feat(orchestration,loop,flow): 接线子代理编排 — 派发入口 + 分支归父会话 + 节点日志（含脱敏）

修的是「文档说 ✅、生产不可达」：此前 Scheduler.Spawn 只有测试调用方、无 bus 入口、无派发工具；Span.Record 无生产调用方 → 泳道画不出、节点日志恒空。
- 入口：subagent_spawn 工具（internal/runtime/orchestration/spawntool.go，同包便于用真 Scheduler/loop/Tracer/Flow 做集成测试；注册在 cmd/cyrene/subagent_tool.go 照 terminal_tool 范式）。默认 owner-only，不设 AllowInGroup/AllowInStranger；安全仍由 restrictSchemas + applyToolSecurityGate 双层保证，未绕代审
- 父会话归属：AgentSpec.ParentSession（请求语义）→ Scheduler 转运行期 ctx 标记 loop.WithFlowBranch → 分支 span 以父 session 发布；**allow 谓词一行未改**；单图语义靠「分支 Run 不调 StartRound/EndRound」+ FlowPublisher 不新建图；未归属 spawn 一张图都不发（有测试锁）
- 前台最多等 2s（对齐 task.autoBackgroundThreshold）→ 合并结果作工具结果；转后台则广播 bus subagent.result（design/05 §9 回填 hook）；新增 Scheduler.Wait(ids) 按批等待（Join 会串并发批次，故不重用）
- 子代理跑在 WithoutCancel(ctx)：保留 span 归属、不被工具超时/回合结束顺手杀掉；生命周期由 PerAgentTimeout + CancelAll 约束；内部 WithMutedBroadcast 静音（不进前台 stream）
- 节点日志：loop/spanlog.go 新增 llm.done / tool.done / subagent.done；工具参数**只记键名不记值**；仅步骤真正结束才追加（跳过/被拒路径不发，不伪造）
- 脱敏（红线）：新增 trace/redact.go（形状规则 sk-/Bearer/JWT/key:value + 键名规则 api_key/token/authorization/password…，递归嵌套、不改调用方事件），graph.go 发布前必经；**顺带修掉一个既有泄漏**：result_summary prop 原先未脱敏（工具结果里的密钥会进图），由图级变异测试抓出
- 测试：新增 22 个（工具级 / 图级 / 日志级），含 4 次变异验证（去掉 WithFlowBranch、去掉 record*、还原未脱敏、去掉静音 各自 FAIL）；-race 过 orchestration+trace+loop
- 已知限制：真实模型端到端未验（无凭据/不起服务）；工具白名单是 design gap 未做；subagent.result 暂无消费者（design/15 未实现）；后台子代理跨轮次边界迟到 span 会丢泳道根；PerAgentTimeout=10min 待确认

internal/runtime/trace/graph.go

@@ -256,11 +256,12 @@ func (g *RunGraph) addEdge(from, to string) {
 }
 
 // SeedInput creates the "input" node for the round. It returns the node id so a
-// caller can reference it.
+// caller can reference it. The label is redacted (design/19 §3), so a message that
+// happens to carry a credential cannot publish one.
 func (g *RunGraph) SeedInput(text string) string {
 	g.Upsert(NodeSpec{
 		ID:        "input",
-		Label:     truncate(text, maxSummaryRunes),
+		Label:     RedactText(text),
 		Kind:      "input",
 		Status:    FlowStatusDone,
 		StartedAt: g.started,
@@ -269,12 +270,12 @@ func (g *RunGraph) SeedInput(text string) string {
 }
 
 // SeedOutput creates the "output" node for the round, wired to the last node so
-// the trunk ends at the answer.
+// the trunk ends at the answer. The label is redacted like SeedInput's.
 func (g *RunGraph) SeedOutput(text string) string {
 	g.ended = time.Now()
 	g.Upsert(NodeSpec{
 		ID:        "output",
-		Label:     truncate(text, maxSummaryRunes),
+		Label:     RedactText(text),
 		Kind:      "output",
 		Status:    FlowStatusDone,
 		StartedAt: g.ended,
@@ -300,7 +301,7 @@ func (g *RunGraph) AddSpan(rec SpanRecord) {
 		StartedAt: rec.StartedAt,
 		EndedAt:   rec.EndedAt,
 		Props:     safeSpanProps(rec),
-		Log:       rec.Events,
+		Log:       redactEvents(rec.Events),
 		ParentID:  rec.ParentID,
 	})
 }
@@ -392,8 +393,9 @@ func labelForStart(name string, kind SpanKind) string {
 }
 
 // safeSpanProps carries only a whitelist of span props to the frontend, plus a
-// desensitized tool result summary. It never forwards raw arguments or secrets,
-// and truncates string text so long content cannot leak a full sensitive payload.
+// desensitized tool result summary. It never forwards raw arguments or secrets, and
+// every string is scrubbed of credential shapes and truncated, so long or sensitive
+// content cannot leak a full payload (design/19 §3).
 func safeSpanProps(rec SpanRecord) map[string]any {
 	var props map[string]any
 	for _, k := range safePropKeys {
@@ -411,21 +413,12 @@ func safeSpanProps(rec SpanRecord) map[string]any {
 			if props == nil {
 				props = make(map[string]any)
 			}
-			props["result_summary"] = truncate(summarize(v), maxSummaryRunes)
+			props["result_summary"] = RedactText(summarize(v))
 		}
 	}
 	return props
 }
 
-// redactValue shortens string props so a long error/step value cannot leak
-// sensitive content through the dashboard; non-string values pass through.
-func redactValue(v any) any {
-	if s, ok := v.(string); ok {
-		return truncate(s, maxSummaryRunes)
-	}
-	return v
-}
-
 // safePropKeys are the span prop keys forwarded to a node's props.
 var safePropKeys = []string{"stop_reason", "step", "error", "error_kind", "tool"}
 

internal/runtime/trace/redact.go

@@ -0,0 +1,141 @@
+package trace
+
+import (
+	"regexp"
+	"strings"
+)
+
+// Redaction for everything the flow graph publishes (design/19 §3 红线: 不泄露敏感 ——
+// 工具参数/内容脱敏；design/11 密钥不落日志). The graph is relayed to the admin panel
+// and every connected client, so every string that reaches it — span props and
+// span log events alike — is scrubbed and truncated here. Deciding to redact at
+// publish time (rather than only at record time) means a runtime that records a
+// raw tool result still cannot leak it.
+
+// redactedMarker replaces anything that looks like a credential.
+const redactedMarker = "[redacted]"
+
+// secretPatterns match credential shapes that must never reach the dashboard: an
+// API-key style assignment (plain or JSON), a standalone provider key, a bearer
+// token, and a JWT. They are deliberately shallow (shape, not semantics): a false
+// positive only over-redacts a dashboard string, while a false negative publishes a
+// live credential.
+var secretPatterns = []*regexp.Regexp{
+	regexp.MustCompile(`(?i)\b[a-z0-9_]*(?:api[_-]?key|access[_-]?token|token|secret|password|passwd|pwd)[a-z0-9_]*"?\s*[:=]\s*"?[^\s"',;}\]]{6,}`),
+	regexp.MustCompile(`\bsk-[A-Za-z0-9_\-]{8,}`),
+	regexp.MustCompile(`(?i)\bbearer\s+[A-Za-z0-9_\-\.=]{10,}`),
+	regexp.MustCompile(`\beyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+`),
+}
+
+// secretKeyNames are prop names whose value is a credential whatever its shape, so
+// a structured payload that names its secret ({api_key: "..."}) is redacted even
+// when the value itself looks like ordinary text. Keys are compared after
+// lower-casing and normalizing -/. to _.
+var secretKeyNames = map[string]bool{
+	"api_key": true, "apikey": true, "api_token": true, "access_token": true,
+	"auth_token": true, "authorization": true, "token": true, "secret": true,
+	"client_secret": true, "password": true, "passwd": true, "pwd": true,
+	"credential": true, "credentials": true, "private_key": true, "session_key": true,
+	"raw_api_key": true, "x_api_key": true, "bearer": true,
+}
+
+// secretKeySuffixes catch prefixed variants such as openai_api_key.
+var secretKeySuffixes = []string{"_api_key", "_access_token", "_auth_token", "_secret", "_token"}
+
+// isSecretKey reports whether a map key names a credential.
+func isSecretKey(key string) bool {
+	k := strings.NewReplacer("-", "_", ".", "_").Replace(strings.ToLower(strings.TrimSpace(key)))
+	if secretKeyNames[k] {
+		return true
+	}
+	for _, suffix := range secretKeySuffixes {
+		if strings.HasSuffix(k, suffix) {
+			return true
+		}
+	}
+	return false
+}
+
+// RedactText scrubs credential-looking substrings from s and truncates the result
+// to maxSummaryRunes, so a published string can never carry a secret or an
+// unbounded blob.
+func RedactText(s string) string {
+	return truncate(redactSecrets(s), maxSummaryRunes)
+}
+
+// RedactEvent returns ev with every string value — including those nested in maps
+// and slices, and including any value under a credential-named key — scrubbed and
+// truncated. Timestamps, types and non-string scalars pass through unchanged.
+func RedactEvent(ev Event) Event {
+	out := Event{Time: ev.Time, Type: ev.Type}
+	if ev.Props == nil {
+		return out
+	}
+	out.Props = redactProps(ev.Props)
+	return out
+}
+
+// redactProps scrubs a property map, applying the key-name rule at the top level
+// as well as the shape rule to each value.
+func redactProps(props map[string]any) map[string]any {
+	out := make(map[string]any, len(props))
+	for k, v := range props {
+		if isSecretKey(k) {
+			out[k] = redactedMarker
+			continue
+		}
+		out[k] = redactValue(v)
+	}
+	return out
+}
+
+// redactEvents returns a redacted copy of events for publication. A nil or empty
+// slice yields nil so a node carries no empty log array.
+func redactEvents(events []Event) []Event {
+	if len(events) == 0 {
+		return nil
+	}
+	out := make([]Event, len(events))
+	for i, ev := range events {
+		out[i] = RedactEvent(ev)
+	}
+	return out
+}
+
+// redactSecrets replaces every credential-shaped substring with the marker.
+func redactSecrets(s string) string {
+	if s == "" {
+		return s
+	}
+	for _, re := range secretPatterns {
+		s = re.ReplaceAllString(s, redactedMarker)
+	}
+	return s
+}
+
+// redactValue scrubs one prop/event value: a string is redacted and truncated, a
+// map or slice is copied and redacted recursively (with credential-named keys
+// replaced outright), and any other value (number, bool, time) passes through
+// unchanged.
+func redactValue(v any) any {
+	switch x := v.(type) {
+	case string:
+		return RedactText(x)
+	case map[string]any:
+		return redactProps(x)
+	case []any:
+		out := make([]any, len(x))
+		for i, item := range x {
+			out[i] = redactValue(item)
+		}
+		return out
+	case []string:
+		out := make([]any, len(x))
+		for i, item := range x {
+			out[i] = RedactText(item)
+		}
+		return out
+	default:
+		return v
+	}
+}

internal/runtime/trace/redact_test.go

@@ -0,0 +1,132 @@
+package trace
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+)
+
+// TestRedactTextScrubsCredentials asserts every credential shape the dashboard
+// could be handed is replaced, while ordinary text passes through unchanged.
+func TestRedactTextScrubsCredentials(t *testing.T) {
+	t.Parallel()
+	secrets := []string{
+		"api_key=sk-abcdef0123456789",
+		`{"token":"abcdef1234567890"}`,
+		"password=hunter2hunter2",
+		"Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.abc.def",
+		"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4",
+		"access_token: ghp_0123456789abcdefghij",
+	}
+	for _, in := range secrets {
+		got := RedactText(in)
+		if !strings.Contains(got, redactedMarker) {
+			t.Fatalf("RedactText(%q) = %q, want the redaction marker", in, got)
+		}
+		for _, leak := range []string{"sk-abcdef0123456789", "hunter2hunter2", "abcdef1234567890",
+			"eyJhbGciOiJIUzI1NiJ9", "ghp_0123456789abcdefghij"} {
+			if strings.Contains(got, leak) {
+				t.Fatalf("RedactText(%q) = %q, still carries %q", in, got, leak)
+			}
+		}
+	}
+
+	benign := "the tool returned 3 rows; stop_reason=tool_calls"
+	if got := RedactText(benign); got != benign {
+		t.Fatalf("RedactText(%q) = %q, want it unchanged", benign, got)
+	}
+	if got := truncate("", maxSummaryRunes); got != "" {
+		t.Fatalf("empty text = %q, want empty", got)
+	}
+	long := strings.Repeat("x", maxSummaryRunes+10)
+	if got := RedactText(long); !strings.HasSuffix(got, "…") || len([]rune(got)) != maxSummaryRunes+1 {
+		t.Fatalf("long text was not truncated to the summary bound: %d runes", len([]rune(got)))
+	}
+}
+
+// TestRedactEventScrubsNestedValues asserts a secret nested in a map or a slice is
+// scrubbed too — the shapes a tool result or error payload actually has.
+func TestRedactEventScrubsNestedValues(t *testing.T) {
+	t.Parallel()
+	ev := Event{Type: "tool.done", Props: map[string]any{
+		"tool": "http",
+		"headers": map[string]any{
+			"Authorization": "Bearer sk-live-0123456789abcdef",
+		},
+		"args_keys": []string{"api_key", "url"},
+		"nested":    []any{map[string]any{"password": "hunter2hunter2"}},
+		"count":     2,
+	}}
+
+	got := RedactEvent(ev)
+	if got.Type != ev.Type || got.Time != ev.Time {
+		t.Fatalf("event envelope changed: %+v", got)
+	}
+	blob, err := json.Marshal(got)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	for _, leak := range []string{"sk-live-0123456789abcdef", "hunter2hunter2"} {
+		if strings.Contains(string(blob), leak) {
+			t.Fatalf("redacted event still carries %q: %s", leak, blob)
+		}
+	}
+	if count, ok := got.Props["count"].(int); !ok || count != 2 {
+		t.Fatalf("non-string prop = %v, want it passed through", got.Props["count"])
+	}
+	// The original event must not be mutated (a caller may still need it).
+	if orig, _ := ev.Props["headers"].(map[string]any)["Authorization"].(string); !strings.Contains(orig, "sk-live-") {
+		t.Fatalf("RedactEvent mutated the caller's event: %v", orig)
+	}
+}
+
+// TestNodePropsAndLogAreRedacted asserts the published graph — both a tool node's
+// result_summary prop and its log events — never carries a credential. This is the
+// design/19 §3 red line at the last point before publication.
+func TestNodePropsAndLogAreRedacted(t *testing.T) {
+	t.Parallel()
+	rec := spanRec("t1", "step1", "tool.http", SpanKindTool, SpanStatusOK,
+		map[string]any{"result": map[string]any{"body": `{"api_key":"sk-abcdef0123456789"}`}})
+	rec.Events = []Event{{
+		Type: "tool.done",
+		Props: map[string]any{
+			"tool":           "http",
+			"args_keys":      []string{"api_key"},
+			"result_summary": `{"api_key":"sk-abcdef0123456789"}`,
+		},
+	}}
+
+	g := graphFor([]SpanRecord{rec}, "token=abcdef1234567890", "reply")
+	node := nodeByID(g, "t1")
+	if len(node.Log) != 1 || node.Log[0].Type != "tool.done" {
+		t.Fatalf("node log = %+v, want the recorded event", node.Log)
+	}
+	blob, err := json.Marshal(g)
+	if err != nil {
+		t.Fatalf("marshal graph: %v", err)
+	}
+	if strings.Contains(string(blob), "sk-abcdef0123456789") {
+		t.Fatalf("published graph leaked the tool result: %s", blob)
+	}
+	if !strings.Contains(string(blob), redactedMarker) {
+		t.Fatalf("published graph carries no redaction marker: %s", blob)
+	}
+	if got := node.Props["result_summary"]; !strings.Contains(got.(string), redactedMarker) {
+		t.Fatalf("result_summary prop = %v, want it scrubbed", got)
+	}
+	// The round's own input/output labels are scrubbed as well.
+	if in := nodeByID(g, "input").Label; strings.Contains(in, "abcdef1234567890") {
+		t.Fatalf("input label leaked a credential: %q", in)
+	}
+}
+
+// TestRedactEventKeepsEmptyPropsNil guards the wire shape: an event without props
+// must not gain an empty map.
+func TestRedactEventKeepsEmptyPropsNil(t *testing.T) {
+	t.Parallel()
+	ev := Event{Type: "llm.done", Time: time.Now()}
+	if got := RedactEvent(ev); got.Props != nil {
+		t.Fatalf("props = %v, want nil", got.Props)
+	}
+}