test(redaction): þing-01 P2 (#135) — delivery-log/provenance redaction audit + permanent guards - #136
Merged
Conversation
…rmanent guards The delivery-log/provenance redaction audit (orð_09 §3 commitment; PLATFORM-001 multi-carrier redaction clause) found the delivery clean: every log line carries filenames/run_ids/counts/regions only, and the provenance description — the one carrier that leaves the machine — is a closed set of delivery primitives. Two guards pin that: the wire/delivery modules stay credential-blind (no environment or credential reference), and build_provenance's key set stays closed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #135 (þing-01 P2 — orð_09 §3 commitment; PLATFORM-001 multi-carrier redaction clause).
Audit report (one pass, 2026-07-28) — verdict: CLEAN
Scope: every log line and provenance/description the delivery emits from this repo's code.
unfao/managers/unfao.py(26) andunfao/wire/sink.py(2, incl. the upload ledger) enumerated and classified: arguments are filenames, run_ids, cell/row counts, regions, staging paths, and non-secret metadata dicts (name/loa). No path by which a credential value reaches any of them.unfao/wire/,delivery/,historical.py,track_a_source.py,frame_extraction.pycontain zero references toos.environ/getenv/load_dotenv/credentials: the wire layer is credential-blind by construction (the manager's DIP port hands it data only). Credentials exist in exactly three places in the repo — theAppwriteConfigconstructions inunfao.py— passed as parameters, never logged, never in a repr that is logged.descriptionuploaded into store metadata is a closed key set of delivery primitives (lookup_version,region,expected_cell_count,actual_cell_count,unmapped_count, optionalfill_count);compact_descriptionserializes exactly that dict, fail-loud on overflow.RuntimeError(PR fix(delivery): 255-safe provenance descriptions + loud upload port (#131 findings) #132) embeds filename + the store's error string (server-side text; the key travels in headers, which the SDK does not echo into messages).exc_info=Truetracebacks show source text, not values.DatastoreModule/AppWriteFileModuleinternals, W&B) are pipeline-core's own þing-01 row (C4), not this repo's surface.Change
tests/test_redaction_guard.py— two permanent guards pinning the audited facts: the credential-blind module set stays credential-blind, and the provenance key set stays closed. Zero production-code changes (the audit found nothing to fix).Verification
🤖 Generated with Claude Code