[diegosouzapw]

Summary

• stop projecting Adapta type: "error" diagnostics into the public HTTP-200 SSE body;
• emit only the fixed, canonically sanitized error text, followed by terminal finish_reason: "stop" and [DONE];
• keep the hostile-stream regression while moving its stateful executor/DB imports into a credential-isolated subprocess;
• keep the parent test process free of DATA_DIR, plugin-directory, DB, call-log-writer, fetch, and event-bus mutations;
• keep the pre-existing auth-failure regression hermetic by replacing its live Clerk call with a deterministic 401 boundary stub.

Candidate

Item	SHA
Exact head	ee3f2cf691ca406ddf2d6c3482d15f4c428e559b
Isolation commit	0d0aaaf0aa03e74499c8809b8bc274beffc2db63
Original security fix	e545d256db394e26ca8a5b5f8b3a4350af311491
Frozen implementation base	97041954171ee3aa3f51a7fb01748797c23716f8
Reconciled release tip	e243b04de22da2d78900c27fde5f83f4fbc3d7f9

The latest release refresh was a normal merge, without conflict, rebase, or force-push. No release commit since the previously reconciled tip touched any of the four PR-owned Adapta paths.

Public error boundary

Contract	Evidence	Status
Hostile upstream diagnostics stay private	SQL text, absolute path, and bearer token are absent from public SSE and captured provider logs	PASS
Public payload is fixed and sanitized	only \n\n[Erro: Adapta upstream error] is emitted for the hostile error event	PASS
Stream remains protocol-compatible	terminal finish_reason: "stop" and data: [DONE] are present	PASS
Network is stubbed	all three expected fetch calls are intercepted; no live upstream call or credential is used	PASS

Test-isolation repair: RED → GREEN

Phase	Exact result	Meaning
RED, real shared process	2/3 under --test-isolation=none paired with call-log-save-drain	the old top-level DATA_DIR mutation redirected the call-log artifact; its existence assertion failed (false !== true)
Child fixture	1/1	the original hostile-stream case passes with an empty environment plus an explicit runtime allowlist
Pure parent wrapper	1/1	subprocess exit, signal, TAP counts, secret absence, and parent invariants are asserted
Shared-process pair	3/3	call-log-save-drain and the Adapta wrapper pass together without concurrency or singleton poisoning
All focused Adapta regressions	6/6	the isolated stream case and the five existing executor cases pass together under --test-isolation=none

Isolation and secret hygiene

Boundary	Guarantee	Status
Parent test	imports built-ins only; does not import the executor, DB, call-log modules, or mutate process.env/globalThis	PASS
Child environment	explicit allowlist: PATH, NODE_PATH, LANG, LC_ALL, TZ, TMPDIR, test flags, synthetic API_KEY_SECRET, isolated DATA_DIR, and isolated plugin directory	PASS
Credential inheritance	no ...process.env, provider tokens, HOME, or CODEX_HOME; NODE_TEST_CONTEXT is explicitly removed before spawn	PASS
Child state	executor/DB imports and the temporary fetch override exist only in the subprocess; fetch is restored after the test	PASS
Teardown	parent waits for child close, then removes only its own temporary root in finally; no parent singleton is opened or closed	PASS
Secret output	synthetic encryption secret is absent from child stdout/stderr; focused credential-pattern scan has zero matches	PASS

Byte-for-byte preservation

The isolation follow-up changes tests only. These pre-existing PR files remained byte-identical before and after the release merge:

Path	SHA-256
open-sse/executors/adapta-web.ts	ac4ab65e51c4cc25cbec800dd5096605af680678b84924bf15678887a70d1b44
tests/unit/executor-adapta-web.test.ts	bc1a0845ad3bdb292e7d56f87117b126ae1ade97f515af9cca1a0a84199ef179

Isolation harness hashes:

Path	SHA-256
tests/unit/executor-adapta-web-stream-error.test.ts	37d652c94e18267f71127866543d14a4378b194cad062ba202222af23d776e66
tests/fixtures/adapta-web-stream-error-boundary.fixture.ts	3771f1cce8566550393c5a9d0ab7269a98db062b9dd0eab9afe4309beb7da3ba

Latest release-base reconciliation

Evidence	Exact result	Status
Live base fetched	e243b04de22da2d78900c27fde5f83f4fbc3d7f9	PASS
Merge commit	ee3f2cf691ca406ddf2d6c3482d15f4c428e559b	PASS
Semantic conflicts	none	PASS
PR-owned paths changed by new base commits	none	PASS

Final gates on the exact head

Gate	Result	Status
Focused ESLint with repository suppressions	exit 0	PASS
Prettier	all matched files formatted	PASS
Core TypeScript	exit 0	PASS
Open-SSE TypeScript	openSseTypecheckErrors=0	PASS
Test discovery	5,437 files / 32 collectors / 9 frozen orphans	PASS
Tracked-artifact policy	no forbidden artifacts	PASS
Changelog integrity	no base bullets lost vs release	PASS
git diff --check	clean	PASS
Independent incremental review	zero P1/HIGH/P2 material findings	PASS
GitHub CI on 0130349906…	started after push; exact results must complete remotely	HOLD-CI

Risk and rollback

The production delta remains the original narrow one-branch redaction: attacker-controlled event.errorText is no longer copied into a public HTTP-200 stream. Normal text-delta, done, and non-streaming paths are unchanged. The follow-up delta is test-only and moves stateful setup across a process boundary. Reverting the isolation commit restores only the former test harness; reverting the original security commit restores the former public-error behavior.

This PR intentionally remains a draft. Do not merge, enable auto-merge, deploy, or release from it until exact-head CI is reviewed.