Evidence record / agent-flywheel
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-agent-flywheel-shareable-task-packets-retained-raw-data-beside-sanitized-briefs
Shareable task packets retained raw data beside sanitized briefs. A sanitized task brief coexisted with a duplicate raw Bead object in packet JSON, so credentials in task fields could still reach packet recipients. The October 10 patch removes that duplication, sanitizes titles and labels and extends service-key/webhook masking in packet and support artifacts. The fix remains untagged. This establishes conditional exposure through the export path, not that any particular secret leaked.
Channel: main-unreleased. Half: defect. Date: 2026-10-10.
Operator consequence: Inspect every field of retained packet JSON and support artifacts before sharing them, including raw source, titles and labels. Sanitized Markdown alone is insufficient evidence that the exported object is safe.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-agent-flywheel-shareable-task-packets-retained-raw-data-beside-sanitized-briefs
Profile citations
- Agent Flywheel / claim / shareable-packet-raw-fields
- Agent Flywheel / posture / governance
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-13-agent-flywheel-shareable-task-packets-retained-raw-data-beside-sanitized-briefsgithub.com/Dicklesworthstone/agentic_coding_flywheel_setup/commit/ae06b55cab0f0862776e5cbbe30b3a6e6f75dc97tagged commit file2026-10-13-agent-flywheel-shareable-task-packets-retained-raw-data-beside-sanitized-briefsDicklesworthstone/agentic_coding_flywheel_setup / scripts/lib/swarm_packet.sh#L615-L650
Versioned source: run artifact