fix(evidence): make result summaries safe

2026-07-12 06:50:23 +02:00
parent b43075289e
commit 8110793f61
5 changed files with 80 additions and 5 deletions
@@ -170,3 +170,19 @@ and fail-closed tests, real Docker lifecycle, scoped Ruff/diff, and the full har

 Focused tests and scoped Ruff/diff pass. The contemporaneous full suite reaches an unrelated Task 6
 DWH snapshot fixture missing its newly required workspace identity.
+
+### Safe result representation and exact text totals
+
+- `PipelineResult.manifest` is explicitly excluded from dataclass representation and the custom
+  representation is fixed-size operational data only. It omits manifest ids, documents, chunks,
+  content, metadata, and errors; `str(result)` inherits the same safe representation.
+- Text-mode Evidence success output reads the uncapped aggregate totals from `payload["counts"]`
+  rather than the intentionally capped identifier arrays.
+- Regression coverage builds a thousand-document/chunk manifest containing content and
+  credential-like metadata secrets, checks bounded `repr`/`str`, and verifies exact totals above
+  the 100-item public-array cap.
+
+Focused Evidence verification passes (`67 passed`), and scoped Ruff is clean. The full harness run
+is not green in this sandbox: Docker-backed tests cannot access the daemon, wheel packaging cannot
+use the restricted build environment, and concurrent Task 6 DWH binding changes currently fail two
+DWH tests. None of those failures touch the Evidence files in this follow-up.