@stigmer/server 3.14.0-dev.20260910084630

package/src/domain/executioncontext/__tests__/resolve-values-capability.test.ts

@@ -0,0 +1,130 @@
+/**
+ * Pins the C4 authorizeExecutionContextRead capability arm of
+ * resolveValuesForCaller (gate ruling Q1): when the composed provider
+ * defines it, the capability IS the entire decrypt trust decision —
+ * true decrypts, false redacts, and a THROWING capability falls closed
+ * to redaction (redaction-as-success must survive a policy fault). The
+ * OSS fallback arm (execution-scoped verify + binding equality) is
+ * pinned by executioncontext.test.ts and the conformance suites; this
+ * file covers only the delegation.
+ */
+import type { HandlerContext } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+import { describe, expect, it } from "vitest";
+
+import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
+
+import { createLogger } from "../../../boot/logger.js";
+import {
+  EncryptionScope,
+  SecretService,
+} from "../../../encryption/encryption.js";
+import { InvalidTokenError } from "../../../runnerauth/runnerauth.js";
+import type { RunnerCredentialProvider } from "../../../runnerauth/runner-credential-provider.js";
+import { resolveValuesForCaller } from "../resolve-values-for-caller.js";
+
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
+
+const secretService = SecretService.create(Buffer.alloc(32, 7));
+
+/** A minimal HandlerContext: the resolve path reads only the auth header. */
+function ctxWithBearer(token: string): HandlerContext {
+  const headers = new Headers();
+  if (token !== "") {
+    headers.set("authorization", `Bearer ${token}`);
+  }
+  return { requestHeader: headers } as unknown as HandlerContext;
+}
+
+function providerWith(
+  authorize: (rawToken: string, executionId: string) => Promise<boolean>,
+): RunnerCredentialProvider & { asked: Array<[string, string]> } {
+  const asked: Array<[string, string]> = [];
+  return {
+    asked,
+    isEnabled: () => false,
+    mint: () => {
+      throw new Error("mint is not under test");
+    },
+    verify: () => {
+      // The capability path must never consult the primitive verify —
+      // throwing here turns an accidental fallback into a test failure.
+      throw new InvalidTokenError();
+    },
+    authorizeExecutionContextRead: (rawToken, executionId) => {
+      asked.push([rawToken, executionId]);
+      return authorize(rawToken, executionId);
+    },
+  };
+}
+
+async function executionContext() {
+  return create(ExecutionContextSchema, {
+    spec: {
+      executionId: "aexec_cap1",
+      data: {
+        API_KEY: {
+          value: await secretService.encrypt(
+            "s3cret",
+            EncryptionScope.forOrganization("test-org"),
+          ),
+          isSecret: true,
+        },
+      },
+    },
+  });
+}
+
+describe("resolveValuesForCaller (capability delegation — C4)", () => {
+  it("decrypts when the capability answers true, passing token and execution id", async () => {
+    const provider = providerWith(async () => true);
+    const ec = await executionContext();
+    await resolveValuesForCaller(
+      { logger: silentLogger, secretService, runnerAuthService: provider },
+      ctxWithBearer("sandbox-token"),
+      ec,
+    );
+    expect(ec.spec?.data["API_KEY"]?.value).toBe("s3cret");
+    expect(provider.asked).toEqual([["sandbox-token", "aexec_cap1"]]);
+  });
+
+  it("redacts when the capability answers false", async () => {
+    const provider = providerWith(async () => false);
+    const ec = await executionContext();
+    await resolveValuesForCaller(
+      { logger: silentLogger, secretService, runnerAuthService: provider },
+      ctxWithBearer("someone-elses-token"),
+      ec,
+    );
+    expect(ec.spec?.data["API_KEY"]?.value).toBe("***REDACTED***");
+  });
+
+  it("redacts without consulting the capability when no bearer token is presented", async () => {
+    const provider = providerWith(async () => true);
+    const ec = await executionContext();
+    await resolveValuesForCaller(
+      { logger: silentLogger, secretService, runnerAuthService: provider },
+      ctxWithBearer(""),
+      ec,
+    );
+    expect(ec.spec?.data["API_KEY"]?.value).toBe("***REDACTED***");
+    expect(provider.asked).toEqual([]);
+  });
+
+  it("a THROWING capability falls closed to redaction — never a failed read", async () => {
+    const provider = providerWith(async () => {
+      throw new Error("policy backend unavailable");
+    });
+    const ec = await executionContext();
+    await resolveValuesForCaller(
+      { logger: silentLogger, secretService, runnerAuthService: provider },
+      ctxWithBearer("sandbox-token"),
+      ec,
+    );
+    expect(ec.spec?.data["API_KEY"]?.value).toBe("***REDACTED***");
+  });
+});

package/src/domain/executioncontext/constants.ts

@@ -0,0 +1,51 @@
+/**
+ * ExecutionContext domain constants — the byte-pinned wire copy shared
+ * with the Go server. Every string here reaches clients verbatim (the
+ * conformance suite and the runner's error surfaces read them), so none
+ * is editable without an owner-ratified wire change.
+ *
+ * The redaction marker itself is NOT defined here: it is imported from
+ * the environment domain's constants (the single source of truth both Go
+ * domains share — Go's redact_secret_values.go imports
+ * envsteps.RedactedMarker the same way).
+ */
+
+/**
+ * InvalidArgument copy for client-supplied enc:v<N>: input — Go
+ * encrypt_secret_values.go's rejectCiphertextShapedStep, byte-pinned.
+ * Note the copy differs from the environment domain's forged-ciphertext
+ * message: each domain pins its own Go string.
+ */
+export function ciphertextShapedMessage(key: string): string {
+  return (
+    `value for '${key}' looks like stored ciphertext (enc:v<N>: prefix); ` +
+    "supply the plaintext value"
+  );
+}
+
+/**
+ * Internal copy for an encrypt failure at write. Replaced the ported
+ * per-key `failed to encrypt secret value for '<key>'` (Go
+ * encrypt_secret_values.go) when EC sealing became one batch through the
+ * v2-capped verb (20260830.04 Stage 1) — a batch failure has no single
+ * failing key. Unreachable for the local v1 codec; a vault-backed write
+ * codec reaches it on KEK-provider failure, with the real error logged.
+ */
+export const ENCRYPT_BATCH_FAILURE_MESSAGE = "failed to encrypt secret values";
+
+/**
+ * Internal copy for the fail-loud decrypt arm: the row holds ciphertext
+ * but the server has no key (key file lost). Dropping the value would
+ * start the execution silently missing a credential — a confusing
+ * downstream failure instead of a clear one here (the oss#405 doctrine).
+ * Go resolve_values_for_caller.go, byte-pinned.
+ */
+export function encryptionKeyMissingMessage(
+  executionId: string,
+  key: string,
+): string {
+  return (
+    `execution context for ${executionId} holds encrypted secret '${key}' ` +
+    "but no encryption key is configured"
+  );
+}

package/src/domain/executioncontext/controller.ts

@@ -0,0 +1,414 @@
+/**
+ * ExecutionContext controller — ports pkg/domain/executioncontext
+ * (command + query sides): the create-only, secret-bearing resource the
+ * execution engine mints to carry one run's merged runtime configuration
+ * and secrets, deleted when the execution completes.
+ *
+ * The domain diverges from the other flat domains in two
+ * contract-significant ways:
+ *   - There is NO update RPC and NO list RPC. Reads are by id, by
+ *     reference (org + slug), or by the parent execution_id.
+ *   - apply is create-or-FAIL: applying over an existing slug returns a
+ *     real AlreadyExists, not an update.
+ *
+ * Secret handling (oss#535, the stigmer-cloud#152 contract ported):
+ * is_secret values rest encrypted (enc:v1:), leave the server as
+ * ***REDACTED*** markers on EVERY user-shaped boundary — get,
+ * getByReference, the create/apply and delete echoes — and are revealed
+ * only through getByExecutionId to a caller presenting an
+ * execution-scoped runner token bound to this very EC (see
+ * resolve-values-for-caller.ts).
+ *
+ * Pipeline per RPC mirrors the Go step chains character-for-character.
+ * Proven by executioncontext.conformance.test.ts
+ * (CONFORMANCE_TARGET=local) and __tests__/executioncontext.test.ts
+ * (the decrypt-lane matrix conformance deliberately never exercises —
+ * its harness authenticates as a user).
+ *
+ * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
+ * and Publish steps (no multi-tenant auth, IAM/FGA, or event publishing
+ * here); the redaction and decrypt-lane contracts run in BOTH editions,
+ * keeping the error contract identical.
+ */
+import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
+
+import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
+import type { ExecutionContext } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
+import { ExecutionContextCommandController } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/command_pb";
+import { ExecutionContextQueryController } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/query_pb";
+import type {
+  ExecutionContextExecutionIdInput,
+  ExecutionContextId,
+} from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/io_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type {
+  ApiResourceDeleteInput,
+  ApiResourceReference,
+} from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+
+import type { Logger } from "../../boot/logger.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { SecretService } from "../../encryption/encryption.js";
+import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
+import { alreadyExistsError, internalError } from "../../pipeline/errors.js";
+import { newPipeline } from "../../pipeline/pipeline.js";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { RequestContext } from "../../pipeline/request-context.js";
+import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
+import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
+import {
+  RESOURCE_ID_KEY,
+  newDeleteResourceStep,
+  newLoadExistingForDeleteStep,
+} from "../../pipeline/steps/delete.js";
+import { newCheckDuplicateStep } from "../../pipeline/steps/duplicate.js";
+import {
+  newDeleteSearchIndexStep,
+  newIndexSearchStep,
+} from "../../pipeline/steps/index-search.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import {
+  SHOULD_CREATE_KEY,
+  newLoadForApplyStep,
+} from "../../pipeline/steps/load-for-apply.js";
+import { newLoadByReferenceStep } from "../../pipeline/steps/load-by-reference.js";
+import {
+  TARGET_RESOURCE_KEY,
+  newLoadTargetStep,
+} from "../../pipeline/steps/load-target.js";
+import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import {
+  newCleanupIamPoliciesStep,
+  newCreateAuthorizationTuplesStep,
+} from "../../pipeline/steps/authorization-tuples.js";
+import { newPersistStep } from "../../pipeline/steps/persist.js";
+import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
+import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibility.js";
+import type { RunnerCredentialProvider } from "../../runnerauth/runner-credential-provider.js";
+import type { Store } from "../../store/interface.js";
+import { redactExecutionContextSecrets } from "./redact.js";
+import { resolveValuesForCaller } from "./resolve-values-for-caller.js";
+import { executionContextSearchExtractor } from "./search-extractor.js";
+import {
+  newEncryptSecretValuesStep,
+  newAuthorizeExecutionContextCreateStep,
+  newLoadByExecutionIdStep,
+  newRejectCiphertextShapedStep,
+} from "./steps.js";
+
+export interface ExecutionContextControllerDeps {
+  readonly store: Store;
+  readonly logger: Logger;
+  /** The composed authorization seam — the Authorize step at position 1 of every chain calls it (O2, DD-007 §3). */
+  readonly authorizer: Authorizer;
+  /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
+  readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+  /**
+   * Shared with the Environment/OAuthApp controllers so the
+   * encrypt-on-write / decrypt-on-read key pair always matches.
+   */
+  readonly secretService: SecretService;
+  /**
+   * Verifies the execution-scoped tokens that gate getByExecutionId's
+   * decrypt lane. REQUIRED: the composition root always constructs one
+   * (boot-fatal otherwise); the keyless state — verify rejects every
+   * token, every read redacts — is the modeled "disabled" arm, the TS
+   * shape of Go's nil-service check.
+   */
+  readonly runnerAuthService: RunnerCredentialProvider;
+}
+
+/** Registers both executioncontext services on the router (routes stage). */
+export function registerExecutionContextServices(
+  router: ConnectRouter,
+  deps: ExecutionContextControllerDeps,
+): void {
+  router.service(ExecutionContextCommandController, {
+    apply: (ec, ctx) => apply(deps, ec, ctx),
+    create: (ec, ctx) => createExecutionContext(deps, ec, ctx),
+    delete: (input, ctx) => deleteExecutionContext(deps, input, ctx),
+  });
+  router.service(ExecutionContextQueryController, {
+    get: (id, ctx) => get(deps, id, ctx),
+    getByReference: (ref, ctx) => getByReference(deps, ref, ctx),
+    getByExecutionId: (input, ctx) => getByExecutionId(deps, input, ctx),
+  });
+}
+
+function kindOf(ctx: HandlerContext): ApiResourceKind {
+  return ctx.values.get(apiResourceKindKey);
+}
+
+/**
+ * Create — chain per Go buildCreatePipeline. The response echo is
+ * redacted AFTER the pipeline: the persisted resource is echoed back, and
+ * without redaction the echo would leak either the plaintext the caller
+ * just sent or the stored ciphertext. The internal builders (agent
+ * execution, workflow execution, MCP connect — they arrive with #17/#19/
+ * #20) only read metadata.id from the echo, so they are unaffected.
+ */
+async function createExecutionContext(
+  deps: ExecutionContextControllerDeps,
+  ec: ExecutionContext,
+  ctx: HandlerContext,
+): Promise<ExecutionContext> {
+  const reqCtx = new RequestContext(
+    ExecutionContextSchema,
+    ec,
+    callerIdentityOf(ctx),
+    kindOf(ctx),
+  );
+  await newPipeline<typeof ExecutionContextSchema>(
+    "execution-context-create",
+    deps.logger,
+  )
+    .addStep(
+      newAuthorizeStep(
+        ExecutionContextCommandController.method.create,
+        deps.authorizer,
+      ),
+    )
+    .addStep(newValidateProtoStep())
+    // The Java AuthorizeCreate order (#297): before the duplicate check,
+    // so an unauthorized caller learns nothing about existing ids.
+    .addStep(newAuthorizeExecutionContextCreateStep(deps.authorizer))
+    .addStep(newValidateVisibilityStep())
+    .addStep(newRejectCiphertextShapedStep())
+    .addStep(newResolveSlugStep())
+    .addStep(newCheckDuplicateStep(deps.store))
+    .addStep(newBuildNewStateStep())
+    .addStep(newGuardReservedLabelsStep(deps.authorizer))
+    .addStep(newNormalizeReferencesStep())
+    .addStep(newEncryptSecretValuesStep(deps.secretService, deps.logger))
+    .addStep(newPersistStep(deps.store))
+    .addStep(
+      newCreateAuthorizationTuplesStep(
+        deps.authorizationLifecycle,
+        deps.logger,
+      ),
+    )
+    .addStep(
+      newIndexSearchStep(
+        deps.store,
+        executionContextSearchExtractor,
+        deps.logger,
+      ),
+    )
+    .build()
+    .execute(reqCtx);
+  redactExecutionContextSecrets(reqCtx.newState);
+  return reqCtx.newState;
+}
+
+/**
+ * Apply — Go apply.go: declarative create-or-FAIL (ExecutionContext has
+ * no update). A minimal probe pipeline decides existence, then delegates
+ * to Create with the ORIGINAL request message or returns AlreadyExists
+ * with Go's exact copy — note it carries metadata.NAME, while the
+ * duplicate arm inside the delegated create emits CheckDuplicate's
+ * slug-shaped message; both are wire contract, reached via different
+ * entry paths.
+ */
+async function apply(
+  deps: ExecutionContextControllerDeps,
+  ec: ExecutionContext,
+  ctx: HandlerContext,
+): Promise<ExecutionContext> {
+  const reqCtx = new RequestContext(
+    ExecutionContextSchema,
+    ec,
+    callerIdentityOf(ctx),
+    kindOf(ctx),
+  );
+  await newPipeline<typeof ExecutionContextSchema>(
+    "execution-context-apply",
+    deps.logger,
+  )
+    .addStep(
+      newAuthorizeStep(
+        ExecutionContextCommandController.method.apply,
+        deps.authorizer,
+      ),
+    )
+    .addStep(newValidateProtoStep())
+    .addStep(newResolveSlugStep())
+    .addStep(newLoadForApplyStep(deps.store))
+    .build()
+    .execute(reqCtx);
+
+  const shouldCreate = reqCtx.get(SHOULD_CREATE_KEY);
+  if (typeof shouldCreate !== "boolean") {
+    throw internalError(
+      new Error("apply pipeline did not set shouldCreate flag"),
+      "apply operation failed to determine create vs update",
+    );
+  }
+  if (shouldCreate) {
+    return createExecutionContext(deps, ec, ctx);
+  }
+  deps.logger.warn("ExecutionContext already exists - UPDATE not supported", {
+    slug: ec.metadata?.name ?? "",
+    id: ec.metadata?.id ?? "",
+  });
+  throw alreadyExistsError("ExecutionContext", ec.metadata?.name ?? "");
+}
+
+/**
+ * Delete — returns the deleted execution context REDACTED (oss#535):
+ * without it, delete would be the one path that leaks the stored
+ * representation — ciphertext today, actual plaintext for legacy
+ * pre-encryption rows. The id is seeded into context manually because
+ * ApiResourceDeleteInput carries resource_id, not the `value` field
+ * ExtractResourceId expects (Go does the same manual seed).
+ */
+async function deleteExecutionContext(
+  deps: ExecutionContextControllerDeps,
+  input: ApiResourceDeleteInput,
+  ctx: HandlerContext,
+): Promise<ExecutionContext> {
+  const reqCtx = new RequestContext(
+    ExecutionContextCommandController.method.delete.input,
+    input,
+    callerIdentityOf(ctx),
+    kindOf(ctx),
+  );
+  reqCtx.set(RESOURCE_ID_KEY, input.resourceId);
+  await newPipeline<
+    typeof ExecutionContextCommandController.method.delete.input
+  >("execution-context-delete", deps.logger)
+    .addStep(
+      newAuthorizeStep(
+        ExecutionContextCommandController.method.delete,
+        deps.authorizer,
+      ),
+    )
+    .addStep(newValidateProtoStep())
+    .addStep(newLoadExistingForDeleteStep(deps.store, ExecutionContextSchema))
+    .addStep(newDeleteResourceStep(deps.store))
+    .addStep(
+      newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger),
+    )
+    .addStep(newDeleteSearchIndexStep(deps.store, deps.logger))
+    .build()
+    .execute(reqCtx);
+
+  const deleted = reqCtx.get(EXISTING_RESOURCE_KEY);
+  if (deleted === undefined) {
+    throw internalError(
+      new Error("deleted execution context not found in context"),
+      "deleted execution context not found in context",
+    );
+  }
+  const ec = deleted as ExecutionContext;
+  redactExecutionContextSecrets(ec);
+  return ec;
+}
+
+/** Get — LoadTarget by id; the response is redacted (oss#535). */
+async function get(
+  deps: ExecutionContextControllerDeps,
+  id: ExecutionContextId,
+  ctx: HandlerContext,
+): Promise<ExecutionContext> {
+  const reqCtx = new RequestContext(
+    ExecutionContextQueryController.method.get.input,
+    id,
+    callerIdentityOf(ctx),
+    kindOf(ctx),
+  );
+  await newPipeline<typeof ExecutionContextQueryController.method.get.input>(
+    "execution-context-get",
+    deps.logger,
+  )
+    .addStep(
+      newAuthorizeStep(
+        ExecutionContextQueryController.method.get,
+        deps.authorizer,
+      ),
+    )
+    .addStep(newValidateProtoStep())
+    .addStep(newLoadTargetStep(deps.store, ExecutionContextSchema))
+    .build()
+    .execute(reqCtx);
+  const ec = reqCtx.get(TARGET_RESOURCE_KEY) as ExecutionContext;
+  redactExecutionContextSecrets(ec);
+  return ec;
+}
+
+/** GetByReference — slug+org lookup; the response is redacted. */
+async function getByReference(
+  deps: ExecutionContextControllerDeps,
+  ref: ApiResourceReference,
+  ctx: HandlerContext,
+): Promise<ExecutionContext> {
+  const reqCtx = new RequestContext(
+    ExecutionContextQueryController.method.getByReference.input,
+    ref,
+    callerIdentityOf(ctx),
+    kindOf(ctx),
+  );
+  await newPipeline<
+    typeof ExecutionContextQueryController.method.getByReference.input
+  >("execution-context-get-by-reference", deps.logger)
+    .addStep(
+      newAuthorizeStep(
+        ExecutionContextQueryController.method.getByReference,
+        deps.authorizer,
+      ),
+    )
+    .addStep(newValidateProtoStep())
+    .addStep(newLoadByReferenceStep(deps.store, ExecutionContextSchema))
+    .build()
+    .execute(reqCtx);
+  const ec = reqCtx.get(TARGET_RESOURCE_KEY) as ExecutionContext;
+  redactExecutionContextSecrets(ec);
+  return ec;
+}
+
+/**
+ * GetByExecutionId — the runner's secret-delivery path: the unified TS
+ * runner fetches the merged environment variables here before executing
+ * an agent or workflow (and during MCP connect discovery). The
+ * execution_id corresponds to a WorkflowExecution ID, AgentExecution ID,
+ * or connect-flow execution id.
+ *
+ * The response carries DECRYPTED is_secret values only when the caller
+ * presents an execution-scoped runner token whose binding matches this
+ * EC — see resolve-values-for-caller.ts. Every other caller receives the
+ * same redaction as get/getByReference, as a SUCCESS.
+ */
+async function getByExecutionId(
+  deps: ExecutionContextControllerDeps,
+  input: ExecutionContextExecutionIdInput,
+  ctx: HandlerContext,
+): Promise<ExecutionContext> {
+  const reqCtx = new RequestContext(
+    ExecutionContextQueryController.method.getByExecutionId.input,
+    input,
+    callerIdentityOf(ctx),
+    kindOf(ctx),
+  );
+  await newPipeline<
+    typeof ExecutionContextQueryController.method.getByExecutionId.input
+  >("execution-context-get-by-execution-id", deps.logger)
+    .addStep(
+      newAuthorizeStep(
+        ExecutionContextQueryController.method.getByExecutionId,
+        deps.authorizer,
+      ),
+    )
+    .addStep(newValidateProtoStep())
+    .addStep(newLoadByExecutionIdStep(deps.store))
+    .build()
+    .execute(reqCtx);
+
+  // Resolve secret values by presented credential: decrypt for a
+  // scope-bound runner token, redact for everyone else. Both transforms
+  // mutate the fresh store unmarshal, never the stored row.
+  const ec = reqCtx.get(TARGET_RESOURCE_KEY) as ExecutionContext;
+  await resolveValuesForCaller(deps, ctx, ec);
+  return ec;
+}

package/src/domain/executioncontext/redact.ts

@@ -0,0 +1,42 @@
+/**
+ * Redaction helper — ports
+ * pkg/domain/executioncontext/controller/redact_secret_values.go.
+ * Deliberately NOT a pipeline step: redaction runs post-pipeline at every
+ * ExecutionContext-returning boundary outside the runner lane.
+ */
+import type { ExecutionContext } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
+
+import { REDACTED_MARKER } from "../environment/constants.js";
+
+/**
+ * Go RedactExecutionContextSecrets: replaces every NON-EMPTY is_secret
+ * value with the marker — called at every controller boundary that
+ * returns an ExecutionContext to a caller outside the runner lane: get,
+ * getByReference, the create/apply response echo, the delete response
+ * echo, and getByExecutionId for callers without a scope-bound runner
+ * token. The EC twin of the environment domain's redaction (oss#535); the
+ * marker is imported from that domain so the sentinel has a single source
+ * of truth, the same move both Go domains make.
+ *
+ * is_secret is preserved so clients know a hidden value exists; EMPTY
+ * secret declarations stay empty (a marker would falsely signal a stored
+ * value). Redaction is representation-agnostic: it replaces whatever is
+ * stored (ciphertext or legacy pre-oss#535 plaintext). Mutates in place —
+ * callers hold either a fresh store unmarshal (reads) or the
+ * already-persisted new state (create echo), so redaction never reaches
+ * the store. Runs strictly AFTER Persist and IndexSearch on the create
+ * path.
+ */
+export function redactExecutionContextSecrets(
+  ec: ExecutionContext | undefined,
+): void {
+  const data = ec?.spec?.data;
+  if (data === undefined) {
+    return;
+  }
+  for (const value of Object.values(data)) {
+    if (value.isSecret && value.value !== "") {
+      value.value = REDACTED_MARKER;
+    }
+  }
+}