The secret-scrub wiring reads workflow.environment_variables / conversation_variables when building the response converter; unit tests that mock the workflow as a bare SimpleNamespace must provide these attributes (empty = no secrets). Fixes the workflow task-pipeline and HITL contract tests.