test(v2): enforce execution scope and progress redaction

tests/integration/test_sources_jobs.py

@@ -104,6 +104,21 @@ async def test_local_source_probe_archive_and_repository_targeted_job(
         assert duplicate.status_code == 409
         assert duplicate.json()["code"] == "execution_active"
         execution_id = execution.json()["id"]
+        scoped_token = await client.post(
+            "/api/v2/auth/tokens",
+            json={"scopes": ["audit:read"], "expires_at": None},
+            headers={**headers, "Idempotency-Key": "execution-audit-token"},
+        )
+        assert scoped_token.status_code == 201
+        token_headers = {"Authorization": f"Bearer {scoped_token.json()['token']}"}
+        assert (
+            await client.get(f"/api/v2/executions/{execution_id}", headers=token_headers)
+        ).status_code == 403
+        assert (
+            await client.post(
+                f"/api/v2/executions/{execution_id}/cancel", headers=token_headers
+            )
+        ).status_code == 403
         async with app.state.sessions() as db:
             assert await claim(db, execution_id, "expired-worker") is not None
             stored = await db.get(Execution, execution_id)
@@ -118,9 +133,20 @@ async def test_local_source_probe_archive_and_repository_targeted_job(
             assert await request_cancellation(db, execution_id) is not None
             assert not await complete_cancellation(db, execution_id, "expired-worker")
             assert await complete_cancellation(db, execution_id, "replacement-worker")
+        async with app.state.sessions() as db:
+            stored = await db.get(Execution, execution_id)
+            assert stored is not None
+            stored.progress = {
+                "source_path": "/private/source",
+                "details": {"Token": "nested-secret", "password": "nested-password"},
+            }
+            await db.commit()
         polled = await client.get(f"/api/v2/executions/{execution_id}", headers=headers)
         assert polled.status_code == 200
         assert polled.json()["state"] == "cancelled"
+        assert "/private/source" not in str(polled.json())
+        assert "nested-secret" not in str(polled.json())
+        assert "nested-password" not in str(polled.json())
         async with app.state.sessions() as db:
             stored = await db.get(Execution, execution.json()["id"])
             assert stored is not None