Project reviewer-safe workflow results

[chubes4]

Summary

Stage an explicit, bounded reviewer-safe projection of the native agent workflow result instead of uploading the complete runtime envelope. Public control, verification, publication, output projection, access, failure, artifact declaration, and canonical transcript provenance fields remain available, while raw runtime/provider/model/tool payloads are excluded.

What changed

• Added a bounded allowlist projection for uploaded agent-task-workflow-result.json files.
• Omitted runtime_result, outputs.engine_data, verification stream bodies, raw diagnostics, and undeclared top-level payloads from the review artifact.
• Kept artifact discovery against the original result, so declared artifact staging and runtime-source content rejection remain fail-closed.
• Added a regression with distinct PHP-shaped content, tool argument/result/error payloads, a private path, and a sentinel in both runtime_result and outputs.engine_data.

How to test

1. Clone this repository, run git fetch origin pull/1815/head:review-1815, and run git switch review-1815.
2. Run npm ci; expect dependency installation and the workspace TypeScript build to complete successfully.
3. Run TMPDIR=/tmp npm run test:runtime-sources-materialization; expect runtime sources materialization ok. This exercises the PHP-shaped nested-payload regression and existing disguised-source artifact rejection.
4. Run TMPDIR=/tmp npm run test:agent-task-contracts; expect the agent-task contracts, canonical evidence, workflow interface, runtime materialization, and reusable workflow suites to pass.
5. Run npm run build; expect TypeScript compilation and CLI executable validation to complete without errors.

Backwards compatibility

The internal .codebox/agent-task-workflow-result.json produced during execution is unchanged, as are reusable-workflow outputs. Only the uploaded reviewer copy becomes intentionally narrower. Existing public control/publication fields and canonical transcript provenance remain; consumers that incorrectly depended on raw runtime/provider/model/tool data inside the uploaded artifact must use the canonical sanitized transcript or declared public projections instead.

Evidence

• Hosted failing run: https://github.com/Automattic/agents-api/actions/runs/29468956857
• Source relationship: closes Native agent upload rejects successful results containing target-code snippets #1814 and directly reproduces the issue payload location in runtime_result plus the equivalent outputs.engine_data exposure.
• Change kind: bounded upload-artifact projection and regression coverage; no runtime producer or public workflow-output contract change.
• Verification capability: local focused regression, full agent-task contract suite, and build all passed. Pull request CI provides hosted repository validation.
• Scope: the runtime change is limited to prepare-agent-task-upload.mjs; source-content rejection remains active for declared artifacts and every other staged file, so the behavior is no broader than the hosted evidence.

AI assistance

• AI assistance: Yes
• Tool: OpenCode
• Model: OpenAI gpt-5.6-sol
• Used for: Inspected uploader and consumer contracts, implemented the bounded projection, added the hosted-shape regression, ran verification, and prepared this pull request.

Source relationships

• Closes Native agent upload rejects successful results containing target-code snippets #1814