[echoomegaprime]

Scope

Small, isolated security-hardening follow-up to combined CertForge #49, concurrency #53 and atomicity #54. It changes no release configuration or running service.

The orphan-reconciliation audit previously copied subscriber_run_dispatches.last_error verbatim into an immutable subscriber_audit_events.details_json entry. This value can carry unexpected worker/remote exception text. The new path retains known non-sensitive machine codes (subscriber_worker_claim_denied, dispatch_attempts_exhausted, dispatch_lease_expired), maps other nonempty values to redacted, and preserves a missing value as null.

Adds parametrized regression cases checking known-code retention, synthetic Bearer-like untrusted text non-disclosure and null handling, alongside run terminalization and metering invariants. Tests use only isolated SQLite temporary fixtures.

Base and exact source

• Parent exact commit: 6cb0c9b0dfca33357cf7f8e7c6caa6671a383b78 (draft PR test(subscriber): prove atomic rollback when dispatch compensation fails #54).
• Head exact commit: 24277990381d376ab427e42851c62a03a3110a34.
• Two changed paths; exact GitHub compare: 2 commits ahead, 0 behind.
• PR is stacked into the PR test(subscriber): prove atomic rollback when dispatch compensation fails #54 branch, not main, to avoid unrelated deployment or merge collisions.

Acceptance gates

• Exact-head hosted deterministic CI, targeted tests and audit-chain verification.
• Independent review for audit compatibility and allowed reason-code completeness.
• Verified backup/rollback and security gate coverage for the entire stacked candidate.
• Signed target-specific CertForge production E2E attestation before any final integration/deploy.

No protected credential, production database, service, OAuth registration, Telegram poller, or ESH/Breebell deployment changed.

[echoomegaprime]

2026-11-11 04:23 UTC — guarded audit-minimization patch and isolated acceptance

Created stacked draft PR #55 against PR #54's feature branch (not main) using base 6cb0c9b0dfca33357cf7f8e7c6caa6671a383b78; final head 24277990381d376ab427e42851c62a03a3110a34. GitHub exact comparison: 2 commits ahead, 0 behind; only src/echo_certification_forge/subscriber.py (12 additions, 1 deletion) and tests/test_dispatch_orphan_audit_redaction.py (58 new lines). Exact file blob readback confirms change.

Risk addressed: orphan reconciliation copied subscriber_run_dispatches.last_error verbatim into append-only subscriber_audit_events.details_json. Worker/remote text can include unexpected sensitive content. Patch retains three known machine reason codes; all other nonempty text is redacted; missing value remains null. This is a limited mitigation for the orphan audit path only, not proof that all audit/error paths are sanitized.

Independent native acceptance on FORGE: Nexus governed python3 execution copied 457 tracked files from the preexisting isolated CertForge checkout into a fresh temporary sandbox, and verified the original combined subscriber.py SHA-256 c8f088b2888c171e80b3ebdc6370752f35113fde288b2cfc894178c1bfe282a1 before applying the exact patch and saved test. Executed python3 -m pytest -q tests/test_dispatch_orphan_audit_redaction.py: 3 passed in 6.85s, exit 0, stderr empty. Assertions cover safe reason retention, synthetic bearer-style message redaction, null preservation, queue terminalization and zero outstanding meter usage. Scratch cleaned by TemporaryDirectory; no production DB touched.

Hosted CI: certification-forge-ci run 42958758348 was in_progress on last check; no green conclusion claimed.

Held release gates: Independent audit compatibility review, exact-head CI/security, full stacked-suite verification, backup/rollback, signed production critical-journeys and E2E attestation. Current CertForge signed verdict remains NOT_READY. PR #55 stays draft/unmerged, no protected or running services changed.

[echoomegaprime]

2026-11-11 05:17 UTC — independent exact-head CI closure and isolated negative-path review

GitHub exact-head CI now verified green: draft PR #55 head 24277990381d376ab427e42851c62a03a3110a34; certification-forge-ci #42958758348 = completed/success. Its test job #130320028951 is green; independent job-step readback confirms exact checkout, compilation, full deterministic suite, P1 verification, P6 deployment-enforcement acceptance, P7 governance acceptance and evidence upload succeeded. Existing isolated audit-redaction 3/3 still valid. This is CI proof, not signed PRODUCTION_READY or permission to merge.

Targeted independent negative-path attempt: A fresh disposable FORGE clone of 457 tracked files from the previously isolated combined #40/#41 scratch checkout executed one proposed missing-positive-usage test. It did not exercise the intended missing-meter condition: SQLite rejected DELETE FROM subscriber_usage_events with sqlite3.IntegrityError: subscriber_usage_events are append-only. This is useful proof that the immutable usage-event guard blocks the naive deletion precondition. The test is not counted as passing and no accounting defect is claimed; a valid reachable missing-meter reproduction would need a separate, authorized fault model. Scratch was auto-cleaned; production DB and Git refs were untouched.

Remaining gates: Independent review of reason-code allowlist, valid backed-up/rollback-safe exact stacked candidate, signed critical-journey and production E2E attestation. Latest connected CertForge signed run remains NOT_READY. No merge, deployment, configuration, credential or protected write.