Redact credential material from agent run transcripts

coilyco-ops commented

2026-07-28 03:19:48 +00:00

Member

Context

Parent goal: #1574.

The incident response and token rotation tracked in coilyco-bridge/agentic-os-kai#776 are complete. This issue owns the remaining Ward product fix. During a sealed engineer run, environment and Git credential probes printed a Forgejo token into a private agent transcript. The credential value must never be copied into this issue or a fixture.

Outcome

Prevent credential-bearing environment values, Git credential responses, authorization headers, and configured secret patterns from reaching stored or rendered agent logs.

Redaction must cover stdout, stderr, structured tool events, Ward agent logs, and failure summaries while preserving enough context to diagnose the command and error class. Raw transcript artifacts must be protected at write time rather than only at display time.

Acceptance criteria

Fixtures inject synthetic tokens through environment output, Git credential fill, headers, stdout, and stderr, then prove every stored transcript and rendered log replaces the value.
Ordinary hashes and non-secret diagnostics remain readable.
Configured secret patterns receive the same write-time protection.
Documentation names the residual boundary.
Repository vet, lint, test, and pre-commit validation pass.

Headless execution boundary

Use synthetic credentials and repository fixtures only. Do not inspect live credentials, the stored incident transcript, or live systems. No operator action or production verification is required for acceptance.

## Context Parent goal: #1574. The incident response and token rotation tracked in coilyco-bridge/agentic-os-kai#776 are complete. This issue owns the remaining Ward product fix. During a sealed engineer run, environment and Git credential probes printed a Forgejo token into a private agent transcript. The credential value must never be copied into this issue or a fixture. ## Outcome Prevent credential-bearing environment values, Git credential responses, authorization headers, and configured secret patterns from reaching stored or rendered agent logs. Redaction must cover stdout, stderr, structured tool events, Ward agent logs, and failure summaries while preserving enough context to diagnose the command and error class. Raw transcript artifacts must be protected at write time rather than only at display time. ## Acceptance criteria * Fixtures inject synthetic tokens through environment output, Git credential fill, headers, stdout, and stderr, then prove every stored transcript and rendered log replaces the value. * Ordinary hashes and non-secret diagnostics remain readable. * Configured secret patterns receive the same write-time protection. * Documentation names the residual boundary. * Repository vet, lint, test, and pre-commit validation pass. ## Headless execution boundary Use synthetic credentials and repository fixtures only. Do not inspect live credentials, the stored incident transcript, or live systems. No operator action or production verification is required for acceptance.

coilyco-ops added the

priority

P0

label

2026-07-28 03:19:48 +00:00

coilyco-ops referenced this issue

2026-07-28 03:21:25 +00:00

Stabilize Ward for safe autonomous burndown and verified releases #1574

coilyco-ops referenced this issue

2026-07-28 03:29:02 +00:00

Make long-lived director Forgejo authentication recoverable and persist pending briefs #1530

coilyco-ops referenced this issue

2026-07-28 20:05:30 +00:00

Keep Forgejo credentials behind the native director broker #1612

coilyco-ops added the

autonomy

live-collab

label

2026-07-29 03:47:17 +00:00

coilyco-ops referenced this issue

2026-07-31 08:09:33 +00:00

Make detached broker dispatch observable without a terminal #1618

coilyco-ops added

and removed

labels

2026-07-31 08:29:39 +00:00

coilyco-ops referenced this issue

2026-08-05 10:08:57 +00:00

Remove the harness-specific tool-failure buffer #1646

coilyco-ops referenced this issue

2026-08-05 10:09:17 +00:00

Remove the provider-specific panic reporter from Ward core #1648

coilyco-ops commented

2026-08-05 10:16:12 +00:00

Author

Member

Kai resolved the storage and redaction boundary on 2026-08-05.

Authoritative implementation contract

Ward keeps one canonical secret-safe host archive. Stop writing raw console, transcript, and broker artifacts. Remove raw fallback from ward agent logs and retire the parallel raw versus redacted product distinction.
The per-run redactor combines built-in secret shapes, exact nonempty values for every credential Ward injects, and operator-local configuration under agent.redaction in ~/.ward/config.yaml.
Support agent.redaction.env-names for extra credential-bearing environment keys and agent.redaction.patterns for RE2 patterns. Do not place this policy in repository .ward/ward.yaml, and document that literal credential values do not belong in configuration.
Apply the same redactor before Ward persists or renders console output, stdout, stderr, structured tool events, broker logs, metadata error fields, and failure summaries.
Retain tool names, scrubbed scalar commands and paths, outcomes, error classes, and bounded scrubbed excerpts. Continue dropping body-shaped arguments, complete credential responses, and tool-result bodies from persisted envelopes.
Invalid configured patterns fail ward doctor and fail dispatch before launch. A sanitization failure writes no artifact, retains the container for explicit recovery, and reports cleanup-needed under #1618.
After a successful safe drain, sanitize or remove the harness transcript inside any retained exited container so the retained rescue object does not preserve the raw credential.
Ward guarantees the artifacts it persists and the logs it renders. Documentation must name the residual boundary that the running agent process and a harness-owned transient session file necessarily see credential material before the safe drain.
Do not automatically delete historical raw archives. ward doctor warns with their exact location and documentation states that earlier archives are not retroactively sanitized. The incident credential is already rotated outside this issue.
Use one [REDACTED] marker without a value-derived fingerprint. Ordinary hashes and unrelated diagnostics remain intact.

There is no encrypted raw archive or privileged raw-log escape hatch. Acceptance remains synthetic-only and must cover arbitrary injected values, not only tokens matching the built-in regex list.

Kai resolved the storage and redaction boundary on 2026-08-05. ## Authoritative implementation contract * Ward keeps one canonical secret-safe host archive. Stop writing raw console, transcript, and broker artifacts. Remove raw fallback from `ward agent logs` and retire the parallel raw versus redacted product distinction. * The per-run redactor combines built-in secret shapes, exact nonempty values for every credential Ward injects, and operator-local configuration under `agent.redaction` in `~/.ward/config.yaml`. * Support `agent.redaction.env-names` for extra credential-bearing environment keys and `agent.redaction.patterns` for RE2 patterns. Do not place this policy in repository `.ward/ward.yaml`, and document that literal credential values do not belong in configuration. * Apply the same redactor before Ward persists or renders console output, stdout, stderr, structured tool events, broker logs, metadata error fields, and failure summaries. * Retain tool names, scrubbed scalar commands and paths, outcomes, error classes, and bounded scrubbed excerpts. Continue dropping body-shaped arguments, complete credential responses, and tool-result bodies from persisted envelopes. * Invalid configured patterns fail `ward doctor` and fail dispatch before launch. A sanitization failure writes no artifact, retains the container for explicit recovery, and reports `cleanup-needed` under #1618. * After a successful safe drain, sanitize or remove the harness transcript inside any retained exited container so the retained rescue object does not preserve the raw credential. * Ward guarantees the artifacts it persists and the logs it renders. Documentation must name the residual boundary that the running agent process and a harness-owned transient session file necessarily see credential material before the safe drain. * Do not automatically delete historical raw archives. `ward doctor` warns with their exact location and documentation states that earlier archives are not retroactively sanitized. The incident credential is already rotated outside this issue. * Use one `[REDACTED]` marker without a value-derived fingerprint. Ordinary hashes and unrelated diagnostics remain intact. There is no encrypted raw archive or privileged raw-log escape hatch. Acceptance remains synthetic-only and must cover arbitrary injected values, not only tokens matching the built-in regex list.

coilyco-ops referenced this issue

2026-08-05 10:53:03 +00:00

Remove the harness-specific tool-failure buffer #1646

coilyco-ops referenced this issue from a commit

2026-08-05 19:33:17 +00:00

fix: make agent logs secret-safe

coilyco-ops referenced this issue from a commit

2026-08-05 19:56:23 +00:00

feat: expose durable dispatch lifecycles

coilyco-ops closed this issue

2026-08-05 19:56:23 +00:00