I2708 — A mesh event field nobody listed fails the mesh check, and no log field or review body carries a credential the redactor knows
Make scripts/ci/mesh-check refuse an EventBody field absent from an allow-list, add a redaction layer for every tracing field, and pass review bodies through the redactor.
DONE wave 1 · p1 · implementation profile · runs alone
Objective
Make scripts/ci/mesh-check refuse an EventBody field absent from an allow-list, add a redaction layer for every tracing field, and pass review bodies through the redactor.
Why
Split from I2161 on 2026-10-14. I2161 passed every HTTP error body, JSON-RPC error, MCP tool refusal, logged request field and handover body through redaction::redact_secrets, and its desired_state said 'Not done here' of an allow-list in scripts/ci/mesh-check that refuses an EventBody field nobody listed, a redaction layer for every tracing field, and review bodies, while its acceptance criteria still required the allow-list, so it could never close. The mesh replicates event bodies in clear over plain HTTP; a field added to EventBody reaches every linked runtime without anyone deciding it may. Pack invariant 9.
Current state
scripts/ci/mesh-check reads every EventBody variant's fields against .ai/repo/ci/mesh-event-fields.yaml and fails on one it does not list (case 3051). A handover body is redacted before it is signed (apps/majordomus-cli/src/mesh/handover.rs), and so are a review's subject, body, verdict and notes (apps/majordomus-cli/src/mesh/cooperation.rs, request_review, answer_review and withdraw_review), and a verdict outside approved, changes_requested and commented, a credential included, is refused before it is signed; the list names those six fields `redacted`. The tracing layer is the one half not in this tree: it is PR #1195 (apps/majordomus-cli/src/logging.rs).
Desired state
scripts/ci/mesh-check reads the fields of every EventBody variant and fails on one that its allow-list does not name, and the allow-list says for each listed field whether it is redacted before signing; every tracing field passes redaction::redact_secrets in one layer; a review's subject and verdict are redacted before they are signed into the journal.
Scope
- scripts/ci/mesh-check
- apps/majordomus-cli/src/mesh/journal.rs
- apps/majordomus-cli/src/mesh/cooperation.rs
- apps/majordomus-cli/src/logging.rs
- apps/majordomus-cli/src/redaction.rs
- apps/majordomus-cli/tests/redaction.rs
- test/cases
Out of scope
- Error bodies, MCP errors, logged request fields and handover bodies, which I2161 delivered
- Wiring the evidence publication to redaction::public_text, which is I1955's
Dependencies
Acceptance criteria
- An EventBody field added without an allow-list entry fails scripts/ci/mesh-check
- A credential-shaped value in any tracing field is absent from server.log
- A review whose subject or verdict carries a credential shape is redacted or refused before it is signed into the journal
Validation
- bin/majordomus plan validate
- scripts/ci/mesh-check
- cargo test --test redaction
Evidence required
- eventbody_allowlist_case
- review_redaction_test
Evidence
| covers | type | command | result | at commit |
|---|---|---|---|---|
| eventbody_allowlist_case | test | bash test/run.sh 3051_an_unlisted_event_field_fails_the_mesh_check 301_the_mesh_stays_one_subsystem; scripts/ci/mesh-check | tests: 2 passed, 0 failed. Case 3051: the real tree passes (47 fields carried, 1 redacted before signing: HandoverBody.body); a copy fails with exit 10 on an unlisted variant field (EventBody.ReviewAnswered.token), an unlisted carried-struct field (SessionInfo.home), a new variant (EventBody.NoteShared.text), an entry neither redacted nor clear, a stale entry, a journal without EventBody and a missing list, and passes again once the field is listed (run 2026-10-15 on #1179 head 98ef9ac6e3 plus this change) | 98ef9ac |
| review_redaction_test | test | cargo test --test redaction; scripts/ci/mesh-check; bash test/run.sh 3051_an_unlisted_event_field_fails_the_mesh_check 301_the_mesh_stays_one_subsystem | redaction: 11 passed, 0 failed (lundra, 2026-10-15). a_review_is_journaled_with_the_marker_never_the_secret writes every credential line of test/fixtures/redaction/shapes.tsv into a review's subject, body, answer note and withdrawal note: the journal on disk and the folded state carry each shape's marker and no body; the same line as a verdict is refused before signing and the refusal names the marker. The test over the old review path fails (the refusal repeated the anthropic-key body). mesh-check OK: 47 fields carried, 6 redacted before signing. Cases 3051 and 301 pass. Run on e2d7042a44 (#1188) plus this change. | e2d7042 |
| eventbody_allowlist_case | test | scripts/ci/mesh-check | OK: every EventBody field listed (47 carried, 6 redacted before signing); tracing redaction since dd4798ce55e (code on master since 3c3372d0617; re-run at master 01227a0) | 01227a0 |
| review_redaction_test | test | cargo test --test redaction | 12 passed, 0 failed, incl. a_review_is_journaled_with_the_marker_never_the_secret (code on master since 3c3372d0617; re-run at master 01227a0) | 01227a0 |
Timeline
- started
- 2026-10-17T12:04:14Z
- verified
- 2026-10-17T12:04:36Z
- completed
- 2026-10-17T12:04:47Z
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I2708.yaml. Read it back with majordomus plan show I2708.