V48 Gate 3 (implementation-only): withhold PCC's selectedContext read-in — it re-carries verbatim inventory source

Found live on run 59504a3e (the first run with working key selection): the
context:selectedContext store re-carries the resolved VALUES of the
selected keys, and when the selection includes deposit#inventory that is
the verbatim source inventory — streamed unwithheld into execution_events
while deposit:inventory itself was withheld. The context namespace's
value-bearing keys (selectedContext, legacy full) join the withholding
allowlist; the key-NAME stores (keys/selectedKeys/missingKeys) stay
visible. Regression-pinned with the exact live leak shape. Streaming
suite 40 green; tsc clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: geraldarthurdavis

packages/pipelines-generics/src/streaming/__tests__/pipeline-stream-integration.test.ts

@@ -286,6 +286,32 @@ describe('sourceSafeStreamEvent — non-llm content-bearing stores (deposit inve
     expect(JSON.stringify(safe)).not.toContain('INVENTORY-SOURCE-MARKER');
   });
 
+  it('withholds context:selectedContext (PCC read-in re-carries resolved values incl. the inventory — live leak, run 59504a3e)', () => {
+    const safe = sourceSafeStreamEvent({
+      type: 'status',
+      namespace: 'context',
+      key: 'selectedContext',
+      data: {
+        'deposit#inventory': {
+          sources: [{ path: 'src/secret.ts', content: SOURCE_LINE }],
+        },
+        'deposit#obfuscations': 'guidance text',
+      },
+    });
+    expect(safe.data.contentWithheld).toBe(true);
+    expect(JSON.stringify(safe)).not.toContain('INVENTORY-SOURCE-MARKER');
+  });
+
+  it('passes through the key-NAME context stores (keys/selectedKeys/missingKeys are source-safe)', () => {
+    const selectedKeys = {
+      type: 'status',
+      namespace: 'context',
+      key: 'selectedKeys',
+      data: ['deposit#obfuscations', 'deposit#inventory'],
+    };
+    expect(sourceSafeStreamEvent(selectedKeys)).toBe(selectedKeys);
+  });
+
   it('passes through OTHER pipeline/deposit metadata keys unchanged (allowlist is key-scoped)', () => {
     const pattern = { type: 'status', namespace: 'pipeline', key: 'pattern', data: 'SDIVF' };
     expect(sourceSafeStreamEvent(pattern)).toBe(pattern);

packages/pipelines-generics/src/streaming/pipeline-stream-integration.ts

@@ -70,6 +70,11 @@ const SOURCE_CONTENT_BEARING_KEYS_BY_NAMESPACE: Record<string, Set<string>> = {
   deposit: new Set(['inventory']),
   tool: new Set(['input', 'result']),
   tools: new Set(['invocation', 'result']),
+  // PCC's read-in re-carries the resolved VALUES of the selected keys — when
+  // the selection includes the inventory, selectedContext holds verbatim
+  // source (observed live, run 59504a3e). context:keys/selectedKeys/
+  // missingKeys stay visible: key NAMES are source-safe.
+  context: new Set(['selectedContext', 'full']),
 };
 
 export function sourceSafeStreamEvent(event: any): any {