fix(sandbox): replay redaction after fixture-history contamination - #906

Replacement purpose

Supersede #888 after its reachable history was re-contaminated by a credential-shaped test fixture while repairing the current Docker/Podman login redaction defect. This branch starts from exact protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba and carries only the corrected final blobs.

RCA

#888 initially existed to replace #842's contaminated test history. A later test commit on #888 introduced the fixed literal quartz-capybara-731-opaque. Replacing that line in a following commit did not repair the gate because Secret Scan correctly evaluates the whole PR commit range; run 31319880976 continued to report one generic-api-key finding in the reachable predecessor commit.

Rejected:

• suppressing or weakening Gitleaks;
• classifying the committed signature as harmless test data;
• force-pushing, rebasing, or rewriting fix(sandbox): replay redaction without secret-shaped history #888;
• treating the corrected final blob as proof that reachable history is clean.

Implemented:

• create this new branch from the exact current protected-main commit;
• replay the ten final fix(sandbox): replay redaction without secret-shaped history #888 file blobs through ordinary fast-forward commits;
• synthesize the credential-shaped test value only at runtime;
• preserve fix(sandbox): replay redaction without secret-shaped history #888 as immutable incident evidence.

Exact identity

• base: 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;
• exact initial head: 5ccf85f64c4a5689d89e64b528880262a22e6de7;
• ten changed file blobs verified byte-for-byte against corrected fix(sandbox): replay redaction without secret-shaped history #888 head 285305291fdf602f31796f0c7ff1c2858406c08e;
• the committed fixed credential-shaped literal is absent from all ten final blobs;
• no force update or destructive history operation was used.

Exact-head evidence

• exact head: 5ccf85f64c4a5689d89e64b528880262a22e6de7;
• Sandbox Log Redaction Quality CI run 31320078657 succeeded: 106 focused tests; 1,024 full-suite tests plus 16 subtests; 611 statements and 206 branches at 100%; Strix quick gate passed;
• Secret Scan run 31320078627 scanned 6eb06cdd..5ccf85f and reported zero Gitleaks findings;
• all 10 exact-head pull-request workflows completed successfully;
• review submissions: 0; review threads: 0; approvals: 0. CodeRabbit skipped the Draft, so checks do not authorize readiness or merge.

Current security scope

This replay includes the focused Docker/Podman login -p, -p=, and --password= redaction repair while preserving benign Docker publish ports and SSH -p ports.

It does not claim the broader blocker is closed. Bounded wrapper recursion for env -S and shell -c operands is tracked by #907; atomic multiline/duplicate-key JSON redaction and layout fidelity is tracked by #908. Keep this PR Draft until those gaps or an explicitly reviewed narrower acceptance boundary are resolved. Output-memory and service-file quotas remain separate work in #766.

Acceptance

Require exact-head Sandbox Log Redaction Quality CI, Secret Scan, all security/dependency checks, current source review, zero valid unresolved findings, a qualifying independent non-author formal approval, and repository protection. After protected integration, run synthetic protected-main acceptance for completed stdout/stderr, timeout evidence, and bounded service tails before closing the incident.