Phase J: fail-closed secret-safe trace retention

[datzle123]

Outcome

RealDone now inspects every newly closed Playwright trace before linking it from automatic-scan or contract/MCP evidence. Secret-bearing, invalid, oversized, and over-expanded ZIPs are deleted fail-closed; reports retain only additive value-free suppression metadata. Exact checks include generated sensitive fields, contract secretEnv, and opaque cookies/tokens from granted Playwright storage state.

Observable gates

• automatic login and authenticated-storage scans: unsafe trace absent/unlinked, sanitized secret-detected metadata only
• recorded contract with secretEnv and auth-state role contracts: verification evidence remains valid, unsafe traces absent
• non-sensitive automatic and contract trace controls remain linked and readable
• direct ZIP controls cover safe, exact-secret, opaque auth state, invalid ZIP, entry limits, and aggregate RG14
• local pnpm check: 142 passed, 2 expected service-dependent skips
• audit, full Chromium smoke, pack and installed-tarball smoke passed

Fresh external qualification

Fingerprint 0b39d542… is backed by fresh SHA-256-bound TodoMVC, Actual Budget, Conduit SQLite, Conduit PostgreSQL 17 + Supabase Data API, PostgreSQL create/update/delete cleanup, Pocket Ledger Level 7, and a new Codex MCP baseline → RD901 → repair cycle. Validator result: 5/5 cases, 9/9 capabilities, RG14 clean. Merging those inputs with the six hosted candidate attestations passed all 15 gates locally; GitHub run 30199694271 is the required signed rerun.