fix(llm): redact provider management identifiers

[tom-sapletta-com]

Ticket: ticket-072

Redacts configured credentials, credential-shaped values, stable credential identifiers and provider key-management URLs once at the OpenRouter boundary. Ordinary provider diagnostics, retry semantics and require-llm fail-closed behavior remain unchanged.

Validation:

• focused OpenRouter suite: 21/21
• full host suite: 407 total, 406 pass, 0 fail, one local JDK skip
• gold v2: all gated metrics 100 percent
• governance: zero findings
• dependency audit: zero vulnerabilities
• Docker smoke: PASS
• paid weekly-limit reproduction: effectiveMode none, graph null, no management path or raw fingerprint

[ifuri-validator-agent]

Deterministic Validator approval for exact head cda4f9cbc19372d73431dfacbdf709a94e8c8031.

Ticket: ticket-072
Correlation ID: todo2code-ticket-072-cda4f9cbc193
Model: openrouter/z-ai/glm-5.2
Reviewed diff chunks: 3
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 3 diff chunk(s). This chunk contains ticket documentation, intent metadata, changelog, and agent logs for ticket-072, which redacts provider key-management identifiers at the OpenRouter boundary. No source code or test code is present in this chunk; it is purely documentation and metadata. The test_results_data shows all required checks passing (verify PASS, Java adapter PASS, koru/code-review PASS), with skipped checks being optional/opt-in (live OpenRouter contract, governance). No blocking or security findings are present in the visible content. | OpenRouter adapter now redacts credentials, credential identifiers, and provider management URLs from provider error messages before they cross the LLM boundary. Tests cover the new redaction behavior and confirm sensitive values are absent from thrown errors. All reported checks pass with no failures. | Test chunk renames a fake API key constant from 'secret-test-key' to 'test-secret-key' across many OpenRouter tests and adds assertions verifying that API keys are not leaked in error messages. No production code changes appear in this chunk. Security-positive: explicit assertions ensure neither the echoed key nor the configured key appears in thrown error messages.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Merge was not requested or performed.

Decision record (recomputable)

DECISION D-072-3363
TICKET ticket-072
HEAD_SHA cda4f9cbc19372d73431dfacbdf709a94e8c8031
CORRELATION_ID todo2code-ticket-072-cda4f9cbc193
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["Live OpenRouter contract (opt-in)=SKIPPING","governance=SKIPPING","verify=PASS","Java adapter (JDK 17 required)=PASS","koru / code-review=PASS","governance=SKIPPING","Live OpenRouter contract (opt-in)=SKIPPING","verify=PASS","Java adapter (JDK 17 required)=PASS"]
INPUT required_checks = ["verify","Java adapter (JDK 17 required)","koru / code-review"]
INPUT required_checks_source = "env/request"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "openrouter/z-ai/glm-5.2"
ASSERT VERDICT_AUTHORITY != "ADVISORY"

[ifuri-validator-agent]

Deterministic Validator approval for exact head 752292826de01d5f5ad8c505c265774a923a4ca1.

Ticket: ticket-072
Correlation ID: todo2code-ticket-072-752292826de0
Model: openrouter/z-ai/glm-5.2
Reviewed diff chunks: 3
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 3 diff chunk(s). This chunk adds ticket-072 documentation, intent metadata, changelog, and agent logs for a bounded OpenRouter provider-error redaction change. The visible content is documentation only; no source code or test code is present in this chunk. No secrets, credentials, or sensitive identifiers are exposed in the ticket files. Test results show all checks passing (verify PASS, code-review PASS, Java adapter PASS). No blocking issues are visible in this documentation chunk. | The diff implements credential redaction at the OpenRouter adapter boundary via redactProviderFailureText, covering bearer tokens, OpenRouter-specific keys, secret assignments, credential identifiers, and provider management URLs. Tests verify redaction while preserving diagnostic messages. No test failures in test_results_data. | This chunk contains test updates that harden credential handling: replacing a recognizable placeholder key ('secret-test-key') with 'test-secret-key', renaming an echoed variable to echoedApiKey, and adding assertions that errors and payloads do not leak the API key. The changes align with ticket-072's stated goal of redacting credentials at the OpenRouter boundary. Visible test results pass with no failures.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Merge was not requested or performed.

Decision record (recomputable)

DECISION D-072-7808
TICKET ticket-072
HEAD_SHA 752292826de01d5f5ad8c505c265774a923a4ca1
CORRELATION_ID todo2code-ticket-072-752292826de0
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["Live OpenRouter contract (opt-in)=SKIPPING","governance=SKIPPING","Java adapter (JDK 17 required)=PASS","verify=PASS","koru / code-review=PASS","Live OpenRouter contract (opt-in)=SKIPPING","governance=SKIPPING","verify=PASS","Java adapter (JDK 17 required)=PASS"]
INPUT required_checks = ["verify","Java adapter (JDK 17 required)","koru / code-review"]
INPUT required_checks_source = "env/request"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "openrouter/z-ai/glm-5.2"
ASSERT VERDICT_AUTHORITY != "ADVISORY"