(CODUX-216) Redact resolved credential values from runtime records

[numnx]

🧩 Task: Redact resolved credential values from runtime records

Automated task PR opened by Code UX for T12.

📋 Summary

Sprint: Sprint 216 · Nodes Full Integration · Task: T12

Turn the existing project-scoped node-flow foundation and browser-local canvas into a canonical, secure, versioned automation control plane with registry-driven nodes, encrypted credentials, durable execution, governed integrations, isolated custom nodes, agent authoring, dashboard integration, and authenticated headless readiness.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.6-sol

⏱️ Timing

Started	2026-07-12 07:34:14 UTC
Finished	2026-07-12 07:46:37 UTC
Duration	12m 22s

📊 Token Usage

Metric	Value
Input tokens	171,160
Cached input tokens	5,086,720
Output tokens	22,411
Total tokens	5,280,291
Invocations	1
Tool calls	49
Active time	11m 40s

Included usage estimate (subscription/local login): $4.07

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

📝 Full Task Prompt

## Objective
Ensure resolved credential material cannot appear in node outputs, attempts, diagnostics, invocation messages, or errors.

## Scope
- `src/services/node-flow-runtime-service.ts`
- `src/services/node-flows/builtins/builtin-executors.ts`
- `src/services/custom-nodes/custom-node-runtime-service.ts` as a consistency reference
- `tests/backend/services/node-flow-runtime-service.test.ts`
- credential and redaction tests

## Requirements
1. Track resolved credential values only in memory for the node invocation and redact exact values from every persisted output, attempt payload, diagnostic, invocation message, and error string.
2. Apply the same protection to provider responses, HTTP response bodies, retry errors, and external-effect payloads.
3. Preserve credential IDs and metadata where required for auditability, but never persist credential values or raw credential headers.
4. Clear temporary secret buffers and avoid logging the redaction input.
5. Add regression coverage for an external provider and HTTP/mock boundary that echoes a credential canary.

## Verification
- Assert serialized run summaries, node attempts, invocation records, audit records, logs, and diagnostics contain no credential canary.
- Run focused credential/runtime/security suites, full backend tests, typecheck, audit, and build.

🌿 Branch Info

Base: feature/CODUX-216-nodes-full-integration
Head: task/feature-codux-21-t12-codex-98f8861c-mrhh9j7e

---

🤖 Generated by Code UX