Generated coverage/build scratch enters workspace patches and can terminally fail the secret gate #1308

Problem

A coverage producer can capture generated build, coverage, and corpus scratch in workspace.patch, then fail terminally at the artifact secret gate even though its authored changes are valid and the configured credential is absent.

Observed on a retained workspace: approximately 16.6 MB of captured data included .cov-work/, .recon/, lcov.info, and generated compiler/build JSON. Credential-shaped text in generated JSON triggered ARTIFACT_SECRET_GATE_REJECTED. Moving the scratch outside the workspace and rebuilding a coherent source-only patch reduced the handoff to 1,364 bytes and allowed verification to proceed.

This is a capture-classification defect. The secret gate should continue to fail closed on every publication it actually receives.

Current behavior on unstable

Reviewed origin/unstable at 809b702f60417d04b03e27746b52327b947d892c, plus all open and closed issue records.

stageableWorkspacePaths in packages/runtime/src/workspace-handoff.ts excludes a fixed set of untracked roots (recon-corpus, echidna, magic, out, and dependency/runtime roots). Agent-selected and nested scratch destinations escape those exclusions. Measured diff-overflow recovery runs only after the 16 MiB patch limit is exceeded, so it cannot prevent below-limit generated content from reaching the secret gate or entering a downstream baseline.

Reproduction

1. Create a minimal Git fixture with an authored harness/test source change.
2. Produce untracked coverage scratch under .cov-work/ and .recon/, an LCOV report, and generated build JSON containing a synthetic credential-shaped value that is not the configured credential.
3. Capture a workspace patch whose total size remains below the patch limit.
4. Run the normal artifact secret check on that patch.

The generated bytes are captured and the patch is rejected, preventing this producer and dependent work from completing.

Expected behavior

• Classify and exclude generated build/coverage/corpus output before it enters a workspace patch, including the observed scratch destinations and nested output layouts.
• Preserve authored harness/test sources, configuration, and tracked edits; do not drop an entire mixed source/scratch tree based on size or a broad prefix.
• Keep capture/replay Git trees and patch manifests coherent.
• Keep security fail-closed: actual configured credentials or credential-shaped content in included authored files must still reject publication. Declared evidence artifacts must still pass their normal secret checks.
• Add below-limit regression fixtures for generated-artifact contamination and authored-source preservation.

Related issues and priority

• Closed Foundry out/ enters the workspace capture and overflow recovery ends in an unattributable "workspace patch exceeds" failure #670 added Foundry out/ exclusion and overflow diagnostics.
• Closed Generated-corpus exclusion is an exact-name list, so an agent-chosen variant like recon-corpus-deep blows the capture buffer again #368 added measured overflow recovery for unknown corpus names; this case can fail below that threshold.
• Closed Workspace patch captures vendored Solidity dependencies: lib/ is not excluded the way node_modules is #833 and Setup agents vendor already-present Solidity dependencies, putting megabytes of third-party source into workspace patches #839 address vendored dependencies entering patches, including the same secret-gate contamination consequence.
• Open Full-run report bundles ship raw agent transcripts and rejected artifacts without a secret scan #1289 concerns full-run report-bundle publication of logs and rejected artifacts, not workspace-patch capture.
• Open One rejected coverage artifact stops the whole stateful pipeline: series coverage loops, then implement-properties, campaign and dedupe all fail #1297 concerns coverage-evidence validation and dependency authority, not generated workspace contents.

P1: normal coverage/build work can terminally block a producer and its downstream run; the current workaround requires manually removing scratch and rebuilding an authenticated handoff. All details above are repository-neutral and reproducible with synthetic fixtures.