From e72f491732d0caf0a2b7a702772d43ef4cc3cdfc Mon Sep 17 00:00:00 2001 From: Vibe Nuage Agent Date: Mon, 19 Oct 2026 14:33:45 +0000 Subject: [PATCH] fix(observability): redact wf.result in strict mode AttributeRedactionPolicy matched on attribute-name fragments, and 'result' was missing from DEFAULT_SENSITIVE_ATTRIBUTE_FRAGMENTS. Activity and workflow outputs (wf.result) were exported unredacted even with OTEL_REDACTION=strict, while wf.arguments was masked. The model reply masked on the chat span (gen_ai.output.messages) thus leaked in clear on the activity span. Add 'result' to the default sensitive fragments and cover wf.arguments/wf.result with a regression test. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .../extra/observability/redaction_policies.py | 1 + src/mistralai/extra/tests/test_redaction_policies.py | 11 +++++++++++ 2 files changed, 12 insertions(+) diff --git a/src/mistralai/extra/observability/redaction_policies.py b/src/mistralai/extra/observability/redaction_policies.py index d99d2a3f9..8017e2cb2 100644 --- a/src/mistralai/extra/observability/redaction_policies.py +++ b/src/mistralai/extra/observability/redaction_policies.py @@ -85,6 +85,7 @@ def redact_status_description(self, description: str | None) -> str | None: "password", "payload", "prompt", + "result", "secret", "set_cookie", "token", diff --git a/src/mistralai/extra/tests/test_redaction_policies.py b/src/mistralai/extra/tests/test_redaction_policies.py index 5d0c279b8..d8677923a 100644 --- a/src/mistralai/extra/tests/test_redaction_policies.py +++ b/src/mistralai/extra/tests/test_redaction_policies.py @@ -44,6 +44,17 @@ def test_fragment_match_redacted(self, attribute_policy: AttributeRedactionPolic ) assert out["custom.prompt.text"] == DEFAULT_REDACTED_VALUE + def test_workflow_arguments_and_result_redacted( + self, attribute_policy: AttributeRedactionPolicy + ): + out = attribute_policy.redact_attributes( + {"wf.arguments": "x", "wf.result": "x"} + ) + assert out == { + "wf.arguments": DEFAULT_REDACTED_VALUE, + "wf.result": DEFAULT_REDACTED_VALUE, + } + def test_token_pattern_on_kept_string( self, attribute_policy: AttributeRedactionPolicy ):