feat(run): add operator journal redaction

[solomonneas]

Summary

• add an operator-confirmed brigade runs redact procedure for terminal journal-authority runs
• lock the run, quarantine the original journal, rewrite the selected sequence range, and rebuild the hash chain
• verify the rewritten journal, checkpoints, projector output, and shadow evidence before cleanup is authorized
• keep quarantine cleanup explicit, idempotent, and limited to the verified transaction
• fail closed on unsupported filesystem capabilities, active or ambiguous locks, links, stale checkpoints, invalid ranges, and unknown reason codes

Issue #568 acceptance criteria

• the operator procedure refuses active runs and requires explicit confirmation: test_redaction_refuses_live_lock_without_mutation and test_redaction_requires_explicit_operator_confirmation
• redaction quarantines the original, rewrites and re-chains the requested range, and reprojects the run: test_redaction_quarantines_rewrites_rechains_and_reprojects
• write, replace, and projection crash windows retain a durable quarantine and support safe retry: test_redaction_replace_failure_retains_original_and_durable_quarantine, test_redaction_retry_completes_after_record_crash_window, and test_redaction_retry_repairs_projection_after_replace_crash_window
• cleanup is explicit and removes only a fully verified quarantine without retaining the original digest oracle: test_cleanup_is_explicit_and_gated_by_post_rewrite_verification, test_cleanup_removes_only_verified_quarantine, and test_cleanup_removes_original_digest_oracle_from_durable_metadata
• descriptor-relative operations fail closed on unsupported capabilities, symlink races, and hardlinked sensitive artifacts: test_redaction_refuses_unsupported_platform_before_lock_or_mutation, test_redaction_rejects_raced_operation_parent_without_external_write, and test_redaction_refuses_hardlinked_sensitive_artifact
• checkpoint coverage, terminal status, reason codes, overlapping ranges, and sequential lineage remain bounded and deterministic: test_redaction_refuses_uncovered_checkpoint_tail_before_quarantine, test_redaction_refuses_nonterminal_or_ambiguous_projection_status, test_redaction_accepts_only_closed_reason_codes, test_overlapping_redactions_are_deterministic_and_idempotent, and test_sequential_redaction_lineage_allows_each_quarantine_cleanup

Verification

• ./scripts/verify
• result: 5511 passed, 3 skipped, coverage 82.97%
• Brigade receipt: 20260731-005546-work-verify-b6b7d6
• independent closure review: clean

Refs #568

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7e738fb2-e52f-4b0f-a3c3-cafeb42e454a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}