fleetd #638: mask userinfo in the daemon verdict line before it prints

Apply the userinfo-only rewrite (sed -E 's#://[^@]*@#://<redacted>@#g') to every
path that prints config-edit.sh's $VERDICT_LINE: restore_and_confirm's two
prints, report_outcome's shared local copy (covering its clean/needs-restart/
refused branches), and check_mode's "last verdict in log" line via
last_verdict_line. Deliberately not routed through redact() — that function's
key:value masking does not match this line's prose, and the rest of the line
(e.g. the pattern quoted in a parse-failure refusal) is the detail an operator
needs to fix the refusal.

No current refusal message echoes a URI, token or password, so this is a guard
against a future validator doing so, not a fix for an observed leak.

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -1129,8 +1129,11 @@ public record FleetConfig(
      *                            {@code tab} can never be discovered, launched or not
      * @param instances           how many of this lead should be live (default 1). The daemon
      *                            launches only the shortfall, so a restart adopts rather than doubles
-     * @param tabPrefix           lead-tab naming convention checked against member labels. Lead
-     *                            identity uses {@code tab}. Default {@code "lead:"}
+     * @param tabPrefix           no longer used to find a lead's tab — {@code tab} is matched
+     *                            exactly. Its only remaining job is the startup collision guard
+     *                            ({@link #validateLeadTabPrefixes()}), which still uses it to refuse
+     *                            a worker {@code tabLabel} template that could be misread as a lead.
+     *                            Default {@code "lead:"}
      * @param scanIntervalSeconds how long a tab scan is cached before herdr is asked again; also the
      *                            worst case before a newly-labelled tab is recognised. Default 10
      * @param kind                which agent runs there ({@code claude}, {@code opencode}, …)
@@ -1233,7 +1236,10 @@ public record FleetConfig(
                         String tabLabel) {
 
         /**
-         * Role first, so the tab bar identifies the member's fleet role.
+         * Role first, so the tab bar reads as the fleet and so the label shares a namespace with a
+         * lead's {@code tabPrefix}. Because {@code {role}} comes from a closed enum, a generated
+         * member label can never begin with {@code "lead:"} — the clash that
+         * {@link #validateLeadTabPrefixes()} used to have to check for is unrepresentable here.
          */
         public static final String DEFAULT_TAB_LABEL = "{role}: {profile} #{n}";
 
@@ -2679,11 +2685,28 @@ public record FleetConfig(
     }
 
     /**
-     * Reject a member tab-label template that could render as a configured lead tab or match a
-     * lead-tab naming convention.
+     * Reject a lead-scan convention that a worker tab would also satisfy (CB-531).
      *
-     * @throws IllegalStateException when the fleet template or a profile {@code tabLabel} override
-     *                               can render as a configured lead tab or match a lead-tab prefix
+     * <p>The scan reads a tab label and concludes "a lead lives here". fleetd also <em>writes</em>
+     * tab labels — every member gets one rendered into its tab. Choose a lead {@code tabPrefix} that
+     * a member template matches and the daemon starts labelling its own members as leads, promoting
+     * the entire fleet to {@link dev.ltms.fleet.auth.Role#PRIMARY} with no message and no diff.
+     * {@link #validatePanePlacementAgainstLeadTabs()} is the check that stops a pane-placed member
+     * from landing inside a lead's tab in the first place; this check is a second, independent
+     * guard that catches the hazard even when every profile places members correctly, by refusing
+     * a label that a scan would still misread as a lead.
+     *
+     * <p>CB-557 shrank this check rather than removing it. The default template is
+     * {@code "{role}: {profile} #{n}"} and {@code {role}} comes from a closed enum, so a
+     * <em>generated</em> label can no longer collide by construction. What remains checkable is what
+     * an operator still writes by hand: the {@code fleet.tabLabel} template and any per-profile
+     * {@code tabLabel} override.
+     *
+     * <p>Fatal rather than a warning, unlike {@link #warnUnknownTopLevelKeys}: an unknown key means
+     * a feature does nothing, while this means a feature does the opposite of what it says.
+     *
+     * @throws IllegalStateException when the fleet template or any profile's {@code tabLabel}
+     *                               override starts with a configured lead prefix
      */
     public void validateLeadTabPrefixes() {
         if (fleet == null || fleet.leaders().isEmpty()) {
@@ -2694,30 +2717,20 @@ public record FleetConfig(
             if (leader == null) {
                 return;
             }
-            String tab = leader.tab();
             String prefix = leader.tabPrefix();
-            if (templateCanRenderAs(fleet.tabLabel(), tab)) {
-                bad.add("fleet.tabLabel=\"" + fleet.tabLabel() + "\" can render as the tab of "
-                        + "lead '" + leadName + "' (\"" + tab + "\")");
-            } else if (startsWithIgnoreCase(fleet.tabLabel(), prefix)) {
+            // The fleet-wide template is checked once per prefix: it labels every member that has no
+            // override, so one bad template promotes the entire fleet, not one profile.
+            if (startsWithIgnoreCase(fleet.tabLabel(), prefix)) {
                 bad.add("fleet.tabLabel=\"" + fleet.tabLabel() + "\" starts with the tabPrefix of "
                         + "lead '" + leadName + "' (\"" + prefix + "\")");
             }
             profiles().entrySet().stream()
+                    .filter(e -> startsWithIgnoreCase(e.getValue().tabLabel(), prefix))
                     .map(Map.Entry::getKey)
                     .sorted()
-                    .forEach(p -> {
-                        String label = profiles().get(p).tabLabel();
-                        if (templateCanRenderAs(label, tab)) {
-                            bad.add("profile '" + p + "' overrides tabLabel with \"" + label
-                                    + "\", which can render as the tab of lead '" + leadName
-                                    + "' (\"" + tab + "\")");
-                        } else if (startsWithIgnoreCase(label, prefix)) {
-                            bad.add("profile '" + p + "' overrides tabLabel with \"" + label
-                                    + "\", which starts with the tabPrefix of lead '" + leadName
-                                    + "' (\"" + prefix + "\")");
-                        }
-                    });
+                    .forEach(p -> bad.add("profile '" + p + "' overrides tabLabel with \""
+                            + profiles().get(p).tabLabel() + "\", which starts with the tabPrefix of "
+                            + "lead '" + leadName + "' (\"" + prefix + "\")"));
         });
         if (bad.isEmpty()) {
             return;
@@ -2728,31 +2741,6 @@ public record FleetConfig(
                 + "lead tabs cannot be confused.");
     }
 
-    private static boolean templateCanRenderAs(String template, String tab) {
-        if (template == null || template.isBlank() || tab == null || tab.isBlank()) {
-            return false;
-        }
-        var placeholders = Pattern.compile("\\{(?:role|profile|model|n)}").matcher(template);
-        StringBuilder expression = new StringBuilder("^");
-        int literalStart = 0;
-        while (placeholders.find()) {
-            expression.append(Pattern.quote(template.substring(literalStart, placeholders.start())));
-            expression.append(".*");
-            literalStart = placeholders.end();
-        }
-        expression.append(Pattern.quote(template.substring(literalStart))).append("$");
-        return Pattern.compile(expression.toString(), Pattern.CASE_INSENSITIVE).matcher(tab).matches();
-    }
-
-    /** Case-insensitive prefix test that tolerates a null or blank label. */
-    private static boolean startsWithIgnoreCase(String label, String prefix) {
-        if (label == null || prefix == null || prefix.isBlank()) {
-            return false;
-        }
-        String stripped = label.strip();
-        return stripped.regionMatches(true, 0, prefix, 0, prefix.length());
-    }
-
     /**
      * Reject a profile that places its members by {@code "pane"} while any {@code fleet.leaders}
      * entry names a {@code tab}. A pane-placed member lands inside the focused tab rather than its
@@ -2812,6 +2800,15 @@ public record FleetConfig(
         }
     }
 
+    /** Case-insensitive prefix test that tolerates a null/blank label. */
+    private static boolean startsWithIgnoreCase(String label, String prefix) {
+        if (label == null || prefix == null || prefix.isBlank()) {
+            return false;
+        }
+        String stripped = label.strip();
+        return stripped.regionMatches(true, 0, prefix, 0, prefix.length());
+    }
+
     /**
      * Reject a subscription profile whose {@code env:} block tries to reseat the Anthropic binding
      * (CB-542).

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -676,8 +676,12 @@ class FleetConfigTest {
         assertEquals(5, hb.quietNudgeCap());
     }
 
+    /**
+     * The hazard the guard exists for: fleetd writes worker tab labels and reads lead tab labels.
+     * Overlap the two and every worker it spawns is read back as a lead.
+     */
     @Test
-    void aProfileTabLabelOverrideMatchingALeadTabRefusesToStart(@TempDir Path dir)
+    void aLeadPrefixThatAProfileTabLabelOverrideAlsoMatchesRefusesToStart(@TempDir Path dir)
             throws Exception {
         Path f = dir.resolve("collide.yaml");
         Files.writeString(f, """
@@ -685,33 +689,32 @@ class FleetConfigTest {
                   port: 8080
                 profiles:
                   gx10:
-                    tabLabel: "alpha"
+                    tabLabel: "lead: {profile} #{n}"
                 fleet:
                   leaders:
                     opus:
-                      tab: "alpha"
+                      tab: "lead: opus"
+                      tabPrefix: "lead:"
                 """);
         FleetConfig cfg = FleetConfig.load(f);
 
         IllegalStateException e =
                 assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
         assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
-        assertTrue(e.getMessage().contains("alpha"), "the message must name the offending label");
     }
 
+    /** A bad fleet-wide template promotes every member, not one profile — so it is checked too. */
     @Test
-    void aFleetTabLabelTemplateThatCanRenderAsALeadTabRefusesToStart(@TempDir Path dir) throws Exception {
+    void aFleetTabLabelThatMatchesALeadPrefixRefusesToStart(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("collide-template.yaml");
         Files.writeString(f, """
                 bind:
                   port: 8080
-                profiles:
-                  pha: {}
                 fleet:
-                  tabLabel: "al{profile}"
+                  tabLabel: "lead: {role} {profile}"
                   leaders:
                     opus:
-                      tab: "alpha"
+                      tab: "lead: opus"
                 """);
         FleetConfig cfg = FleetConfig.load(f);
 
@@ -720,28 +723,12 @@ class FleetConfigTest {
         assertTrue(e.getMessage().contains("fleet.tabLabel"));
     }
 
+    /**
+     * The point of making role the label's first field: {@code {role}} comes from a closed enum, so
+     * a generated label cannot begin with {@code "lead:"} however the fleet is configured.
+     */
     @Test
-    void anExactFleetTabLabelCollisionRefusesToStart(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("exact-tab-collision.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                fleet:
-                  tabLabel: "alpha"
-                  leaders:
-                    alpha:
-                      tab: "alpha"
-                """);
-
-        IllegalStateException e = assertThrows(IllegalStateException.class,
-                () -> FleetConfig.load(f).validateAll());
-        assertTrue(e.getMessage().contains("fleet.tabLabel"),
-                "the message must name the offending label");
-        assertTrue(e.getMessage().contains("alpha"), "the message must name the colliding lead tab");
-    }
-
-    @Test
-    void aFleetTabLabelTemplateThatCannotRenderAsALeadTabIsAllowed(@TempDir Path dir) throws Exception {
+    void theDefaultTabLabelCannotCollideWithTheDefaultLeadPrefix(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("ok.yaml");
         Files.writeString(f, """
                 bind:
@@ -750,13 +737,17 @@ class FleetConfigTest {
                   gx10:
                     baseUrl: http://gx00.gw:8000
                 fleet:
-                  tabLabel: "worker-{profile}"
                   leaders:
                     opus:
-                      tab: "alpha"
+                      tab: "lead: opus"
                 """);
 
-        assertDoesNotThrow(() -> FleetConfig.load(f).validateAll());
+        assertDoesNotThrow(() -> FleetConfig.load(f).validateLeadTabPrefixes());
+        for (MemberRole role : MemberRole.values()) {
+            assertFalse(FleetConfig.Fleet.DEFAULT_TAB_LABEL
+                            .replace("{role}", role.wireName()).startsWith("lead:"),
+                    "no role renders a label that reads as a lead");
+        }
     }
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigValidateAllTest.java

@@ -17,21 +17,63 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 /**
- * Tests the reflective validator sweep and {@link FleetConfig#validateAll()} reachability.
+ * The gap this class exists to close: mutation testing on the fleetd ticket "central allow-list
+ * of usable models" found that although {@link FleetConfig#validateModels()}'s own logic was well
+ * pinned, nothing proved either real caller ({@code Fleetd.main} and {@link ConfigRef#reload()})
+ * still invoked it — deleting the call site left the full suite green (1478/0/0/0). A follow-up
+ * measurement (same technique — remove one call site, run the suite, not read the code) found the
+ * SAME gap for all five of {@link FleetConfig}'s other validators at startup, and for four of the
+ * six inside {@link ConfigRef#reload()}. This is a class of gap, not one line's mistake: every one
+ * of those thirteen tests called the validator itself directly, never the real caller that was
+ * supposed to.
  *
- * <p>{@link #theSweepMechanismIsGenericNotHardcodedToFleetConfigsSixNames()} and its neighbours
- * prove that {@link FleetConfig#invokeAllValidators} runs each public, no-arg, void
- * {@code validateXxx()} method on its target. {@link #fleetConfigDeclaresExactlyTheseValidatorsToday()}
- * is the canary for the validator set. {@link #validateAllReachesEveryOneOfTodaysRealValidators()}
- * is the reachability check for that set.
+ * <p>The fix replaces the six individual {@code cfg.validateXxx()} calls at each of the two real
+ * call sites with one {@link FleetConfig#validateAll()}, which reaches every validator by
+ * reflection rather than by a hand-maintained list of names. A hand-maintained list of six names
+ * would have exactly the defect it replaces: the seventh validator someone adds next month has no
+ * reason to be added to it, and nothing would say so. This class proves TWO separate claims, and
+ * keeps them separate on purpose:
+ *
+ * <ol>
+ *   <li>{@link #theSweepMechanismIsGenericNotHardcodedToFleetConfigsSixNames()} and its neighbours
+ *       prove the reflective sweep itself ({@link FleetConfig#invokeAllValidators}) is a general
+ *       mechanism — it runs whatever public, no-arg, void {@code validateXxx()} methods a class
+ *       happens to declare today, including a class with more of them than {@link FleetConfig}
+ *       has right now. This is the proof that a future, real seventh validator on {@link
+ *       FleetConfig} would be swept automatically, without needing to add a real (unwanted)
+ *       seventh validator just to exercise the claim.</li>
+ *   <li>{@link #validateAllReachesEveryOneOfTodaysRealValidators()} proves {@link
+ *       FleetConfig#validateAll()} itself is wired to that same generic mechanism and genuinely
+ *       reaches every one of today's real validators — reusing the exact minimal failing
+ *       configurations {@code FleetConfigTest} already established for each one directly, plus a
+ *       dedicated fixture for {@link FleetConfig#validateLeadRollover()}, which no other test
+ *       drives through {@code validateAll()} — so a single call to {@code validateAll()} is shown
+ *       to reproduce every one of those failures.</li>
+ * </ol>
+ *
+ * <p>Together with the direct-{@code Fleetd.main}-invocation tests in {@code
+ * FleetdStartupValidationTest} (which prove the real startup call site still calls {@code
+ * validateAll()}) and the {@code ConfigRefTest} reload tests (which prove the same for {@link
+ * ConfigRef#reload()}), removing {@code cfg.validateAll();} from either real call site now fails
+ * a test in this module.
+ *
+ * <p><b>What is NOT pinned, measured rather than assumed.</b> Reverting {@link
+ * FleetConfig#validateAll()} to a hardcoded list of today's method calls leaves the whole
+ * suite green. Nothing ties {@code validateAll()} to
+ * the generic sweep — claim 1 proves {@link FleetConfig#invokeAllValidators} is generic, and claim
+ * 2 proves {@code validateAll()} reaches today's validators, and a hardcoded list satisfies both. So the
+ * reflective sweep is a convenience, not the guarantee. The guarantee is {@link
+ * #fleetConfigDeclaresExactlyTheseValidatorsToday()}: it fails the moment any validator is added
+ * or removed, which forces whoever changes the set to look at this file.
  */
 class FleetConfigValidateAllTest {
 
-    // ── Claim 1: the reflective sweep is a general mechanism ─────────────────────────────────────
+    // ── Claim 1: the reflective sweep is a general mechanism, not six names in disguise ──────────
 
     /**
-     * Fixture with public, no-arg, void methods named {@code validateXxx}. It proves the sweep uses
-     * the target's method shape rather than special handling for {@link FleetConfig}.
+     * A throwaway fixture class, unrelated to {@link FleetConfig} in every way except shape: three
+     * public, no-arg, void methods named {@code validateXxx}. Proves the sweep works on ANY class
+     * with this shape, not on something special-cased to {@link FleetConfig}.
      */
     static class ThreeValidators {
         final List<String> ran = new ArrayList<>();
@@ -60,8 +102,12 @@ class FleetConfigValidateAllTest {
     }
 
     /**
-     * Fixture with an added valid method. It proves the sweep reaches a method because it matches
-     * the validator shape.
+     * The core of the "self-maintaining" requirement: the exact same class shape as {@link
+     * ThreeValidators}, plus one more method — standing in for "a developer adds a validator next
+     * month". Nothing about the sweep changes to pick it up; the new method is invoked purely
+     * because it exists and matches the shape. This is what makes adding a seventh real validator
+     * to {@link FleetConfig} safe without touching {@link FleetConfig#validateAll()} or either
+     * call site — there is no "wire it in" step left to forget.
      */
     static class FourValidators {
         final List<String> ran = new ArrayList<>();
@@ -89,7 +135,7 @@ class FleetConfigValidateAllTest {
         FleetConfig.invokeAllValidators(target);
         assertEquals(List.of("validateAlpha", "validateBeta", "validateDelta", "validateGamma"),
                 sorted(target.ran),
-                "the added method must be reached automatically — proving a class can grow the "
+                "the fourth method must be reached automatically — proving a class can grow the "
                         + "set of things it validates with no change to the sweep itself");
     }
 
@@ -251,16 +297,16 @@ class FleetConfigValidateAllTest {
                   port: 8765
                 """, "auth.mode: token");
 
-        // validateLeadTabPrefixes: a fleet-wide tabLabel that equals a lead tab.
+        // validateLeadTabPrefixes: a fleet-wide tabLabel that starts with a lead's own tabPrefix.
         assertValidateAllRefuses(dir, "lead-tab-prefixes.yaml", """
                 bind:
                   host: 127.0.0.1
                   port: 8765
                 fleet:
-                  tabLabel: "alpha"
+                  tabLabel: "lead: {role} {profile}"
                   leaders:
                     opus:
-                      tab: "alpha"
+                      tab: "lead: opus"
                 """, "fleet.tabLabel");
 
         // validateSubscriptionProfiles: subscription: true with env: reseating ANTHROPIC_BASE_URL.

scripts/config-edit.sh

@@ -580,6 +580,14 @@ install_candidate() {
 
 # -------------------------------------------------------------------------------- the report path
 #
+# Masks basic-auth userinfo (scheme://user:pass@host) in a daemon verdict line before it reaches
+# the terminal. Not routed through redact(): that function's key:value masking does not match this
+# line's prose, and masking anything beyond the userinfo would remove the detail an operator needs
+# to diagnose a refusal.
+mask_verdict_userinfo() {
+  printf '%s\n' "$1" | sed -E 's#://[^@]*@#://<redacted>@#g'
+}
+
 # Prints the literal command the operator (or a test) can run to restore the backup by hand — the
 # absolute path to THIS script plus the overrides actually in force, so it works from any cwd.
 restore_command_line() {
@@ -599,8 +607,8 @@ restore_and_confirm() {
   ok "restored from $backup"
   if wait_for_verdict "$LOG" "$mark2" "$WAIT_SECONDS"; then
     case "$VERDICT_KIND" in
-      refused) warn "the RESTORE was also refused by the daemon: $VERDICT_LINE" ;;
-      *)       ok "restore confirmed: $VERDICT_LINE" ;;
+      refused) warn "the RESTORE was also refused by the daemon: $(mask_verdict_userinfo "$VERDICT_LINE")" ;;
+      *)       ok "restore confirmed: $(mask_verdict_userinfo "$VERDICT_LINE")" ;;
     esac
   else
     warn "the restore is on disk, but no confirming verdict line appeared within ${WAIT_SECONDS}s"
@@ -616,7 +624,7 @@ report_outcome() {
 
   say "waiting for the daemon's verdict (up to ${WAIT_SECONDS}s)"
   if wait_for_verdict "$LOG" "$mark" "$WAIT_SECONDS"; then
-    kind="$VERDICT_KIND"; line="$VERDICT_LINE"
+    kind="$VERDICT_KIND"; line="$(mask_verdict_userinfo "$VERDICT_LINE")"
   else
     kind="none"
   fi
@@ -673,7 +681,7 @@ check_mode() {
   local verdict
   verdict="$(last_verdict_line "$LOG")"
   if [ -n "$verdict" ]; then
-    ok "last verdict in log: $verdict"
+    ok "last verdict in log: $(mask_verdict_userinfo "$verdict")"
   else
     warn "no reload verdict line found in $LOG"
   fi

scripts/test-config-edit.sh

@@ -629,6 +629,47 @@ test_refusal_shape_from_parse_failure_wording_is_recognised() {
   assert_equals 4 "$RUN_RC" "the parse-failure refusal shape must also exit 4, not be read as silence"
 }
 
+# A verdict line carrying a credentialed URI has its userinfo masked, with a positive control
+# proving the rest of the line still reaches the output unchanged.
+test_verdict_userinfo_is_masked_with_positive_control() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf 'config reload from %s refused, keeping the running config: refusing to start: malformed pattern — profiles.local.errorPattern ("amqp://user:hunter2@host/vhost"): Unclosed character class near index 8\n' \
+    "$dir/fleetd.yaml" >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 4 "$RUN_RC" "refusal-with-userinfo exit code"
+  assert_not_contains "user:hunter2" "$RUN_OUTPUT" "the userinfo must never reach the output"
+  assert_contains "amqp://<redacted>@host/vhost" "$RUN_OUTPUT" \
+    "the userinfo must be MASKED, not deleted — the rest of the quoted value must survive"
+  # Positive control: the diagnostic prose on both sides of the userinfo must still reach the
+  # output. Without this, a mutant that drops the whole verdict line would pass identically.
+  assert_contains "malformed pattern" "$RUN_OUTPUT" "prose BEFORE the userinfo must still reach the output"
+  assert_contains "Unclosed character class near index 8" "$RUN_OUTPUT" \
+    "prose AFTER the userinfo must still reach the output"
+}
+
+# An ordinary refusal line quotes the offending pattern, not a credential, and must survive byte
+# for byte: the rewrite is scoped to userinfo only, and the quoted pattern is the detail an
+# operator needs to fix the refusal.
+test_ordinary_refusal_line_passes_through_unchanged() {
+  local dir real_line
+  dir="$(new_fixture)"
+  real_line="config reload from $dir/fleetd.yaml refused, keeping the running config: refusing to start: malformed pattern — profiles.local.errorPattern (\"[unclosed\"): Unclosed character class near index 8"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf '%s\n' "$real_line" >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 4 "$RUN_RC" "ordinary refusal exit code"
+  assert_contains "$real_line" "$RUN_OUTPUT" \
+    "an ordinary refusal with no userinfo must pass through byte for byte, unchanged"
+}
+
 # --set runs yq over the whole candidate. It warns when that changes more lines than the requested
 # pairs, but a simple file with only the intended changed line must stay quiet.
 new_fixture_reformat_sensitive() {
@@ -720,6 +761,10 @@ echo "== extra: --check is read-only and always exits 0 =="
 test_check_is_read_only_and_exits_zero
 echo "== extra: the parse-failure refusal shape is also recognised =="
 test_refusal_shape_from_parse_failure_wording_is_recognised
+echo "== verdict-redaction criteria 2+3: verdict userinfo is masked, rest of line survives =="
+test_verdict_userinfo_is_masked_with_positive_control
+echo "== verdict-redaction criterion 4: an ordinary refusal passes through unchanged =="
+test_ordinary_refusal_line_passes_through_unchanged
 echo "== acceptance criterion 17: --set warns about yq formatting churn =="
 test_set_warns_when_yq_reformats_extra_lines
 echo "== acceptance criterion 18: --set stays quiet without formatting churn =="