fix(security): redact research failures before persistence and events

[1012839419a-alt]

Parent: #130
Verifier evidence: #137 / commit 6a6a646418b902195edd98ca880a8aae02390aa9

Goal

Prevent secrets or untrusted request text from being persisted or returned in project research run errors and research.failed events. Preserve useful, stable error categories and correlation data without echoing credentials, URLs containing secrets, raw exception bodies, or arbitrary input.

Execution contract

• Worktree: D:\projects\opencli-research-redaction-20260914
• Branch: codex/research-redaction-20260914
• Baseline: 6b7c69e0d7f1767d7101336cfeb68e869c772fdf
• Worker owns only:
  • _bmad-output/implementation-artifacts/spec-gh-139-research-event-redaction.md
  • backend/services/research_service.py
  • tests/unit/test_research_service.py
  • tests/integration/test_research_api.py
• Do not touch MCP/tool routing, models/migrations, package files, or production data.
• If a shared redaction utility or additional file is truly required, report upward before expanding scope.

Acceptance

• Secret-bearing seed URL, Authorization/Bearer/API-key/password-like values, and hostile exception strings never appear in stored error_message, reply_payload, or emitted research.failed event payloads.
• Stable public error code/category and safe bounded message remain.
• Existing successful/partial research behavior and idempotency remain intact.
• Targeted tests and git diff --check pass; report real vs fixture evidence.

[1012839419a-alt]

Draft specification revised and cross-reviewed. Commit: 1594eb724f911b5188038ac934e785224258db40. The redaction boundary now covers DB, API, event, reply, logger.exception/traceback and operational logs; negative tests must prove URLs/userinfo/query secrets, Authorization/Bearer/API-key/password/token values, and hostile exception text never cross those surfaces while safe category/correlation data remains. Status remains draft; no implementation has started pending approval.

[1012839419a-alt]

Human approval received in the Codex closeout thread on 2026-09-14: A / Approve. Approved scope is revised draft commit 1594eb72, including DB/API/event/reply/log/traceback negative redaction acceptance.