Security re-review changes are ready in 1eefc9aa.

Addressed:

• shared URL/result sanitization for JSON artifact writes, returned/error artifacts, and stdout across probe, actions/scenario, editor, and multi-actor commands
• real-browser action, editor-open, and multi-actor artifact/stdout sentinel coverage
• tracked callback operations plus registration-aware close/final-drain lifecycle in every routed consumer
• cleanup containment so geolocation or browser close failures cannot skip final drain or artifact composition
• broad runtime-playground/browser/editor workflow path filters and both security suites in required CI

Validation:

• build passed
• routing security suite passed (12 tests)
• real routed command security suite passed
• browser accessibility/oracle suite passed (47 tests)
• browser scenario, artifact-session, diagnostics, redaction, and production-boundary suites passed
• pinned actionlint passed
• required npm run check executed both security suites successfully before the unrelated pre-existing command-registry-smoke fails on main: wordpress.collect-workload-result outputShape missing outputSchema id mention #1745 failure

An unrelated baseline test:editor-actions fixture crash is tracked separately in #2105.

Rebase follow-up complete. New head: 5ea1b621.

• rebased non-interactively onto current origin/main (ab8f91c9, Fix canonical routed preview origins #2098)
• preserved Fix canonical routed preview origins #2098 canonical-origin contextOptions() / localProxyOrigin routing
• preserved shared URL/result sanitization and tracked close/final-drain lifecycle
• build passed
• routing security suite passed (12 tests)
• real routed action/editor/multi-actor suite passed
• pinned workflow lint passed
• branch is clean and GitHub reports MERGEABLE; required contracts checks are currently in progress

No merge, release, or deployment performed.

Residual security/lifecycle review fixes are ready on head 8af43977.

Completed:

• embedded absolute/relative URL and sensitive query assignment redaction in ordinary persisted text, with real console capture proving normal text remains intact
• real failing-command stderr coverage for actions, scenario, editor, and multi-actor
• editor-canvas routed tracker plus bounded close/final drain and post-drain summary composition
• probe cancellation and final checkpoint/lifecycle failure paths now continue through bounded close/drain and reviewer-safe artifact composition
• browser close has a deterministic timeout and cannot block route drain
• unexpected abort failures in recoverable fetch, redirect escape, and redirect limit paths are operation-classified and tracked; expected closed/disposed aborts remain quiet
• preserved Fix canonical routed preview origins #2098 canonical routing, POST replay safety, and fix: harden adaptive policy block evidence #2101 adaptive policy evidence

Validation passed:

• build
• routing security suite (14 tests)
• real routed command security suite
• canonical preview origin and materialization contracts
• editor validation suite and real editor/editor-canvas integration
• browser accessibility/oracle suite (50 tests)
• browser scenario suite
• pinned workflow lint
• required check group executes both security suites successfully before the unrelated tracked command-registry-smoke fails on main: wordpress.collect-workload-result outputShape missing outputSchema id mention #1745 assertion

Branch is clean and GitHub reports MERGEABLE; required checks are running. No merge, release, or deployment performed.

Final rebase onto 3f9ca387 is complete at head 39dda74d.

The overlap was resolved additively:

• preserved fix: preserve browser environments across action journeys #2099 shared browser environment/session continuity, observed evidence, adaptive identity, and recipe behavior
• shared sessions now carry fix: harden routed preview recovery boundaries #2103's route tracker across probe and actions
• probe/actions drain routed work between phases without closing the shared runtime
• scenario teardown performs the authoritative bounded runtime/browser close and final registration-aware drain
• retained sanitizer, cancellation, canonical-origin, POST replay, and error-classification boundaries

Validation passed:

• build
• browser preview routing security (14 tests)
• real routed-command security
• canonical preview origin and callback materialization contracts
• browser environment matrix (13 tests)
• browser actions environment/session continuity (8 tests)
• browser scenarios
• adaptive/accessibility observed-evidence suite (50 tests)
• pinned workflow lint
• diff checks

Branch is clean, pushed with lease, and GitHub reports MERGEABLE. Required checks are running. No merge, release, or deployment performed.

HIGH blocker fixed at head 63d3adbd.

runBrowserScenarioCommand now:

• computes the full preview topology before creating the shared probe/actions environment context
• includes server.previewProxyDiagnostics?.targetOrigin in topology evidence
• merges topology.contextOptions() with imported storage state
• retains the shared route tracker, phase drains, bounded final close, and registration-aware final drain

Added a real probe-plus-actions intersection regression using an unresolvable .invalid canonical host, disposable local proxy, and local upstream. It proves:

• canonical browser-origin navigation succeeds only through the disposable proxy
• the local upstream receives the canonical-host request
• probe-created session state remains available to actions
• probe and actions retain the canonical URL
• artifacts expose canonical browser, local proxy, and upstream runtime origins

Passed:

• build
• canonical-origin and callback materialization contracts
• browser environment continuity, including the new regression (9 tests)
• browser environment matrix (13 tests)
• routing security (14 tests)
• real routed-command security
• browser scenarios
• pinned workflow lint and diff checks

Branch is clean, current with origin/main, and GitHub reports MERGEABLE. Required checks are running. No merge, release, or deployment performed.