fix(harness): take the build-hazard look's folders in name order (TH-9514)

src/fi/alk/harness/scan_ai.py

@@ -168,7 +168,8 @@ def _events(self, received: Any, turn: Turn) -> list[Any]:
                     self._on_turn_end()
                 except Exception:
                     # A failed cost note must not turn a paid answer into a retried one. The
-                    # trace is logged (secret values masked), so a fault in the cost writer can be found.
+                    # trace is logged, with only the platform's secret values masked, so a fault
+                    # in the cost writer can be found.
                     logger.warning("find_agents: the cost note after the turn failed", exc_info=True)
 
 
@@ -412,7 +413,8 @@ async def _answered(work: Callable[..., str], *args: Any) -> dict[str, Any]:
     except asyncio.TimeoutError:
         return _error(_TOO_SLOW)
     except Exception:
-        # The model is told only that the call failed; the trace is logged, secret values masked.
+        # The model is told only that the call failed. The trace is logged, with only the
+        # platform's secret values masked.
         logger.warning("find_agents: a tool call failed", exc_info=True)
         return _error(_FAILED)
 

src/fi/alk/harness/scan_document.py

@@ -21,7 +21,7 @@
 from pathlib import Path
 from typing import TYPE_CHECKING, Any
 
-from .scan_walk import fits_path_rule
+from .scan_walk import ENV_NAMES_KEPT, fits_path_rule
 
 if TYPE_CHECKING:
     from .job import HarnessJob
@@ -33,7 +33,6 @@
 SCHEMA_VERSION = "futureagi.agent-scan.v1"
 MAX_AGENTS = 50
 MAX_BYTES = 1_048_576
-ENV_NAMES_KEPT = 50
 NAME_MAX = 255
 EVIDENCE_MAX = 200
 EVIDENCE_KEPT = 5

src/fi/alk/harness/scan_folders.py

@@ -67,7 +67,8 @@ def _answer(source: Path, subfolder: str) -> dict[str, Any]:
         return {"name": "unknown", "version": None}
     except Exception:
         # A fault in the check itself. The child stays up for the next folder, and sends the
-        # trace so the parent logs it masked and marks the row unfinished.
+        # trace so the parent logs it, with only the platform's secret values masked, and marks
+        # the row unfinished.
         return {_FAILED: traceback.format_exc()}