fix(goals): keep the lifecycle projection honest at its boundaries

Review found two defects in the derived projection.

Closeout ignored milestone reachability: a Goal whose declared acceptance
marker was still unreached, with no open agent work, was reported as closing
with a next transition of closed. Running out of open work is not the same as
having reached acceptance, so an unreached milestone now keeps the Goal in
qualifying with a milestone_unreached reason. An existing work-lane constraint
also outranks this projection's own reading of remaining work.

The compact label helper claimed public safety without providing it: it only
collapsed whitespace and truncated, so a private absolute path in a run
history reference reached the projection verbatim. It now reuses the shared
redaction rule and drops a value that still matches a private-text or provider
token shape.

Both are covered by negative cases, and each case kills its mutant: removing
the closeout guard or the redaction rule fails the smoke.

Signed-off-by: song <liusongstep@gmail.com>

Author: songoow

examples/control_plane/goal-artifact-lifecycle-projection-smoke.py

@@ -24,6 +24,7 @@
     PHASE_QUALIFYING,
     PHASE_STARTING,
     PHASE_WAITING_OWNER,
+    _compact_text,
     build_goal_artifact_lifecycle_projection,
 )
 
@@ -214,6 +215,93 @@ def assert_projection_is_pure_and_reads_no_state() -> None:
     assert first["lifecycle_phase"] == PHASE_QUALIFYING, first
 
 
+def assert_unreached_milestone_blocks_closeout() -> None:
+    """An unclaimed-acceptance Goal must not be told to close."""
+
+    projection = build_goal_artifact_lifecycle_projection(
+        goal_id=GOAL_ID,
+        goal={
+            "id": GOAL_ID,
+            "status": "active",
+            "acceptance": {"milestones": ["baseline_pass"]},
+        },
+        user_todo_summary={"gate_open_items": []},
+        agent_todo_summary={"open_count": 0},
+        run_history={"latest_runs": []},
+    )
+    assert projection["lifecycle_phase"] == PHASE_QUALIFYING, projection
+    transitions = projection["next_transitions"]
+    assert transitions, projection
+    assert transitions[0]["target_phase"] != PHASE_CLOSED, projection
+    assert transitions[0]["reason_codes"] == ["milestone_unreached"], projection
+
+
+def assert_reached_milestones_still_allow_closeout() -> None:
+    """The same inputs with evidence present do reach the closing phase."""
+
+    projection = build_goal_artifact_lifecycle_projection(
+        goal_id=GOAL_ID,
+        goal={
+            "id": GOAL_ID,
+            "status": "active",
+            "acceptance": {"milestones": ["primary_goal_outcome"]},
+        },
+        user_todo_summary={"gate_open_items": []},
+        agent_todo_summary={"open_count": 0},
+        run_history={
+            "latest_runs": [
+                {
+                    "delivery_outcome": "primary_goal_outcome",
+                    "delivery_batch_scale": "multi_surface",
+                }
+            ]
+        },
+    )
+    assert projection["lifecycle_phase"] == PHASE_CLOSING, projection
+    assert projection["next_transitions"][0]["target_phase"] == PHASE_CLOSED, projection
+
+
+def assert_private_values_are_redacted_or_dropped() -> None:
+    """A run-history reference is free text; private values must not survive."""
+
+    projection = build_goal_artifact_lifecycle_projection(
+        goal_id=GOAL_ID,
+        goal={"id": GOAL_ID, "status": "active"},
+        agent_todo_summary={"open_count": 1},
+        run_history={
+            "latest_runs": [
+                {
+                    "delivery_outcome": "primary_goal_outcome",
+                    "delivery_batch_scale": "multi_surface",
+                    "evidence_ref": "/Users/private-owner/.ssh/id_rsa",
+                    "recommended_action": (
+                        "publish ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ012345 and "
+                        "see /private/var/folders/secret/notes.md"
+                    ),
+                }
+            ]
+        },
+    )
+    rendered = json.dumps(projection, ensure_ascii=False)
+    for leaked in (
+        "/Users/private-owner",
+        "/private/var/folders",
+        "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ012345",
+    ):
+        assert leaked not in rendered, (leaked, rendered)
+
+    # Pin the redaction rule itself: a benign local path must be replaced, not
+    # merely dropped, so the boundary still holds when a caller later renders a
+    # label this projection chose to keep.
+    assert _compact_text("/Users/private-owner/notes.md") == (
+        "<local-path-redacted>"
+    ), _compact_text("/Users/private-owner/notes.md")
+    assert _compact_text("token ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ012345") is None
+    assert _compact_text("/private/var/folders/x/secret.md") == (
+        "<local-path-redacted>"
+    )
+
+
 def main() -> int:
     assert_starting_phase_without_work()
     assert_declared_milestone_stays_unreached_while_gapped()
@@ -222,6 +310,9 @@ def main() -> int:
     assert_evidence_guard_is_required_and_owned_by_the_agent()
     assert_closing_then_closed_phase()
     assert_projection_is_pure_and_reads_no_state()
+    assert_unreached_milestone_blocks_closeout()
+    assert_reached_milestones_still_allow_closeout()
+    assert_private_values_are_redacted_or_dropped()
     print("goal-artifact-lifecycle-projection-smoke ok")
     return 0
 

loopx/control_plane/goals/artifact_lifecycle.py

@@ -18,8 +18,12 @@
 
 from __future__ import annotations
 
+import re
 from typing import Any
 
+from ...presentation.public_safety import redact_public_text
+from ...public_safe_text import find_private_text_match
+
 GOAL_ARTIFACT_LIFECYCLE_PROJECTION_SCHEMA_VERSION = (
     "goal_artifact_lifecycle_projection_v0"
 )
@@ -37,19 +41,31 @@
 
 _TERMINAL_GOAL_STATUSES = {"closed", "retired", "archived", "done", "complete"}
 
+# Provider token shapes the shared private-text rules do not cover. A run
+# history reference is free text, so a leaked token there must never reach a
+# public projection just because the shared corpus did not list its prefix.
+_TOKEN_SHAPES = re.compile(
+    r"\b(?:gh[pousr]_[A-Za-z0-9]{16,}|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16})\b"
+)
+
 # A material run outcome that a Goal's own acceptance can rest on.
 _MATERIAL_OUTCOMES = {"primary_goal_outcome", "outcome_progress", "multi_surface"}
 
 
 def _compact_text(value: Any, *, limit: int = 240) -> str | None:
-    """Bound one public-safe label; never carry a raw body or path."""
+    """Bound and redact one label; never carry a raw body, path or credential."""
 
     if not isinstance(value, str):
         return None
-    collapsed = " ".join(value.split())
+    collapsed = redact_public_text(value, limit=limit)
     if not collapsed:
         return None
-    return collapsed[:limit]
+    # The shared sanitizer covers local paths; this projection additionally
+    # refuses a value that still matches a private-text or credential shape
+    # rather than publishing a partly-redacted fragment.
+    if find_private_text_match(collapsed) or _TOKEN_SHAPES.search(collapsed):
+        return None
+    return collapsed
 
 
 def _mapping(value: Any) -> dict[str, Any]:
@@ -207,7 +223,10 @@ def _lifecycle_phase(
     total_open = open_count if isinstance(open_count, int) and not isinstance(open_count, bool) else 0
     if not milestones and total_open == 0:
         return PHASE_STARTING
-    if total_open == 0:
+    # An unclaimed-acceptance Goal is never closing: running out of open agent
+    # work is not the same as having reached the declared acceptance markers.
+    unreached = any(milestone["reached"] is not True for milestone in milestones)
+    if total_open == 0 and not unreached:
         return PHASE_CLOSING
     return PHASE_QUALIFYING
 
@@ -217,6 +236,7 @@ def _next_transitions(
     *,
     phase: str,
     guards: list[dict[str, Any]],
+    milestones: list[dict[str, Any]],
     work_lane: dict[str, Any],
 ) -> list[dict[str, Any]]:
     """Reuse the existing lane/frontier derivation instead of a second machine."""
@@ -238,6 +258,27 @@ def _next_transitions(
                 "reason_codes": ["guard_open"],
             }
         ]
+    # An existing work-lane constraint outranks this projection's own reading
+    # of open work: the lane owner decides what runs next.
+    if lane and phase != PHASE_CLOSING:
+        return [
+            {
+                "target_phase": PHASE_QUALIFYING,
+                "precondition": obligation or "advance the selected lane",
+                "reason_codes": ["work_lane_selected"],
+            }
+        ]
+    unreached = [
+        milestone["id"] for milestone in milestones if milestone["reached"] is not True
+    ]
+    if unreached:
+        return [
+            {
+                "target_phase": PHASE_QUALIFYING,
+                "precondition": "reach the declared acceptance milestones with evidence",
+                "reason_codes": ["milestone_unreached"],
+            }
+        ]
     if phase == PHASE_CLOSING:
         return [
             {
@@ -293,7 +334,11 @@ def build_goal_artifact_lifecycle_projection(
         "milestones": milestones,
         "guards": guards,
         "next_transitions": _next_transitions(
-            goal_record, phase=phase, guards=guards, work_lane=lane
+            goal_record,
+            phase=phase,
+            guards=guards,
+            milestones=milestones,
+            work_lane=lane,
         ),
     }