Publish redacted ConfigKit effective configuration

internal/core/config/loaded_config_test.go

@@ -127,6 +127,52 @@ pipelines:
 	}
 }
 
+func TestLoadedConfigRedactsSensitiveNestedOptions(t *testing.T) {
+	t.Parallel()
+
+	loaded, err := loadConfigSource(configkit.Bytes("document.yml", []byte(`version: 5
+pipelines:
+  session:
+    input:
+      module: input
+      options:
+        nested:
+          api_key: input-secret
+    artifacts:
+      score:
+        extract:
+          module: extract
+          validators:
+            - module: configured-a
+              options:
+                credentials:
+                  token: validator-secret
+`)), LoadOptions{})
+	if err != nil {
+		t.Fatalf("loadConfigSource() error = %v", err)
+	}
+	var effective bytes.Buffer
+	if err := loaded.WriteEffective(&effective); err != nil {
+		t.Fatalf("WriteEffective() error = %v", err)
+	}
+	for _, secret := range []string{"input-secret", "validator-secret"} {
+		if strings.Contains(effective.String(), secret) {
+			t.Fatalf("effective configuration exposes %q: %q", secret, effective.String())
+		}
+	}
+	if !strings.Contains(effective.String(), "[REDACTED]") {
+		t.Fatalf("effective configuration did not mark sensitive values: %q", effective.String())
+	}
+
+	var explanation bytes.Buffer
+	if err := loaded.WriteExplanation(&explanation, "/pipelines/session/artifacts/score/extract/validators/0/options/credentials/token"); err != nil {
+		t.Fatalf("WriteExplanation() error = %v", err)
+	}
+	if strings.Contains(explanation.String(), "validator-secret") || !strings.Contains(explanation.String(), "[REDACTED]") {
+		t.Fatalf("explanation exposes sensitive value: %q", explanation.String())
+	}
+}
+
 func pipelineProfileWithChangedOption(profile pipeline.PipelineProfile) pipeline.PipelineProfile {
 	profile = clonePipelineProfile(profile)
 	nested := profile.Artifacts["score"].Extract.Options["nested"].(map[string]any)