Redact credentials and sensitive headers from trace logs

[shiny-code-bot]

Finish Line

Codex Lab trace logging remains useful for dogfood and diagnostics without persisting bearer credentials, cookies, API keys, session secrets, or equivalent sensitive request headers.

Current Status

State: active from installed lab.5 dogfood on August 23, 2026.

The trace generated with the documented RUST_LOG=trace dogfood workflow logged a WebSocket handshake containing a complete authorization header. The local file was owner-readable only, but raw traces cannot be safely shared, attached to issues, or retained as ordinary diagnostic artifacts until redaction is enforced at the logging boundary.

Acceptance Criteria

• HTTP and WebSocket request logging redacts authorization, cookie, API-key, session, and provider credential headers before formatting.
• Redaction applies to debug and trace paths in first-party and wrapped networking clients.
• Regression tests prove secrets never appear in emitted diagnostic text while non-sensitive handshake metadata remains useful.
• Existing dogfood/support instructions warn against sharing older unredacted traces and identify safe cleanup guidance.
• Installed prerelease dogfood produces a usable trace that passes an automated secret-pattern scan.

Relationships

• Related to release/dogfood proof Publish and prove Codex Lab lab.5 #624.
• Related to reliability baseline Make Background Review trustworthy for daily dogfood #570.
• Found while reviewing the real-life lab.5 session for PR Draft: converge to openai/codex 343074d4 #782.

• related: Publish and prove Codex Lab lab.5 #624 - Publish and prove Codex Lab lab.5 #624
• related: Make Background Review trustworthy for daily dogfood #570 - Make Background Review trustworthy for daily dogfood #570