I2161 — No answer, log line or mesh frame carries a credential the redactor knows

✓DONE wave 0 · p1 · implementation profile · runs alone

Part of architecture-is-enforced — A violated invariant fails a gate, and green means every required check ran.

Objective

Pass every response reason, logged request field and replicated mesh text through the one redactor, bound the fields a mesh event may carry, and make the redaction module's documentation name the callers that exist.

Why

The published-artifact guard generate::forbidden_in (apps/majordomus-cli/src/generate.rs:1364,1398) is a substring list (ghp_, AKIA, Bearer, PEM, /Users/) applied to generated documents only, not to HTTP responses, MCP results, mesh frames or logs. Request paths and origins are logged raw (apps/majordomus-cli/src/http/router.rs:731-736) and logging has no redaction layer (apps/majordomus-cli/src/logging.rs:29-37). redaction::public_text (apps/majordomus-cli/src/redaction.rs:223) has no production caller, although the module doc (apps/majordomus-cli/src/redaction.rs:1-7) and case 504_public_text_is_redacted_once.sh say published evidence goes through it; wiring the evidence publication to it is I1955 (test-evidence). The mesh replicates intents, scopes and handover bodies in clear over plain HTTP (apps/majordomus-cli/src/mesh/link.rs:878-908). Pack invariant 9: no token or key in logs, web responses, mesh discovery, telemetry or generated docs. Baseline audit of 2026-10-09 at master 1fb8d6be44, failure gap 7, the redaction rows and drift 1.

Current state

Only generated documents and tracked text are scanned; responses, logs and frames are not.

Desired state

Every HTTP error body (Response::error, error_response), every JSON-RPC error and MCP tool refusal, the request fields the server logs (origin, path, target), and a handover body before it is signed into the journal pass redaction::redact_secrets; the module documentation of redaction.rs names only callers that exist. The deferred part, an EventBody allow-list in scripts/ci/mesh-check, a redaction layer for every tracing field and review bodies, is I2708.

Scope

• apps/majordomus-cli/src/http/router.rs
• apps/majordomus-cli/src/http/server.rs
• apps/majordomus-cli/src/logging.rs
• apps/majordomus-cli/src/redaction.rs
• apps/majordomus-cli/src/mesh/handover.rs
• apps/majordomus-cli/src/mesh/journal.rs
• scripts/ci/mesh-check
• apps/majordomus-cli/tests/redaction.rs
• test/cases

Dependencies

None. This issue is a root of the graph.

What waits on this

• I2708✓DONE A mesh event field nobody listed fails the mesh check, and no log field or review body carries a credential the redactor knows

Acceptance criteria

• A credential-shaped value in a request is absent from the HTTP error response, the MCP error and server.log
• A handover body containing a credential shape is redacted or refused before it is signed into the journal
• The module documentation of apps/majordomus-cli/src/redaction.rs names only callers that exist

Validation

• bin/majordomus plan validate
• cargo test --test redaction
• cargo test --test no_answer_carries_a_credential

Evidence required

• credential_never_echoed_test

Evidence

Timeline

started

2026-10-14T12:16:03Z

verified

—

completed

2026-10-14T12:16:43Z

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I2161.yaml. Read it back with majordomus plan show I2161.