From 79cb08efc7e61372a0e703498bd6b544941e912f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Thu, 10 Sep 2026 01:26:40 +0200
Subject: [PATCH] test(ops): prove the journey's redactor on a key-shaped body

Low, review 2. The self-test walked every leg but never once asked whether
the redactor actually holds. The excerpt path is the only thing between a
token in a failure body and the run log, so it gets its own case: a body
carrying this project's own key prefix must come back with the token
replaced.
---
 scripts/synthetic-journey.mjs | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/scripts/synthetic-journey.mjs b/scripts/synthetic-journey.mjs
index d5ddfb732..e70a5c4db 100644
--- a/scripts/synthetic-journey.mjs
+++ b/scripts/synthetic-journey.mjs
@@ -673,6 +673,22 @@ function selfTestHostAllowlist() {
   return failures;
 }
 
+/**
+ * The excerpt path is what keeps a token out of a failure log. Prove it
+ * once, on a body shaped like this project's own key prefix.
+ */
+function selfTestRedaction() {
+  const shaped = `hlk_${"a".repeat(24)}`;
+  const redacted = excerpt(`{"error":"bad token","token":"${shaped}"}`);
+  const label = "redaction";
+  if (redacted.includes("hlk_") || !redacted.includes("[redacted]")) {
+    console.log(`self-test FAILED  ${label.padEnd(44)} → ${redacted}`);
+    return 1;
+  }
+  console.log(`self-test ok      ${label.padEnd(44)} → ${redacted}`);
+  return 0;
+}
+
 async function selfTest() {
   const cases = [
     { breaks: null, expect: "pass", clean: true },
@@ -713,7 +729,7 @@ async function selfTest() {
     { breaks: "delete: kept", expect: "fail", leg: "delete" },
   ];
 
-  let failures = selfTestHostAllowlist();
+  let failures = selfTestHostAllowlist() + selfTestRedaction();
   for (const testCase of cases) {
     const label = testCase.breaks ?? "nothing broken";
     const instance = await startMockInstance(testCase.breaks);
@@ -752,7 +768,7 @@ async function selfTest() {
     return 1;
   }
   console.log(
-    `\nself-test: ${cases.length} journey cases, every leg proven breakable; host allowlist proven`,
+    `\nself-test: ${cases.length} journey cases, every leg proven breakable; host allowlist and redaction proven`,
   );
   return 0;
 }