Agent-supplied verdict and refusal fields reach committed records unredacted, in two sibling ingests. In internal/core/intent/audit.go the ingested block renders verifier.id, verifier.version, policy.rubric_hash, policy.prompt_hash and every input_attestations[] kind, ref and digest through orDash/oneLine alone: no privacy redaction and no shape validation, though iss-2608300924205748's resolution claims identifiers, enum values and hashes are validated shapes. Nothing validates them; a real attestation ref is free prose (a commit range with a parenthetical), so an absolute home path in a ref or a hostname in a verifier id lands in the shipped intent's Audit Notes verbatim. In internal/core/reading/ingest_regime.go a refused comparative item's free-text criterion is echoed into RunRecord.RefusedItems and lands in the durable run.json and refusal.json unredacted, while an ACCEPTED item's body is redacted on write by the same ingest. Expected: every payload-derived string bound for a durable record is redacted before it is neutralised, and what has a declared shape is validated instead.

Agent-supplied verdict and refusal fields reach committed records unredacted, in two sibling ingests. In internal/core/intent/audit.go the ingested block renders verifier.id, verifier.version, policy.rubric_hash, policy.prompt_hash and every input_attestations[] kind, ref and digest through orDash/oneLine alone: no privacy redaction and no shape validation, though iss-2608300924205748's resolution claims identifiers, enum values and hashes are validated shapes. Nothing validates them; a real attestation ref is free prose (a commit range with a parenthetical), so an absolute home path in a ref or a hostname in a verifier id lands in the shipped intent's Audit Notes verbatim. In internal/core/reading/ingest_regime.go a refused comparative item's free-text criterion is echoed into RunRecord.RefusedItems and lands in the durable run.json and refusal.json unredacted, while an ACCEPTED item's body is redacted on write by the same ingest. Expected: every payload-derived string bound for a durable record is redacted before it is neutralised, and what has a declared shape is validated instead.

Grounds

• pursued: every agent-supplied string that reaches a committed record is privacy-redacted at the moment it is written, in both ingests, and the fields excused from redaction are exactly those a validator constrains. What would show it wrong: a home path, hostname or person name surviving into a shipped intent's Audit Notes or into a reading run's run.json or refusal.json, or a validated field corrupted by the redactor.