fix(sandbox): replay redaction after fixture-history contamination - #906

Replacement purpose

Supersede #888 after its reachable history was re-contaminated by a credential-shaped test fixture while repairing the current Docker/Podman login redaction defect. This branch starts from exact protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba and carries only the corrected final blobs.

RCA

#888 initially existed to replace #842's contaminated test history. A later test commit on #888 introduced the fixed literal quartz-capybara-731-opaque. Replacing that line in a following commit did not repair the gate because Secret Scan correctly evaluates the whole PR commit range; run 31319880976 continued to report one generic-api-key finding in the reachable predecessor commit.

Rejected:

• suppressing or weakening Gitleaks;
• classifying the committed signature as harmless test data;
• force-pushing, rebasing, or rewriting fix(sandbox): replay redaction without secret-shaped history #888;
• treating the corrected final blob as proof that reachable history is clean.

Implemented:

• create this new branch from the exact current protected-main commit;
• replay the ten final fix(sandbox): replay redaction without secret-shaped history #888 file blobs through ordinary fast-forward commits;
• synthesize the credential-shaped test value only at runtime;
• preserve fix(sandbox): replay redaction without secret-shaped history #888 as immutable incident evidence.

Exact identity

• base: 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;
• exact initial head: 5ccf85f64c4a5689d89e64b528880262a22e6de7;
• ten changed file blobs verified byte-for-byte against corrected fix(sandbox): replay redaction without secret-shaped history #888 head 285305291fdf602f31796f0c7ff1c2858406c08e;
• the committed fixed credential-shaped literal is absent from all ten final blobs;
• no force update or destructive history operation was used.

Exact-head evidence

• exact head: d573d21752e07d3cbbf9845b4b413baf81ecea7c;
• fail-first reproduction: three malformed public sh -c / env -S / env --split-string= wrapper cases exposed the runtime-synthesized opaque credential before the repair;
• local repaired-head acceptance: 145 focused tests; 789 statements and 306 branches at exact 100%; 1,063 full-suite tests plus 16 subtests; all 7,400 owned-production statements and 2,964 branches at exact 100%; compile, public-docstring, and diff checks passed;
• exact-head hosted runs Sandbox Log Redaction Quality CI 31534673352 and Strix Changed Path Quality CI 31534673441 are in progress; eight security/supply-chain runs are queued, so none is represented as passing yet;
• review submissions: 0; review threads: 0; approvals: 0. The predecessor-head review request is stale, and automated review remains separate from qualifying independent human approval.

Current security scope

This Draft includes the direct Docker/Podman login -p, -p=, and --password= repair plus the bounded env -S / shell -c implementation tracked by #907. The latest repair fails closed when malformed outer wrapper quoting prevents safe tokenization while preserving the established non-wrapper fallback. Benign Docker publish ports, SSH -p ports, env assignments/options, and valid --password-stdin registries remain visible.

The #907 source repair is active_pr, not protected-main behavior; keep its issue open until integration and protected-main acceptance. Atomic multiline/duplicate-key JSON redaction and layout fidelity remains the stacked active_pr in #929 for #908. Keep this PR Draft until exact-head gates and current review pass and the #908 dependency is integrated or an explicitly reviewed narrower acceptance boundary is adopted. Output-memory and service-file quotas remain separate work in #766.

Acceptance

Require exact-head Sandbox Log Redaction Quality CI, Secret Scan, all security/dependency checks, current source review, zero valid unresolved findings, a qualifying independent non-author formal approval, and repository protection. After protected integration, run synthetic protected-main acceptance for completed stdout/stderr, timeout evidence, and bounded service tails before closing the incident.