Description
An adjacent security review found internal/telemetry/delivery.go logs the raw first-failure error. OTLP SDK non-2xx errors can include backend response text, which may contain sensitive diagnostic material. This pre-existing behavior is separate from the ingress WAL cadence and HTTP acknowledgement correction; no credential or customer instance is included in this finding.
Acceptance Criteria
- #1 First-failure and outage diagnostics preserve useful bounded error classes without logging arbitrary backend response bodies or credential-bearing content
- #2 Local fake HTTP exporter response with a synthetic secret sentinel proves logs exclude the sentinel while failure classification remains visible
- #3 Unknown joined transport errors and recovery summaries retain correct health accounting without exposing raw response text
Definition of Done
- #1 just check passes (the full gate; it is what CI enforces)
- #2 just gen leaves no diff (only if a generated artifact’s inputs changed)
- #3 just –fmt –check passes and every new recipe has a # doc comment and a [group(…)]
Implementation Notes
loop18: 0 implementation attempts; dependency park. D3 serial follow-on cannot start because the WAL build/harness remain unfinished, and delivery.go is part of the retained build candidate. Resume only after the build and identical-entry harness are accepted and landed.
loop19: 1 implementation attempt + 1 review-repair round; landed 303616b9; security review approve (residual Low: one-word malformed HTTP status line can pick a class from the fixed list, no leak); CodeRabbit 0 findings; composed just check green; CI green.
Final Summary
Delivery-health lines log only signal, bounded error class and allowlisted reason; classification uses numeric HTTP status / gRPC code, never server text; non-2xx ‘partial success’ counts as failure. Landed 303616b9.