fix(sandbox): replay redaction after fixture-history contamination

[seonghobae]

Replacement purpose

Supersede #888 after its reachable history was re-contaminated by a credential-shaped test fixture while repairing the current Docker/Podman login redaction defect. This branch starts from exact protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba and carries only the corrected final blobs.

RCA

#888 initially existed to replace #842's contaminated test history. A later test commit on #888 introduced the fixed literal quartz-capybara-731-opaque. Replacing that line in a following commit did not repair the gate because Secret Scan correctly evaluates the whole PR commit range; run 31319880976 continued to report one generic-api-key finding in the reachable predecessor commit.

Rejected:

• suppressing or weakening Gitleaks;
• classifying the committed signature as harmless test data;
• force-pushing, rebasing, or rewriting fix(sandbox): replay redaction without secret-shaped history #888;
• treating the corrected final blob as proof that reachable history is clean.

Implemented:

• create this new branch from the exact current protected-main commit;
• replay the ten final fix(sandbox): replay redaction without secret-shaped history #888 file blobs through ordinary fast-forward commits;
• synthesize the credential-shaped test value only at runtime;
• preserve fix(sandbox): replay redaction without secret-shaped history #888 as immutable incident evidence.

Exact identity

• base: 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;
• exact initial head: 5ccf85f64c4a5689d89e64b528880262a22e6de7;
• ten changed file blobs verified byte-for-byte against corrected fix(sandbox): replay redaction without secret-shaped history #888 head 285305291fdf602f31796f0c7ff1c2858406c08e;
• the committed fixed credential-shaped literal is absent from all ten final blobs;
• no force update or destructive history operation was used.

Exact-head evidence

• exact head: 5ccf85f64c4a5689d89e64b528880262a22e6de7;
• Sandbox Log Redaction Quality CI run 31320078657 succeeded: 106 focused tests; 1,024 full-suite tests plus 16 subtests; 611 statements and 206 branches at 100%; Strix quick gate passed;
• Secret Scan run 31320078627 scanned 6eb06cdd..5ccf85f and reported zero Gitleaks findings;
• all 10 exact-head pull-request workflows completed successfully;
• review submissions: 0; review threads: 0; approvals: 0. CodeRabbit skipped the Draft, so checks do not authorize readiness or merge.

Current security scope

This replay includes the focused Docker/Podman login -p, -p=, and --password= redaction repair while preserving benign Docker publish ports and SSH -p ports.

It does not claim the broader blocker is closed. Bounded wrapper recursion for env -S and shell -c operands is tracked by #907; atomic multiline/duplicate-key JSON redaction and layout fidelity is tracked by #908. Keep this PR Draft until those gaps or an explicitly reviewed narrower acceptance boundary are resolved. Output-memory and service-file quotas remain separate work in #766.

Acceptance

Require exact-head Sandbox Log Redaction Quality CI, Secret Scan, all security/dependency checks, current source review, zero valid unresolved findings, a qualifying independent non-author formal approval, and repository protection. After protected integration, run synthetic protected-main acceptance for completed stdout/stderr, timeout evidence, and bounded service tails before closing the incident.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bba960d9-c36c-46e5-a03d-d2558028710e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}