Reject secrets before journal persistence by default

[taras]

Current status

The scanner, safe finding shape, default-on execution policy, CLI opt-out, and pre-journal persistence gate are complete on main.

The remaining work is cross-backend/cross-runtime certification and user-facing documentation. Only that final slice closes this issue.

Retained contract

• Secret detection is active before the first journal append for run, test, programmatic execution, and future workflow execution.
• Only a trusted execution request may disable it; executable Markdown cannot weaken the policy.
• Findings and scanner failures retain no matched value, source content, or unsafe raw cause.
• Replay does not rescan existing journal entries.
• The scanner runs offline and performs no sanitization, repair, approval, telemetry, or network verification.
• Disabling detection remains explicit and conspicuous.

One WorkflowRun SQLite database may physically contain the filtered journal and DOFS storage, but arbitrary Workspace files do not become journal or training data. This issue does not scan or ingest the complete Workspace. Generated XMD and external-effect results cross the existing journal gate before retention; no second workflow-specific filtering system is required.

Remaining acceptance

• Memory, file, and HTTP journal backends reject synthetic secrets before persistence.
• Deno, Node, Bun, the compiled binary, TypeScript, and JSR gates certify the same default-on behavior.
• Tests use only synthetic canaries and prove diagnostics never expose them.
• Representative performance is recorded for repeated small and larger journal events.
• Website and specification documentation explain the default, dangerous opt-out, offline behavior, safe finding shape, and pre-persistence boundary.
• xmd workflow installs the same execution-scoped policy when its production journal adapter lands.

Not included

• Scanning or training on arbitrary Workspace filesystem contents.
• A Git sidecar snapshot or refs/xmd/runs ledger.
• Broad PII or low-confidence entropy classification.
• User-, document-, or repository-defined allowlists.
• Sanitization, repair, approval, or elicitation.

Dependencies

• Store WorkflowRuns and filtered journals in SQLite #291 consumes the existing journal security boundary.
• PR 📝 Specify retained workflow Workspaces #358 defines the WorkflowRun physical/logical storage separation.