feat(tenancy): harden shared cloud runtime boundaries

tests/unit_tests/core/test_load_config.py

@@ -35,6 +35,22 @@ class TestApplyEnvOverridesToConfig:
 
         assert result['system']['name'] == 'custom_name'
 
+    def test_override_log_never_prints_secret_value(self, capsys):
+        """Environment-backed credentials must not be copied into logs."""
+        load_config = get_load_config_module()
+
+        secret = 'database-password-that-must-not-leak'
+        cfg = {'database': {'postgresql': {'password': ''}}}
+        env = {'DATABASE__POSTGRESQL__PASSWORD': secret}
+
+        with patch.dict(os.environ, env, clear=True):
+            result = load_config._apply_env_overrides_to_config(cfg)
+
+        captured = capsys.readouterr().out
+        assert result['database']['postgresql']['password'] == secret
+        assert 'DATABASE__POSTGRESQL__PASSWORD' in captured
+        assert secret not in captured
+
     def test_override_int_value(self):
         """Test overriding an int value with proper conversion."""
         load_config = get_load_config_module()
@@ -196,6 +212,19 @@ class TestApplyEnvOverridesToConfig:
 
         assert result['system']['name'] == 'default'
 
+    def test_skip_env_vars_with_empty_path_segments(self, capsys):
+        """Platform variables such as __CF_USER_TEXT_ENCODING are not config."""
+        load_config = get_load_config_module()
+
+        cfg = {'system': {'name': 'default'}}
+        env = {'__CF_USER_TEXT_ENCODING': '0x1F5:0x0:0x64'}
+
+        with patch.dict(os.environ, env, clear=True):
+            result = load_config._apply_env_overrides_to_config(cfg)
+
+        assert result == cfg
+        assert capsys.readouterr().out == ''
+
     def test_nested_config_path(self):
         """Test overriding deeply nested config."""
         load_config = get_load_config_module()

tests/unit_tests/core/test_taskmgr.py

@@ -12,6 +12,7 @@ from __future__ import annotations
 
 import pytest
 import asyncio
+import contextvars
 import sys
 from unittest.mock import Mock, MagicMock
 from contextlib import contextmanager
@@ -360,6 +361,53 @@ class TestAsyncTaskManager:
 
         wrapper.cancel()
 
+    @pytest.mark.asyncio
+    async def test_create_task_does_not_inherit_request_context(self):
+        """Long-lived tasks must receive identity through explicit arguments."""
+
+        _, _, AsyncTaskManager = get_taskmgr_classes()
+        mock_app = create_mock_app()
+        manager = AsyncTaskManager(mock_app)
+        request_value = contextvars.ContextVar('request_value', default=None)
+        token = request_value.set('request-scoped-transaction')
+        observed = []
+
+        async def detached_task(captured_workspace: str) -> None:
+            observed.append((request_value.get(), captured_workspace))
+
+        try:
+            wrapper = manager.create_task(detached_task('workspace-a'))
+            await wrapper.task
+        finally:
+            request_value.reset(token)
+
+        assert observed == [(None, 'workspace-a')]
+
+    @pytest.mark.asyncio
+    async def test_create_task_waits_for_registered_transaction_commit(self):
+        _, _, AsyncTaskManager = get_taskmgr_classes()
+        mock_app = create_mock_app()
+        gate = asyncio.get_running_loop().create_future()
+
+        class PersistenceManagerStub:
+            def create_after_commit_gate(self):
+                return gate
+
+        mock_app.persistence_mgr = PersistenceManagerStub()
+        manager = AsyncTaskManager(mock_app)
+        observed = []
+
+        async def background_work() -> None:
+            observed.append('started')
+
+        wrapper = manager.create_task(background_work())
+        await asyncio.sleep(0)
+        assert observed == []
+
+        gate.set_result(None)
+        await wrapper.task
+        assert observed == ['started']
+
     @pytest.mark.asyncio
     async def test_get_stats_counts_correctly(self):
         """Test get_stats returns correct counts."""