[þing-01] Delivery-log/provenance redaction audit

[Polichinel]

Context: the platform's Appwrite-seam identity/config was folk knowledge — one unowned laptop .env as origin, one all-powerful key, and misconfiguration that silently succeeds into phantom storage. The ratified verdict fixes this via one contract ADR (PLATFORM-001), one owned coordinates registry file, declared classification, three credential tiers, and raise-by-default failure semantics.

Do (orð_09 §3 commitment): one-pass audit of every log line and provenance description the delivery emits (upload ledger: filenames, file_ids, byte counts, descriptions) confirming no credential in any carrier appears. The multi-carrier redaction clause is binding platform-wide.

Part of þing-01 — the platform Identity/Secrets/Configuration verdict, ratified as amended
2026-07-28 (sign-off: Simon Polichinel von der Maase, who is also the named operator).
Canonical record (local): views_platform/þingit/01_identity_secrets_config/ — orð_dómr.md
as amended by dómr_endurmat.md; plain-language summary in final_decision.md.

🤖 Generated with Claude Code

[Polichinel]

Done — PR #136 (merged into development). Audit verdict: CLEAN — no credential in any carrier the delivery emits. Full one-pass report in the PR body: all 28 log statements classified (filenames/run_ids/counts/regions only); the wire/delivery packages are credential-blind by construction (zero env/credential references); the provenance description (the carrier that leaves the machine) is a closed key set of delivery primitives; port exception text carries store error messages, never the key. Two permanent guards pin the audited facts (tests/test_redaction_guard.py). Boundary named: pipeline-core's own module logs during delivery are their C4 row, not this repo's surface.