I2708

What it is

Objective

Make scripts/ci/mesh-check refuse an EventBody field absent from an allow-list, add a redaction layer for every tracing field, and pass review bodies through the redactor.

Why

Split from I2161 on 2026-10-14. I2161 passed every HTTP error body, JSON-RPC error, MCP tool refusal, logged request field and handover body through redaction::redact_secrets, and its desired_state said 'Not done here' of an allow-list in scripts/ci/mesh-check that refuses an EventBody field nobody listed, a redaction layer for every tracing field, and review bodies, while its acceptance criteria still required the allow-list, so it could never close. The mesh replicates event bodies in clear over plain HTTP; a field added to EventBody reaches every linked runtime without anyone deciding it may. Pack invariant 9.

Now

scripts/ci/mesh-check reads every EventBody variant's fields against .ai/repo/ci/mesh-event-fields.yaml and fails on one it does not list (case 3051). A handover body is redacted before it is signed (apps/majordomus-cli/src/mesh/handover.rs), and so are a review's subject, body, verdict and notes (apps/majordomus-cli/src/mesh/cooperation.rs, request_review, answer_review and withdraw_review), and a verdict outside approved, changes_requested and commented, a credential included, is refused before it is signed; the list names those six fields `redacted`. The tracing layer is the one half not in this tree: it is PR #1195 (apps/majordomus-cli/src/logging.rs).

Wanted

scripts/ci/mesh-check reads the fields of every EventBody variant and fails on one that its allow-list does not name, and the allow-list says for each listed field whether it is redacted before signing; every tracing field passes redaction::redact_secrets in one layer; a review's subject and verdict are redacted before they are signed into the journal.

Done when

unknown: the record declares no `completion`

Risk

unknown: the record declares no `risk`

Acceptance

Scope

Touches

scripts/ci/mesh-checkapps/majordomus-cli/src/mesh/journal.rsapps/majordomus-cli/src/mesh/cooperation.rsapps/majordomus-cli/src/logging.rsapps/majordomus-cli/src/redaction.rsapps/majordomus-cli/tests/redaction.rstest/cases

Not

Error bodies, MCP errors, logged request fields and handover bodies, which I2161 deliveredWiring the evidence publication to redaction::public_text, which is I1955's

Depends on

I2161

Priority

p1

Profile

implementation

Parallel safe

false

Owner

unknown: the record declares no `owner`

The work so far

Synchronisation

Adapter

scripts/github-sync

Repository

unknown: the derived plan's header carries no repository

External issue

unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

State there

unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings