Redact secret-shaped values from agent logs and live observer feeds

[jusso-dev]

Parent: #21
Related: #20, #25, #27
Source: block/buzz#2869

Why this is valuable

Live agent activity, tool envelopes, errors, and debug logs can accidentally carry environment variables or credentials into UI, logs, traces, and test artifacts. Muster already needs safe previews; one central recursive redactor is a small, high-value hardening layer.

Bounded v1

• Add one well-tested recursive redaction utility for maps, arrays, nested objects, env name/value pairs, headers, URLs with credentials, and common snake/camel-case secret keys.
• Apply it before agent observer events, activity headlines, structured logs, error diagnostics, traces, and browser-visible run data leave their trust boundary.
• Preserve execution payloads required by the runtime; scrub only copies destined for observation/logging and explicitly restricted projections.
• Bound depth, item count, string length, and cyclic/unserialisable input behavior.
• Emit a safe redaction marker without revealing the original value or secret length.

Acceptance criteria

• API keys, tokens, passwords, cookies, authorisation headers, private keys, and env name/value pairs are redacted across observer/log surfaces.
• Redaction handles nested arrays/maps, mixed casing, URLs, cycles, and oversized payloads safely.
• Normal security evidence remains useful and is not globally replaced by blank output.
• Runtime execution semantics are unchanged.
• Structured logging tests prove raw secrets never reach captured output.
• Browser/API tests prove unauthorised and authorised observer projections are both secret-safe.
• Synthetic canary secrets are absent from generated logs, traces, screenshots, and test artifacts.

Effort guardrail

Central helper plus targeted call sites. Do not redesign encrypted evidence storage in this issue.

[jusso-dev]

Implemented, verified, and deployed to the homelab.

Delivered

• cb8d279 adds the central bounded recursive observation redactor and structured-log protection.
• 55369ec applies safe-copy redaction to agent run reads, observer events, failure diagnostics, activity/output projections, API errors, trace identifiers, and browser-visible task/run data.
• Execution records remain authoritative and unchanged; only observer, log, audit, diagnostic, and browser projections are scrubbed.
• Redaction covers mixed snake/camel secret keys, headers, cookies, private keys, credentialed URLs, env name/value pairs, arrays, maps, sets, nested objects, errors, cycles, unserialisable values, depth/item limits, and string limits.
• Normal evidence, hashes, status, usage, and cost metadata remain available.

Verification

• pnpm check: all 22 packages passed lint, strict typecheck, unit tests, and production builds.
• Redactor suite: 6/6 passed, including nested collections, URL/header/env handling, cycles, oversized private keys, and captured structured logs.
• Agent runtime integration: 5/5 passed, including proof that the observer projection omits the canary while the raw execution record remains unchanged.
• Focused Chromium browser/API test passed locally and against the exact deployed image:
  • authorised task and run projections were redacted;
  • anonymous requests returned 401 and contained no canary;
  • raw execution persistence was unchanged;
  • no canary appeared in retained logs, traces, screenshots, or test artifacts.
• Main CI run passed quality, clean-install, Chromium, container publication, attestation, and anonymous pull verification.
• Security and supply-chain run passed CodeQL, dependency audit, gitleaks, Trivy, SBOM, and provenance checks.

Deployment

• Source/runtime revision: 55369eccbf4168aa91be323a81a423ad6c53a336.
• Image: ghcr.io/jusso-dev/muster:sha-55369ec.
• Digest: sha256:556a2d5fdc98fff9144f189e7a3838bae9a81019390f06ac98f71e83fc1d95b8.
• Web, worker, and agent gateway are healthy with zero restarts.
• Pre-rollout database backup and rollback image are retained privately.
• Post-test domain counts remained stable: rooms 26, memberships 67, messages 110, tasks 10, evidence 9, audit 303, outbox 255.
• The live port-3010 homelab handbook now records the revision, digest, health, rollback, and verification evidence.

All bounded-v1 acceptance criteria are satisfied. Encrypted evidence storage was not redesigned.