I2161

What it is

Objective

Pass every response reason, logged request field and replicated mesh text through the one redactor, bound the fields a mesh event may carry, and make the redaction module's documentation name the callers that exist.

Why

The published-artifact guard generate::forbidden_in (apps/majordomus-cli/src/generate.rs:1364,1398) is a substring list (ghp_, AKIA, Bearer, PEM, /Users/) applied to generated documents only, not to HTTP responses, MCP results, mesh frames or logs. Request paths and origins are logged raw (apps/majordomus-cli/src/http/router.rs:731-736) and logging has no redaction layer (apps/majordomus-cli/src/logging.rs:29-37). redaction::public_text (apps/majordomus-cli/src/redaction.rs:223) has no production caller, although the module doc (apps/majordomus-cli/src/redaction.rs:1-7) and case 504_public_text_is_redacted_once.sh say published evidence goes through it; wiring the evidence publication to it is I1955 (test-evidence). The mesh replicates intents, scopes and handover bodies in clear over plain HTTP (apps/majordomus-cli/src/mesh/link.rs:878-908). Pack invariant 9: no token or key in logs, web responses, mesh discovery, telemetry or generated docs. Baseline audit of 2026-10-09 at master 1fb8d6be44, failure gap 7, the redaction rows and drift 1.

Now

Only generated documents and tracked text are scanned; responses, logs and frames are not.

Wanted

Every HTTP error body (Response::error, error_response), every JSON-RPC error and MCP tool refusal, the request fields the server logs (origin, path, target), and a handover body before it is signed into the journal pass redaction::redact_secrets; the module documentation of redaction.rs names only callers that exist. The deferred part, an EventBody allow-list in scripts/ci/mesh-check, a redaction layer for every tracing field and review bodies, is I2708.

Done when

unknown: the record declares no `completion`

Risk

unknown: the record declares no `risk`

Acceptance

Scope

Touches

apps/majordomus-cli/src/http/router.rsapps/majordomus-cli/src/http/server.rsapps/majordomus-cli/src/logging.rsapps/majordomus-cli/src/redaction.rsapps/majordomus-cli/src/mesh/handover.rsapps/majordomus-cli/src/mesh/journal.rsscripts/ci/mesh-checkapps/majordomus-cli/tests/redaction.rstest/cases

Not

unknown: the record declares no `non_scope`

Depends on

none

Priority

p1

Profile

implementation

Parallel safe

false

Owner

unknown: the record declares no `owner`

The work so far

Synchronisation

Adapter

scripts/github-sync

Repository

unknown: the derived plan's header carries no repository

External issue

unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

State there

unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.