V48 Gate 3 (specification-implementation): withhold raw llm/response in synthesis telemetry; fix log x-overflow (F18)

During /deposit "Synthesize options", the Synthesis run telemetry leaked the raw model response line-by-line (```json / { / "analysis": ... / "steps": [ each a row) and the long unwrapped lines x-overflowed the whole page.

Root cause (source-safety): the formal Thricified substeps store LLM content under llm/input|prompt|output|parsedOutput, but AgentLLMsRegistry/PipelineLLMRegistry (direct getLLM calls, used by the setup-plan agent) store the raw prompt under llm/messages and the raw response under llm/response (output.content). sourceSafeStreamEvent withheld only the substep key names, so llm/response passed through as a status-event message into execution_events unredacted — and the renderer (splits output on \n) fragmented that multi-line payload into one row per line.

Fix, three layers:
- pipeline-stream-integration.ts: sourceSafeStreamEvent now withholds by metadata ALLOWLIST — every llm store is content-withheld except a fixed source-safe set (startTime/endTime/duration/usage/status/provider/model/configKey/stopReason/error). Robust to content-key drift across the two LLM-call paths; llm/response + llm/messages now withheld (message -> [content withheld - source-safe], data -> structural summary). Regression test added (5/5 pass).
- terminal-run-activity.ts: every event line collapsed to a single bounded line (toSafeSingleLine, 280 chars) so one streamed event = exactly one accordion row and the outputDetails key lookup stays intact (defense-in-depth).
- pipeline-execution-log.tsx + DepositPageClient.tsx: min-w-0 on the compact/desktop title spans and the telemetry panel section/wrapper (+ overflow-hidden on the panel) so a long line truncates within its row instead of x-overflowing the page.

Spec (BITCODE_SPEC_V48_NOTES.md) records the allowlist gate + single-line/no-overflow telemetry invariant; QA ledger records F18 (incl. the read-lens setup-plan-agent-in-deposit observation queued separately). pipelines-generics tsc + uapi tsc 0; pipeline-stream-integration, terminalTransactionActivity, depositPageClient, conversation/reading pipeline-log tests green; spec checker green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: geraldarthurdavis

BITCODE_SPEC_V48_NOTES.md

@@ -182,10 +182,25 @@ Accepted V48 architecture law (decided 2026-06-25):
   `POST /api/deposit/synthesize-options` against the streaming execution, so the
   SDIVF telemetry renders end to end; the bounded-structured-inference path
   remains a resilience fallback when the pipeline yields no admissible options.
-- Source-safety is enforced universally: a content-withholding streaming filter
-  withholds every pipeline's `llm` content events (prompt/input/output/reasoning/
-  judgment/parsed), plus a synthesis-local defense-in-depth candidate assertion;
-  `rawPromptVisible` / `rawProviderResponseVisible` stay false by law.
+- Source-safety is enforced universally by `sourceSafeStreamEvent`, the single
+  content-withholding gate every persisted/streamed pipeline event passes through.
+  It withholds by **metadata allowlist**, not a content-key denylist: every `llm`
+  store is content-withheld (message → `[content withheld — source-safe]`, data →
+  a structural summary of {stage, generation, provider, model, contentChars,
+  phase, agent, step}) EXCEPT a fixed source-safe metadata set
+  (`startTime/endTime/duration/usage/status/provider/model/configKey/stopReason/
+  error`). The allowlist is required because the two LLM-call paths name their
+  content keys differently — the Thricified substeps use `input/prompt/output/
+  parsedOutput`, while `AgentLLMsRegistry`/`PipelineLLMRegistry` (direct `getLLM`)
+  use `messages/config/response` — and a denylist silently leaked `llm/response`
+  (the raw provider response) as a status-event message (QA F18). A
+  synthesis-local defense-in-depth candidate assertion remains; `rawPromptVisible`
+  / `rawProviderResponseVisible` stay false by law.
+- Telemetry rendering is single-line and bounded: the activity builder collapses
+  every event to exactly one bounded line (one streamed event = one accordion
+  row, never fragmented by embedded newlines) and the log row title spans carry
+  `min-w-0` so a long line truncates within its row rather than x-overflowing the
+  page (QA F18).
 - **OTF (on-the-fly instructions) is eradicated entirely** as legacy residue:
   the dead telemetry types (`otf_instructions`/`otf_adherence`), the unused
   `setOnTheFly` prompt primitive, the live instruction-injection feature (the

BITCODE_V48_QA.md

@@ -178,6 +178,18 @@ Track 3-4 scripts (BTD ledger, settlement, pack journaling) get added when those
 - Cause: the option `<article>` (a grid item in the `xl:grid-cols-3` options grid) lacked `min-w-0`, and the `font-mono` covered-source-paths list lacked `break-all`, so a card with long unbreakable mono content refused to shrink below its content's min-content width and overflowed the `minmax(0,1.45fr)` left column.
 - Repair (2026-06-26, `DepositPageClient.tsx`): `min-w-0` on the option card + `break-all` on the covered-paths list (the Option-roots `<dd>` already wrapped). The card now shrinks to its grid column and long paths/roots wrap rather than forcing overflow.
 
+### F18 — Synthesis run telemetry leaks the raw model response and x-overflows the page (one accordion row per content line)
+
+- Severity: high (source-safety law) + low (layout). Telemetry must never expose raw prompts/responses (`rawProviderResponseVisible=false`).
+- Observed (2026-06-26): during `/deposit` "Synthesize options", the Synthesis run telemetry accordion rendered the raw model output line-by-line — ` ```json `, `{`, `"analysis": "…"`, `"steps": [`, `"1. ANCHOR IDENTITY: …"` each became their own row — and the long unwrapped `"analysis"`/step lines x-overflowed the entire page (page shifted right, panel toggle clipped). The raw content was the setup-plan agent's plan prose (a provider response).
+- Cause (root, source-safety): the formal Thricified substeps store LLM content under `llm/input|prompt|output|parsedOutput`, but `AgentLLMsRegistry`/`PipelineLLMRegistry` (direct `getLLM` calls, used by the setup-plan agent) store the raw prompt under `llm/messages` and the raw response under **`llm/response`** (`output.content`). The universal streaming filter `sourceSafeStreamEvent` withheld only the substep key names, so `llm/response` (a raw string) passed through as a `status`-event `message` and reached `execution_events` unredacted.
+- Cause (display): `buildTerminalRunActivityFromEvents` joins event messages with `\n` and `PipelineExecutionLog` splits `output` on `\n` (one row per line), so the multi-line leak fragmented into many rows; the compact/desktop title spans lacked `min-w-0`, so a long line's min-content width escaped the `overflow-auto` log container and widened the page.
+- Repair (2026-06-26):
+  - `pipeline-stream-integration.ts` — `sourceSafeStreamEvent` now withholds by **metadata allowlist**: every `llm` store is content-withheld except a fixed source-safe set (`startTime/endTime/duration/usage/status/provider/model/configKey/stopReason/error`). Robust to content-key drift between the two LLM-call paths; `llm/response` + `llm/messages` are now withheld (message → `[content withheld — source-safe]`, `data` → structural summary). Regression test added.
+  - `terminal-run-activity.ts` — every event line is collapsed to a single bounded line (`toSafeSingleLine`, 280 chars) so one event = exactly one row and the `outputDetails` key lookup stays intact (defense-in-depth).
+  - `pipeline-execution-log.tsx` + `DepositPageClient.tsx` — `min-w-0` on the compact/desktop title spans and on the telemetry panel section/wrapper (+ `overflow-hidden` on the panel) so a long line truncates within its row instead of x-overflowing the page.
+- Related observation (not yet filed): the deposit run executes `ReadFitsFindingSynthesisSetupPlanAgent` planning a "Read-Need" — a read-lens setup agent running under the deposit lens. Telemetry is now source-safe regardless, but the deposit setup-plan agent identity should be confirmed/queued as a separate correctness finding.
+
 ## Track 1 — Identity / Authentication / Auxillaries — COMPLETE 2026-06-12 (email deferred by decision; F2/F9 and legacy eradication queued for gates)
 
 - [x] Sign up / sign in via Connect Wallet (nav CTA → SignUpWindow → wallet signature on testnet4 → `custom:bitcode-bitcoin` session → `/tps/supabase/callback`) — verified 2026-06-12 after F5 fix; lands on `/packs`. Re-verified from fully nuked state (purged user + cleared site data): created 19:29:21 → session 19:29:25 → binding auto-written 19:29:29 by the bridge on `/packs` mount with no Auxillaries visit; UI consistent across nav, Wallet, and Profile panes.

packages/pipelines-generics/src/streaming/__tests__/pipeline-stream-integration.test.ts

@@ -1,6 +1,6 @@
 // @ts-nocheck
 import { Execution } from '@bitcode/execution-generics';
-import { enablePipelineStreaming } from '../../streaming/pipeline-stream-integration';
+import { enablePipelineStreaming, sourceSafeStreamEvent } from '../../streaming/pipeline-stream-integration';
 
 // Mock ORM model so we can assert persistence without a real DB
 const createdEvents: any[] = [];
@@ -40,3 +40,50 @@ describe('pipeline-stream-integration', () => {
     expect(createdEvents[0].event_type).toBeDefined();
   });
 });
+
+describe('sourceSafeStreamEvent (telemetry source-safety law, V48)', () => {
+  const RAW_RESPONSE = '```json\n{\n  "analysis": "secret plan prose",\n  "steps": ["step one"]\n}\n```';
+
+  it('withholds the raw model response stored under llm/response', () => {
+    const safe = sourceSafeStreamEvent({
+      type: 'status',
+      namespace: 'llm',
+      key: 'response',
+      message: RAW_RESPONSE,
+      data: RAW_RESPONSE,
+      executionState: { phase: 'setup', agent: 'SetupPlanAgent', step: 'plan' },
+    });
+    expect(safe.message).toBe('[content withheld — source-safe]');
+    expect(safe.data.contentWithheld).toBe(true);
+    expect(safe.data.sourceSafetyClass).toBe('source_safe');
+    expect(safe.data.contentChars).toBe(RAW_RESPONSE.length);
+    // The raw prose must not survive anywhere on the event.
+    expect(JSON.stringify(safe)).not.toContain('secret plan prose');
+  });
+
+  it('withholds the raw prompt stored under llm/messages', () => {
+    const safe = sourceSafeStreamEvent({
+      type: 'status',
+      namespace: 'llm',
+      key: 'messages',
+      data: [{ role: 'user', content: 'secret prompt body' }],
+    });
+    expect(safe.message).toBe('[content withheld — source-safe]');
+    expect(JSON.stringify(safe)).not.toContain('secret prompt body');
+  });
+
+  it('passes through source-safe llm metadata (usage) unchanged', () => {
+    const event = {
+      type: 'status',
+      namespace: 'llm',
+      key: 'usage',
+      data: { promptTokens: 10, completionTokens: 20 },
+    };
+    expect(sourceSafeStreamEvent(event)).toBe(event);
+  });
+
+  it('passes through non-llm events unchanged', () => {
+    const event = { type: 'phase-start', namespace: 'phase', key: 'start', message: 'Setup phase started' };
+    expect(sourceSafeStreamEvent(event)).toBe(event);
+  });
+});

packages/pipelines-generics/src/streaming/pipeline-stream-integration.ts

@@ -27,25 +27,38 @@ export interface PipelineStreamConfig {
 }
 
 // Source-safety law (V48): pipeline telemetry must never serialize raw prompts
-// or provider responses (rawPromptVisible/rawProviderResponseVisible=false). The
-// formal LLM substeps store full prompt/response content under the `llm`
-// namespace, which auto-streams via Execution.store. This withholds that content
-// from any persisted/streamed event, leaving only a content-withheld summary —
-// applied universally to every pipeline stream event (not per-pipeline).
-const SOURCE_SAFE_LLM_CONTENT_KEYS = new Set([
-  'prompt',
-  'input',
-  'output',
-  'reasoningOutput',
-  'judgmentOutput',
-  'parsedOutput',
+// or provider responses (rawPromptVisible/rawProviderResponseVisible=false). Raw
+// prompt/response content auto-streams via Execution.store under the `llm`
+// namespace, but the content-bearing key NAMES drift between the two LLM-call
+// paths: the formal Thricified substeps store `input`/`prompt`/`output`/
+// `parsedOutput`, while AgentLLMsRegistry/PipelineLLMRegistry (direct getLLM
+// calls) store `messages`/`config`/`response`. A content-key denylist silently
+// missed `response`, so a raw model response leaked through as a status-event
+// message (and the renderer split that multi-line payload into one row per
+// line). We therefore withhold by ALLOWLIST: every `llm` store is content-
+// withheld EXCEPT a fixed set of source-safe metadata keys. This is robust to
+// new content keys and is applied universally to every pipeline stream event
+// (not per-pipeline).
+const SOURCE_SAFE_LLM_METADATA_KEYS = new Set([
+  'startTime',
+  'endTime',
+  'duration',
+  'usage',
+  'status',
+  'provider',
+  'model',
+  'configKey',
+  'stopReason',
+  'error',
 ]);
 
 export function sourceSafeStreamEvent(event: any): any {
   if (!event || typeof event !== 'object') return event;
   const namespace = (event as any).namespace;
   const key = (event as any).key;
-  if (namespace !== 'llm' || !SOURCE_SAFE_LLM_CONTENT_KEYS.has(String(key))) {
+  // Only llm-namespace stores carry raw prompt/response content. Anything that
+  // is an llm metadata store, or any non-llm event, passes through unchanged.
+  if (namespace !== 'llm' || SOURCE_SAFE_LLM_METADATA_KEYS.has(String(key))) {
     return event;
   }
   const data =

uapi/app/deposit/DepositPageClient.tsx

@@ -1300,7 +1300,7 @@ export default function DepositPageClient() {
             {synthesisRunId ? (
               <section
                 ref={synthesisTelemetryRef}
-                className="border border-white/10 bg-white/[0.035] px-4 py-4"
+                className="min-w-0 overflow-hidden border border-white/10 bg-white/[0.035] px-4 py-4"
                 aria-label="AssetPacksSynthesis run telemetry"
                 data-testid="deposit-synthesis-telemetry"
               >
@@ -1323,7 +1323,7 @@ export default function DepositPageClient() {
                     {synthesisRunId}
                   </span>
                 </div>
-                <div className="mt-4">
+                <div className="mt-4 min-w-0">
                   <PipelineExecutionLog
                     output={synthesisActivity.output}
                     outputDetails={synthesisActivity.outputDetails}

uapi/app/terminal/terminal-run-activity.ts

@@ -35,6 +35,25 @@ export type MockRunActivitySnapshot = {
   error?: string | null;
 };
 
+// One streamed event must render as exactly one accordion row. The renderer
+// (PipelineExecutionLog) splits `output` on '\n', so any embedded newline in an
+// event message would fragment a single event into many rows (and break the
+// outputDetails key lookup, since the key is the full multi-line string). We
+// therefore collapse every event line to a single bounded line. Raw model
+// content is already withheld upstream by sourceSafeStreamEvent; this is the
+// client-side guarantee that nothing can fragment or overflow the log even if a
+// future event slips a newline through.
+const MAX_ACTIVITY_LINE_CHARS = 280;
+function toSafeSingleLine(value: string): string {
+  const collapsed = String(value ?? '')
+    .replace(/\s*\r?\n\s*/g, ' ')
+    .replace(/\s{2,}/g, ' ')
+    .trim();
+  return collapsed.length > MAX_ACTIVITY_LINE_CHARS
+    ? `${collapsed.slice(0, MAX_ACTIVITY_LINE_CHARS - 1)}…`
+    : collapsed;
+}
+
 function normalizeEventMessage(payload: any) {
   if (!payload || typeof payload !== 'object') return null;
 
@@ -102,8 +121,10 @@ export function buildTerminalRunActivityFromEvents(
 
     const normalized = normalizeEventMessage(payload);
     if (!normalized) continue;
-    outputLines.push(normalized.text);
-    outputDetails[normalized.text] = payload;
+    const safeText = toSafeSingleLine(normalized.text);
+    if (!safeText) continue;
+    outputLines.push(safeText);
+    outputDetails[safeText] = payload;
   }
 
   const latestStatusEvent = statusEvents[statusEvents.length - 1];

uapi/components/base/bitcode/execution/pipeline-execution-log.tsx

@@ -869,7 +869,7 @@ function renderLogLine(
           />
           <span
             title={logLine.text}
-            className="truncate flex-1 text-[0.82rem] leading-none m-0"
+            className="truncate flex-1 min-w-0 text-[0.82rem] leading-none m-0"
           >
             {logLine.text}
           </span>
@@ -995,7 +995,7 @@ function renderLogLine(
           {/* Main text */}
           <span
             title={logLine.text}
-            className="select-text cursor-text truncate pr-3 text-xs tablet:text-sm laptop:text-[0.94rem] desktop:text-base font-medium leading-none h-5 flex items-center gap-1"
+            className="select-text cursor-text truncate min-w-0 flex-1 pr-3 text-xs tablet:text-sm laptop:text-[0.94rem] desktop:text-base font-medium leading-none h-5 flex items-center gap-1"
           >
             <Icon className="inline-block laptop:hidden w-4 h-4 text-current" />
             {logLine.text}