Redact and cap subprocess diagnostics

docs/integrations/notarius.md

@@ -33,8 +33,8 @@ Standard output is reserved for the JSON receipt. Standard error is captured
 separately as diagnostic output. Narratio applies the configured timeout and
 does not interpret stdout as a receipt unless the subprocess exits successfully.
 It does not pass a Narratio session ID or run `notarius config validate`
-automatically; the configured working directory and inherited environment
-apply to the subprocess.
+automatically; the configured working directory and Narratio's minimal child
+environment apply to the subprocess.
 
 ## Accepted Result
 

docs/internal/adapters.md

@@ -59,9 +59,12 @@ configured filesystem secrets before adapter initialization.
 - Shared subprocess execution starts an owned process group on Linux/macOS or a
   kill-on-close job object on Windows. Cancellation and deadlines request
   termination, use a bounded forceful fallback, and wait for the leader before
-  returning. Unlogged stdout/stderr use direct null-device descriptors so a
-  descendant cannot retain an adapter pipe after its leader exits. Unsupported
-  platforms reject owned command execution.
+  returning. Child environments contain only the execution baseline and
+  adapter-specified values; configured credentials are explicit sensitive
+  values. Stdout and stderr are redacted while streaming into separate 8 MiB
+  diagnostic captures; a bounded wait closes a stream retained by a departed
+  leader's descendant. Reaching either limit terminates the owned tree.
+  Unsupported platforms reject owned command execution.
 
 ## Implementation And Tests
 

docs/operations.md

@@ -149,6 +149,11 @@ reaped, and descendants that keep standard output or error open cannot keep
 the invocation blocked. Other operating systems fail closed rather than launch
 a command without tree ownership.
 
+Subprocess stdout and stderr diagnostics are separately redacted and capped at
+8 MiB per invocation. Narratio does not retain configured credential values in
+these logs or their error tails; reaching a capture limit terminates the command
+tree and reports which stream exceeded the limit.
+
 Run-local diagnostics are:
 
 - `runs/{run_id}/extract/notarius.receipt.json`

docs/roadmap/implementation.md

@@ -24,7 +24,7 @@ All stages are pending when this plan is created.
 | 6 | Harden API-key file acquisition | RSK-010 | Completed |
 | 7 | Bound and verify external result acquisition | RSK-013, TST-007 | Completed |
 | 8 | Terminate owned subprocess trees | RSK-011 | Completed |
-| 9 | Redact and cap subprocess diagnostics | RSK-012 | Pending |
+| 9 | Redact and cap subprocess diagnostics | RSK-012 | Completed |
 | 10 | Confine publish archive reads | COR-005 | Pending |
 | 11 | Make manifest and run identity singular | COR-001, TST-006 | Pending |
 | 12 | Centralize handled terminal-failure persistence | RSK-001, TST-002, SIM-001, COM-001 | Pending |