CB-575: charter receipt on spawn, in the roster and in the logs

Record a CharterReceipt (role, source, sha-256 digest, byte count) for every
launch, store it on the MemberSession, expose it in bridge_list and GET
/members, and log it at spawn as digest+role only. Redact the charter argv
argument in the legacy pane-placement spawn log so the charter text never
reaches the daemon log. The charter prose itself is never recorded.

bridged/src/test/java/dev/ltms/bridged/member/HerdrPeerLauncherCharterTest.java

@@ -1,13 +1,19 @@
 package dev.ltms.bridged.member;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.peer.Capability;
+import dev.ltms.bridged.peer.CharterReceipt;
 import dev.ltms.bridged.peer.MemberRole;
 import dev.ltms.bridged.peer.SpawnRequest;
 import org.junit.jupiter.api.Test;
+import org.slf4j.LoggerFactory;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -17,6 +23,8 @@ import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Supplier;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 class HerdrPeerLauncherCharterTest {
 
@@ -38,10 +46,72 @@ class HerdrPeerLauncherCharterTest {
                 "a role charter does not depend on an MCP mount");
     }
 
+    @Test
+    void panePlacementSpawnLogNeverContainsTheCharterText() {
+        // A pane-placement spawn used to log the whole argv (CB-575), and the charter travels
+        // inside argv — so the charter text leaked to the daemon log. Prove the legacy pane path
+        // now redacts it to its digest.
+        String secret = "TOP SECRET charter marker 99x"; // distinctive, so a leak is unambiguous
+        AtomicReference<BridgedConfig.Fleet> fleet = new AtomicReference<>(fleet(Map.of("dev", secret)));
+        CharterArgLauncher launcher = new CharterArgLauncher(fleet::get);
+
+        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
+        Level previous = logger.getLevel();
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        logger.setLevel(Level.INFO); // the test logback sets dev.ltms.bridged to WARN; a leak lives at INFO
+        try {
+            launcher.spawn(new SpawnRequest("mcp", null, null, null, null, MemberRole.DEV));
+
+            String all = String.join("\n", appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
+            assertFalse(all.contains(secret),
+                    "the pane-placement spawn log must not contain the charter text; got:\n" + all);
+            // The "mcp" profile composes role + reply charter; the digest must match that composed
+            // string (the exact bytes the adapter receives), proving the redaction hashes and
+            // removes the real, full charter — not some placeholder.
+            String composed = secret + "\n\n" + HerdrPeerLauncher.REPLY_CHARTER;
+            assertTrue(all.contains("<charter sha256=" + CharterReceipt.digestOf(composed) + ">"),
+                    "the charter argv argument should be replaced by its digest; got:\n" + all);
+        } finally {
+            logger.setLevel(previous);
+            logger.detachAppender(appender);
+        }
+    }
+
     private static BridgedConfig.Fleet fleet(Map<String, String> charters) {
         return new BridgedConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(), charters, null);
     }
 
+    private static BridgedConfig.Profile profile(String name, String mcpUrl) {
+        return new BridgedConfig.Profile(name, "http://gx00.gw:8000", null, null,
+                "BRIDGED_WORKER_TOKEN", List.of("test"), "pane", null, null, mcpUrl, null, null);
+    }
+
+    /**
+     * A launcher whose {@code buildLaunch} hands the composed charter to herdr as one argv element
+     * (what the claude-cod adapter does), so a pane-placement spawn log would print it unless the
+     * base redacts it.
+     */
+    private static final class CharterArgLauncher extends HerdrPeerLauncher {
+
+        CharterArgLauncher(Supplier<BridgedConfig.Fleet> fleet) {
+            super("test", new AgentControl(new FakeHerdr()), new WorkspaceControl(new FakeHerdr()),
+                    Map.of("mcp", profile("mcp", "http://bridge")),
+                    "mcp", _ -> null, 0, () -> 0L, () -> { }, fleet);
+        }
+
+        @Override
+        protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
+            return new Launch(Map.of(), List.of("test", spec.charter() == null ? "none" : spec.charter()));
+        }
+
+        @Override
+        public Set<Capability> capabilities() {
+            return Set.of();
+        }
+    }
+
     private static final class CapturingLauncher extends HerdrPeerLauncher {
         private final List<LaunchSpec> specs = new ArrayList<>();
 
@@ -62,10 +132,5 @@ class HerdrPeerLauncherCharterTest {
         public Set<Capability> capabilities() {
             return Set.of();
         }
-
-        private static BridgedConfig.Profile profile(String name, String mcpUrl) {
-            return new BridgedConfig.Profile(name, "http://gx00.gw:8000", null, null,
-                    "BRIDGED_WORKER_TOKEN", List.of("test"), "pane", null, null, mcpUrl, null, null);
-        }
     }
 }

bridged/src/test/java/dev/ltms/bridged/peer/CharterReceiptTest.java

@@ -0,0 +1,57 @@
+package dev.ltms.bridged.peer;
+
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class CharterReceiptTest {
+
+    @Test
+    void recordsNoCharterConfiguredDistinctFromCharterDelivered() {
+        // No role charter configured — only the reply charter is composed. Source is "none", but
+        // text was still delivered, so absent() is false and the digest is present.
+        CharterReceipt viaReply = CharterReceipt.compose(MemberRole.DEV, "s", null, "reply charter");
+        // A role charter was configured AND delivered.
+        CharterReceipt delivered = CharterReceipt.compose(MemberRole.DEV, "s", "role charter",
+                "role charter\n\nreply charter");
+
+        // The two cases must not collapse: the no-role-charter case reports "none", the delivered
+        // case reports the config key, and their digests differ.
+        assertEquals(CharterReceipt.NO_SOURCE, viaReply.charterSource());
+        assertEquals("fleet.charters.dev", delivered.charterSource());
+        assertNotEquals(viaReply.charterSource(), delivered.charterSource());
+        assertNotEquals(viaReply.charterSha256(), delivered.charterSha256());
+
+        // Both actually delivered text — the distinction is the source and digest, not absence.
+        assertFalse(viaReply.absent());
+        assertFalse(delivered.absent());
+    }
+
+    @Test
+    void recordsExplicitAbsenceWhenNoCharterIsComposed() {
+        CharterReceipt none = CharterReceipt.compose(MemberRole.REVIEWER, "s", null, null);
+        assertTrue(none.absent());
+        assertNull(none.charterSha256());
+        assertEquals(0, none.charterBytes());
+        assertEquals(CharterReceipt.NO_SOURCE, none.charterSource(),
+                "no configured charter and nothing composed still reports a source, never a gap");
+    }
+
+    @Test
+    void digestIsStableForSameTextAndDiffersForDifferentText() {
+        assertEquals(CharterReceipt.digestOf("charter-aaa"), CharterReceipt.digestOf("charter-aaa"),
+                "the same text must always produce the same digest");
+        assertNotEquals(CharterReceipt.digestOf("charter-aaa"), CharterReceipt.digestOf("charter-bbb"),
+                "different text must produce a different digest");
+        assertNull(CharterReceipt.digestOf(""), "blank text carries no digest");
+
+        // The record's fingerprint matches the standalone digest for the same composed string.
+        CharterReceipt r = CharterReceipt.compose(MemberRole.DEV, "s", "role", "the composed text");
+        assertEquals(CharterReceipt.digestOf("the composed text"), r.charterSha256());
+        assertFalse(r.absent());
+    }
+}

bridged/src/test/java/dev/ltms/bridged/session/SessionManagerTest.java

@@ -10,6 +10,8 @@ import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.member.ClaudeCodeLauncher;
+import dev.ltms.bridged.peer.CharterReceipt;
+import dev.ltms.bridged.peer.MemberRole;
 import dev.ltms.bridged.peer.PeerUnreachableException;
 import org.junit.jupiter.api.Test;
 import org.slf4j.LoggerFactory;
@@ -90,6 +92,24 @@ class SessionManagerTest {
         assertEquals(2, sessions.roster().size(), "both sessions are registered");
     }
 
+    @Test
+    void rosterViewExposesTheCharterReceiptButNeverTheCharterText() {
+        // The roster (bridge_list and GET /members both render through rosterView) must let a lead
+        // see which charter a member got, without ever carrying the charter prose itself (CB-575).
+        MemberSession s = new MemberSession("p1", "term1", "prof", MemberRole.DEV, "/cwd", null,
+                0, 0, 0, MemberSession.State.READY, null, null,
+                CharterReceipt.compose(MemberRole.DEV, "prof", "role charter", "role charter\n\nreply"));
+
+        Map<String, Object> view = SessionManager.rosterView(s, null);
+
+        assertEquals("fleet.charters.dev", view.get("charterSource"),
+                "the config key that supplied the role charter is reported");
+        assertEquals(CharterReceipt.digestOf("role charter\n\nreply"), view.get("charterSha256"),
+                "the digest of the exact composed charter bytes is reported");
+        assertFalse(view.values().toString().contains("role charter"),
+                "the roster row must not embed the charter text itself");
+    }
+
     @Test
     void aNullTerminalFromThePrimaryIsANoOpEvenWithSessionsRegistered() {
         // The primary resolves to a Principal with no terminal, and BridgeMcp's context extractor