fleetd #638: mask userinfo in the daemon verdict line before it prints

Apply the userinfo-only rewrite (sed -E 's#://[^@]*@#://<redacted>@#g') to every
path that prints config-edit.sh's $VERDICT_LINE: restore_and_confirm's two
prints, report_outcome's shared local copy (covering its clean/needs-restart/
refused branches), and check_mode's "last verdict in log" line via
last_verdict_line. Deliberately not routed through redact() — that function's
key:value masking does not match this line's prose, and the rest of the line
(e.g. the pattern quoted in a parse-failure refusal) is the detail an operator
needs to fix the refusal.

No current refusal message echoes a URI, token or password, so this is a guard
against a future validator doing so, not a fix for an observed leak.

fleetd/src/main/java/dev/ltms/fleet/auth/Authz.java

@@ -20,22 +20,16 @@ public final class Authz {
         SPAWN,
         /** Tear a worker peer down. */
         STOP,
-        /** Deliver a turn to a local session, addressed by {@code sessionId}. */
+        /** Deliver a turn to a session (or answer a worker's question). */
         SEND,
-        /** Resolve a worker's blocked question and resume its turn, addressed by {@code turnId}. */
-        ANSWER,
-        /** Address a peer lead on another daemon over the coordination broker, by {@code coordId}. */
-        COORD_SEND,
         /** A worker's terminal reply for its own turn. */
         REPLY,
         /** A worker's mid-turn question to the primary. */
         ASK,
         /** Collect held replies from a session's inbox. */
         DRAIN,
-        /** Read-only roster, profile, and identity observation: no ticket, task, or turn state. */
+        /** Read-only observation: status, roster, profiles, task polling. */
         READ,
-        /** Poll a ticket, or read a session's status. */
-        TASK_READ,
         /**
          * Read (never ack) this daemon's own held lead-to-lead coordination mail (fleetd #421).
          *
@@ -77,19 +71,11 @@ public final class Authz {
             // escalating into the orchestrator role.
             case SPAWN, STOP, DRAIN, HANDOVER -> caller.isPrimary();
 
-            // Delivering a turn to a local session is open to the primary and the architect: an
-            // architect delegates to workers (that is the role's point) but still has no lifecycle
-            // rights. A worker is excluded — sending would be it escalating.
+            // Delivering a turn is open to the primary and the architect: an architect delegates
+            // to workers (that is the role's point) but still has no lifecycle rights. A worker is
+            // excluded — sending would be it escalating.
             case SEND -> caller.isPrimary() || caller.isArchitect();
 
-            // Same grant as SEND. Resolving a worker's blocked question is part of delegating to
-            // it, not a separate capability.
-            case ANSWER -> caller.isPrimary() || caller.isArchitect();
-
-            // Same grant as SEND. This leaves the daemon over the coordination broker rather than
-            // addressing a local session, but the caller who may do one may do the other.
-            case COORD_SEND -> caller.isPrimary() || caller.isArchitect();
-
             // The load-bearing rule: a caller acts only as the pane it occupies. CB-532 widened who
             // that can be — a lead answering another lead is replying for its OWN terminal, which
             // this already permits — while the rule itself is unchanged, and is what stops anyone
@@ -98,17 +84,10 @@ public final class Authz {
             // unnamed primary (token/loopback, no pane) owns nothing and is still excluded.
             case REPLY, ASK -> caller.ownsSession(targetSession);
 
-            // READ is roster, profile, and identity observation — fleet_list, fleet_profiles, and
-            // fleet_whoami — and carries no secrets: no ticket reply, no pending question, and no
-            // other session's turn state. Those live under TASK_READ. METRICS is the separate
-            // Prometheus scrape. Both stay open to every authenticated role.
+            // Observation is open to every authenticated role: a worker legitimately polls its own
+            // status, and the roster carries no secrets.
             case READ, METRICS -> caller.isPrimary() || caller.isWorker() || caller.isArchitect();
 
-            // Ticket polling and session status, open to every authenticated role the same as READ.
-            // Unlike READ, a holder may poll a ticket it did not create, or read another session's
-            // pending question and the turnId that answers it.
-            case TASK_READ -> caller.isPrimary() || caller.isWorker() || caller.isArchitect();
-
             // fleetd #421: reading held lead-to-lead mail is the primary's alone. An architect
             // holds READ today (CB-548), so "not primary" must mean not-architect here too — this
             // is coordination between leads, not observation of the roster.

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -690,7 +690,7 @@ public final class FleetMcp {
             return null; // AuthorizationMode.UNENFORCED: authorization not enforced (fleetd #518)
         }
         if (Authz.permits(caller, action, target)) {
-            if (action != Authz.Action.READ && action != Authz.Action.TASK_READ) {
+            if (action != Authz.Action.READ) {
                 AuditLog.allowed(caller, action, target); // reads would drown the trail
             }
             return null;
@@ -1035,21 +1035,31 @@ public final class FleetMcp {
     }
 
     /**
-     * Which authorization action a {@code fleet_poll} call needs, decided by its arguments.
+     * Which authorization action a {@code fleet_poll} call needs, decided by its arguments
+     * (fleetd #272, widened by fleetd #421).
      *
-     * <p>{@code fleet_poll} is <strong>three operations behind one tool name</strong>. With
+     * <p>{@code fleet_poll} is now <strong>three operations behind one tool name</strong>. With
      * {@code ticket} it observes an async delegation and changes nothing, which is a {@link
-     * Authz.Action#TASK_READ}. With {@code target} it calls {@link MessageService#drainReplies} on
-     * that session -- the replies are removed from the inbox and a second call returns nothing --
-     * so it is a {@link Authz.Action#DRAIN}, the same gate {@code fleet_ack} already uses for
-     * removing a single message, and the same one the REST path uses at
-     * {@code FleetApp.drainReplies}. With {@code coordId} it reads (never acks) this daemon's own
-     * held lead-to-lead mail, which is a {@link Authz.Action#COORD_READ} -- <strong>not</strong>
-     * {@code TASK_READ} or {@code READ}: a lead-to-lead body is a different inbox from either, and
-     * folding it into either would let any worker or architect read every peer lead's mail in full.
+     * Authz.Action#READ}. With {@code target} it calls {@link MessageService#drainReplies} on that
+     * session -- the replies are removed from the inbox and a second call returns nothing -- so it
+     * is a {@link Authz.Action#DRAIN}, the same gate {@code fleet_ack} already uses for removing a
+     * single message, and the same one the REST path uses at {@code FleetApp.drainReplies}. With
+     * {@code coordId} it reads (never acks) this daemon's own held lead-to-lead mail, which is a
+     * {@link Authz.Action#COORD_READ} -- <strong>not</strong> {@code READ}, even though nothing is
+     * consumed: {@code READ}'s grant is open to every authenticated role on the premise that the
+     * roster carries no secrets, and a lead-to-lead body is not the roster. Mapping a non-destructive
+     * peer-mail read to {@code READ} would let any worker read every peer lead's mail in full.
+     *
+     * <p>Before this method existed (fleetd #272) the handler passed a constant {@code READ} for
+     * both of the original branches. {@code READ} is open to every authenticated role, so any
+     * worker could read a peer's id out of {@code fleet_list} and destroy the replies that peer had
+     * queued for the primary. The gate failed open, and it did so because the required action is a
+     * function of the arguments while the handler chose it before looking at them.
      *
      * <p>The choice lives in this method, and not inline in the handler, so that a test can assert
-     * the mapping the handler actually uses.
+     * the mapping the handler actually uses. {@code FleetMcpAuthzTest} already checked every
+     * {@link Authz.Action} against every {@link Role} and passed throughout -- it tested the policy
+     * table, which was correct, while the defect was in which action the caller handed it.
      *
      * <p>Checked first, and exclusively of {@code target}: a call naming {@code coordId} is reading
      * a different inbox entirely (this daemon's own lead channel, never a worker's), so it takes
@@ -1062,30 +1072,7 @@ public final class FleetMcp {
         if (!isBlank(coordId)) {
             return Authz.Action.COORD_READ;
         }
-        return isBlank(target) ? Authz.Action.TASK_READ : Authz.Action.DRAIN;
-    }
-
-    /**
-     * Which authorization action a {@code fleet_send} call needs, decided by its arguments.
-     *
-     * <p>{@code fleet_send} is three call shapes behind one tool name, mirroring {@link
-     * #pollAction}. With {@code coordId} it addresses a peer lead on another daemon over the
-     * coordination broker, which is {@link Authz.Action#COORD_SEND}. With {@code turnId} it
-     * resolves a worker's blocked {@code fleet_ask} and resumes that turn, which is {@link
-     * Authz.Action#ANSWER}. Otherwise it delivers to a local session by {@code sessionId}, which is
-     * the plain {@link Authz.Action#SEND}.
-     *
-     * <p>Checked in the same order the handler branches: {@code coordId} first and exclusively of
-     * {@code turnId}, matching {@link #sendToLead}'s own mutual-exclusion check.
-     *
-     * @param coordId the {@code coordId} argument of the call, or {@code null}/blank when absent
-     * @param turnId  the {@code turnId} argument of the call, or {@code null}/blank when absent
-     */
-    static Authz.Action sendAction(String coordId, String turnId) {
-        if (!isBlank(coordId)) {
-            return Authz.Action.COORD_SEND;
-        }
-        return isBlank(turnId) ? Authz.Action.SEND : Authz.Action.ANSWER;
+        return isBlank(target) ? Authz.Action.READ : Authz.Action.DRAIN;
     }
 
     /**
@@ -1110,11 +1097,10 @@ public final class FleetMcp {
      */
     private static Authz.Action authzAction(FleetTool tool, Map<String, Object> arguments) {
         return switch (tool) {
-            case SEND -> sendAction(str(arguments, "coordId"), str(arguments, "turnId"));
+            case SEND -> Authz.Action.SEND;
             case REPLY -> Authz.Action.REPLY;
             case ASK -> Authz.Action.ASK;
-            case STATUS -> Authz.Action.TASK_READ;
-            case LIST, PROFILES, WHOAMI -> Authz.Action.READ;
+            case STATUS, LIST, PROFILES, WHOAMI -> Authz.Action.READ;
             case POLL -> pollAction(str(arguments, "target"), str(arguments, "coordId"));
             case ACK -> Authz.Action.DRAIN;
             case SPAWN -> Authz.Action.SPAWN;

fleetd/src/main/java/dev/ltms/fleet/rest/FleetApp.java

@@ -49,36 +49,18 @@ import java.util.stream.Collectors;
  */
 public final class FleetApp {
 
-    /**
-     * The authorization action the matching route handler hands to {@link #allow}, for a route
-     * whose action does not depend on the request body.
-     */
+    /** The authorization action the matching route handler hands to {@link #allow}. */
     static Authz.Action routeAction(String route) {
-        return routeAction(route, null);
-    }
-
-    /**
-     * As above, plus the one route whose action depends on the body: {@code POST
-     * /sessions/{id}/message} carries a {@code turnId} (the answer-a-blocked-worker shape) or not
-     * (a plain delivery), mirroring {@code FleetMcp#sendAction}'s split of the same two call
-     * shapes over MCP. {@code turnId} is ignored by every other route.
-     *
-     * @param turnId the request body's {@code turnId}, or {@code null}/blank when absent or not
-     *               applicable to this route
-     */
-    static Authz.Action routeAction(String route, String turnId) {
         return switch (route) {
             case "GET /metrics" -> Authz.Action.METRICS;
             case "POST /members" -> Authz.Action.SPAWN;
             case "DELETE /members/{paneId}" -> Authz.Action.STOP;
-            case "POST /sessions/{id}/message" -> turnId == null || turnId.isBlank()
-                    ? Authz.Action.SEND : Authz.Action.ANSWER;
+            case "POST /sessions/{id}/message" -> Authz.Action.SEND;
             case "POST /sessions/{id}/reply" -> Authz.Action.REPLY;
             case "GET /sessions/{id}/replies" -> Authz.Action.DRAIN;
             case "POST /sessions/{id}/ask" -> Authz.Action.ASK;
             case "GET /sessions", "GET /agents", "GET /members", "GET /profiles",
-                    "GET /member-credentials" -> Authz.Action.READ;
-            case "GET /sessions/{id}/status", "GET /tasks/{ticket}" -> Authz.Action.TASK_READ;
+                    "GET /member-credentials", "GET /sessions/{id}/status", "GET /tasks/{ticket}" -> Authz.Action.READ;
             default -> throw new IllegalArgumentException("route has no authorization gate: " + route);
         };
     }
@@ -268,8 +250,7 @@ public final class FleetApp {
         }
         Principal caller = ctx.attribute(CALLER);
         if (Authz.permits(caller, action, target)) {
-            if (action != Authz.Action.READ && action != Authz.Action.METRICS
-                    && action != Authz.Action.TASK_READ) {
+            if (action != Authz.Action.READ && action != Authz.Action.METRICS) {
                 AuditLog.allowed(caller, action, target); // reads would drown the trail
             }
             return true;
@@ -622,33 +603,26 @@ public final class FleetApp {
      * status-gated injector and block until the worker returns a structured {@code fleet_reply}.
      * Times out with a typed 202 (working / queued / busy) rather than an error — the message may
      * still land.
-     *
-     * <p>Two call shapes share this route, exactly as {@code fleet_send} does over MCP (see
-     * {@code FleetMcp#sendAction}): a plain delivery to {@code id}, and -- when the body carries
-     * {@code turnId} -- resolving a worker's blocked question. The body is parsed before the
-     * authorization check so the right one of {@link Authz.Action#SEND}/{@link Authz.Action#ANSWER}
-     * reaches the gate; a body that fails to parse is treated as the plain shape for that check
-     * alone, and is rejected afterward exactly as before.
      */
     private void sendMessage(Context ctx) {
         String id = ctx.pathParam("id");
-        JsonNode body;
-        try {
-            body = mapper.readTree(ctx.body());
-        } catch (Exception e) {
-            body = null;
-        }
-        String turnId = body == null ? null : body.path("turnId").asText(null);
-        if (!allow(ctx, routeAction("POST /sessions/{id}/message", turnId), id)) {
+        if (!allow(ctx, routeAction("POST /sessions/{id}/message"), id)) {
             return;
         }
-        if (body == null) {
+        String content;
+        String turnId;
+        long timeout;
+        boolean wait;
+        try {
+            JsonNode body = mapper.readTree(ctx.body());
+            content = body.path("content").asText("");
+            turnId = body.path("turnId").asText(null);
+            timeout = body.path("timeoutMs").asLong(DEFAULT_MESSAGE_TIMEOUT_MS);
+            wait = body.path("wait").asBoolean(true); // default: block for the reply (CB-104)
+        } catch (Exception e) {
             ctx.status(400).json(Map.of("error", "bad_request", "detail", "body must be JSON"));
             return;
         }
-        String content = body.path("content").asText("");
-        long timeout = body.path("timeoutMs").asLong(DEFAULT_MESSAGE_TIMEOUT_MS);
-        boolean wait = body.path("wait").asBoolean(true); // default: block for the reply (CB-104)
         if (content.isBlank()) {
             ctx.status(400).json(Map.of("error", "bad_request", "detail", "content is required"));
             return;

fleetd/src/test/java/dev/ltms/fleet/auth/AuthzTest.java

@@ -38,37 +38,6 @@ class AuthzTest {
         }
     }
 
-    /**
-     * {@code fleet_send} is three call shapes behind one action name until {@code
-     * FleetMcp#sendAction} picks one: a plain local {@link Authz.Action#SEND}, the {@code coordId}
-     * route ({@link Authz.Action#COORD_SEND}), and the {@code turnId} answer form ({@link
-     * Authz.Action#ANSWER}). All three carry the same grant as the undivided action did — a worker
-     * is excluded from every one, exactly as it was excluded from the one combined action before.
-     */
-    @Test
-    void theThreeSendShapesCarryTheSameGrantAsTheOldUndividedAction() {
-        for (Authz.Action a : new Authz.Action[]{SEND, COORD_SEND, ANSWER}) {
-            assertTrue(Authz.permits(PRIMARY, a, "term_a"), "the primary may " + a);
-            assertTrue(Authz.permits(ARCH_DESIGN, a, "term_a"), "an architect may " + a);
-            assertFalse(Authz.permits(WORKER_A, a, "term_a"),
-                    "a worker performing " + a + " would be escalating into the orchestrator role");
-            assertFalse(Authz.permits(ANON, a, "term_a"));
-        }
-    }
-
-    /**
-     * {@code fleet_poll{ticket}} and {@code fleet_status} are {@link Authz.Action#TASK_READ}, split
-     * out of the roster-only {@link Authz.Action#READ} (fleetd #678). The grant is unchanged from
-     * what the undivided {@code READ} action gave every one of these callers.
-     */
-    @Test
-    void taskReadCarriesTheSameGrantReadDidBeforeTheSplit() {
-        assertTrue(Authz.permits(PRIMARY, TASK_READ, null));
-        assertTrue(Authz.permits(WORKER_A, TASK_READ, null));
-        assertTrue(Authz.permits(ARCH_DESIGN, TASK_READ, null));
-        assertFalse(Authz.permits(ANON, TASK_READ, null));
-    }
-
     @Test
     void aWorkerMayReplyAndAskOnlyAsItself() {
         assertTrue(Authz.permits(WORKER_A, REPLY, "term_a"));

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpAuthzTest.java

@@ -156,45 +156,6 @@ class FleetMcpAuthzTest {
         }
     }
 
-    /**
-     * fleetd #669 Unit A: {@code SEND} is split into three actions ({@link Authz.Action#SEND},
-     * {@link Authz.Action#COORD_SEND}, {@link Authz.Action#ANSWER}), each carrying the same grant
-     * the one undivided action gave. An architect holds all three, exactly as it held the one.
-     */
-    @Test
-    void anArchitectMayUseAllThreeSendShapesOverMcp() {
-        FleetMcp m = mcp(true);
-        for (Authz.Action a : new Authz.Action[]{Authz.Action.SEND, Authz.Action.COORD_SEND,
-                Authz.Action.ANSWER}) {
-            assertNull(m.denyFor(ARCH_DESIGN, a, "term_a"),
-                    a + " carries the same grant the undivided SEND action gave an architect");
-        }
-    }
-
-    /** The other half of the same split: a worker is excluded from all three, as it was from one. */
-    @Test
-    void aWorkerMayNotUseAnySendShapeOverMcp() {
-        FleetMcp m = mcp(true);
-        for (Authz.Action a : new Authz.Action[]{Authz.Action.SEND, Authz.Action.COORD_SEND,
-                Authz.Action.ANSWER}) {
-            McpSchema.CallToolResult denied = m.denyFor(WORKER_A, a, "term_a");
-            assertNotNull(denied, a + " must stay refused to a worker");
-            assertTrue(denied.isError(), "a refusal is returned as an MCP tool error");
-        }
-    }
-
-    /**
-     * fleetd #669 Unit A / #678: {@code TASK_READ} (ticket polling, session status) is split out of
-     * the roster-only {@code READ}, carrying forward the grant the undivided action gave. A worker
-     * still has both — it never gained or lost anything by the split.
-     */
-    @Test
-    void aWorkerKeepsBothReadActionsAfterTheSplit() {
-        FleetMcp m = mcp(true);
-        assertNull(m.denyFor(WORKER_A, Authz.Action.READ, null));
-        assertNull(m.denyFor(WORKER_A, Authz.Action.TASK_READ, null));
-    }
-
     @Test
     void anArchitectMayReplyAndAskOnlyAsItsOwnPaneOverMcp() {
         FleetMcp m = mcp(true);
@@ -336,53 +297,35 @@ class FleetMcpAuthzTest {
      * the whole time the defect was live -- the table was right, the action fed to it was wrong.
      */
     @Test
-    void pollingByTargetIsADrainAndPollingByTicketIsATaskRead() {
+    void pollingByTargetIsADrainAndPollingByTicketIsARead() {
         assertEquals(Authz.Action.DRAIN, FleetMcp.pollAction("term_b", null),
                 "poll by target removes the replies — that is a drain, not an observation");
-        assertEquals(Authz.Action.TASK_READ, FleetMcp.pollAction(null, null),
-                "poll by ticket changes nothing, but is not the roster-only READ action");
-        assertEquals(Authz.Action.TASK_READ, FleetMcp.pollAction("  ", null),
+        assertEquals(Authz.Action.READ, FleetMcp.pollAction(null, null),
+                "poll by ticket changes nothing");
+        assertEquals(Authz.Action.READ, FleetMcp.pollAction("  ", null),
                 "a blank target is an absent target");
     }
 
     /**
      * fleetd #421: a coordId branch is a THIRD operation behind fleet_poll's one name, and it must
-     * map to {@link Authz.Action#COORD_READ} — never {@link Authz.Action#READ} or {@link
-     * Authz.Action#TASK_READ}, even though this branch also consumes nothing. A lead-to-lead body
-     * is not the roster and not a ticket/status read, so folding this branch into either would let
-     * any worker or architect read every peer lead's mail in full. coordId also takes priority over
-     * target when both happen to be present — it addresses a different inbox entirely.
+     * map to {@link Authz.Action#COORD_READ} — never {@link Authz.Action#READ}, even though this
+     * branch also consumes nothing. READ's grant is open to every authenticated role on the premise
+     * that the roster carries no secrets; a lead-to-lead body is not the roster, so folding this
+     * branch into READ would let any worker read every peer lead's mail in full. coordId also takes
+     * priority over target when both happen to be present — it addresses a different inbox entirely.
      */
     @Test
-    void pollingByCoordIdIsACoordReadNeverAPlainOrTaskRead() {
+    void pollingByCoordIdIsACoordReadNeverAPlainRead() {
         assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction(null, "mac-opus"),
-                "reading held peer mail must not be mapped to a widely-readable action");
+                "reading held peer mail must not be mapped to the everyone-readable READ action");
         assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction("  ", "mac-opus"),
                 "a blank target must not fall through to READ/DRAIN when coordId is present");
-        assertEquals(Authz.Action.TASK_READ, FleetMcp.pollAction(null, "  "),
+        assertEquals(Authz.Action.READ, FleetMcp.pollAction(null, "  "),
                 "a blank coordId is an absent coordId, same as target/ticket");
         assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction("term_b", "mac-opus"),
                 "coordId takes priority over target — this is a different inbox, not a drain");
     }
 
-    /**
-     * {@code fleet_send} is three call shapes behind one tool name, exactly as {@code fleet_poll}
-     * is (fleetd #669 Unit A). {@link FleetMcp#sendAction} picks the action from the arguments, not
-     * the handler, for the same reason {@link FleetMcp#pollAction} does: a test can assert the
-     * mapping the handler actually uses.
-     */
-    @Test
-    void sendMapsToThreeDifferentActionsByItsArguments() {
-        assertEquals(Authz.Action.SEND, FleetMcp.sendAction(null, null),
-                "a plain delivery, with neither coordId nor turnId, is a local SEND");
-        assertEquals(Authz.Action.COORD_SEND, FleetMcp.sendAction("mac-opus", null),
-                "coordId addresses a peer lead over the coordination broker");
-        assertEquals(Authz.Action.ANSWER, FleetMcp.sendAction(null, "turn-1"),
-                "turnId resolves a worker's blocked question");
-        assertEquals(Authz.Action.COORD_SEND, FleetMcp.sendAction("mac-opus", "turn-1"),
-                "coordId takes priority over turnId, mirroring sendToLead's own mutual-exclusion check");
-    }
-
     @Test
     void everyRegisteredToolHasItsHandlerActionPinned() {
         // fleetd #469: this used to scrape FleetMcp.java's tool("…") calls for the registered set —
@@ -401,22 +344,16 @@ class FleetMcpAuthzTest {
                 () -> tool + " is registered but has no pinned authorization action"));
 
         assertEquals(Authz.Action.SEND, FleetMcp.toolAction("fleet_send", Map.of()));
-        assertEquals(Authz.Action.SEND,
-                FleetMcp.toolAction("fleet_send", Map.of("sessionId", "term_a", "content", "hi")));
-        assertEquals(Authz.Action.COORD_SEND,
-                FleetMcp.toolAction("fleet_send", Map.of("coordId", "mac-opus", "content", "hi")));
-        assertEquals(Authz.Action.ANSWER,
-                FleetMcp.toolAction("fleet_send", Map.of("turnId", "turn-1", "content", "hi")));
         assertEquals(Authz.Action.REPLY, FleetMcp.toolAction("fleet_reply", Map.of()));
         assertEquals(Authz.Action.ASK, FleetMcp.toolAction("fleet_ask", Map.of()));
-        assertEquals(Authz.Action.TASK_READ, FleetMcp.toolAction("fleet_status", Map.of()));
+        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_status", Map.of()));
         assertEquals(Authz.Action.DRAIN, FleetMcp.toolAction("fleet_ack", Map.of()));
         assertEquals(Authz.Action.SPAWN, FleetMcp.toolAction("fleet_spawn", Map.of()));
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_list", Map.of()));
         assertEquals(Authz.Action.STOP, FleetMcp.toolAction("fleet_stop", Map.of()));
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_profiles", Map.of()));
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_whoami", Map.of()));
-        assertEquals(Authz.Action.TASK_READ, FleetMcp.toolAction("fleet_poll", Map.of("ticket", "task")));
+        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_poll", Map.of("ticket", "task")));
         assertEquals(Authz.Action.DRAIN, FleetMcp.toolAction("fleet_poll", Map.of("target", "term_b")));
         assertEquals(Authz.Action.COORD_READ,
                 FleetMcp.toolAction("fleet_poll", Map.of("coordId", "mac-opus")));

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppAuthTest.java

@@ -122,28 +122,12 @@ class FleetAppAuthTest {
         assertEquals(Authz.Action.DRAIN, FleetApp.routeAction("GET /sessions/{id}/replies"));
         assertEquals(Authz.Action.ASK, FleetApp.routeAction("POST /sessions/{id}/ask"));
         for (String route : Set.of("GET /sessions", "GET /agents", "GET /members", "GET /profiles",
-                "GET /member-credentials")) {
+                "GET /member-credentials", "GET /sessions/{id}/status", "GET /tasks/{ticket}")) {
             assertEquals(Authz.Action.READ, FleetApp.routeAction(route), route);
         }
-        for (String route : Set.of("GET /sessions/{id}/status", "GET /tasks/{ticket}")) {
-            assertEquals(Authz.Action.TASK_READ, FleetApp.routeAction(route), route);
-        }
         assertThrows(IllegalArgumentException.class, () -> FleetApp.routeAction("GET /healthz"));
     }
 
-    /**
-     * fleetd #669 Unit A: {@code POST /sessions/{id}/message} is two call shapes behind one route,
-     * mirroring {@code fleet_send}'s MCP-side split into {@link Authz.Action#SEND} and {@link
-     * Authz.Action#ANSWER} ({@code FleetMcp#sendAction}). The route never carries a {@code coordId}
-     * shape — that peer-lead route is MCP-only — so only these two apply here.
-     */
-    @Test
-    void theMessageRouteIsASendWithNoTurnIdAndAnAnswerWithOne() {
-        assertEquals(Authz.Action.SEND, FleetApp.routeAction("POST /sessions/{id}/message", null));
-        assertEquals(Authz.Action.SEND, FleetApp.routeAction("POST /sessions/{id}/message", "  "));
-        assertEquals(Authz.Action.ANSWER, FleetApp.routeAction("POST /sessions/{id}/message", "turn-1"));
-    }
-
     private static Set<String> routesTheServerRegisters() {
         try {
             String source = Files.readString(REST_SOURCE).lines()
@@ -208,21 +192,6 @@ class FleetAppAuthTest {
                 "draining an inbox is the primary's collection step");
     }
 
-    /**
-     * fleetd #669 Unit A: the {@code turnId} shape of {@code POST /sessions/{id}/message} maps to
-     * {@link Authz.Action#ANSWER}, not the plain {@link Authz.Action#SEND} the test above drives —
-     * a worker must stay refused on this shape too, exactly as it was refused on the one undivided
-     * action before the split.
-     */
-    @Test
-    void aWorkerMayNotAnswerAnotherSessionsBlockedQuestionOverRest() throws Exception {
-        int port = start(FakeHerdr.WORKER_PID, false, null);
-
-        assertEquals(403, send(port, "POST", "/sessions/term_b/message",
-                "{\"turnId\":\"turn-1\",\"content\":\"hi\"}", null).statusCode(),
-                "resolving another session's blocked question would be a worker escalating too");
-    }
-
     // --- token mode ---------------------------------------------------------------------------
 
     @Test

scripts/config-edit.sh

@@ -580,6 +580,14 @@ install_candidate() {
 
 # -------------------------------------------------------------------------------- the report path
 #
+# Masks basic-auth userinfo (scheme://user:pass@host) in a daemon verdict line before it reaches
+# the terminal. Not routed through redact(): that function's key:value masking does not match this
+# line's prose, and masking anything beyond the userinfo would remove the detail an operator needs
+# to diagnose a refusal.
+mask_verdict_userinfo() {
+  printf '%s\n' "$1" | sed -E 's#://[^@]*@#://<redacted>@#g'
+}
+
 # Prints the literal command the operator (or a test) can run to restore the backup by hand — the
 # absolute path to THIS script plus the overrides actually in force, so it works from any cwd.
 restore_command_line() {
@@ -599,8 +607,8 @@ restore_and_confirm() {
   ok "restored from $backup"
   if wait_for_verdict "$LOG" "$mark2" "$WAIT_SECONDS"; then
     case "$VERDICT_KIND" in
-      refused) warn "the RESTORE was also refused by the daemon: $VERDICT_LINE" ;;
-      *)       ok "restore confirmed: $VERDICT_LINE" ;;
+      refused) warn "the RESTORE was also refused by the daemon: $(mask_verdict_userinfo "$VERDICT_LINE")" ;;
+      *)       ok "restore confirmed: $(mask_verdict_userinfo "$VERDICT_LINE")" ;;
     esac
   else
     warn "the restore is on disk, but no confirming verdict line appeared within ${WAIT_SECONDS}s"
@@ -616,7 +624,7 @@ report_outcome() {
 
   say "waiting for the daemon's verdict (up to ${WAIT_SECONDS}s)"
   if wait_for_verdict "$LOG" "$mark" "$WAIT_SECONDS"; then
-    kind="$VERDICT_KIND"; line="$VERDICT_LINE"
+    kind="$VERDICT_KIND"; line="$(mask_verdict_userinfo "$VERDICT_LINE")"
   else
     kind="none"
   fi
@@ -673,7 +681,7 @@ check_mode() {
   local verdict
   verdict="$(last_verdict_line "$LOG")"
   if [ -n "$verdict" ]; then
-    ok "last verdict in log: $verdict"
+    ok "last verdict in log: $(mask_verdict_userinfo "$verdict")"
   else
     warn "no reload verdict line found in $LOG"
   fi

scripts/test-config-edit.sh

@@ -629,6 +629,47 @@ test_refusal_shape_from_parse_failure_wording_is_recognised() {
   assert_equals 4 "$RUN_RC" "the parse-failure refusal shape must also exit 4, not be read as silence"
 }
 
+# A verdict line carrying a credentialed URI has its userinfo masked, with a positive control
+# proving the rest of the line still reaches the output unchanged.
+test_verdict_userinfo_is_masked_with_positive_control() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf 'config reload from %s refused, keeping the running config: refusing to start: malformed pattern — profiles.local.errorPattern ("amqp://user:hunter2@host/vhost"): Unclosed character class near index 8\n' \
+    "$dir/fleetd.yaml" >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 4 "$RUN_RC" "refusal-with-userinfo exit code"
+  assert_not_contains "user:hunter2" "$RUN_OUTPUT" "the userinfo must never reach the output"
+  assert_contains "amqp://<redacted>@host/vhost" "$RUN_OUTPUT" \
+    "the userinfo must be MASKED, not deleted — the rest of the quoted value must survive"
+  # Positive control: the diagnostic prose on both sides of the userinfo must still reach the
+  # output. Without this, a mutant that drops the whole verdict line would pass identically.
+  assert_contains "malformed pattern" "$RUN_OUTPUT" "prose BEFORE the userinfo must still reach the output"
+  assert_contains "Unclosed character class near index 8" "$RUN_OUTPUT" \
+    "prose AFTER the userinfo must still reach the output"
+}
+
+# An ordinary refusal line quotes the offending pattern, not a credential, and must survive byte
+# for byte: the rewrite is scoped to userinfo only, and the quoted pattern is the detail an
+# operator needs to fix the refusal.
+test_ordinary_refusal_line_passes_through_unchanged() {
+  local dir real_line
+  dir="$(new_fixture)"
+  real_line="config reload from $dir/fleetd.yaml refused, keeping the running config: refusing to start: malformed pattern — profiles.local.errorPattern (\"[unclosed\"): Unclosed character class near index 8"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf '%s\n' "$real_line" >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 4 "$RUN_RC" "ordinary refusal exit code"
+  assert_contains "$real_line" "$RUN_OUTPUT" \
+    "an ordinary refusal with no userinfo must pass through byte for byte, unchanged"
+}
+
 # --set runs yq over the whole candidate. It warns when that changes more lines than the requested
 # pairs, but a simple file with only the intended changed line must stay quiet.
 new_fixture_reformat_sensitive() {
@@ -720,6 +761,10 @@ echo "== extra: --check is read-only and always exits 0 =="
 test_check_is_read_only_and_exits_zero
 echo "== extra: the parse-failure refusal shape is also recognised =="
 test_refusal_shape_from_parse_failure_wording_is_recognised
+echo "== verdict-redaction criteria 2+3: verdict userinfo is masked, rest of line survives =="
+test_verdict_userinfo_is_masked_with_positive_control
+echo "== verdict-redaction criterion 4: an ordinary refusal passes through unchanged =="
+test_ordinary_refusal_line_passes_through_unchanged
 echo "== acceptance criterion 17: --set warns about yq formatting churn =="
 test_set_warns_when_yq_reformats_extra_lines
 echo "== acceptance criterion 18: --set stays quiet without formatting churn =="