refactor(redact): lift + generalize the ADR-0018 scrubbers into a shared engine/redact/ module (JEF-486)

[thejefflarson]

What

Lifts the breach notifier's redaction primitives out of notify.rs into a new shared engine/src/engine/redact/ module and generalizes them off BreachNotice, so the (future) read-only MCP server from ADR-0031 reuses the exact same scrubbers — the two sanctioned egress paths can't drift in what they consider safe to emit off-cluster.

Grounded in docs/adr/0031-read-only-mcp-server-tiered-redaction.md §3, which calls for sanitize / scrub_decision_names / scrub_cve_tokens to be "lifted and generalized from their current private home ... into a shared redaction module."

Generalized API (engine/src/engine/redact/)

• sanitize(&str) -> String — strip prompt/wire STRUCTURE (fences, braces, backtick, CR/LF). Now the ONE home; previously the adjudication prompt kept its own copy in reason::adjudicate::guards, which now re-exports this so the prompt path is unchanged.
• scrub_decision_names(text: &str, names: &[&str]) -> String — replace each supplied name (longest-first, trimmed, deduped) with [redacted]. SEMANTIC name stripping only — no CVE coupling, so the MCP raw tier can relax it independently.
• scrub_cve_tokens(text: &str) -> String — case-insensitive CVE-… token scrub; independent so the MCP forensic tier can relax it.
• redacted_attack_outcome(refs: impl IntoIterator<Item = &AttackRef>, cap) -> Vec<Value> — the counts-only ATT&CK-outcome reducer (distinct, ordered, sanitized, capped techniques — never the per-objective targets).

notify.rs re-points to these; the notifier-specific name-collection (entry + objective node-keys + bare suffixes) stays local as decision_names. Each new file is well under the 1,000-line cap.

Byte-identical proof (the load-bearing check)

Captured the exact serialized redacted payload from the pre-refactor code for a fixture exercising every scrubber (structure chars + a CVE token + a full node-key AND its bare secret name), across default / verbose / armed shapes, then pinned those exact strings in a new test redacted_payload_is_byte_identical_to_pre_refactor. It passes against the refactored code, proving the notifier's output is unchanged to the byte. All pre-existing ADR-0018 notifier tests stay green.

Tests

• New engine::redact::tests — 12 unit tests on the generalized inputs the MCP server will pass (verdict text blob, CVE line, bare decision name) plus fence/CVE/name edge cases.
• New byte-identical snapshot assertion in the notifier tests.

Checks

• cargo fmt — clean
• cargo clippy --all-targets -- -D warnings — clean
• cargo test — 814 lib + all integration tests pass (incl. the file-size guard: no file >1000 lines)

Scope note / decision recorded

The ticket's "counts-only helper" was ambiguous (parenthesized as "redacted_payload / whatever it's called"). I interpreted it as the reusable redaction rule — the ATT&CK-outcome reducer that drops per-objective targets and keeps only distinct techniques + a count — and lifted that (redacted_attack_outcome), rather than moving the notifier's whole redacted_payload wire-shape builder (which stays in notify.rs, since it assembles the notifier's specific JSON, not a shared primitive). This keeps redact/ focused on shared redaction decisions and out of per-path wire shapes, matching ADR-0031's "one redaction implementation" goal without over-building.

Closes JEF-486

🤖 Generated with Claude Code

https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP