Module redaction 

Redaction for anything that can reach a log, a span, or a durable receipt.

Two classes of content are stripped before text is allowed to leave the process — either onto a provider’s wire or into a journal:

1. Absolute paths. /Users/hunter/src/app, /home/x/..., C:\Users\… and ~/… carry the operator’s username, home directory, and machine layout. A journal travels further than the machine that wrote it.
2. Repo-relative paths. crates/tui/src/main.rs, ./deploy.sh, ../../secret/notes.md — and their escaped spellings, crates\/tui\/… and crates\\tui\\…. An absolute path discloses the machine; a relative one discloses the private tree’s shape, which is exactly as much as the reader of a routing summary at another provider needs to reconstruct it. The rule is deliberately conservative — see looks_relative — because the failure it must not trade for is mangling ordinary prose or a provider/model label.
3. Secret-shaped tokens. Provider keys, bearer tokens, and SOMETHING_KEY=value assignments. These have no business in a routing summary and must never be persisted next to one.

Redaction is recorded, not silent: Redaction::kinds names what was removed so a receipt can disclose the fact without disclosing the content.

Structs

Redaction

The result of redacting one string.

Constants

REDACTION_ABSOLUTE_PATH

A redaction kind, as it appears on a disclosure. These are stable labels — receipts persist them.

REDACTION_RELATIVE_PATH

REDACTION_SECRET

Functions

redact_for_disclosure

Redact absolute paths and secret-shaped tokens from input.