+    r"(?:\x1b\[|\x9b)[0-?]*[ -/]*[@-~]"
+    r"|(?:\x1b\]|\x9d)[^\x1b\x07\x9c]*(?:\x07|\x9c|\x1b\\)"
+    r"|(?:\x1b[PX^_]|\x90|\x98|\x9e|\x9f)[^\x1b\x9c]*(?:\x9c|\x1b\\)"
+    r"|(?:\x1b\]|\x1b[PX^_]|\x90|\x98|\x9d|\x9e|\x9f)[\s\S]*\Z"
+    r"|\x1b[ -/]*[0-~]"
+    r"|[\x80-\x84\x86-\x8f\x91-\x9a\x9c]"
+)
+SGR_ESCAPE_RE = re.compile(r"(?:\x1b\[|\x9b)[0-9:;]*m")
+UNSAFE_INLINE_CONTROL_RE = re.compile(
+    r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x84\x86-\x9f]"
+)
+LINE_SEPARATOR_RE = re.compile(r"\r\n|[\n\r\v\f\x1c-\x1e\x85\u2028\u2029]")
+LINE_SEPARATOR_END_RE = re.compile(
+    r"(?:\r\n|[\n\r\v\f\x1c-\x1e\x85\u2028\u2029])\Z"
+)
+CAMEL_ACRONYM_BOUNDARY_RE = re.compile(r"(?<=[A-Z])(?=[A-Z][a-z])")
+CAMEL_WORD_BOUNDARY_RE = re.compile(r"(?<=[a-z0-9])(?=[A-Z])")
+NON_KEY_WORD_RE = re.compile(r"[^A-Za-z0-9]+")
+SENSITIVE_KEY_TERMS = frozenset(
+    {
+        "auth",
+        "authorization",
+        "credential",
+        "credentials",
+        "jwt",
+        "passwd",
+        "password",
+        "secret",
+        "token",
+    }
+)
+SENSITIVE_KEY_PAIRS = frozenset(
+    {
+        ("access", "key"),
+        ("api", "key"),
+        ("connection", "string"),
+        ("database", "url"),
+        ("encryption", "key"),
+        ("private", "key"),
+        ("secret", "key"),
+        ("session", "key"),
+        ("signing", "key"),
+    }
+)
+SENSITIVE_JOINED_KEY_TERMS = frozenset(
+    "".join(pair) for pair in SENSITIVE_KEY_PAIRS
+)
+BENIGN_JOINED_KEY_TERMS = frozenset({"notsecret", "retoken"})
+SAFE_METADATA_SUFFIXES = frozenset(
+    {
+        ("budget",),
+        ("count",),
+        ("decode", "error"),
+        ("expires", "at"),
+        ("failure", "reason"),
+        ("policy",),
+        ("policy", "status"),
+        ("rotation", "status"),
+        ("scan", "count"),
+        ("status",),
+        ("type",),
+        ("usage",),
+    }
 )
 JWT_RE = re.compile(
     r"(?<![A-Za-z0-9_-])[A-Za-z0-9_-]{3,}\.[A-Za-z0-9_-]{3,}\."
     r"[A-Za-z0-9_-]{3,}(?![A-Za-z0-9_-])"
 )
+AUTHORIZATION_HEADER_RE = re.compile(
+    r"(?P<prefix>\b(?:proxy-)?authorization\s*:\s*)[^\r\n]+",
+    re.IGNORECASE,
+)
 BEARER_RE = re.compile(
-    r"(?P<prefix>\b(?:authorization\s*:\s*)?(?:bearer|basic)\s+)"
+    r"(?P<prefix>\b(?:bearer|basic)\s+)"
     r"[^\s\"'\\]+",
     re.IGNORECASE,
 )
+URL_CREDENTIAL_RE = re.compile(
+    r"(?P<scheme>\b[a-z][a-z0-9+.-]*://)[^/\s:@]*:[^@\s/]+@",
+    re.IGNORECASE,
+)
+PRIVATE_KEY_PEM_RE = re.compile(
+    r"-----BEGIN (?P<label>[A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?)-----[\s\S]*?"
+    r"-----END (?P=label)-----"
+    r"|-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*\Z"
+)
+DEFAULT_IGNORABLE_RANGES = (
+    (0x034F, 0x034F),
+    (0x115F, 0x1160),
+    (0x17B4, 0x17B5),
+    (0x180B, 0x180F),
+    (0x2065, 0x2065),
+    (0x3164, 0x3164),
+    (0xFE00, 0xFE0F),
+    (0xFFA0, 0xFFA0),
+    (0x1BCA0, 0x1BCA3),
+    (0x1D173, 0x1D17A),
+    (0xE0000, 0xE0FFF),
+)
+SENSITIVE_COMMAND_OPTIONS = frozenset(
+    {
+        "auth",
+        "oauth2-bearer",
+        "proxy-user",
+        "u",
+        "user",
+        "user-pass",
+        "user-password",
+        "userpass",
+    }
+)
 PROVIDER_TOKEN_RES = (
     re.compile(r"\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,})\b"),
     re.compile(r"\bsk-[A-Za-z0-9_-]{20,}\b"),
@@ -32,18 +134,258 @@
 )
 
 
-def _redact_json(value: Any) -> Any:
+def _word_identifies_credentials(word: str) -> bool:
+    """Return whether one key word contains a credential-denoting signal."""
+    signals = SENSITIVE_KEY_TERMS | SENSITIVE_JOINED_KEY_TERMS
+    return word not in BENIGN_JOINED_KEY_TERMS and any(
+        (word == signal if signal == "auth" else signal in word)
+        for signal in signals
+    )
+
+
+def _key_identifies_credentials(value: object) -> bool:
+    """Return whether a structured key denotes a credential value rather than metadata."""
+    expanded = CAMEL_ACRONYM_BOUNDARY_RE.sub("_", _strip_ansi(str(value)))
+    expanded = CAMEL_WORD_BOUNDARY_RE.sub("_", expanded)
+    words = tuple(word for word in NON_KEY_WORD_RE.split(expanded.lower()) if word)
+    if not words:
+        return False
+    signal_end = 0
+    for index, word in enumerate(words):
+        if _word_identifies_credentials(word):
+            signal_end = index + 1
+        if index and words[index - 1 : index + 1] in SENSITIVE_KEY_PAIRS:
+            signal_end = index + 1
+    if not signal_end:
+        return False
+    return words[signal_end:] not in SAFE_METADATA_SUFFIXES
+
+
+def _strip_ansi(text: str) -> str:
+    """Remove terminal escape sequences before credential-shape matching."""
+    return ANSI_ESCAPE_RE.sub("", text)
+
+
+def _strip_safe_ansi(text: str) -> str:
+    """Remove styling and replace unsafe escape payloads on every affected line."""
+    def replacement(match: re.Match[str]) -> str:
+        """Return one unsafe-control sentinel for every affected logical line."""
+        sequence = match.group(0)
+        if SGR_ESCAPE_RE.fullmatch(sequence):
+            return ""
+        output = ["\x00"]
+        for separator in LINE_SEPARATOR_RE.finditer(sequence):
+            output.extend((separator.group(0), "\x00"))
+        return "".join(output)
+
+    return ANSI_ESCAPE_RE.sub(
+        replacement,
+        text,
+    )
+
+
+def _contains_unsafe_render_controls(text: str) -> bool:
+    """Return whether text can alter or invisibly split its rendered representation."""
+    for match in ANSI_ESCAPE_RE.finditer(text):
+        if SGR_ESCAPE_RE.fullmatch(match.group(0)) is None:
+            return True
+    visible = ANSI_ESCAPE_RE.sub("", text)
+    return UNSAFE_INLINE_CONTROL_RE.search(visible) is not None or any(
+        unicodedata.category(char) == "Cf"
+        or any(start <= ord(char) <= end for start, end in DEFAULT_IGNORABLE_RANGES)
+        for char in visible
+    )
+
+
+def _literal_replacement(value: str) -> str:
+    """Return one marker while retaining separators in their original positions."""
+    output: list[str] = []
+    cursor = 0
+    marker_added = False
+    for match in LINE_SEPARATOR_RE.finditer(value):
+        if match.start() > cursor and not marker_added:
+            output.append(REDACTED)
+            marker_added = True
+        output.append(match.group(0))
+        cursor = match.end()
+    if cursor < len(value) and not marker_added:
+        output.append(REDACTED)
+        marker_added = True
+    return "".join(output) if marker_added else value
+
+
+def _canonical_sensitive_values(sensitive_values: Sequence[str]) -> tuple[str, ...]:
+    """Normalize and de-duplicate literal credentials once per redaction call."""
+    canonical_values: set[str] = set()
+    for original in sensitive_values:
+        for value in {original, _strip_ansi(original)}:
+            if not value:
+                continue
+            canonical_values.add(value)
+            represented = repr(value)
+            canonical_values.add(represented[1:-1])
+            canonical_values.add(json.dumps(value, ensure_ascii=True)[1:-1])
+            canonical_values.add(json.dumps(value, ensure_ascii=False)[1:-1])
+    return tuple(
+        sorted(
+            (value for value in canonical_values if value),
+            key=lambda value: (-len(value), value),
+        )
+    )
+
+
+def _compile_literal_pattern(values: Sequence[str]) -> re.Pattern[str] | None:
+    """Compile one marker-safe matcher for caller-supplied literal credentials."""
+    if not values:
+        return None
+    sensitive_alternatives = "|".join(re.escape(value) for value in values)
+    return re.compile(
+        f"(?P<marker>{re.escape(REDACTED)})|"
+        f"(?P<sensitive>{sensitive_alternatives})"
+    )
+
+
+def _redact_literal_values(
+    text: str,
+    literal_pattern: re.Pattern[str] | None,
+) -> str:
+    """Replace literal credentials against the original text in one pass."""
+    if literal_pattern is None:
+        return text
+    return literal_pattern.sub(
+        lambda match: (
+            match.group(0)
+            if match.group("marker") is not None
+            else _literal_replacement(match.group("sensitive"))
+        ),
+        text,
+    )
+
+
+def _redact_json(
+    value: Any,
+    literal_pattern: re.Pattern[str] | None,
+    redact_literal_keys: bool,
+) -> Any:
     """Recursively replace values whose JSON keys identify credentials."""
     if isinstance(value, dict):
-        return {
-            key: REDACTED if SENSITIVE_KEY_RE.search(str(key)) else _redact_json(item)
-            for key, item in value.items()
-        }
+        cleaned: dict[Any, Any] = {}
+        collision_counts: dict[str, int] = {}
+        for key, item in value.items():
+            key_identifies_credentials = _key_identifies_credentials(key)
+            key_has_unsafe_controls = (
+                isinstance(key, str) and _contains_unsafe_render_controls(key)
+            )
+            cleaned_key = (
+                _redact_unstructured(
+                    key,
+                    literal_pattern if redact_literal_keys else None,
+                )
+                if isinstance(key, str)
+                else key
+            )
+            if cleaned_key in cleaned and isinstance(cleaned_key, str):
+                collision_index = collision_counts.get(cleaned_key, 2)
+                while f"{cleaned_key}#{collision_index}" in cleaned:
+                    collision_index += 1
+                collision_counts[cleaned_key] = collision_index + 1
+                cleaned_key = f"{cleaned_key}#{collision_index}"
+            cleaned[cleaned_key] = (
+                REDACTED
+                if (
+                    key_identifies_credentials
+                    or _key_identifies_credentials(cleaned_key)
+                    or key_has_unsafe_controls
+                )
+                else _redact_json(item, literal_pattern, redact_literal_keys)
+            )
+        return cleaned
     if isinstance(value, list):
-        return [_redact_json(item) for item in value]
+        return [
+            _redact_json(item, literal_pattern, redact_literal_keys)
+            for item in value
+        ]
+    if isinstance(value, str):
+        return _redact_unstructured(value, literal_pattern)
     return value
 
 
+def redact_json_value(
+    value: Any,
+    *,
+    sensitive_values: Sequence[str] = (),
+    redact_literal_keys: bool = True,
+) -> Any:
+    """Return a recursively redacted JSON-compatible value without serializing it."""
+    values = _canonical_sensitive_values(sensitive_values)
+    return _redact_json(
+        value,
+        _compile_literal_pattern(values),
+        redact_literal_keys,
+    )
+
+
+def _command_option_identifies_credentials(argument: str) -> bool:
+    """Return whether an argv element expects a separate credential value."""
+    if not argument.startswith("-") or "=" in argument:
+        return False
+    option = argument.lstrip("-")
+    return bool(option) and (
+        option.lower() in SENSITIVE_COMMAND_OPTIONS
+        or _key_identifies_credentials(option)
+    )
+
+
+def redact_command_argv(
+    command: Sequence[str],
+    *,
+    sensitive_values: Sequence[str] = (),
+) -> list[str]:
+    """Redact argv, including values following credential-denoting options."""
+    values = _canonical_sensitive_values(sensitive_values)
+    literal_pattern = _compile_literal_pattern(values)
+    cleaned: list[str] = []
+    redact_next = False
+    for argument in command:
+        if redact_next:
+            cleaned.append(REDACTED)
+            redact_next = False
+            continue
+        option, separator, _value = argument.partition("=")
+        if (
+            separator
+            and option.startswith("-")
+            and option.lstrip("-").lower() in SENSITIVE_COMMAND_OPTIONS
+        ):
+            cleaned.append(f"{option}={REDACTED}")
+            continue
+        cleaned.append(_redact_unstructured(argument, literal_pattern))
+        redact_next = _command_option_identifies_credentials(argument)
+    return cleaned
+
+
+def redact_command_text(
+    command: str,
+    *,
+    sensitive_values: Sequence[str] = (),
+) -> str:
+    """Redact a shell-like command string without changing the executed command."""
+    cleaned_command = redact_text(command, sensitive_values=sensitive_values)
+    try:
+        arguments = shlex.split(cleaned_command)
+    except ValueError:
+        rough_arguments = cleaned_command.split()
+        if any(
+            _command_option_identifies_credentials(argument)
+            for argument in rough_arguments
+        ):
+            return REDACTED
+        return cleaned_command
+    return shlex.join(
+        redact_command_argv(arguments, sensitive_values=sensitive_values)
+    )
+
+
 def _consume_sensitive_assignment(text: str, start: int) -> tuple[str, int] | None:
     """Return a redacted key/value assignment parsed in linear time."""
     cursor = start
@@ -61,7 +403,7 @@ def _consume_sensitive_assignment(text: str, start: int) -> tuple[str, int] | No
         if cursor >= len(text) or text[cursor] != key_quote:
             return None
         cursor += 1
-    if not SENSITIVE_KEY_RE.search(key):
+    if not _key_identifies_credentials(key):
         return None
     while cursor < len(text) and text[cursor].isspace():
         cursor += 1
@@ -101,9 +443,23 @@ def _redact_assignments(text: str) -> str:
     cursor = 0
     last_append = 0
     while cursor < len(text):
+        char = text[cursor]
+        if char in "\"'":
+            next_cursor = cursor + 1
+        elif (
+            char not in KEY_CHARS
+            or char.isdigit()
+            or (cursor > 0 and text[cursor - 1] in KEY_CHARS)
+        ):
+            cursor += 1
+            continue
+        else:
+            next_cursor = cursor + 1
+            while next_cursor < len(text) and text[next_cursor] in KEY_CHARS:
+                next_cursor += 1
         match = _consume_sensitive_assignment(text, cursor)
         if match is None:
-            cursor += 1
+            cursor = next_cursor
             continue
         output.append(text[last_append:cursor])
         replacement, cursor = match
@@ -113,34 +469,99 @@ def _redact_assignments(text: str) -> str:
     return "".join(output)
 
 
-def _redact_unstructured(text: str) -> str:
+def _redact_unstructured(
+    text: str,
+    literal_pattern: re.Pattern[str] | None = None,
+) -> str:
     """Redact credential-shaped values from non-JSON diagnostic text."""
-    cleaned = _redact_assignments(text)
+    if _contains_unsafe_render_controls(text):
+        return REDACTED
+    cleaned = _strip_ansi(text)
+    cleaned = _redact_literal_values(cleaned, literal_pattern)
+    cleaned = URL_CREDENTIAL_RE.sub(
+        lambda match: f"{match.group('scheme')}{REDACTED}@",
+        cleaned,
+    )
+    cleaned = AUTHORIZATION_HEADER_RE.sub(
+        lambda match: f"{match.group('prefix')}{REDACTED}",
+        cleaned,
+    )
     cleaned = BEARER_RE.sub(lambda match: f"{match.group('prefix')}{REDACTED}", cleaned)
-    cleaned = JWT_RE.sub(REDACTED, cleaned)
+    cleaned = _redact_assignments(cleaned)
+    cleaned = JWT_RE.sub(_redact_jwt_candidate, cleaned)
     for pattern in PROVIDER_TOKEN_RES:
         cleaned = pattern.sub(REDACTED, cleaned)
     return cleaned
 
 
-def _redact_line(line: str) -> str:
+def _redact_jwt_candidate(match: re.Match[str]) -> str:
+    """Redact a JWT only when its first segment is a valid JOSE header."""
+    candidate = match.group(0)
+    header = candidate.split(".", 1)[0]
+    padding = "=" * (-len(header) % 4)
+    try:
+        decoded_header = json.loads(base64.urlsafe_b64decode(header + padding))
+    except (ValueError, RecursionError):
+        return candidate
+    if isinstance(decoded_header, dict) and isinstance(decoded_header.get("alg"), str):
+        return REDACTED
+    return candidate
+
+
+def _redact_line(
+    line: str,
+    json_literal_pattern: re.Pattern[str] | None,
+    unstructured_literal_pattern: re.Pattern[str] | None,
+) -> str:
     """Redact one log line, preferring recursive JSON handling when valid."""
     try:
         value = json.loads(line)
-    except json.JSONDecodeError:
-        return _redact_unstructured(line)
-    return json.dumps(_redact_json(value), ensure_ascii=False, separators=(",", ":"))
+        cleaned = _redact_json(value, json_literal_pattern, True)
+    except (ValueError, RecursionError):
+        return _redact_unstructured(line, unstructured_literal_pattern)
+    return json.dumps(
+        cleaned,
+        ensure_ascii=False,
+        separators=(",", ":"),
+    )
 
 
-def redact_text(text: str) -> str:
+def redact_text(text: str, *, sensitive_values: Sequence[str] = ()) -> str:
     """Return redacted log text while preserving line boundaries."""
     if not text:
         return text
+    text = _strip_safe_ansi(text)
+    text = PRIVATE_KEY_PEM_RE.sub(
+        lambda match: _literal_replacement(match.group(0)),
+        text,
+    )
+    values = _canonical_sensitive_values(sensitive_values)
+    json_literal_pattern = _compile_literal_pattern(values)
+    single_line_values = tuple(
+        value for value in values if LINE_SEPARATOR_RE.search(value) is None
+    )
+    multiline_values = tuple(
+        value for value in values if LINE_SEPARATOR_RE.search(value) is not None
+    )
+    unstructured_literal_pattern = _compile_literal_pattern(single_line_values)
+    text = _redact_literal_values(text, _compile_literal_pattern(multiline_values))
     output: list[str] = []
     for raw_line in text.splitlines(keepends=True):
-        line = raw_line.rstrip("\r\n")
-        ending = raw_line[len(line) :]
-        output.append(_redact_line(line) + ending)
+        separator = LINE_SEPARATOR_END_RE.search(raw_line)
+        if separator is None:
+            line = raw_line
+            ending = ""
+        else:
+            line = raw_line[: separator.start()]
+            ending = separator.group(0)
+        output.append(
+            _redact_line(
+                line,
+                json_literal_pattern,
+                unstructured_literal_pattern,
+            )
+            + ending
+        )
     return "".join(output)
 
 
diff --git a/scripts/ci/sandboxed_verify.py b/scripts/ci/sandboxed_verify.py
index aace18d45..7aec7d9b4 100644
--- a/scripts/ci/sandboxed_verify.py
+++ b/scripts/ci/sandboxed_verify.py
@@ -11,9 +11,19 @@
 import sys
 import tempfile
 import time
-from collections.abc import Sequence
+from collections.abc import Mapping, Sequence
 from pathlib import Path
 
+if __package__ in (None, ""):  # pragma: no cover
+    sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
+
+from scripts.ci.redact_sensitive_log import (
+    REDACTED as REDACTION_MARKER,
+    redact_command_argv,
+    redact_json_value,
+    redact_text,
+)
+
 
 DEFAULT_IGNORE = (
     ".git",
@@ -57,6 +67,38 @@
 )
 RESULT_MARKER = "SANDBOXED_VERIFY_RESULT"
 ENV_NAME_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+MIN_ALLOWED_ENV_VALUE_LENGTH = 8
+RESERVED_EVIDENCE_FRAGMENTS = (
+    "SANDBOXED_VERIFY_RESULT",
+    "SANDBOXED_WEB_E2E_RESULT",
+    "sandboxed-verify",
+    "sandboxed-web-e2e",
+    "allowed env names",
+    "service readiness failed",
+    "command timed out after",
+    "execution failed",
+    "allowed_env",
+    "backend_cmd",
+    "backend_ready",
+    "command",
+    "cwd",
+    "e2e_cmd",
+    "elapsed_seconds",
+    "evidence_note",
+    "exit_code",
+    "frontend_cmd",
+    "frontend_ready",
+    "frontend",
+    "network",
+    "not-required",
+    "required",
+    "sandbox",
+    "sandboxed",
+)
+
+
+class UnsafeAllowedEnvValueError(ValueError):
+    """An allowed environment value cannot be redacted unambiguously."""
 
 
 def parse_args(argv: Sequence[str] | None = None) -> argparse.Namespace:
@@ -85,7 +127,11 @@ def parse_args(argv: Sequence[str] | None = None) -> argparse.Namespace:
         action="append",
         default=[],
         metavar="NAME",
-        help="Pass one named environment variable into the sandbox. Values are never printed.",
+        help=(
+            "Pass one named environment variable into the sandbox. Nonempty values "
+            "must be at least 8 characters and must not collide with fixed "
+            "redaction evidence."
+        ),
     )
     parser.add_argument(
         "--network",
@@ -138,6 +184,48 @@ def scrubbed_env(sandbox_root: Path, allow_env: Sequence[str] = ()) -> dict[str,
     return env
 
 
+def allowed_env_values(
+    allow_env: Sequence[str],
+    source: Mapping[str, str] | None = None,
+) -> tuple[str, ...]:
+    """Capture nonempty allowed values before any fallible sandbox setup."""
+    environment = os.environ if source is None else source
+    return tuple(
+        dict.fromkeys(
+            environment[name]
+            for name in allow_env
+            if name in environment and environment[name]
+        )
+    )
+
+
+def validate_allowed_env_values(
+    allow_env: Sequence[str],
+    source: Mapping[str, str] | None = None,
+) -> None:
+    """Reject short values that cannot be redacted without destroying evidence."""
+    environment = os.environ if source is None else source
+    for name in dict.fromkeys(allow_env):
+        value = environment.get(name, "")
+        if value and len(value) < MIN_ALLOWED_ENV_VALUE_LENGTH:
+            raise UnsafeAllowedEnvValueError(
+                f"--allow-env value for {name} must contain at least "
+                f"{MIN_ALLOWED_ENV_VALUE_LENGTH} characters"
+            )
+        if value and (value in REDACTION_MARKER or REDACTION_MARKER in value):
+            raise UnsafeAllowedEnvValueError(
+                f"--allow-env value for {name} must not overlap the redaction marker"
+            )
+        if value and any(value in fragment for fragment in RESERVED_EVIDENCE_FRAGMENTS):
+            raise UnsafeAllowedEnvValueError(
+                f"--allow-env value for {name} conflicts with reserved evidence text"
+            )
+        if value and any(value in allowed_name for allowed_name in allow_env):
+            raise UnsafeAllowedEnvValueError(
+                f"--allow-env value for {name} conflicts with an allowed environment name"
+            )
+
+
 def copy_workspace(repo_root: Path, sandbox_root: Path, extra_ignores: Sequence[str]) -> Path:
     """Copy the repository into the sandbox and return the copied root."""
     source = repo_root.resolve()
@@ -164,13 +252,19 @@ def run_command(command: Sequence[str], cwd: Path, env: dict[str, str], timeout:
     )
 
 
-def timeout_output_text(value: str | bytes | None) -> str:
-    """Return timeout output as text, regardless of subprocess internals."""
+def timeout_output_text(
+    value: str | bytes | None,
+    *,
+    sensitive_values: Sequence[str] = (),
+) -> str:
+    """Return redacted timeout output as text, regardless of subprocess internals."""
     if value is None:
         return ""
     if isinstance(value, bytes):
-        return value.decode(errors="replace")
-    return value
+        text = value.decode(errors="replace")
+    else:
+        text = value
+    return redact_text(text, sensitive_values=sensitive_values)
 
 
 def emit_result(
@@ -184,11 +278,15 @@ def emit_result(
     allowed_env: Sequence[str],
     network: str,
     evidence_note: str,
+    sensitive_values: Sequence[str] = (),
 ) -> None:
     """Print a machine-readable execution evidence summary."""
     payload = {
         "allowed_env": sorted(set(allowed_env)),
-        "command": list(command),
+        "command": redact_command_argv(
+            command,
+            sensitive_values=sensitive_values,
+        ),
         "cwd": str(copied_repo),
         "elapsed_seconds": round(elapsed_seconds, 3),
         "evidence_note": evidence_note,
@@ -197,7 +295,12 @@ def emit_result(
         "sandbox": str(sandbox_root) if kept else "(removed)",
         "sandboxed": True,
     }
-    print(f"{RESULT_MARKER} {json.dumps(payload, sort_keys=True)}")
+    redacted_payload = redact_json_value(
+        payload,
+        sensitive_values=sensitive_values,
+        redact_literal_keys=False,
+    )
+    print(f"{RESULT_MARKER} {json.dumps(redacted_payload, sort_keys=True)}")
 
 
 def main(argv: Sequence[str] | None = None) -> int:
@@ -207,11 +310,27 @@ def main(argv: Sequence[str] | None = None) -> int:
     start = time.monotonic()
     exit_code = 1
     copied_repo = sandbox / "repo"
+    sensitive_values = allowed_env_values(args.allow_env)
     try:
+        validate_allowed_env_values(args.allow_env)
         copied_repo = copy_workspace(Path(args.repo_root), sandbox, args.ignore)
         env = scrubbed_env(sandbox, args.allow_env)
+        validate_allowed_env_values(args.allow_env, env)
+        sensitive_values = tuple(
+            dict.fromkeys(
+                (*sensitive_values, *allowed_env_values(args.allow_env, env))
+            )
+        )
         print(f"sandboxed-verify: cwd={copied_repo}")
-        print(f"sandboxed-verify: command={' '.join(args.command)}")
+        print(
+            "sandboxed-verify: command="
+            + " ".join(
+                redact_command_argv(
+                    args.command,
+                    sensitive_values=sensitive_values,
+                )
+            )
+        )
         if args.allow_env:
             print(f"sandboxed-verify: allowed env names={','.join(sorted(set(args.allow_env)))}")
         if args.network != "default":
@@ -219,13 +338,20 @@ def main(argv: Sequence[str] | None = None) -> int:
         try:
             completed = run_command(args.command, copied_repo, env, args.timeout)
             if completed.stdout:
-                print(completed.stdout, end="")
+                print(
+                    redact_text(completed.stdout, sensitive_values=sensitive_values),
+                    end="",
+                )
             if completed.stderr:
-                print(completed.stderr, end="", file=sys.stderr)
+                print(
+                    redact_text(completed.stderr, sensitive_values=sensitive_values),
+                    end="",
+                    file=sys.stderr,
+                )
             exit_code = completed.returncode
         except subprocess.TimeoutExpired as exc:
-            stdout = timeout_output_text(exc.stdout)
-            stderr = timeout_output_text(exc.stderr)
+            stdout = timeout_output_text(exc.stdout, sensitive_values=sensitive_values)
+            stderr = timeout_output_text(exc.stderr, sensitive_values=sensitive_values)
             if stdout:
                 print(stdout, end="" if stdout.endswith("\n") else "\n")
             if stderr:
@@ -233,6 +359,16 @@ def main(argv: Sequence[str] | None = None) -> int:
             print(f"sandboxed-verify: command timed out after {args.timeout}s", file=sys.stderr)
             exit_code = 124
         return exit_code
+    except UnsafeAllowedEnvValueError as exc:
+        print(f"sandboxed-verify: execution failed: {exc}", file=sys.stderr)
+        exit_code = 126
+        return exit_code
+    except Exception as exc:
+        detail = redact_text(str(exc), sensitive_values=sensitive_values).strip()
+        suffix = f": {detail}" if detail else ""
+        print(f"sandboxed-verify: execution failed{suffix}", file=sys.stderr)
+        exit_code = 126
+        return exit_code
     finally:
         elapsed = time.monotonic() - start
         emit_result(
@@ -245,6 +381,7 @@ def main(argv: Sequence[str] | None = None) -> int:
             allowed_env=args.allow_env,
             network=args.network,
             evidence_note=args.evidence_note,
+            sensitive_values=sensitive_values,
         )
         if not args.keep_sandbox:
             shutil.rmtree(sandbox, ignore_errors=True)
diff --git a/scripts/ci/sandboxed_web_e2e.py b/scripts/ci/sandboxed_web_e2e.py
index ae0c3105a..14539233b 100644
--- a/scripts/ci/sandboxed_web_e2e.py
+++ b/scripts/ci/sandboxed_web_e2e.py
@@ -22,6 +22,12 @@
     sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
 
 from scripts.ci import sandboxed_verify
+from scripts.ci.redact_sensitive_log import (
+    REDACTED,
+    redact_command_text,
+    redact_json_value,
+    redact_text,
+)
 
 
 RESULT_MARKER = "SANDBOXED_WEB_E2E_RESULT"
@@ -68,7 +74,11 @@ def parse_args(argv: Sequence[str] | None = None) -> argparse.Namespace:
         action="append",
         default=[],
         metavar="NAME",
-        help="Pass one named environment variable into the sandbox. Values are never printed.",
+        help=(
+            "Pass one named environment variable into the sandbox. Nonempty values "
+            "must be at least 8 characters and must not collide with fixed "
+            "redaction evidence."
+        ),
     )
     parser.add_argument(
         "--network",
@@ -101,17 +111,16 @@ def parse_args(argv: Sequence[str] | None = None) -> argparse.Namespace:
 def start_service(label: str, command: str, cwd: Path, env: dict[str, str], logs_dir: Path) -> Service:
     """Start a service command in its own process group."""
     log_path = logs_dir / f"{label}.log"
-    log_file = log_path.open("w", encoding="utf-8")
-    process = subprocess.Popen(
-        shlex.split(command),
-        cwd=cwd,
-        env=env,
-        text=True,
-        stdout=log_file,
-        stderr=subprocess.STDOUT,
-        start_new_session=True,
-    )
-    log_file.close()
+    with log_path.open("w", encoding="utf-8") as log_file:
+        process = subprocess.Popen(
+            shlex.split(command),
+            cwd=cwd,
+            env=env,
+            text=True,
+            stdout=log_file,
+            stderr=subprocess.STDOUT,
+            start_new_session=True,
+        )
     return Service(label=label, command=command, process=process, log_path=log_path)
 
 
@@ -156,20 +165,32 @@ def stop_service(service: Service) -> None:
     try:
         os.killpg(service.process.pid, signal.SIGTERM)
         service.process.wait(timeout=10)
-    except (ProcessLookupError, subprocess.TimeoutExpired):
+    except (OSError, subprocess.TimeoutExpired):
         try:
             os.killpg(service.process.pid, signal.SIGKILL)
-        except ProcessLookupError:
+        except OSError:
+            return
+        try:
+            service.process.wait(timeout=10)
+        except (OSError, subprocess.TimeoutExpired):
             return
-        service.process.wait(timeout=10)
 
 
-def tail_text(path: Path, max_lines: int = 80) -> str:
-    """Return the final lines of a service log."""
+def tail_text(
+    path: Path,
+    max_lines: int = 80,
+    *,
+    sensitive_values: Sequence[str] = (),
+) -> str:
+    """Return redacted final lines of a service log."""
     if not path.exists():
         return ""
-    lines = path.read_text(encoding="utf-8", errors="replace").splitlines()
-    return "\n".join(lines[-max_lines:])
+    try:
+        text = path.read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return REDACTED
+    cleaned = redact_text(text, sensitive_values=sensitive_values)
+    return "\n".join(cleaned.splitlines()[-max_lines:])
 
 
 def emit_result(
@@ -181,24 +202,39 @@ def emit_result(
     frontend_ready: bool,
     exit_code: int,
     elapsed_seconds: float,
+    sensitive_values: Sequence[str] = (),
 ) -> None:
     """Print a machine-readable web E2E execution evidence summary."""
     payload = {
-        "backend_cmd": args.backend_cmd,
+        "backend_cmd": redact_command_text(
+            args.backend_cmd,
+            sensitive_values=sensitive_values,
+        ),
         "backend_ready": backend_ready,
         "allowed_env": sorted(set(args.allow_env)),
         "cwd": str(copied_repo),
-        "e2e_cmd": args.e2e_cmd,
+        "e2e_cmd": redact_command_text(
+            args.e2e_cmd,
+            sensitive_values=sensitive_values,
+        ),
         "elapsed_seconds": round(elapsed_seconds, 3),
         "evidence_note": args.evidence_note,
         "exit_code": exit_code,
-        "frontend_cmd": args.frontend_cmd,
+        "frontend_cmd": redact_command_text(
+            args.frontend_cmd,
+            sensitive_values=sensitive_values,
+        ),
         "frontend_ready": frontend_ready,
         "network": args.network,
         "sandbox": str(sandbox_root) if args.keep_sandbox else "(removed)",
         "sandboxed": True,
     }
-    print(f"{RESULT_MARKER} {json.dumps(payload, sort_keys=True)}")
+    redacted_payload = redact_json_value(
+        payload,
+        sensitive_values=sensitive_values,
+        redact_literal_keys=False,
+    )
+    print(f"{RESULT_MARKER} {json.dumps(redacted_payload, sort_keys=True)}")
 
 
 def main(argv: Sequence[str] | None = None) -> int:
@@ -212,10 +248,21 @@ def main(argv: Sequence[str] | None = None) -> int:
     backend_ready = False
     frontend_ready = False
     exit_code = 1
+    sensitive_values = sandboxed_verify.allowed_env_values(args.allow_env)
     start = time.monotonic()
     try:
+        sandboxed_verify.validate_allowed_env_values(args.allow_env)
         copied_repo = sandboxed_verify.copy_workspace(Path(args.repo_root), sandbox, args.ignore)
         env = sandboxed_verify.scrubbed_env(sandbox, args.allow_env)
+        sandboxed_verify.validate_allowed_env_values(args.allow_env, env)
+        sensitive_values = tuple(
+            dict.fromkeys(
+                (
+                    *sensitive_values,
+                    *sandboxed_verify.allowed_env_values(args.allow_env, env),
+                )
+            )
+        )
         print(f"sandboxed-web-e2e: cwd={copied_repo}")
         if args.allow_env:
             print(f"sandboxed-web-e2e: allowed env names={','.join(sorted(set(args.allow_env)))}")
@@ -232,14 +279,27 @@ def main(argv: Sequence[str] | None = None) -> int:
         try:
             completed = run_shell(args.e2e_cmd, copied_repo, env, args.e2e_timeout)
             if completed.stdout:
-                print(completed.stdout, end="")
+                print(
+                    redact_text(completed.stdout, sensitive_values=sensitive_values),
+                    end="",
+                )
             if completed.stderr:
-                print(completed.stderr, end="", file=sys.stderr)
+                print(
+                    redact_text(completed.stderr, sensitive_values=sensitive_values),
+                    end="",
+                    file=sys.stderr,
+                )
             exit_code = completed.returncode
             return exit_code
         except subprocess.TimeoutExpired as exc:
-            stdout = sandboxed_verify.timeout_output_text(exc.stdout)
-            stderr = sandboxed_verify.timeout_output_text(exc.stderr)
+            stdout = sandboxed_verify.timeout_output_text(
+                exc.stdout,
+                sensitive_values=sensitive_values,
+            )
+            stderr = sandboxed_verify.timeout_output_text(
+                exc.stderr,
+                sensitive_values=sensitive_values,
+            )
             if stdout:
                 print(stdout, end="" if stdout.endswith("\n") else "\n")
             if stderr:
@@ -247,10 +307,23 @@ def main(argv: Sequence[str] | None = None) -> int:
             print(f"sandboxed-web-e2e: e2e command timed out after {args.e2e_timeout}s", file=sys.stderr)
             exit_code = 124
             return exit_code
+    except sandboxed_verify.UnsafeAllowedEnvValueError as exc:
+        print(f"sandboxed-web-e2e: execution failed: {exc}", file=sys.stderr)
+        exit_code = 126
+        return exit_code
+    except Exception as exc:
+        detail = redact_text(str(exc), sensitive_values=sensitive_values).strip()
+        suffix = f": {detail}" if detail else ""
+        print(f"sandboxed-web-e2e: execution failed{suffix}", file=sys.stderr)
+        exit_code = 126
+        return exit_code
     finally:
         for service in reversed(services):
             stop_service(service)
-            log_tail = tail_text(service.log_path)
+            log_tail = tail_text(
+                service.log_path,
+                sensitive_values=sensitive_values,
+            )
             if log_tail:
                 print(f"--- {service.label} log tail ---")
                 print(log_tail)
@@ -262,6 +335,7 @@ def main(argv: Sequence[str] | None = None) -> int:
             frontend_ready=frontend_ready,
             exit_code=exit_code,
             elapsed_seconds=time.monotonic() - start,
+            sensitive_values=sensitive_values,
         )
         if not args.keep_sandbox:
             shutil.rmtree(sandbox, ignore_errors=True)
diff --git a/tests/test_opencode_security_boundaries.py b/tests/test_opencode_security_boundaries.py
index 1b22706fa..39f63c9b0 100644
--- a/tests/test_opencode_security_boundaries.py
+++ b/tests/test_opencode_security_boundaries.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import base64
 import hashlib
 import io
 import json
@@ -23,25 +24,55 @@
 
 def _synthetic_jwt() -> str:
     """Build JWT-shaped fixture text without committing secret-looking literals."""
-    return ".".join(("header", "payload", "signature"))
+    header = base64.urlsafe_b64encode(b'{"alg":"HS256","typ":"JWT"}').rstrip(b"=").decode()
+    payload = base64.urlsafe_b64encode(b'{"sub":"fixture-user"}').rstrip(b"=").decode()
+    return ".".join((header, payload, "signaturefixture"))
 
 
 def test_sensitive_log_redaction_handles_json_credentials_and_jwts() -> None:
     """Structured credentials and provider-independent JWTs never survive evidence redaction."""
     jwt_fixture = _synthetic_jwt()
     secrets = {
+        "apikey": "fixture-joined-api-key",
         "token": jwt_fixture,
         "jwt": jwt_fixture,
         "oidc_token": jwt_fixture,
+        "oidctoken": "fixture-joined-oidc-token",
         "api_credential": "fixture-api-credential",
         "client_secret": "fixture-client-secret",
+        "client_secret_b64": "fixture-client-secret-base64",
+        "clientsecrethash": "fixture-joined-client-secret-hash",
+        "connection_string": "fixture-connection-string",
+        "credential_data": "fixture-credential-data",
+        "credentials_json": "fixture-credentials-json",
+        "database_url": "fixture-database-url",
+        "encryption_key": "fixture-encryption-key",
+        "githubtoken": "fixture-joined-github-token",
+        "myservicecredential": "fixture-joined-service-credential",
         "MY_SERVICE_TOKEN": "fixture-service-token",
+        "password_hash": "fixture-password-hash",
+        "private_key_data": "fixture-private-key-data",
+        "private_key_pem": "fixture-private-key-pem",
+        "refreshtoken": "fixture-joined-refresh-token",
+        "secret_key": "fixture-secret-key",
+        "secret_material": "fixture-secret-material",
+        "servicepasswordhash": "fixture-joined-service-password-hash",
+        "signing_key": "fixture-signing-key",
+        "token_response": "fixture-token-response",
     }
     cleaned = redactor.redact_text(json.dumps({"nested": secrets}))
 
     assert all(value not in cleaned for value in secrets.values())
     assert set(json.loads(cleaned)["nested"].values()) == {redactor.REDACTED}
 
+    key_collision = json.loads(
+        redactor.redact_text(
+            json.dumps({"password": "second-credential-material-731"}),
+            sensitive_values=("password",),
+        )
+    )
+    assert key_collision == {redactor.REDACTED: redactor.REDACTED}
+
 
 def test_sensitive_log_redaction_preserves_normal_diagnostics() -> None:
     """Ordinary failure reasons remain visible while credentials are removed."""
@@ -58,6 +89,105 @@ def test_sensitive_log_redaction_preserves_normal_diagnostics() -> None:
     assert cleaned.count(redactor.REDACTED) >= 2
 
 
+def test_sensitive_log_redaction_handles_auth_headers_urls_and_command_values() -> None:
+    """Common registry, URL-userinfo, and separated curl credential forms are removed."""
+    opaque_secret = "opaque-auth-material-123456789"
+    source = (
+        f"Authorization: token {opaque_secret}\n"
+        f"Proxy-Authorization: Custom {opaque_secret}\n"
+        f"registry https://alice:{opaque_secret}@registry.example.test/image\n"
+        f"cache redis://:{opaque_secret}@cache.internal:6379/0\n"
+        f"auth={opaque_secret}\n"
+    )
+
+    cleaned = redactor.redact_text(source)
+    structured = json.loads(
+        redactor.redact_text(
+            json.dumps(
+                {
+                    "detail": (
+                        f'Authorization: Custom "{opaque_secret}"\n'
+                        "ordinary structured diagnostic"
+                    )
+                }
+            )
+        )
+    )
+    command = redactor.redact_command_argv(
+        [
+            "curl",
+            "--user",
+            f"alice:{opaque_secret}",
+            "-H",
+            f"Authorization: token {opaque_secret}",
+        ]
+    )
+    inline_command = redactor.redact_command_argv(
+        ["curl", f"--user=alice:{opaque_secret}", "-u", f"alice:{opaque_secret}"]
+    )
+    proxy_command = redactor.redact_command_argv(
+        [
+            "curl",
+            "--proxy-user",
+            f"alice:{opaque_secret}",
+            "--oauth2-bearer",
+            opaque_secret,
+        ]
+    )
+
+    assert opaque_secret not in cleaned
+    assert opaque_secret not in structured["detail"]
+    assert "ordinary structured diagnostic" in structured["detail"]
+    assert "alice:" not in cleaned
+    assert opaque_secret not in " ".join(command)
+    assert command[2] == redactor.REDACTED
+    assert command[4].endswith(redactor.REDACTED)
+    assert inline_command == [
+        "curl",
+        f"--user={redactor.REDACTED}",
+        "-u",
+        redactor.REDACTED,
+    ]
+    assert proxy_command == [
+        "curl",
+        "--proxy-user",
+        redactor.REDACTED,
+        "--oauth2-bearer",
+        redactor.REDACTED,
+    ]
+
+
+def test_sensitive_log_redaction_removes_multiline_private_key_blocks() -> None:
+    """Credential assignments cannot expose later lines of a PEM private key block."""
+    begin_private_key = "-----BEGIN " + "PRIVATE KEY-----"
+    end_private_key = "-----END " + "PRIVATE KEY-----"
+    begin_pgp_private_key = "-----BEGIN PGP " + "PRIVATE KEY BLOCK-----"
+    end_pgp_private_key = "-----END PGP " + "PRIVATE KEY BLOCK-----"
+    source = (
+        f"PRIVATE_KEY={begin_private_key}\n"
+        "MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSj\n"
+        f"{end_private_key}\n"
+        f"PGP_PRIVATE_KEY={begin_pgp_private_key}\n"
+        "xcLYBFfixturePrivatePacketBody731\n"
+        f"{end_pgp_private_key}\n"
+        "ordinary diagnostic after\n"
+    )
+
+    cleaned = redactor.redact_text(source)
+    structured_cleaned = json.loads(
+        redactor.redact_text(json.dumps({"detail": source}))
+    )["detail"]
+
+    assert "BEGIN PRIVATE KEY" not in cleaned
+    assert "MIIEvQ" not in cleaned
+    assert "END PRIVATE KEY" not in cleaned
+    assert "fixturePrivatePacketBody" not in cleaned
+    assert "MIIEvQ" not in structured_cleaned
+    assert "fixturePrivatePacketBody" not in structured_cleaned
+    assert "ordinary diagnostic after" in cleaned
+    assert cleaned.count("\n") == source.count("\n")
+
+
 def test_sensitive_log_redaction_handles_adversarial_quoted_values() -> None:
     """Quoted sensitive assignments are parsed linearly even with many escapes."""
     source = "_jwt:\"" + "\\!" * 5000
@@ -110,6 +240,39 @@ def test_sensitive_log_redaction_scrubs_provider_token_shapes() -> None:
     assert cleaned.count(redactor.REDACTED) == 5
 
 
+def test_sensitive_log_redaction_distinguishes_jwts_from_diagnostic_domains() -> None:
+    """JWT recognition preserves provider hostnames used by failed-check classification."""
+    jwt_fixture = _synthetic_jwt()
+    non_jose_header = base64.urlsafe_b64encode(b'{"typ":"diagnostic"}').rstrip(b"=").decode()
+    dotted_diagnostic = f"{non_jose_header}.payload.signature"
+    source = (
+        f"provider api.deepseek.com failed\n"
+        f"dotted diagnostic {dotted_diagnostic}\n"
+        f"opaque jwt {jwt_fixture}\n"
+    )
+
+    cleaned = redactor.redact_text(source)
+
+    assert "api.deepseek.com" in cleaned
+    assert dotted_diagnostic in cleaned
+    assert jwt_fixture not in cleaned
+    assert cleaned.count(redactor.REDACTED) == 1
+
+
+def test_sensitive_log_redaction_falls_back_safely_for_excessive_json_nesting() -> None:
+    """Pathological structured diagnostics cannot abort the shared evidence collector."""
+    provider_token = "ghp_" + ("N" * 24)
+    source = "[" * 2000 + json.dumps(provider_token) + "]" * 2000
+
+    cleaned = redactor.redact_text(source)
+
+    assert provider_token not in cleaned
+    assert redactor.REDACTED in cleaned
+
+    excessive_integer = "9" * 5000
+    assert redactor.redact_text(excessive_integer) == excessive_integer
+
+
 def test_sensitive_log_redaction_handles_lists_empty_input_and_cli(monkeypatch: pytest.MonkeyPatch) -> None:
     """Recursive lists, empty input, and the streaming CLI share the same scrubber."""
     source = '{"values":[{"ok":1,"api_key":"secret-value"},2]}\n'
@@ -134,6 +297,289 @@ def test_sensitive_log_redaction_handles_lists_empty_input_and_cli(monkeypatch:
     assert exc.value.code == 0
 
 
+def test_sensitive_log_redaction_scans_opaque_json_values_without_hiding_metadata() -> None:
+    """Opaque JSON values are scrubbed while benign token and password metadata remains useful."""
+    provider_token = "ghp_" + ("A" * 24)
+    source = json.dumps(
+        {
+            "build_status": "failed",
+            "diagnostic": provider_token,
+            "nested": [{"detail": f"Bearer {provider_token}"}],
+            "authorization_failure_reason": "missing repository scope",
+            "credential_rotation_status": "current",
+            "jwt_decode_error": "signature expired",
+            "notsecret": "ordinary negative assertion",
+            "password_policy": "minimum 14 characters",
+            "password_policy_status": "compliant",
+            "retoken": "retry label",
+            "secret_scan_count": 0,
+            "token_budget": 4096,
+            "token_count": 512,
+            "token_expires_at": "2026-08-09T00:00:00Z",
+            "token_type": "Bearer",
+            "token_usage": {"input": 256, "output": 128},
+        }
+    )
+
+    cleaned = json.loads(redactor.redact_text(source))
+
+    assert cleaned["build_status"] == "failed"
+    assert cleaned["diagnostic"] == redactor.REDACTED
+    assert cleaned["nested"] == [{"detail": f"Bearer {redactor.REDACTED}"}]
+    assert cleaned["authorization_failure_reason"] == "missing repository scope"
+    assert cleaned["credential_rotation_status"] == "current"
+    assert cleaned["jwt_decode_error"] == "signature expired"
+    assert cleaned["notsecret"] == "ordinary negative assertion"
+    assert cleaned["password_policy"] == "minimum 14 characters"
+    assert cleaned["password_policy_status"] == "compliant"
+    assert cleaned["retoken"] == "retry label"
+    assert cleaned["secret_scan_count"] == 0
+    assert cleaned["token_budget"] == 4096
+    assert cleaned["token_count"] == 512
+    assert cleaned["token_expires_at"] == "2026-08-09T00:00:00Z"
+    assert cleaned["token_type"] == "Bearer"
+    assert cleaned["token_usage"] == {"input": 256, "output": 128}
+
+
+def test_sensitive_log_redaction_removes_ansi_bypasses_but_preserves_visible_diagnostics() -> None:
+    """Terminal control sequences cannot split credential keys or provider-token signatures."""
+    opaque_secret = "-".join(("opaque", "fixture", "secret", "123456"))
+    provider_body = "B" * 24
+    source = (
+        "ordinary build failure\n"
+        f"to\x1b[31mken\x1b[0m={opaque_secret}\n"
+        f"to\x1b(Bken={opaque_secret}\n"
+        f"to\x1b7ken={opaque_secret}\n"
+        f"to\x9b31mken={opaque_secret}\n"
+        f"provider ghp_\x1b[32m{provider_body}\x1b[0m\n"
+        + json.dumps(
+            {
+                f"to\x1b[31mken": opaque_secret,
+                "ghp_" + provider_body: "provider key diagnostic",
+                f"{redactor.REDACTED}#2": "existing suffixed marker key",
+                redactor.REDACTED: "existing marker key",
+            }
+        )
+        + "\n"
+    )
+
+    cleaned = redactor.redact_text(source)
+
+    assert opaque_secret not in cleaned
+    assert provider_body not in cleaned
+    assert "ordinary build failure" in cleaned
+    assert "\x1b" not in cleaned
+    assert "\x9b" not in cleaned
+    structured = json.loads(cleaned.splitlines()[-1])
+    assert len(structured) == 4
+    assert sorted(structured.values()) == [
+        redactor.REDACTED,
+        "existing marker key",
+        "existing suffixed marker key",
+        "provider key diagnostic",
+    ]
+    assert all("ghp_" not in key for key in structured)
+
+
+def test_sensitive_log_redaction_fails_closed_for_terminal_overwrite_controls() -> None:
+    """Backspace, cursor motion, and invisible format controls cannot reconstruct secrets."""
+    opaque_secret = "opaque-rendered-secret-123456"
+    provider_body = "R" * 24
+    source = (
+        "ordinary diagnostic before\n"
+        f"toX\bken={opaque_secret}\n"
+        f"toX\x1b[1Dken={opaque_secret}\n"
+        f"to\u200bken={opaque_secret}\n"
+        f"to\u034fken={opaque_secret}\n"
+        f"to\ufe0fken={opaque_secret}\n"
+        f"provider ghp_X\b{provider_body}\n"
+        + json.dumps({f"toX\bken": opaque_secret})
+        + "\nordinary diagnostic after\n"
+    )
+
+    cleaned = redactor.redact_text(source)
+
+    assert opaque_secret not in cleaned
+    assert provider_body not in cleaned
+    assert "\b" not in cleaned
+    assert "\x1b" not in cleaned
+    assert "\u200b" not in cleaned
+    assert "ordinary diagnostic before" in cleaned
+    assert "ordinary diagnostic after" in cleaned
+    assert cleaned.count(redactor.REDACTED) >= 7
+    assert (
+        redactor.redact_json_value(f"toX\x1b[1Dken={opaque_secret}")
+        == redactor.REDACTED
+    )
+
+
+def test_sensitive_log_redaction_fails_closed_for_multiline_terminal_sequences() -> None:
+    """Secrets inside multiline OSC/DCS control payloads cannot escape line-local checks."""
+    opaque_secret = "opaque-multiline-terminal-secret-731"
+    source = (
+        "ordinary diagnostic before\n"
+        f"\x1b]0;title-prefix\n{opaque_secret}\ntitle-suffix\x07\n"
+        "ordinary diagnostic after\n"
+    )
+
+    cleaned = redactor.redact_text(source)
+
+    assert opaque_secret not in cleaned
+    assert "\x1b" not in cleaned
+    assert "\x07" not in cleaned
+    assert "ordinary diagnostic before" in cleaned
+    assert "ordinary diagnostic after" in cleaned
+    assert cleaned.count("\n") == source.count("\n")
+
+    unterminated = f"\x1b]0;title-prefix\n{opaque_secret}\ntitle-suffix"
+    unterminated_cleaned = redactor.redact_text(unterminated)
+    assert opaque_secret not in unterminated_cleaned
+    assert unterminated_cleaned.count("\n") == unterminated.count("\n")
+
+
+def test_sensitive_log_redaction_accepts_explicit_literal_secrets() -> None:
+    """Caller-supplied opaque and multiline credential values are removed exactly."""
+    opaque_secret = "-".join(("opaque", "allow", "env", "fixture", "123456"))
+    multiline_secret = "private-line-one\nprivate-line-two"
+    ansi_secret = "violet\x1b[31m-capybara-731"
+    source = f"ordinary diagnostic\n{opaque_secret}\n{multiline_secret}\n{ansi_secret}\n"
+
+    cleaned = redactor.redact_text(
+        source,
+        sensitive_values=(
+            opaque_secret,
+            multiline_secret,
+            ansi_secret,
+            "",
+            opaque_secret,
+        ),
+    )
+
+    assert opaque_secret not in cleaned
+    assert "private-line-one" not in cleaned
+    assert "private-line-two" not in cleaned
+    assert "violet-capybara-731" not in cleaned
+    assert "ordinary diagnostic" in cleaned
+    assert cleaned.count(redactor.REDACTED) == 3
+    assert cleaned.count("\n") == source.count("\n")
+
+    escaped = repr(multiline_secret)
+    escaped_cleaned = redactor.redact_text(
+        f"FileNotFoundError: {escaped}",
+        sensitive_values=(multiline_secret,),
+    )
+    assert "private-line-one\\nprivate-line-two" not in escaped_cleaned
+
+
+def test_sensitive_literal_redaction_preserves_leading_and_unicode_line_separators() -> None:
+    """Opaque multiline values keep every separator at its original relative position."""
+    leading_secret = "\nprivate-leading-value"
+    unicode_secret = "private-unicode-one\u2028private-unicode-two"
+    source = f"prefix{leading_secret} suffix\n{unicode_secret} tail"
+
+    cleaned = redactor.redact_text(
+        source,
+        sensitive_values=(leading_secret, unicode_secret),
+    )
+
+    assert cleaned == (
+        f"prefix\n{redactor.REDACTED} suffix\n"
+        f"{redactor.REDACTED}\u2028 tail"
+    )
+
+
+def test_sensitive_log_redaction_preserves_all_supported_line_boundaries() -> None:
+    """Line separators remain boundaries rather than unsafe inline controls."""
+    source = "before\vafter\fnext\x1cunit\x85unicode\u2028paragraph\u2029last"
+
+    assert redactor.redact_text(source) == source
+
+
+def test_sensitive_literal_redaction_preserves_json_types_and_its_own_marker() -> None:
+    """Opaque values redact string evidence without corrupting JSON or prior markers."""
+    source = json.dumps(
+        {
+            "enabled": True,
+            "literal": "true",
+            "marker_word": "REDACTED",
+            "opaque": "fixture-secret-long",
+            "token_count": 512,
+        }
+    )
+
+    cleaned_text = redactor.redact_text(
+        source,
+        sensitive_values=("fixture-secret-long", "REDACTED", "true"),
+    )
+    cleaned = json.loads(cleaned_text)
+
+    assert cleaned["enabled"] is True
+    assert cleaned["literal"] == redactor.REDACTED
+    assert cleaned["marker_word"] == redactor.REDACTED
+    assert cleaned["opaque"] == redactor.REDACTED
+    assert cleaned["token_count"] == 512
+    assert "[[REDACTED]]" not in cleaned_text
+
+
+def test_sensitive_literal_redaction_does_not_rewrite_existing_markers() -> None:
+    """Literal substrings inside an existing marker are never scanned as credentials."""
+    source = "prior [REDACTED] evidence and plain REDACTED value"
+
+    cleaned = redactor.redact_text(
+        source,
+        sensitive_values=("RED", "REDACTED"),
+    )
+
+    assert cleaned == "prior [REDACTED] evidence and plain [REDACTED] value"
+    assert redactor.redact_text(
+        "prior [REDACTED] evidence",
+        sensitive_values=("[REDACTE",),
+    ) == "prior [REDACTED] evidence"
+
+
+def test_command_redaction_fails_closed_for_malformed_sensitive_quoting() -> None:
+    """Malformed shell quoting hides sensitive option evidence but preserves benign text."""
+    assert (
+        redactor.redact_command_text("tool --token 'unterminated")
+        == redactor.REDACTED
+    )
+    assert redactor.redact_command_text("tool 'unterminated") == "tool 'unterminated"
+
+
+def test_sensitive_log_redaction_processes_long_key_like_diagnostics_within_budget() -> None:
+    """A modest non-secret key-like line cannot trigger quadratic CI redaction work."""
+    source = (
+        "from scripts.ci.redact_sensitive_log import redact_text; "
+        "value = 'a' * 10000; assert redact_text(value) == value"
+    )
+
+    subprocess.run(
+        [sys.executable, "-c", source],
+        cwd=Path.cwd(),
+        check=True,
+        shell=False,
+        timeout=2,
+    )
+
+
+def test_sensitive_log_redaction_processes_many_lines_and_values_within_budget() -> None:
+    """Many opaque values cannot multiply work independently for every log line."""
+    source = (
+        "from scripts.ci.redact_sensitive_log import redact_text; "
+        "text = 'ordinary diagnostic\\n' * 20000; "
+        "values = tuple(f'opaque-{index:03d}-fixture-value' for index in range(100)); "
+        "assert redact_text(text, sensitive_values=values) == text"
+    )
+
+    subprocess.run(
+        [sys.executable, "-c", source],
+        cwd=Path.cwd(),
+        check=True,
+        shell=False,
+        timeout=2,
+    )
+
+
 @pytest.mark.parametrize(
     ("command", "expected"),
     [
diff --git a/tests/test_sandboxed_log_redaction_regression.py b/tests/test_sandboxed_log_redaction_regression.py
new file mode 100644
index 000000000..8133361e0
--- /dev/null
+++ b/tests/test_sandboxed_log_redaction_regression.py
@@ -0,0 +1,489 @@
+"""Fail-first regressions for credential-shaped sandbox subprocess evidence."""
+
+from __future__ import annotations
+
+import subprocess
+from types import SimpleNamespace
+
+from scripts.ci import sandboxed_verify, sandboxed_web_e2e
+
+
+GITHUB_TOKEN = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890"
+PASSWORD = "correct-horse-battery-staple"
+SESSION_KEY = "session-value-should-not-leak"
+
+
+def _bind_verify_workspace(monkeypatch, tmp_path) -> None:
+    """Avoid filesystem-copy behavior while exercising the verification output boundary."""
+    monkeypatch.setattr(sandboxed_verify, "copy_workspace", lambda *_args: tmp_path)
+    monkeypatch.setattr(sandboxed_verify, "scrubbed_env", lambda *_args: {})
+
+
+def _service(log_path):
+    """Return a minimal running service fixture accepted by the E2E wrapper."""
+    process = SimpleNamespace(poll=lambda: None, pid=12345, wait=lambda timeout: None)
+    return sandboxed_web_e2e.Service("service", "serve", process, log_path)
+
+
+def _bind_e2e_services(monkeypatch, tmp_path, *, log_text: str = "ordinary service log\n") -> None:
+    """Bind deterministic ready services whose log evidence is controlled by the test."""
+    counter = {"value": 0}
+
+    def start_service(label, _command, _cwd, _env, logs_dir):
+        counter["value"] += 1
+        log_path = logs_dir / f"{label}-{counter['value']}.log"
+        log_path.write_text(log_text, encoding="utf-8")
+        return _service(log_path)
+
+    monkeypatch.setattr(sandboxed_verify, "copy_workspace", lambda *_args: tmp_path)
+    monkeypatch.setattr(sandboxed_verify, "scrubbed_env", lambda *_args: {})
+    monkeypatch.setattr(sandboxed_web_e2e, "start_service", start_service)
+    monkeypatch.setattr(sandboxed_web_e2e, "wait_for_url", lambda *_args: True)
+    monkeypatch.setattr(sandboxed_web_e2e, "stop_service", lambda _service: None)
+
+
+def test_sandboxed_verify_redacts_completed_stdout_and_stderr(monkeypatch, tmp_path, capsys):
+    """Completed verification output must cross the shared credential-redaction boundary."""
+    _bind_verify_workspace(monkeypatch, tmp_path)
+    monkeypatch.setattr(
+        sandboxed_verify,
+        "run_command",
+        lambda *_args: subprocess.CompletedProcess(
+            args=["fake"],
+            returncode=0,
+            stdout=f"token={GITHUB_TOKEN}\nordinary stdout\n",
+            stderr=f"password={PASSWORD}\nordinary stderr\n",
+        ),
+    )
+
+    assert sandboxed_verify.main(["--repo-root", str(tmp_path), "--", "fake"]) == 0
+    captured = capsys.readouterr()
+
+    assert GITHUB_TOKEN not in captured.out
+    assert PASSWORD not in captured.err
+    assert "[REDACTED]" in captured.out
+    assert "[REDACTED]" in captured.err
+    assert "ordinary stdout" in captured.out
+    assert "ordinary stderr" in captured.err
+
+
+def test_sandboxed_verify_redacts_timeout_bytes(monkeypatch, tmp_path, capsys):
+    """Timeout byte streams must be decoded and redacted before becoming CI evidence."""
+    _bind_verify_workspace(monkeypatch, tmp_path)
+
+    def timeout(*_args):
+        raise subprocess.TimeoutExpired(
+            cmd=["fake"],
+            timeout=1,
+            output=f"api_key={GITHUB_TOKEN}\nordinary timeout stdout\n".encode(),
+            stderr=f"session_key={SESSION_KEY}\nordinary timeout stderr\n".encode(),
+        )
+
+    monkeypatch.setattr(sandboxed_verify, "run_command", timeout)
+
+    assert sandboxed_verify.main(["--repo-root", str(tmp_path), "--timeout", "1", "--", "fake"]) == 124
+    captured = capsys.readouterr()
+
+    assert GITHUB_TOKEN not in captured.out
+    assert SESSION_KEY not in captured.err
+    assert "[REDACTED]" in captured.out
+    assert "[REDACTED]" in captured.err
+    assert "ordinary timeout stdout" in captured.out
+    assert "ordinary timeout stderr" in captured.err
+
+
+def test_sandboxed_verify_timeout_without_captured_streams(monkeypatch, tmp_path, capsys):
+    """A timeout with no captured streams preserves the empty-output branches."""
+    _bind_verify_workspace(monkeypatch, tmp_path)
+
+    def timeout(*_args):
+        raise subprocess.TimeoutExpired(cmd=["fake"], timeout=1, output=None, stderr=None)
+
+    monkeypatch.setattr(sandboxed_verify, "run_command", timeout)
+
+    assert sandboxed_verify.main(["--repo-root", str(tmp_path), "--timeout", "1", "--", "fake"]) == 124
+    captured = capsys.readouterr()
+
+    assert "[REDACTED]" not in captured.out
+    assert "command timed out after 1s" in captured.err
+
+
+def test_sandboxed_verify_handles_empty_completed_streams(monkeypatch, tmp_path, capsys):
+    """Redaction does not invent output when a completed command emits no streams."""
+    _bind_verify_workspace(monkeypatch, tmp_path)
+    monkeypatch.setattr(
+        sandboxed_verify,
+        "run_command",
+        lambda *_args: subprocess.CompletedProcess(
+            args=["fake"],
+            returncode=0,
+            stdout="",
+            stderr="",
+        ),
+    )
+
+    assert sandboxed_verify.main(["--repo-root", str(tmp_path), "--", "fake"]) == 0
+    captured = capsys.readouterr()
+
+    assert "[REDACTED]" not in captured.out
+    assert captured.err == ""
+
+
+def test_sandboxed_verify_redacts_explicit_allow_env_value(monkeypatch, tmp_path, capsys):
+    """An opaque explicitly allowed environment value never becomes completed-process evidence."""
+    env_name = "CWL_TEST_CREDENTIAL"
+    env_value = "opaque-allow-env-fixture-123456"
+    monkeypatch.setattr(sandboxed_verify, "copy_workspace", lambda *_args: tmp_path)
+    monkeypatch.setattr(sandboxed_verify, "scrubbed_env", lambda *_args: {env_name: env_value})
+
+    def completed(_command, _cwd, env, _timeout):
+        assert env[env_name] == env_value
+        return subprocess.CompletedProcess(
+            args=["fake"],
+            returncode=0,
+            stdout=f"ordinary stdout {env_value}\n",
+            stderr=f"ordinary stderr {env_value}\n",
+        )
+
+    monkeypatch.setattr(sandboxed_verify, "run_command", completed)
+
+    assert (
+        sandboxed_verify.main(
+            ["--repo-root", str(tmp_path), "--allow-env", env_name, "--", "fake"]
+        )
+        == 0
+    )
+    captured = capsys.readouterr()
+
+    assert env_value not in captured.out
+    assert env_value not in captured.err
+    assert "ordinary stdout" in captured.out
+    assert "ordinary stderr" in captured.err
+
+
+def test_sandboxed_verify_redacts_explicit_allow_env_value_on_timeout(
+    monkeypatch, tmp_path, capsys
+):
+    """An opaque explicitly allowed environment value never becomes timeout evidence."""
+    env_name = "CWL_TEST_CREDENTIAL"
+    env_value = "opaque-timeout-env-fixture-123456"
+    monkeypatch.setattr(sandboxed_verify, "copy_workspace", lambda *_args: tmp_path)
+    monkeypatch.setattr(sandboxed_verify, "scrubbed_env", lambda *_args: {env_name: env_value})
+
+    def timeout(_command, _cwd, env, timeout_seconds):
+        assert env[env_name] == env_value
+        raise subprocess.TimeoutExpired(
+            cmd=["fake"],
+            timeout=timeout_seconds,
+            output=f"ordinary timeout stdout {env_value}\n".encode(),
+            stderr=f"ordinary timeout stderr {env_value}\n".encode(),
+        )
+
+    monkeypatch.setattr(sandboxed_verify, "run_command", timeout)
+
+    assert (
+        sandboxed_verify.main(
+            [
+                "--repo-root",
+                str(tmp_path),
+                "--timeout",
+                "1",
+                "--allow-env",
+                env_name,
+                "--",
+                "fake",
+            ]
+        )
+        == 124
+    )
+    captured = capsys.readouterr()
+
+    assert env_value not in captured.out
+    assert env_value not in captured.err
+    assert "ordinary timeout stdout" in captured.out
+    assert "ordinary timeout stderr" in captured.err
+
+
+def test_sandboxed_web_e2e_redacts_completed_output_and_service_tails(monkeypatch, tmp_path, capsys):
+    """E2E process streams and backend/frontend log tails must redact credentials."""
+    _bind_e2e_services(
+        monkeypatch,
+        tmp_path,
+        log_text=f"credential={GITHUB_TOKEN}\nordinary service log\n",
+    )
+    monkeypatch.setattr(
+        sandboxed_web_e2e,
+        "run_shell",
+        lambda *_args: subprocess.CompletedProcess(
+            args=["fake-e2e"],
+            returncode=0,
+            stdout=f"authorization=Bearer {GITHUB_TOKEN}\nordinary e2e stdout\n",
+            stderr=f"password={PASSWORD}\nordinary e2e stderr\n",
+        ),
+    )
+
+    assert (
+        sandboxed_web_e2e.main(
+            [
+                "--repo-root",
+                str(tmp_path),
+                "--backend-cmd",
+                "backend",
+                "--frontend-cmd",
+                "frontend",
+                "--e2e-cmd",
+                "e2e",
+            ]
+        )
+        == 0
+    )
+    captured = capsys.readouterr()
+
+    assert GITHUB_TOKEN not in captured.out
+    assert PASSWORD not in captured.err
+    assert captured.out.count("[REDACTED]") >= 3
+    assert "[REDACTED]" in captured.err
+    assert "ordinary e2e stdout" in captured.out
+    assert "ordinary service log" in captured.out
+    assert "ordinary e2e stderr" in captured.err
+
+
+def test_sandboxed_web_e2e_redacts_timeout_bytes(monkeypatch, tmp_path, capsys):
+    """E2E timeout stdout/stderr bytes must be redacted without changing timeout semantics."""
+    _bind_e2e_services(monkeypatch, tmp_path)
+
+    def timeout(*_args):
+        raise subprocess.TimeoutExpired(
+            cmd=["fake-e2e"],
+            timeout=1,
+            output=f"token={GITHUB_TOKEN}\nordinary e2e timeout stdout\n".encode(),
+            stderr=f"session_key={SESSION_KEY}\nordinary e2e timeout stderr\n".encode(),
+        )
+
+    monkeypatch.setattr(sandboxed_web_e2e, "run_shell", timeout)
+
+    assert (
+        sandboxed_web_e2e.main(
+            [
+                "--repo-root",
+                str(tmp_path),
+                "--backend-cmd",
+                "backend",
+                "--frontend-cmd",
+                "frontend",
+                "--e2e-cmd",
+                "e2e",
+                "--e2e-timeout",
+                "1",
+            ]
+        )
+        == 124
+    )
+    captured = capsys.readouterr()
+
+    assert GITHUB_TOKEN not in captured.out
+    assert SESSION_KEY not in captured.err
+    assert "[REDACTED]" in captured.out
+    assert "[REDACTED]" in captured.err
+    assert "ordinary e2e timeout stdout" in captured.out
+    assert "ordinary e2e timeout stderr" in captured.err
+
+
+def test_sandboxed_web_e2e_timeout_without_captured_streams(monkeypatch, tmp_path, capsys):
+    """E2E timeout with no captured streams preserves the empty-output branches."""
+    _bind_e2e_services(monkeypatch, tmp_path, log_text="")
+
+    def timeout(*_args):
+        raise subprocess.TimeoutExpired(cmd=["fake-e2e"], timeout=1, output=None, stderr=None)
+
+    monkeypatch.setattr(sandboxed_web_e2e, "run_shell", timeout)
+
+    assert (
+        sandboxed_web_e2e.main(
+            [
+                "--repo-root",
+                str(tmp_path),
+                "--backend-cmd",
+                "backend",
+                "--frontend-cmd",
+                "frontend",
+                "--e2e-cmd",
+                "e2e",
+                "--e2e-timeout",
+                "1",
+            ]
+        )
+        == 124
+    )
+    captured = capsys.readouterr()
+
+    assert "[REDACTED]" not in captured.out
+    assert "e2e command timed out after 1s" in captured.err
+
+
+def test_sandboxed_web_e2e_handles_empty_completed_streams(monkeypatch, tmp_path, capsys):
+    """E2E redaction preserves the no-output branch for successful commands."""
+    _bind_e2e_services(monkeypatch, tmp_path, log_text="")
+    monkeypatch.setattr(
+        sandboxed_web_e2e,
+        "run_shell",
+        lambda *_args: subprocess.CompletedProcess(
+            args=["fake-e2e"],
+            returncode=0,
+            stdout="",
+            stderr="",
+        ),
+    )
+
+    assert (
+        sandboxed_web_e2e.main(
+            [
+                "--repo-root",
+                str(tmp_path),
+                "--backend-cmd",
+                "backend",
+                "--frontend-cmd",
+                "frontend",
+                "--e2e-cmd",
+                "e2e",
+            ]
+        )
+        == 0
+    )
+    captured = capsys.readouterr()
+
+    assert "[REDACTED]" not in captured.out
+    assert captured.err == ""
+
+
+def test_sandboxed_web_e2e_redacts_explicit_allow_env_value_from_all_evidence(
+    monkeypatch, tmp_path, capsys
+):
+    """An opaque allowed value is removed from E2E streams and backend/frontend log tails."""
+    env_name = "CWL_TEST_CREDENTIAL"
+    env_value = "opaque-e2e-env-fixture-123456"
+    counter = {"value": 0}
+    monkeypatch.setattr(sandboxed_verify, "copy_workspace", lambda *_args: tmp_path)
+    monkeypatch.setattr(sandboxed_verify, "scrubbed_env", lambda *_args: {env_name: env_value})
+
+    def start_service(label, _command, _cwd, env, logs_dir):
+        assert env[env_name] == env_value
+        counter["value"] += 1
+        log_path = logs_dir / f"{label}-{counter['value']}.log"
+        log_path.write_text(f"ordinary service log {env_value}\n", encoding="utf-8")
+        return _service(log_path)
+
+    monkeypatch.setattr(sandboxed_web_e2e, "start_service", start_service)
+    monkeypatch.setattr(sandboxed_web_e2e, "wait_for_url", lambda *_args: True)
+    monkeypatch.setattr(sandboxed_web_e2e, "stop_service", lambda _service: None)
+    monkeypatch.setattr(
+        sandboxed_web_e2e,
+        "run_shell",
+        lambda *_args: subprocess.CompletedProcess(
+            args=["fake-e2e"],
+            returncode=0,
+            stdout=f"ordinary e2e stdout {env_value}\n",
+            stderr=f"ordinary e2e stderr {env_value}\n",
+        ),
+    )
+
+    assert (
+        sandboxed_web_e2e.main(
+            [
+                "--repo-root",
+                str(tmp_path),
+                "--backend-cmd",
+                "backend",
+                "--frontend-cmd",
+                "frontend",
+                "--e2e-cmd",
+                "e2e",
+                "--allow-env",
+                env_name,
+            ]
+        )
+        == 0
+    )
+    captured = capsys.readouterr()
+
+    assert env_value not in captured.out
+    assert env_value not in captured.err
+    assert "ordinary e2e stdout" in captured.out
+    assert "ordinary e2e stderr" in captured.err
+    assert captured.out.count("ordinary service log") == 2
+
+
+def test_sandboxed_web_e2e_redacts_explicit_allow_env_value_on_timeout(
+    monkeypatch, tmp_path, capsys
+):
+    """An opaque explicitly allowed environment value never becomes E2E timeout evidence."""
+    env_name = "CWL_TEST_CREDENTIAL"
+    env_value = "opaque-e2e-timeout-env-fixture-123456"
+    _bind_e2e_services(monkeypatch, tmp_path, log_text="")
+    monkeypatch.setattr(sandboxed_verify, "scrubbed_env", lambda *_args: {env_name: env_value})
+
+    def timeout(_command, _cwd, env, timeout_seconds):
+        assert env[env_name] == env_value
+        raise subprocess.TimeoutExpired(
+            cmd=["fake-e2e"],
+            timeout=timeout_seconds,
+            output=f"ordinary e2e timeout stdout {env_value}\n".encode(),
+            stderr=f"ordinary e2e timeout stderr {env_value}\n".encode(),
+        )
+
+    monkeypatch.setattr(sandboxed_web_e2e, "run_shell", timeout)
+
+    assert (
+        sandboxed_web_e2e.main(
+            [
+                "--repo-root",
+                str(tmp_path),
+                "--backend-cmd",
+                "backend",
+                "--frontend-cmd",
+                "frontend",
+                "--e2e-cmd",
+                "e2e",
+                "--e2e-timeout",
+                "1",
+                "--allow-env",
+                env_name,
+            ]
+        )
+        == 124
+    )
+    captured = capsys.readouterr()
+
+    assert env_value not in captured.out
+    assert env_value not in captured.err
+    assert "ordinary e2e timeout stdout" in captured.out
+    assert "ordinary e2e timeout stderr" in captured.err
+
+
+def test_wait_for_url_retries_nonready_http_status(monkeypatch, tmp_path):
+    """A non-ready HTTP status follows the existing bounded polling path."""
+
+    class RunningProcess:
+        def poll(self):
+            return None
+
+    class Response:
+        status = 503
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, exc_type, exc, traceback):
+            return False
+
+    class Opener:
+        def open(self, _url, timeout):
+            assert timeout == 2
+            return Response()
+
+    ticks = iter([0.0, 0.0, 2.0])
+    monkeypatch.setattr(sandboxed_web_e2e.time, "monotonic", lambda: next(ticks))
+    monkeypatch.setattr(sandboxed_web_e2e.urllib.request, "build_opener", lambda *_args: Opener())
+    service = _service(tmp_path / "unused.log")
+
+    assert sandboxed_web_e2e.wait_for_url("http://127.0.0.1:8000/health", 1, service) is False
diff --git a/tests/test_sandboxed_verify.py b/tests/test_sandboxed_verify.py
index c711f3489..f0c7fa657 100644
--- a/tests/test_sandboxed_verify.py
+++ b/tests/test_sandboxed_verify.py
@@ -1,6 +1,7 @@
 import json
 import runpy
 import shutil
+import subprocess
 import sys
 from pathlib import Path
 
@@ -29,6 +30,7 @@ def test_scrubbed_env_uses_sandbox_paths_and_drops_secrets(monkeypatch, tmp_path
 
 def test_scrubbed_env_allows_named_credentials_without_printing_values(monkeypatch, tmp_path, capsys):
     """Allowed secret names are recorded, but secret values are not printed."""
+    escaped_secret = 'violet"\\capybara\n731'
     monkeypatch.setenv("GITHUB_TOKEN", "secret-value")
     monkeypatch.setenv("OTHER_TOKEN", "other-secret")
 
@@ -38,7 +40,13 @@ def test_scrubbed_env_allows_named_credentials_without_printing_values(monkeypat
     assert "OTHER_TOKEN" not in env
 
     sandboxed_verify.emit_result(
-        command=["true"],
+        command=[
+            "tool",
+            "--token=opaque-command-secret",
+            "--password",
+            "opaque-separated-secret",
+            f"--label={escaped_secret}",
+        ],
         copied_repo=tmp_path / "repo",
         sandbox_root=tmp_path,
         exit_code=0,
@@ -47,14 +55,27 @@ def test_scrubbed_env_allows_named_credentials_without_printing_values(monkeypat
         allowed_env=["GITHUB_TOKEN"],
         network="required",
         evidence_note="fetch private dependency",
+        sensitive_values=(escaped_secret,),
     )
     output = capsys.readouterr().out
+    result_line = output.removeprefix(sandboxed_verify.RESULT_MARKER).strip()
+    payload = json.loads(result_line)
 
     assert "GITHUB_TOKEN" in output
     assert "required" in output
     assert "fetch private dependency" in output
     assert "secret-value" not in output
     assert "other-secret" not in output
+    assert "violet" not in output
+    assert "capybara" not in output
+    assert payload["allowed_env"] == ["GITHUB_TOKEN"]
+    assert payload["command"] == [
+        "tool",
+        "--token=[REDACTED]",
+        "--password",
+        "[REDACTED]",
+        "--label=[REDACTED]\n",
+    ]
 
 
 def test_copy_workspace_excludes_default_noise_and_keeps_sources(tmp_path):
@@ -175,6 +196,164 @@ def test_main_reports_allowed_env_network_stderr_timeout_and_kept_sandbox(monkey
     shutil.rmtree(payload["sandbox"], ignore_errors=True)
 
 
+def test_main_redacts_allowed_value_when_workspace_setup_fails(monkeypatch, tmp_path, capsys):
+    """A pre-copy failure cannot expose allowed values in result metadata or a traceback."""
+    secret = "opaque-precopy-credential-731"
+    monkeypatch.setenv("CWL_TEST_CREDENTIAL", secret)
+
+    exit_code = sandboxed_verify.main(
+        [
+            "--repo-root",
+            str(tmp_path / "missing"),
+            "--allow-env",
+            "CWL_TEST_CREDENTIAL",
+            "--",
+            "tool",
+            secret,
+        ]
+    )
+    captured = capsys.readouterr()
+
+    assert exit_code == 126
+    assert secret not in captured.out
+    assert secret not in captured.err
+    assert "repo root is not a directory" in captured.err
+    result_line = [
+        line for line in captured.out.splitlines() if line.startswith(sandboxed_verify.RESULT_MARKER)
+    ][-1]
+    payload = json.loads(result_line.removeprefix(sandboxed_verify.RESULT_MARKER).strip())
+    assert payload["command"] == ["tool", sandboxed_verify.redact_text(secret, sensitive_values=(secret,))]
+    assert payload["exit_code"] == 126
+
+
+def test_main_redacts_missing_executable_exception(monkeypatch, tmp_path, capsys):
+    """A process-spawn exception is reported without a raw secret-bearing traceback."""
+    repo = tmp_path / "repo"
+    repo.mkdir()
+    secret = "opaque-missing-executable-731"
+    monkeypatch.setenv("CWL_TEST_CREDENTIAL", secret)
+
+    exit_code = sandboxed_verify.main(
+        [
+            "--repo-root",
+            str(repo),
+            "--allow-env",
+            "CWL_TEST_CREDENTIAL",
+            "--",
+            secret,
+        ]
+    )
+    captured = capsys.readouterr()
+
+    assert exit_code == 126
+    assert secret not in captured.out
+    assert secret not in captured.err
+    assert "execution failed" in captured.err
+    assert "[REDACTED]" in captured.out + captured.err
+
+
+def test_main_rejects_short_allowed_values_without_changing_result_schema(
+    monkeypatch,
+    tmp_path,
+    capsys,
+):
+    """Ambiguous short values fail before execution and cannot rename result fields."""
+    repo = tmp_path / "repo"
+    repo.mkdir()
+    monkeypatch.setenv("CWL_TEST_CREDENTIAL", "a")
+    monkeypatch.setattr(
+        sandboxed_verify,
+        "run_command",
+        lambda *args, **kwargs: pytest.fail("short allowed value reached execution"),
+    )
+
+    exit_code = sandboxed_verify.main(
+        [
+            "--repo-root",
+            str(repo),
+            "--allow-env",
+            "CWL_TEST_CREDENTIAL",
+            "--",
+            "tool",
+            "a",
+        ]
+    )
+    captured = capsys.readouterr()
+
+    assert exit_code == 126
+    assert "at least 8 characters" in captured.err
+    result_line = [
+        line for line in captured.out.splitlines() if line.startswith(sandboxed_verify.RESULT_MARKER)
+    ][-1]
+    payload = json.loads(result_line.removeprefix(sandboxed_verify.RESULT_MARKER).strip())
+    assert set(payload) == {
+        "allowed_env",
+        "command",
+        "cwd",
+        "elapsed_seconds",
+        "evidence_note",
+        "exit_code",
+        "network",
+        "sandbox",
+        "sandboxed",
+    }
+    assert payload["command"] == ["tool", "[REDACTED]"]
+
+
+def test_main_redacts_whitespace_in_allowed_values_without_changing_execution(
+    monkeypatch,
+    tmp_path,
+    capsys,
+):
+    """Whitespace-bearing allowed values execute unchanged but never enter evidence."""
+    repo = tmp_path / "repo"
+    repo.mkdir()
+    secret = "opaque credential material 731"
+    monkeypatch.setenv("CWL_TEST_CREDENTIAL", secret)
+
+    def fake_run_command(command, cwd, env, timeout):
+        assert command == ["tool", secret]
+        assert env["CWL_TEST_CREDENTIAL"] == secret
+        return subprocess.CompletedProcess(command, 0, stdout=f"{secret}\n", stderr="")
+
+    monkeypatch.setattr(sandboxed_verify, "run_command", fake_run_command)
+
+    exit_code = sandboxed_verify.main(
+        [
+            "--repo-root",
+            str(repo),
+            "--allow-env",
+            "CWL_TEST_CREDENTIAL",
+            "--",
+            "tool",
+            secret,
+        ]
+    )
+    captured = capsys.readouterr()
+
+    assert exit_code == 0
+    assert secret not in captured.out + captured.err
+    assert sandboxed_verify.REDACTION_MARKER in captured.out
+    result_line = [
+        line for line in captured.out.splitlines() if line.startswith(sandboxed_verify.RESULT_MARKER)
+    ][-1]
+    payload = json.loads(result_line.removeprefix(sandboxed_verify.RESULT_MARKER).strip())
+    assert payload["command"] == ["tool", sandboxed_verify.REDACTION_MARKER]
+
+
+@pytest.mark.parametrize(
+    "value",
+    ["REDACTED", "SANDBOXED_VERIFY_RESULT", "CWL_TEST_CREDENTIAL"],
+)
+def test_allowed_env_validation_rejects_evidence_collisions(value):
+    """Allowed values cannot collide with markers, schema text, or public env names."""
+    with pytest.raises(sandboxed_verify.UnsafeAllowedEnvValueError):
+        sandboxed_verify.validate_allowed_env_values(
+            ["CWL_TEST_CREDENTIAL"],
+            {"CWL_TEST_CREDENTIAL": value},
+        )
+
+
 def test_parse_args_rejects_invalid_inputs():
     """The CLI rejects invocations without a command or with invalid options."""
     with pytest.raises(SystemExit):
diff --git a/tests/test_sandboxed_web_e2e.py b/tests/test_sandboxed_web_e2e.py
index 6e092c293..d4bdc4f63 100644
--- a/tests/test_sandboxed_web_e2e.py
+++ b/tests/test_sandboxed_web_e2e.py
@@ -145,6 +145,32 @@ def fake_killpg(pid, sig):
     sandboxed_web_e2e.stop_service(slow_service)
     assert len(killed) == 2
 
+    class NeverStops:
+        pid = 54321
+
+        def poll(self):
+            return None
+
+        def wait(self, timeout):
+            raise subprocess.TimeoutExpired("opaque-cleanup-command", timeout)
+
+    never_stops = sandboxed_web_e2e.Service(
+        "stuck",
+        "opaque-cleanup-command",
+        NeverStops(),
+        tmp_path / "stuck.log",
+    )
+    sandboxed_web_e2e.stop_service(never_stops)
+
+    class UnreadablePath:
+        def exists(self):
+            return True
+
+        def read_text(self, **_kwargs):
+            raise OSError("opaque-unreadable-log-detail")
+
+    assert sandboxed_web_e2e.tail_text(UnreadablePath()) == "[REDACTED]"
+
     killed.clear()
     slow_service = sandboxed_web_e2e.Service("slow", "sleep", SlowProcess(), tmp_path / "slow.log")
     monkeypatch.setattr(sandboxed_web_e2e.os, "killpg", lambda pid, sig: killed.append((pid, sig)), raising=False)
@@ -228,6 +254,63 @@ def open(self, url, timeout):
     assert sandboxed_web_e2e.tail_text(log_path).splitlines()[0] == "line-10"
 
 
+def test_service_tail_redacts_multiline_values_before_selecting_final_lines(tmp_path):
+    """Tail selection cannot expose a clipped fragment of a multiline allowed value."""
+    multiline_secret = "private-first-line\nprivate-second-line"
+    log_path = tmp_path / "service.log"
+    log_path.write_text(
+        f"header\n{multiline_secret}\nordinary final line\n",
+        encoding="utf-8",
+    )
+
+    cleaned = sandboxed_web_e2e.tail_text(
+        log_path,
+        max_lines=2,
+        sensitive_values=(multiline_secret,),
+    )
+
+    assert "private-first-line" not in cleaned
+    assert "private-second-line" not in cleaned
+    assert "ordinary final line" in cleaned
+
+
+def test_web_result_marker_remains_valid_json_after_command_redaction(tmp_path, capsys):
+    """Credential-shaped command arguments are redacted without corrupting marker JSON."""
+    args = sandboxed_web_e2e.parse_args(
+        [
+            "--repo-root",
+            str(tmp_path),
+            "--backend-cmd",
+            "serve --token opaque-backend-secret",
+            "--frontend-cmd",
+            "serve --label=opaque-env-secret",
+            "--e2e-cmd",
+            "test --password opaque-e2e-secret",
+            "--allow-env",
+            "GITHUB_TOKEN",
+        ]
+    )
+
+    sandboxed_web_e2e.emit_result(
+        args=args,
+        copied_repo=tmp_path / "repo",
+        sandbox_root=tmp_path,
+        backend_ready=True,
+        frontend_ready=True,
+        exit_code=0,
+        elapsed_seconds=0.1,
+        sensitive_values=("opaque-env-secret",),
+    )
+    output = capsys.readouterr().out
+    result_line = output.removeprefix(sandboxed_web_e2e.RESULT_MARKER).strip()
+    payload = json.loads(result_line)
+
+    assert payload["allowed_env"] == ["GITHUB_TOKEN"]
+    assert "opaque-backend-secret" not in payload["backend_cmd"]
+    assert "opaque-env-secret" not in payload["frontend_cmd"]
+    assert "opaque-e2e-secret" not in payload["e2e_cmd"]
+
+
 def test_no_redirect_handler_raises_httperror_without_following():
     """Readiness checks must raise HTTPError on redirects to prevent attacker-controlled internal URLs."""
     import urllib.error
@@ -428,6 +511,135 @@ def fake_run_shell(command, cwd, env, timeout):
     assert "e2e command timed out after 3s" in captured.err
 
 
+def test_main_redacts_allowed_value_when_workspace_setup_fails(monkeypatch, tmp_path, capsys):
+    """A pre-copy web setup failure cannot expose allowed values in result commands."""
+    secret = "opaque-web-precopy-credential-731"
+    monkeypatch.setenv("CWL_TEST_CREDENTIAL", secret)
+
+    exit_code = sandboxed_web_e2e.main(
+        [
+            "--repo-root",
+            str(tmp_path / "missing"),
+            "--backend-cmd",
+            secret,
+            "--frontend-cmd",
+            "frontend",
+            "--e2e-cmd",
+            secret,
+            "--allow-env",
+            "CWL_TEST_CREDENTIAL",
+        ]
+    )
+    captured = capsys.readouterr()
+
+    assert exit_code == 126
+    assert secret not in captured.out
+    assert secret not in captured.err
+    assert "repo root is not a directory" in captured.err
+    result_line = [
+        line for line in captured.out.splitlines() if line.startswith(sandboxed_web_e2e.RESULT_MARKER)
+    ][-1]
+    payload = json.loads(result_line.removeprefix(sandboxed_web_e2e.RESULT_MARKER).strip())
+    assert payload["backend_cmd"] == "'[REDACTED]'"
+    assert payload["e2e_cmd"] == "'[REDACTED]'"
+    assert payload["exit_code"] == 126
+
+
+@pytest.mark.parametrize("failure_stage", ["backend", "frontend", "e2e"])
+def test_main_redacts_launch_exceptions_at_each_web_stage(
+    failure_stage,
+    monkeypatch,
+    tmp_path,
+    capsys,
+):
+    """Backend, frontend, and E2E spawn failures stay inside the redaction boundary."""
+    repo = tmp_path / "repo"
+    repo.mkdir()
+    secret = "opaque-web-launch-credential-731"
+    monkeypatch.setenv("CWL_TEST_CREDENTIAL", secret)
+
+    class DoneProcess:
+        def poll(self):
+            return 0
+
+    def fake_start(label, command, cwd, env, logs_dir):
+        if label == failure_stage:
+            raise FileNotFoundError(secret)
+        return sandboxed_web_e2e.Service(
+            label,
+            command,
+            DoneProcess(),
+            logs_dir / f"{label}.log",
+        )
+
+    def fake_run_shell(command, cwd, env, timeout):
+        if failure_stage == "e2e":
+            raise FileNotFoundError(secret)
+        return subprocess.CompletedProcess(command, 0, stdout="", stderr="")
+
+    monkeypatch.setattr(sandboxed_web_e2e, "start_service", fake_start)
+    monkeypatch.setattr(sandboxed_web_e2e, "wait_for_url", lambda url, timeout, service: True)
+    monkeypatch.setattr(sandboxed_web_e2e, "run_shell", fake_run_shell)
+
+    exit_code = sandboxed_web_e2e.main(
+        [
+            "--repo-root",
+            str(repo),
+            "--backend-cmd",
+            "backend",
+            "--frontend-cmd",
+            "frontend",
+            "--e2e-cmd",
+            "e2e",
+            "--allow-env",
+            "CWL_TEST_CREDENTIAL",
+        ]
+    )
+    captured = capsys.readouterr()
+
+    assert exit_code == 126
+    assert secret not in captured.out
+    assert secret not in captured.err
+    assert "execution failed" in captured.err
+
+
+def test_main_rejects_short_allowed_values_before_web_startup(monkeypatch, tmp_path, capsys):
+    """Web execution rejects ambiguous short allowed values before starting services."""
+    repo = tmp_path / "repo"
+    repo.mkdir()
+    monkeypatch.setenv("CWL_TEST_CREDENTIAL", "a")
+    monkeypatch.setattr(
+        sandboxed_web_e2e,
+        "start_service",
+        lambda *args, **kwargs: pytest.fail("short allowed value reached startup"),
+    )
+
+    exit_code = sandboxed_web_e2e.main(
+        [
+            "--repo-root",
+            str(repo),
+            "--backend-cmd",
+            "backend a",
+            "--frontend-cmd",
+            "frontend",
+            "--e2e-cmd",
+            "e2e a",
+            "--allow-env",
+            "CWL_TEST_CREDENTIAL",
+        ]
+    )
+    captured = capsys.readouterr()
+
+    assert exit_code == 126
+    assert "at least 8 characters" in captured.err
+    result_line = [
+        line for line in captured.out.splitlines() if line.startswith(sandboxed_web_e2e.RESULT_MARKER)
+    ][-1]
+    payload = json.loads(result_line.removeprefix(sandboxed_web_e2e.RESULT_MARKER).strip())
+    assert payload["backend_cmd"] == "'b[REDACTED]ckend' '[REDACTED]'"
+    assert payload["e2e_cmd"] == "e2e '[REDACTED]'"
+
+
 @POSIX_PROCESS_GROUPS
 def test_sandboxed_web_e2e_reports_readiness_failure(tmp_path, capsys):
     """Readiness failures return a distinct nonzero exit code."""