[echoomegaprime]

Draft security follow-up to #57 (which itself is stacked on #56 / #49). Corrects the independent source-review concern raised on #57: fail_worker_execution() previously used require_identifier but retained arbitrary identifier-form reasons in three persistent sinks. This change uses a fixed allowlist of documented machine codes, and maps all other values to redacted before state transition, dispatch update, and immutable audit append. New synthetic-input regression checks all three stored surfaces and tenant-visible dispatch status; a known machine reason remains diagnostic. Exact base parent: 86a11e0b2ad0a72c7b9ecb0dde008b83240ffbb0. No production change. Requires hosted CI, exact-head independent review, CodeQL/security verification, integration and certification before promotion. Do not merge against protected approvals or release gates.

[echoomegaprime]

Independent security patch verification (2026-11-12 04:37 UTC):

• Draft PR fix(subscriber): redact worker-failure reason in audit, state history and dispatch #58 is stacked on fix: redact retained subscriber dispatch worker errors (stacked on #56) #57 exact parent 86a11e0b2ad0a72c7b9ecb0dde008b83240ffbb0, not the deployed release.
• First exact head 5b639aec0db099bee3af77ccf40e940b024a7cea did not pass: GitHub Actions run 43155391392 ran 648 tests, 647 passed and one failed. That new test correctly revealed the existing dispatch_status() filter still obscured one now-allowlisted safe machine code.
• Corrected by sharing the same bounded worker-code allowlist with the readback sanitizer. The current exact head is 76b85df4185addbba0f8b700750c38c019e083ec; follow-up CI run 43155802051 was in progress at the time of this comment. Do not count it as passed until GitHub reports completed success.
• Scope: only subscriber.py and a new two-case synthetic-input regression; reason string is bounded before writing subscriber_run_dispatches.last_error, state_events.reason, and immutable subscriber_audit_events.details_json. The test checks all three durable sinks and tenant-visible dispatch status.
• No production service/data/key was changed. Independent review, exact SHA CI, CodeQL and eventual certified integration remain required.

[echoomegaprime]

Independent CertForge exact-head review update (2026-11-12 05:24 UTC; not an approval): PR #58 remains draft at 76b85df4185addbba0f8b700750c38c019e083ec, parent PR #57 86a11e0b2ad0a72c7b9ecb0dde008b83240ffbb0. Hosted certification-forge-ci run 43155802051 is now completed/success. Job 130975317028 reports successful full deterministic suite and P1/P6/P7 acceptance steps; previously pending P1 is no longer pending. The current patch restricts identifier-form fail_worker_execution reasons to four known codes (else redacted) and includes a synthetic-token persistence regression across dispatch, run state, and immutable audit. Still needed: independent reviewer approval, exact-head security/CodeQL evidence (not established by the retrieved CI workflow), and reviewed integration onto deployed CertForge ancestry before any release. No production change or attestation claimed.