[echoomegaprime]

Scope

Follow-up to #49, #55 and #50: the proposed orphan-audit redaction in #55 covers immutable events, but finish_dispatch() still persisted raw worker exception text in subscriber_run_dispatches.last_error, and dispatch_status() returned it. This draft closes both routes without mutating old database rows, bypassing the state machine, or changing production.

• Allowlist three stable machine reasons and replace all other worker-supplied messages with redacted before writing new records.
• Redact legacy raw errors on API readback, without rewriting historical run evidence or tenant ownership.
• Include synthetic non-secret test values and assert run terminalization, reservation release, and exactly-once metering effects remain intact.
• Parent: PR test(subscriber): reconcile multi-tenant orphan batches exactly once #56 exact head 9056dcae36a110e23e6b9721cc3524a65312620d, stacking on fix(subscriber): redact untrusted orphan-dispatch errors in immutable audit #55 and combined fix(subscriber): combine transaction rollback and exhausted dispatch recovery (#40 #41) #49. No production deployment.

Verification

Initial isolated FORGE prototype (same logic, before this exact follow-up commit): 16/16 regression tests passed against immutable parent 9056dca on Nov 12, 2026 UTC. The exact GitHub head and hosted CI must be retested before release. Draft until independent review and security checks.

This fix is separate from the required signed runner restoration, ancestry reconciliation, two-phase policy approval and full-40 HAMMER attestation.

[echoomegaprime]

Independent exact-head regression result — 2026-11-12 02:35 UTC (FORGE)

• Verified draft PR fix: redact retained subscriber dispatch worker errors (stacked on #56) #57 head 86a11e0b2ad0a72c7b9ecb0dde008b83240ffbb0, based directly on test(subscriber): reconcile multi-tenant orphan batches exactly once #56 head 9056dcae36a110e23e6b9721cc3524a65312620d.
• Disposable clone of that published exact SHA, no local source modifications: /usr/bin/python3 -m pytest -q --disable-warnings tests/test_dispatch_orphan_audit_redaction.py tests/test_dispatch_orphan_batch_recovery.py tests/test_dispatch_orphan_concurrency.py tests/test_dispatch_orphaned_runs.py tests/test_dispatch_error_retention.py tests/test_subscriber_migration_rollback.py.
• 16 passed in 14.57 s; exit 0; git working tree clean; temp checkout removed. The new synthetic-error regression asserts that fresh untrusted worker exception text is persisted only as redacted, legacy stored raw error is redacted on dispatch_status() without rewriting its database row, and terminal state/reservation/metering invariants remain correct.
• Follow-up (02:37 UTC): GitHub Actions certification-forge-ci run 43142040176 completed SUCCESS on this exact SHA. Job 130931057712 passed checkout, compilation, full deterministic suite, P1, P6 deployment enforcement, P7 subscriber governance, and evidence-upload steps. Separate exact-head CodeQL and independent review remain unestablished. This is test evidence, not release approval.
• Production remains untouched at d8ad9fd881365801354b78a758632d2a31ab6828. Do not deploy this draft or count it as signed runner restoration or PRODUCTION_READY.

[echoomegaprime]

Independent exact-head source review — 2026-11-12 03:34 UTC; HEAD 86a11e0b2ad0a72c7b9ecb0dde008b83240ffbb0 (hosted CI successful, no independent reviews yet).

Additional error-retention path to examine before promoting the stack: PR #57 wraps worker text in _bounded_dispatch_error() only in finish_dispatch() and dispatch_status() (subscriber.py lines 4458, 4484). The same exact-head file also has fail_worker_execution(claim, *, reason: str) (roughly lines 5065–5145), where require_identifier(reason, "reason") validates syntax, not membership in documented machine reason codes. That function passes reason into the run state transition, writes it raw to subscriber_run_dispatches.last_error, and copies it into immutable certification.worker_fail audit details. canonical.py permits 1–128 chars including alphanumeric, dot, colon, underscore and hyphen. Current run_worker.py call sites mostly supply fixed machine codes or SubscriberError.code; no actual secret exposure is established.

Bounded acceptance test: invoke fail_worker_execution using a valid synthetic, unrecognized identifier (e.g. syntheticcredentialdoNotRetain000) against an isolated claimed run; assert stored dispatch value, status response, transition reason and immutable audit record do not retain/display that exact string; ensure allowlisted machine reasons, tenant attribution, compensation and fencing still behave. If this is intentionally trusted input, document the threat boundary and test it explicitly. Do not rewrite historical audits or touch production state. Existing PR #57 tests cover finish_dispatch and legacy dispatch_status, not this path.

This is a source-level coverage finding, not an assertion of exploitation or evidence that a new fix has passed tests. Release remains gated.