Goal
Add a first-pass redaction/secret scanning layer for wp-codebox artifacts.
Context
The artifact contract is now broad enough for review/apply flows: patch, changed files, review payload, test results, provenance, logs, and mounted files. Before production owner review, artifacts need default-safe redaction behavior.
Acceptance
- Scan artifact JSON/log/text outputs for common secret patterns and configured secret env values/names.
- Redact findings before writing review-facing artifacts.
- Record redaction metadata/counts without exposing secret values.
- Fail or risk-flag artifacts when unredactable secrets are found.
- Extend smoke coverage with a fixture secret value.
Goal
Add a first-pass redaction/secret scanning layer for wp-codebox artifacts.
Context
The artifact contract is now broad enough for review/apply flows: patch, changed files, review payload, test results, provenance, logs, and mounted files. Before production owner review, artifacts need default-safe redaction behavior.
Acceptance