fix: make workflow drafts explicitly opt in

tests/wf_api/test_direct_service.py

@@ -27,7 +27,7 @@ def _api(root: Path) -> WorkflowApi:
         ConnectionConfig(id="demo.personal", server="demo", account="personal")
     )
     service.register_specs("demo.personal", echo_tool)
-    return WorkflowApi(context_from_service(service))
+    return WorkflowApi(context_from_service(service), drafts=True)
 
 
 def test_workflow_api_composes_domain_services(tmp_path: Path) -> None:

tests/wf_api/test_durable_context.py

@@ -69,3 +69,8 @@ def test_durable_workflow_api_can_opt_out_of_draft_store(tmp_path) -> None:
     api = durable_workflow_api(context, drafts=False)
 
     assert api.drafts_enabled is False
+    assert api.drafts is None
+    assert api.draft_authoring is None
+    assert api.capabilities.drafts is None
+    assert api.capabilities.draft_authoring is None
+    assert api.artifacts.drafts is None

tests/wf_client/test_repr.py

@@ -86,6 +86,45 @@ def test_rich_representations_bound_large_values_and_redact_secret_like_fields()
     assert port.calls == []
 
 
+def test_repr_redacts_only_exact_sensitive_keys_in_snake_and_camel_case() -> None:
+    result = CapabilityResult(
+        outcome="ok",
+        output={
+            "apiKey": "hide-me",
+            "accessToken": "hide-me-too",
+            "setCookie": "hide-me-three",
+            "tokenCount": 3,
+            "authorizationStatus": "ok",
+            "secretary": "safe",
+        },
+        diagnostics=(),
+    )
+
+    rendered = repr(result)
+
+    assert "hide-me" not in rendered
+    assert "hide-me-too" not in rendered
+    assert "hide-me-three" not in rendered
+    assert '"tokenCount": 3' in rendered
+    assert '"authorizationStatus": "ok"' in rendered
+    assert '"secretary": "safe"' in rendered
+
+
+def test_repr_does_not_materialize_an_unbounded_iterable() -> None:
+    class ExplodingIterable:
+        def __iter__(self):
+            for index in range(10_000):
+                if index > 8:
+                    raise AssertionError("repr consumed too many values")
+                yield index
+
+    result = CapabilityResult("ok", {"values": ExplodingIterable()}, ())
+
+    rendered = repr(result)
+
+    assert "more items" in rendered
+
+
 def test_all_rich_objects_render_without_port_access() -> None:
     port = cast(WorkflowClientPort, _port())
     diagnostic = WorkflowDiagnostic("error", "bad", "state.x", "broken")

tests/wf_transport_rpc_http/test_app.py

@@ -35,7 +35,6 @@ async def _rpc(
 def test_rpc_app_can_omit_draft_methods(tmp_path) -> None:
     server = build_local_static_workflow_server(tmp_path / "store")
 
-    assert server.api.drafts_enabled is True
     app = create_rpc_app(server, drafts=False)
     methods = {method["name"] for method in app.get_openrpc()["methods"]}
 
@@ -43,6 +42,14 @@ def test_rpc_app_can_omit_draft_methods(tmp_path) -> None:
     assert "workflow.draft_workspaces.list" not in methods
 
 
+def test_rpc_app_draft_methods_require_explicit_server_opt_in(tmp_path) -> None:
+    server = build_local_static_workflow_server(tmp_path / "store", drafts=True)
+    app = create_rpc_app(server, drafts=True)
+    methods = {method["name"] for method in app.get_openrpc()["methods"]}
+
+    assert "workflow.draft_workspaces.list" in methods
+
+
 def _rpc_constant_draft() -> dict[str, Any]:
     """Return the canonical keyed draft shared by stateless RPC tests."""
     return {