Add implementation plan for CLI and configuration test coverage

internal/core/config/redaction_test.go

@@ -117,6 +117,40 @@ func TestRedactedEffectiveConfigPayloadDoesNotAliasSource(t *testing.T) {
 	assertRedactionTestBindingUnchanged(t, effective.ResolvedPipeline.Input, "effective")
 }
 
+func TestRedactedResolvedPipelinePayloadHandlesTypedOptionContainers(t *testing.T) {
+	type optionMap map[string]string
+	type optionList []optionMap
+
+	typed := optionList{{
+		"api_key": "typed-container-secret",
+		"safe":    "typed-container-safe",
+	}}
+	effective := EffectiveConfig{ResolvedPipeline: pipeline.ResolvedPipeline{
+		Input: pipeline.ModuleBinding{Options: map[string]any{"nested": typed}},
+	}}
+
+	payload := effective.RedactedResolvedPipelinePayload()
+	nested, ok := payload.Input.Options["nested"].([]any)
+	if !ok || len(nested) != 1 {
+		t.Fatalf("redacted typed list = %#v", payload.Input.Options["nested"])
+	}
+	item, ok := nested[0].(map[string]any)
+	if !ok {
+		t.Fatalf("redacted typed map = %#v", nested[0])
+	}
+	if got := item["api_key"]; got != "[REDACTED]" {
+		t.Fatalf("redacted api_key = %v", got)
+	}
+	if got := item["safe"]; got != "typed-container-safe" {
+		t.Fatalf("safe option = %v", got)
+	}
+
+	item["safe"] = "mutated"
+	if got := typed[0]["safe"]; got != "typed-container-safe" {
+		t.Fatalf("source typed map mutated through redacted payload: %q", got)
+	}
+}
+
 func redactionTestBinding(name string) pipeline.ModuleBinding {
 	return pipeline.ModuleBinding{
 		Module: "safe-" + name,