S10 — Repair the þing-01 redaction guard: four of its five scan roots no longer exist (C-74) #192

Part of epic #181. Closes register C-74 (Tier 3). Found during S1 (#182) review.

Background

The þing-01 delivery-log redaction audit (#135, orð_09 §3) certified five module trees as credential-blind — they never read the environment, never see a key, and receive data only through the manager's DIP port. tests/test_redaction_guard.py was written to pin that finding permanently, "so drift fails loud instead of leaking quietly."

Epic #148's S5 (#153) then moved the machinery out from under unfao/ into contract/. Four of the five declared roots were never re-pointed:

The failure is silent by construction. _python_sources branches:

if path.is_file():
    yield path
else:
    yield from sorted(path.rglob("*.py"))

rglob on a nonexistent directory yields an empty iterator rather than raising. A missing root and a clean root are indistinguishable to the test. It passes either way, and has been passing while covering roughly a third of what it claims.

This is not currently a leak. The relocated modules were checked directly during the S1 review — zero hits for os.environ, getenv, load_dotenv, API_KEY, credentials. The audited fact is still true. What is gone is the thing that would notice it stopping being true.

Why it belongs in this epic

The epic's thesis is a claim should be checkable by a command, or not made. This is that thesis turned on the epic's own evidence base:

• C-57's register entry vouches for this guard in writing — "the þing-01 redaction clause is already mechanically enforced" — and that sentence is now corrected in place.
• Cluster I's fix strategy cites this exact file as an example of the guard pattern working.

Both were written in good faith. Both were overclaims. The cluster's disease reproduced inside the cluster's own prescription.

It is the sixth instance of the stale-claim class found in two days: C-63 and C-47 (Open with the defect fixed), C-43/C-59/C-61 (Open with their closing conditions met, → S2 #183), #158 (closed with the code half undone, → S3 #184), test_validation.py (claiming fidelity to a method it no longer resembles, → S4 #185), and this.

The common shape is not carelessness. A move leaves prose and paths behind, and nothing in this repo asserts that a declared path exists.

Work

1. Re-point the four roots at views_postprocessing/contract/ — contract/wire, contract/historical.py, contract/track_a_source.py, contract/frame_extraction.py. Verify against the current tree rather than against this issue; the epic's other stories do not move these, but check.
2. Assert every declared root exists, before scanning. This is the half that fixes the class rather than today's instance: a future relocation must fail with "declared credential-blind root no longer exists: X" rather than quietly narrowing the scan to nothing.
3. Consider whether the scan should follow the package rather than a path list. contract/ and delivery/ are, post-S5 — Separate partner declarations from delivery machinery #153, exactly "the partner-neutral machinery" — the same set tests/test_clone_readiness.py::_MACHINERY enumerates. Two hand-maintained lists of the same modules is the defect that produced this issue.
   Decide and record which: an explicit list that must exist (simple, and the existence assertion makes it safe), or derivation from the package (no list to go stale, but couples two tests). Prefer the explicit list plus the existence assertion — WET before DRY, and the two tests ask different questions. Say so in the PR either way.
4. Update the module docstring: it currently implies full coverage of the audited set.

Do not widen _FORBIDDEN_TOKENS or re-run the #135 audit in this story. This restores a guard to the scope it was written for; changing that scope is a separate judgement.

Acceptance criteria

• All five roots resolve to real paths; the scan covers the modules [þing-01] Delivery-log/provenance redaction audit #135 actually audited (~16 files, not 6).
• A missing declared root fails the test with a message naming the path — verified by a test that feeds a bogus root.
• test_wire_and_delivery_modules_stay_credential_blind still passes against the real tree (the modules are clean; confirmed during S1).
• The list-vs-derivation choice is recorded in the PR.
• C-74 closed citing the command that proves it.

Testing

ruff check .
pytest -q tests/test_redaction_guard.py tests/test_clone_readiness.py
pytest -q

Prove the repaired guard bites — twice, because it has two failure modes:

def test_the_guard_fails_when_a_declared_root_is_missing():
    """The defect this story fixes: rglob on a vanished directory is silent."""

def test_the_guard_catches_a_credential_reference():
    """The defect it was written for: a delivery module reading the environment."""

The first is the important one. This repo has a standing practice of proving guards bite (test_clone_readiness.py::test_the_guard_would_actually_catch_a_violation); the absence of that proof here is precisely why the rot went unnoticed.

Sanity check before and after:

python - <<'PY'
from pathlib import Path
from tests.test_redaction_guard import _CREDENTIAL_BLIND, _python_sources
print(sum(1 for r in _CREDENTIAL_BLIND for _ in _python_sources(r)))   # 6 before, ~16 after
PY

Dependencies

None — independent of S1–S9. Sequence it after S1 (#182) only because S1's review produced it and S1 touches an adjacent test file.

Files

• tests/test_redaction_guard.py:25-31 (_CREDENTIAL_BLIND), :34-39 (_python_sources), :1-9 (docstring)
• views_postprocessing/contract/ — where the audited modules now live
• tests/test_clone_readiness.py:34-56 (_MACHINERY) — the other hand-maintained list of the same modules
• Register C-74, C-57 (corrected), Cluster I
• [þing-01] Delivery-log/provenance redaction audit #135 (the audit), S5 — Separate partner declarations from delivery machinery #153 (the move that broke it), S1 — appwrite_env logs before it raises (C-71) #182 (the review that found it)