Extend trace-argument redaction beyond `memory.*` capabilities

[dgenio]

Summary

Apply argument redaction to ActionTrace.args for all capabilities (or make the
redaction scope configurable), and scrub driver error text before embedding it in
trace error fields. Today only memory.* capability args are redacted.

Why this matters

The trace store is the long-lived audit record. If invocation arguments routinely
contain user content, secrets passed as parameters, or PII, storing them raw makes
the TraceStore itself a sensitive data store — undermining the I-01 boundary the
firewall enforces on outputs. DriverError messages additionally embed up to 200
characters of raw HTTP response bodies into traces.

Current evidence

• kernel/_invoke.py:44-55: _MEMORY_CAPABILITY_PREFIX = "memory." and _redact_args_for_trace only redacts when capability_id starts with "memory."; all other args stored raw at lines 162 and 191.
• drivers/http.py:111-114: DriverError message includes exc.response.text[:200] — raw upstream body text flows into ActionTrace.error via record_failure_trace.
• firewall/redaction.py has the full pattern set (email/phone/card/SSN/Bearer/JWT/API-key/connection-string) but is not applied to trace args.

External context

Audit-log hygiene guidance (e.g., OWASP logging recommendations) treats secrets and
PII in logs as a standing risk class; agent audit trails inherit the same concern.

Proposed implementation

1. Run the string-pattern portion of redact() over all trace args by default
   (sensitive-field-name redaction plus inline pattern scrubbing).
2. Keep the existing full-payload redaction for memory.* unchanged.
3. Scrub driver error strings through the same pattern pass in
   record_failure_trace before persisting.
4. Optionally allow a kernel/policy switch (trace_args: "redacted" | "raw" | "omit")
   for deployments that need full-fidelity traces.

AI-agent execution notes

• Inspect first: kernel/_invoke.py (_redact_args_for_trace, record_failure_trace), firewall/redaction.py, trace.py, tests/test_kernel.py, tests/test_trace.py.
• Preserve the determinism rule (AGENTS.md) and the existing memory.* behavior.
• Edge cases: args containing nested dicts; non-string arg values; very large args.
• Do not change ActionTrace field names — downstream consumers (Export ActionTrace to OpenTelemetry / LangWatch-compatible trace format #125, Interop: export action traces for downstream lesson extraction #94) read them.

Acceptance criteria

• A fake API key passed as an invocation arg never appears verbatim in any stored ActionTrace.
• A driver failure whose HTTP body contains a fake secret produces a trace error with the secret redacted.
• memory.* behavior is unchanged and covered by existing tests.

Test plan

Add cases to tests/test_trace.py and tests/test_kernel.py with secret-bearing args
and a failing fake driver; assert redaction. Run make ci.

Documentation plan

Document trace-content guarantees in docs/security.md; CHANGELOG Security.

Migration and compatibility notes

Trace consumers will see redacted args where they previously saw raw values; the
optional "raw" switch preserves old behavior where explicitly chosen.

Risks and tradeoffs

Redacted traces are less useful for debugging; the configuration switch and stable
[REDACTED] sentinel mitigate this. Small per-invocation CPU cost.

Suggested labels

security, reliability, architecture

[dgenio]

Closing as fixed by merged PR #229 (merged 2026-06-17).

ActionTrace.args for every capability (not just memory.*) and driver error text now pass through the firewall redactor before persistence, so the trace store no longer becomes a sensitive-data sink. Memory-payload stripping for memory.* is unchanged. Verified in the current tree at src/weaver_kernel/kernel/_invoke.py (_redact_args_for_trace now calls redact(args); new _redact_trace_text scrubs error text used in record_failure_trace). Regression coverage: tests/test_firewall_canary.py::test_canary_in_non_memory_arg_is_redacted_in_trace / ::test_canary_in_driver_error_is_redacted_in_trace; docs/security.md threat table updated.

---

Generated by Claude Code