Module redact 

A process-global redaction hook (#456 H5).

Secrets are resolved on raw config text long before they become typed values, so the CLI tracks the resolved values in cli::secrets::registry and scrubs them from anything it emits. faucet-core cannot see that registry — it has no secrets layer and must not gain one — yet core is where two outbound surfaces are built:

• the DLQ envelope’s error.message (crate::dlq::build_envelope), which is written to a file or object store, and
• any error text a host application forwards onward.

An error string routinely embeds the material that produced it: reqwest’s Display includes the request URL, so a REST source whose API key rides a query parameter leaks the key; connection-string leakage in a CDC error has already been a filed bug here (#84).

So core exposes a hook: a host installs a scrubber once at startup, and core routes outbound text through redact. With no hook installed, redact is the identity function and costs one atomic load — library users who never resolve secrets pay nothing and see no behaviour change.

Functions

install

Install the process-wide redactor. The first call wins; later calls are ignored and return false, so a second install_observability (or a test that runs after one) can never swap the scrubber out from under a run.

is_installed

Whether a redactor has been installed.

redact

Scrub text with the installed redactor, or return it unchanged when none is installed.

Type Aliases

Redactor

A scrubber: takes text, returns it with every known secret replaced.