[AlexanderZ-Band]

Why

Supplying an API-key or JWT authentication header still leaves credentials in the WebSocket URL, and transport diagnostics expose credentials and personal data to logging handlers.

What

Select header-only authentication for valid API-key and JWT headers with platform JWT precedence, reject empty or ambiguous headers, and sanitize retained credential-bearing errors. Connection and protocol logs omit dynamic values, frame payloads, identities and raw exception content before handlers receive records while respecting native logger disabling and filters. Cover actual accepted/refused handshakes, reconnects, encoded values, custom handlers, and dynamic log-level changes.

Scope

Mainline security fix for INT-1838. Deliberate standalone query authentication remains available without a header. Application payload redaction, historical logs, publication, and consumer dependency adoption are separate work.

[linear-code]

INT-1838

[AlexanderZ-Band]

Blocking — would be REQUEST_CHANGES on a PR by someone else. One verified logging-configuration regression; header authentication, wire reconnect/refusal behavior and scoped test coverage otherwise passed this review.

[AlexanderZ-Band]

Code review with fixes converged after 2 full-PR cycles. One confirmed logger-configuration regression was fixed in ada7555 and its thread resolved; the second independent pass found no further in-scope issues. Simplify required no changes. Verification: 272 tests passed, 98.02% coverage, Ruff/format/type checks passed; all 10 current CI checks succeeded on this exact head. Review covers header authentication and connection/protocol diagnostics; remote deployment verification remains separate.

[AlexanderZ-Band]

Resume checkpoint — 2026-10-18

Implemented/reviewed/tested; not merged, released or adopted. Owner: Alexander Zaikman. Current-cycle tracking: INT-1838, parent INT-1807. These tickets' current checkpoints supersede the earlier broader attached plans.

Head: ada7555. Review converged in two cycles. Fixed native logger disabling/filter handling; 272 tests, 98.02% coverage, lint/format/types and all 10 current CI checks pass. Zero unresolved inline threads. Normal auto-squash merge is enabled; one independent approval is still required. User authorized merging/releasing #71; do not bypass review rules.

Continue here

1. Refresh head/checks/thread state and obtain the independent approval. Allow normal queued merge; no additional implementation is currently identified.
2. After merge, follow main's .github/workflows/release.yml / Release Please. Inspect environment approval and ensure the release includes the merge. Existing waiting run 38253836838 targets pre-fix main 71c8caf; it cannot establish release of this fix.
3. Review the generated release PR/version, changelog, manifest, pyproject, init and lock. SDK #837 expects >=0.3.1,<0.4, but verify the generated version. Normal main-line release only: no 0.2.x backport, maintenance branch or policy exception. Obtain an explicit command naming the generated release PR before merging it.
4. Verify the GitHub release/tag and publish.yml succeed. That publisher validates a package-prefixed tag/version on main. If publication fails after tagging, recover using its existing workflow_dispatch tag input, not a replacement tag.
5. Verify PyPI and install the actual released wheel. PyPI latest was 0.2.5 and 0.3.1 absent at this checkpoint. Then unblock SDK #837: refresh its real registry lock, run locked validation/current CI and record actual version/adoption in the tickets.

Local checkout: /Users/zaikman/repo/phoenix-main-security-1838. Preserve work; never stash. Prior exact-head local checks: pytest -q, Ruff, format check and pyrefly, using the existing project environment. Rerun when source changes; local candidate tests do not prove registry publication.

Scope remains header authentication and connection/protocol diagnostics. Infrastructure/platform, incident cleanup, generic application logging and unrelated consumer migrations are excluded. No production operational safety or historical remediation is claimed.