Repository navigation
[Bug] Raw envelopes reach disk before redaction runs, with no file mode set #71
Description
Found by a six-perspective adversarial review of #60.
packages/guardian/src/envelope-log-sink.ts:10-19 states the design plainly: "no field stripping, no redaction, no reordering." server.ts:517 writes the request to .acs/envelopes.jsonl on parse, before dispatch() and before any policy evaluation. ToolCallRequestPayload.raw_command and ToolCallResultPayload.outputs carry the shell commands and tool output that hold credentials.
The sharp part is an asymmetry in the test suite. Dozens of assertions cover redaction on the model-facing path, in hosts/opencode/test/result-gate.test.ts and apply-opencode-output.test.ts. There are none on the envelope-log or audit-sink path. A reader who sees the first set concludes secrets are handled.
Neither audit-sink.ts nor envelope-log-sink.ts passes a mode to mkdirSync or appendFileSync, so files land at the process umask, typically world-readable.
.acs/ is gitignored, which closes the accidental-commit path. That is not the same as the file being safe at rest.
Activity
rocklambros commentedon Oct 12, 2026
A third file joins the two listed here. #244 adds an OTLP trace file (
ACS_OTEL_FILE) that holds decision reasoning, tool names, capabilities, and provenancesource_idvalues, which can be URLs or file paths. Raw tool arguments are not exported. I've asked #244 to create that file with mode0600and its directory with0700, so it should not need fixing here. Please include it when checking this issue's acceptance criteria. Its sample collector config is also movingdebugtoverbosity: basic, so it doesn't print every attribute to stdout.Create the trace file readable by its owner only
Answer the 12 October review of the Go Guardian