GeezerVison

Problem

Batch steps can request environment variables by name. The executor passed its full process environment into this resolver, so a step could request reserved SRC_EXECUTOR_* values. These values include executor control credentials that must not be available inside an ordinary batch step.

This fixes VULN-141.

Solution

Filter the reserved SRC_EXECUTOR_* namespace from the outer environment before resolving step variables. The filter is applied at the step execution boundary, so it covers every caller and also protects future variables in the reserved namespace. Normal environment variables and explicit step values continue to work.

Verification Evidence

• Added a regression test showing that normal outer variables still resolve.
• Added coverage showing that current and future SRC_EXECUTOR_* outer variables resolve to empty values.
• go test ./internal/batches/...
• go test ./cmd/src