[Security] Keep target-connector exception diagnostics out of ordinary logs

[seonghobae]

Buyer / confidentiality gap

Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 passes provider/runtime exception objects directly to SLF4J from TargetConnectorDispatcher when connector-open cleanup or connector close fails. Third-party connector exceptions can contain endpoint URLs, account/workspace names, request payload fragments, authentication-adjacent values, storage paths, or other provider diagnostics. Ordinary logs need lifecycle outcome and connector identity, not the complete exception message/stack trace.

This is distinct from CDC diagnostic work #170–#174 and from connector scaffold retirement #153/#156/#158/#163.

RCA

• Immediate cause: log.warn(..., cleanupFailure) and log.error(..., exception) serialize caught connector exceptions to logs.
• Technical root cause: lifecycle failure classification is coupled to provider exception transport.
• Control failure: existing lifecycle tests verify cleanup/close behavior but do not assert log confidentiality.

Bounded remediation

Use TDD on the real dispatcher lifecycle boundary. Preserve connector open/write/close ordering, rethrow/suppressed-exception semantics, and stable connector IDs while removing provider exception text/stack traces from ordinary logs.

• Open failure itself must still propagate unchanged to the caller; a cleanup failure may remain attached as a suppressed exception for in-process causal handling, but must not be rendered to ordinary logs.
• Shutdown must remain best-effort across connectors and continue after one connector close failure.
• Stable connector IDs and finite outcome messages may remain logged.
• Do not use regex masking as the primary confidentiality control and do not suppress the exception object from programmatic error propagation where the existing contract requires it.

Standards / evidence

Current OWASP Logging Cheat Sheet guidance lists database connection strings, passwords, access tokens, sensitive personal data, and other secrets among data that should not normally be recorded directly. MITRE CWE-532 defines the weakness class as insertion of sensitive information into log files. The product boundary should therefore prefer finite lifecycle classification over third-party exception transport.

Acceptance

• fail-first log-capture tests inject realistic connector exceptions containing a credential-like URI/value and prove protected code emits it;
• minimal production fix preserves open-failure propagation, suppressed cleanup failure attachment, shutdown continuation, and connector lifecycle ordering;
• ordinary logs retain stable lifecycle classification and connector ID but no provider message, URL/query secret, exception class, or stack trace;
• focused/full ETL tests pass;
• current dependency/SBOM/SAST/security gates pass as applicable;
• canonical Security/Threat Model/Test Strategy/Operability/Traceability later records this boundary as active_pr until protected integration;
• synthetic-merge execution remains compatibility evidence, not literal-source proof.

[seonghobae]

Fresh current-head diagnosis for active PR #176: live source head is f1461b03a70752f56e9113ef5ea02c5f41f7fcce over unchanged protected develop@622e5e6c3d534f230c390f10e3832efadfc01825; the PR body still names predecessor 5f2c..., so its body/check inventory is stale and the source branch is branch-locally frozen for this invocation rather than raced.

Current workflows on f1461b03...: Dependency Review 31344336697, SBOM 31344336680, SAST 31344336681, and Security Scan 31344336694 are terminal-success; CI 31344336692 is terminal-failure on all three hosted OSes. macOS job 93323363150 checked out synthetic merge 1b7cec3c296ae001a1f1f009e7169e0a69425717 and reached the intended documentation boundary after the connector logging behavior itself was already green. Exactly TargetConnectorDiagnosticConfidentialityDocumentationTest.doctoringDocumentsProviderExceptionMinimizationAndCausalErrorRetention failed because the required connector diagnostic-confidentiality doctoring was not yet checked in; TargetConnectorDispatcherLoggingTest passed 2/2 and its captured runtime messages contain the stable connector lifecycle classifications without provider exception rendering.

This is therefore a valid documentation RED, not a regression in the current behavior repair and not a setup/import/runner failure. The smallest next action belongs to the existing #176 writer: add the source-backed doctoring required by that test, then regenerate current-head CI and reconcile the PR body. No second writer should patch the moving branch.