feat: bound and redact console operation evidence

web/apps/console/src/app/state.test.ts

@@ -23,6 +23,7 @@ const makeSuccess = (target = "http://127.0.0.1:8765/rpc") =>
 
 const evidence: EvidenceRecord = {
   id: "e1",
+  target: "http://console.test/rpc",
   operation: "workflow.sources.list",
   label: "Source inventory",
   equivalentCli: "uv run wf source list",
@@ -271,4 +272,27 @@ describe("evidence", () => {
     });
     expect(next.evidence).toEqual([evidence]);
   });
+
+  it("sanitizes evidence and retains only the newest 100 records", () => {
+    const state: ConnectionState = {
+      ...initialState(),
+      evidence: Array.from({ length: 100 }, (_, index) => ({
+        ...evidence,
+        id: `e${index}`,
+      })),
+    };
+
+    const next = connectionReducer(state, {
+      type: "evidence_recorded",
+      record: {
+        ...evidence,
+        id: "e100",
+        request: { Authorization: "Bearer secret" },
+      },
+    });
+
+    expect(next.evidence).toHaveLength(100);
+    expect(next.evidence[0]?.id).toBe("e1");
+    expect(next.evidence.at(-1)?.request).toEqual({ Authorization: "[redacted]" });
+  });
 });

web/apps/console/src/app/state.ts

@@ -1,4 +1,5 @@
 import type { ConnectionSuccess } from "../connection/contracts.js";
+import { retainEvidence } from "../workspace/domain/evidence-policy.js";
 
 export type ConnectionPhase =
   | "not_configured"
@@ -12,6 +13,7 @@ export type ConnectionPhase =
 
 export type EvidenceRecord = {
   readonly id: string;
+  readonly target: string;
   readonly operation: string;
   readonly label: string;
   readonly equivalentCli: string;
@@ -111,16 +113,11 @@ export const connectionReducer = (
     case "evidence_recorded":
       return {
         ...state,
-        evidence: appendEvidence(state.evidence, action.record),
+        evidence: retainEvidence(state.evidence, action.record),
       };
   }
 };
 
-const appendEvidence = (
-  existing: ReadonlyArray<EvidenceRecord>,
-  record: EvidenceRecord,
-): ReadonlyArray<EvidenceRecord> => [...existing, record];
-
 const mapCodeToPhase = (code: string): ConnectionPhase => {
   switch (code) {
     case "invalid_target":