feat(hardening): Phase 15 — redaction, retry/backoff, budgets, threat-model docs

Release-readiness hardening.

- redaction.py (zero-dep): redact_secrets masks provider API keys, AWS/GitHub/Slack/
  Google tokens, bearer tokens, URL-embedded credentials, PEM private keys, and
  sensitive key=value assignments. Wired into the trace writer and the markdown report
  (on by default), so scan artifacts never leak a credential quoted from source.
- provider/openrouter.py: call_with_retry — exponential backoff on transient failures
  (HTTP 429/5xx, connection errors, timeouts); non-transient errors fail fast. Both the
  chat and embedding clients use it (max_attempts/retry_base_delay configurable).
- config [hardening]: redact_secrets (default true) + max_findings (bounded-CI output
  cap, 0 = unlimited; truncation is severity-ordered and disclosed as a `budget`
  degradation). Agentic spend stays bounded by [harnessx] max_cost_usd/token_threshold.
- docs/threat-model.md (trust boundaries, controls, sandbox limits) + docs/examples.md
  (six end-to-end walkthroughs); README "Security & hardening" section links both.
- CI lint/typecheck/test/detection-gate/dagger gates already existed.

tests/test_redaction.py, test_provider_retry.py, test_hardening_pipeline.py + config
tests. 206 passed, 4 skipped; ruff + mypy clean; detection gate PASS.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/openultrasast/config.py

@@ -77,6 +77,14 @@ class HarnessxConfig:
     token_threshold: int = 120_000
 
 
+@dataclass(frozen=True)
+class HardeningConfig:
+    # Release-readiness controls. redact_secrets masks credentials in traces/reports;
+    # max_findings caps the reported finding count for bounded CI runs (0 = unlimited).
+    redact_secrets: bool = True
+    max_findings: int = 0
+
+
 @dataclass(frozen=True)
 class FusionConfig:
     # Two-panel fusion adjudication for triggered findings (standard mode). Runs
@@ -100,6 +108,7 @@ class ResolvedConfig:
     ruleset: RulesetConfig = RulesetConfig()
     harnessx: HarnessxConfig = HarnessxConfig()
     fusion: FusionConfig = FusionConfig()
+    hardening: HardeningConfig = HardeningConfig()
     runs_dir: str = ".openultrasast/runs"
 
 
@@ -120,6 +129,7 @@ def load_config(config_path: Path | None = None) -> ResolvedConfig:
         ruleset=_load_ruleset_config(data.get("ruleset", {})),
         harnessx=_load_harnessx(data.get("harnessx", {})),
         fusion=_load_fusion(data.get("fusion", {})),
+        hardening=_load_hardening(data.get("hardening", {})),
         runs_dir=os.environ.get("OPENULTRASAST_RUNS_DIR", ".openultrasast/runs"),
     )
 
@@ -223,6 +233,14 @@ def _load_harnessx(value: object) -> HarnessxConfig:
     )
 
 
+def _load_hardening(value: object) -> HardeningConfig:
+    data = _section(value)
+    return HardeningConfig(
+        redact_secrets=bool(data.get("redact_secrets", True)),
+        max_findings=_int_value(data.get("max_findings"), 0),
+    )
+
+
 def _load_fusion(value: object) -> FusionConfig:
     data = _section(value)
     return FusionConfig(