fix(voice): redact TTS instructions from speech spans

[ayaangazali]

Summary

speech_span gates the text being spoken on trace_include_sensitive_data, but emits model_config["instructions"] unconditionally:

input=text if self._voice_pipeline_config.trace_include_sensitive_data else "",
model_config={
    "voice": self.tts_settings.voice,
    "instructions": self.instructions,   # not gated
    "speed": self.tts_settings.speed,
},

TTSModelSettings.instructions is author-written prompt text, documented as the knob for controlling the tone of the audio output. That is the same category as the STT prompt and keywords, which #4663 gated a few hours ago. The transcription span now draws the line clearly: keywords and prompt follow the flag, while temperature, language, languages and turn_detection stay visible because they are settings rather than prompt text. instructions is prompt text sitting on the settings side of that line.

Reproduced on main with a real VoicePipeline and a recording trace processor. With trace_include_sensitive_data=False:

SpeechSpanData.input              ''                              suppressed, correct
SpeechGroupSpanData.input         ''                              suppressed, correct
SpeechSpanData.model_config       instructions='SECRET-STYLE-...' still exported

So a caller who explicitly turned sensitive data off still ships their instructions prompt to every trace backend. After the change that field is None and nothing else about the span moves.

This is not a provider-behavior change. voice and speed stay visible either way, and the TTS model still receives the real instructions; only the exported span is redacted.

Test plan

tests/voice/test_pipeline.py::test_speech_span_redacts_tts_instructions, parametrized over both values of the flag. It asserts the full matrix rather than just the redacted case: with the flag on, instructions and input both carry their real values; with it off, both are cleared; speed is asserted unchanged in both to show the settings fields are untouched; and the recording TTS model asserts it received the real instructions either way, so the redaction is trace-only.

Verified it fails without the source change by resetting src/ to main and rerunning: the False case fails, the True case passes, which is the expected split for a test that also pins existing behavior.

.agents/skills/code-change-verification/scripts/run.sh passes end to end: format, lint, typecheck and the full suite.

Issue number

None. Found while sibling-checking #4663.

Checks

• I've added new tests, if relevant
• I've run .agents/skills/code-change-verification/scripts/run.sh
• I've confirmed all verification steps pass
• If using Codex, I've run /review before submitting this PR

---

I went looking for this straight after #4663 landed, on the theory that a redaction fix usually has a sibling field somewhere that nobody checked. Happy to be told that instructions are considered configuration rather than user content here, in which case the fix is wrong and the docs are the thing worth changing instead. I'm a freshman in college and this is the part of the codebase I have spent the most time in, so I would rather ask than assume.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.