fix(redaction): skip RFC 3339 offset and HTAB timestamps

[cursor]

Next action

Merge this successor instead of #1038. That head still fail-closes a pretty-printed password dump when the collector emits RFC 3339 time-numoffset (+00:00, -07:00) or separates the timestamp from the payload with HTAB.

What changed

• Skip line-start RFC 3339 timestamps whose offset is Z or time-numoffset, then a SPACE or HTAB, inside raw JSON spans the same way JSON whitespace is skipped.
• Keep the [ opener guard from fix(redaction): keep timestamped Actions job logs visible #1038 so [INFO] / [timeout] stay visible.
• Add fail-first fixtures for +00:00 / -07:00 prefixes and tab-separated downloaded logs.
• Cite RFC 3339 §5.6 time-numoffset and HTAB next to the existing APA 7 JSON / workflow-log references.

Verification

Focused redaction selection: 170 passed. Owned modules redact_sensitive_log.py, sandboxed_verify.py, and sandboxed_web_e2e.py report 100% statement and branch coverage (1,094 statements, 444 branches).

Acceptance

Do not merge #929, #1031, or #1038. After this head is green, treat [REDACTED] as evidence suppression and rerun the exact-head sandbox redaction quality job before closing #908.

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Stale comment

Next action

Mark this pull request ready for review, then merge it instead of #1038, #1031, or #929.

This head skips RFC 3339 time-numoffset and HTAB runner prefixes inside raw JSON spans so a downloaded pretty-printed password dump keeps ##[group] and status text. Local focused selection: 170 passed; 100% statement/branch on the three owned modules.

Do not self-approve. After it is green, treat [REDACTED] as evidence suppression and rerun the exact-head sandbox redaction quality job before closing #908.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Next action

Do not merge this pull request. Merge #1053 instead.

This head correctly skips RFC 3339 time-numoffset and HTAB on line-start downloaded zip timestamps, so a pretty-printed password object keeps ##[group] and "status". The production collector does not feed that shape. collect_failed_check_evidence.sh runs gh run view --log-failed, which prefixes every zip line with job<HTAB>step<HTAB> (UNKNOWN STEP when unassociated) before the timestamp (GitHub, n.d.-d). On this head that prefix is treated as JSON text, the next collector line breaks the span, and the excerpt fail-closes to [REDACTED].

#1053 (5b66ccd4) skips that two-field prefix only when an RFC 3339 timestamp follows, and unstructured-redacts skipped job/step bytes that remain inside a rewritten span so a credential-shaped job name or run: step text cannot survive on continuation lines. Focused selection: 177 passed; 100% statement/branch on the three owned modules (1,136 / 464).

Do not self-approve. Do not merge #929, #1031, #1038, or this pull request.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Current-head evidence: rebased the sandbox log-redaction/timestamp repair onto main bbedc1a. Exact head c40cd4b. Focused redaction/sandbox suite: 170 passed; changed workflow actionlint and git diff --check passed. Protected hosted checks remain; no bypass used.

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.

Findings

1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch

• Problem: GitHub reports mergeStateStatus DIRTY for this pull request.
• Root cause: Branch cursor/bc-f7a56233-973b-4875-8395-c453b26f5bde-841c cannot be merged cleanly into main; the changed-file flow below shows which review/runtime path is blocked by the conflict.
• Fix: Merge or rebase the latest main into cursor/bc-f7a56233-973b-4875-8395-c453b26f5bde-841c, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch.
• Repair commands:

gh pr checkout 1040 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:cursor/bc-f7a56233-973b-4875-8395-c453b26f5bde-841c
# rebase path only: git push --force-with-lease origin HEAD:cursor/bc-f7a56233-973b-4875-8395-c453b26f5bde-841c

• Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.

Merge Conflict Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: sandbox-log-redaction-quality-ci.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (3 files)"]
  S2 --> I2["repository behavior"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["required checks"]
  Evidence --> S3["Docs: sandbox-log-redaction.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V3["docs review"]
  Evidence --> S4["CI script (3 files)"]
  S4 --> I4["review and security gate shell path"]
  I4 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (6 files)"]
  S5 --> I5["regression suite"]
  I5 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V5["targeted test run"]

Loading

• Result: REQUEST_CHANGES
• Reason: mergeStateStatus is DIRTY; mergeable is CONFLICTING.
• Head SHA: c40cd4b2e6ed409949968d0b3d3ee44d76b88357
• Workflow run: 32294966414
• Workflow attempt: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: sandbox-log-redaction-quality-ci.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (3 files)"]
  S2 --> I2["repository behavior"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["required checks"]
  Evidence --> S3["Docs: sandbox-log-redaction.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V3["docs review"]
  Evidence --> S4["CI script (3 files)"]
  S4 --> I4["review and security gate shell path"]
  I4 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (6 files)"]
  S5 --> I5["regression suite"]
  I5 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V5["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: c40cd4b2e6ed409949968d0b3d3ee44d76b88357
• Workflow run: 32294966414
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.

Findings

1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch

• Problem: GitHub reports mergeStateStatus DIRTY for this pull request.
• Root cause: Branch cursor/bc-f7a56233-973b-4875-8395-c453b26f5bde-841c cannot be merged cleanly into main; the changed-file flow below shows which review/runtime path is blocked by the conflict.
• Fix: Merge or rebase the latest main into cursor/bc-f7a56233-973b-4875-8395-c453b26f5bde-841c, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch.
• Repair commands:

gh pr checkout 1040 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:cursor/bc-f7a56233-973b-4875-8395-c453b26f5bde-841c
# rebase path only: git push --force-with-lease origin HEAD:cursor/bc-f7a56233-973b-4875-8395-c453b26f5bde-841c

• Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.

Merge Conflict Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: sandbox-log-redaction-quality-ci.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (3 files)"]
  S2 --> I2["repository behavior"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["required checks"]
  Evidence --> S3["Docs: sandbox-log-redaction.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V3["docs review"]
  Evidence --> S4["CI script (3 files)"]
  S4 --> I4["review and security gate shell path"]
  I4 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (6 files)"]
  S5 --> I5["regression suite"]
  I5 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V5["targeted test run"]

Loading

• Result: REQUEST_CHANGES
• Reason: mergeStateStatus is DIRTY; mergeable is CONFLICTING.
• Head SHA: c40cd4b2e6ed409949968d0b3d3ee44d76b88357
• Workflow run: 32294966414
• Workflow attempt: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: sandbox-log-redaction-quality-ci.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (3 files)"]
  S2 --> I2["repository behavior"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["required checks"]
  Evidence --> S3["Docs: sandbox-log-redaction.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V3["docs review"]
  Evidence --> S4["CI script (3 files)"]
  S4 --> I4["review and security gate shell path"]
  I4 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (6 files)"]
  S5 --> I5["regression suite"]
  I5 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V5["targeted test run"]

Loading

Merge Conflict Guidance

• Current merge state: DIRTY
• Base branch: main
• Head branch: cursor/bc-f7a56233-973b-4875-8395-c453b26f5bde-841c
• Fix direction: merge or rebase origin/main into cursor/bc-f7a56233-973b-4875-8395-c453b26f5bde-841c, resolve conflict markers in the changed files, rerun the focused checks, then push the same branch.
• Repair commands:

gh pr checkout 1040 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:cursor/bc-f7a56233-973b-4875-8395-c453b26f5bde-841c
# rebase path only: git push --force-with-lease origin HEAD:cursor/bc-f7a56233-973b-4875-8395-c453b26f5bde-841c

[seonghobae]

Closing as superseded by the cumulative current-head sandbox redaction implementation in #1053; the rebased replacement carries this protection with its focused contract tests.

[seonghobae]

Superseded by #1053.