fix(runs): strip private recovery-checkpoint bodies at export (#636)

[solomonneas]

Summary

• Enforce run-checkpoint: classify or strip checkpoint bodies at export boundaries #636 at export boundaries: recovery-checkpoint bodies under events/recovery-checkpoints/ are privacy_class: private and must be stripped to the closed artifact-reference shape (path, sha256, media_type, byte_size, privacy_class), replaced, or refused with a bounded error naming the privacy class.
• Wire stripping into _archive_verify_run after the byte-identical copy check (source run dirs unchanged). Document the rule next to FORBIDDEN_PAYLOAD_KEYS in run_events.py.
• Local recovery / doctor / redaction validation continue to read private bodies in place.

Closes #636.

Audited surfaces (grep: recovery-checkpoints / validate_checkpoint / recover_from_checkpoint)

Surface	Disposition
run_checkpoint.validate_checkpoint / recover_from_checkpoint	Local keep — private bodies required for recovery
runs_cmd._recover_from_checkpoint / runs_cmd.recover	Local keep — operator recovery path
doctor._check_recovery_checkpoints / validate_checkpoint	Local keep — read-only health check
run_redaction._validate_checkpoint_artifacts	Local keep — integrity before quarantine
aboyeur / run_lifecycle → write_checkpoint	Local writer — not an export boundary
work_cmd.verification._archive_verify_run (shutil.copytree)	Strip on export — replace bodies with artifact references before archive lands
receipts_cmd MiseLedger export (*/receipt.json, */run.json)	Does not read checkpoint files today (exports receipt/run.json only)
Provenance envelope / ingest (#583/#584)	Does not read events/recovery-checkpoints/ today
tools_cmd checkpoint store	Different artifact — tools approval checkpoints, not recovery-checkpoints

Acceptance → tests

Acceptance	Test
Export path cannot emit checkpoint body content	test_strip_checkpoint_bodies_for_export_replaces_private_body, test_assert_export_tree_refuses_checkpoint_body, test_refuse_checkpoint_body_export_names_privacy_class, test_archive_verify_run_strips_recovery_checkpoint_bodies
Local recovery still round-trips	test_local_recovery_round_trips_after_export_strip_of_copy (plus existing test_recover_from_checkpoint_*)

Verification

brigade work verify run --target . --command "./scripts/verify" --capture brigade-work

Receipt: 20260801-035934-work-verify-52e52d (status: completed, exit=0).

Test plan

• Focused export/recovery tests green
• Full ./scripts/verify via Brigade
• External grader review before merge

Made with Cursor

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8e617ea6-7ada-41c9-97e3-026892f648f8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}