fix(supervisor-network): redact FORWARD query strings in OCSF and denials

architecture/security-policy.md

@@ -239,4 +239,8 @@ the HTTP relay have succeeded so a later denial cannot coexist with an allowed
 record for the same request.
 
 Never log secrets, credentials, bearer tokens, or query parameters in OCSF
-messages. OCSF JSONL output may be shipped to external systems.
+messages. OCSF JSONL output may be shipped to external systems. The FORWARD
+HTTP proxy redacts query strings at emit sites (`?[redacted]`) in OCSF URL
+fields, messages, parse-error details, and client-facing 403 bodies so
+on-disk shorthand/JSONL logs stay clean even before agent-facing denial
+read-path redaction.

crates/openshell-supervisor-network/src/policy_local.rs

@@ -384,13 +384,10 @@ fn read_recent_denial_lines(log_dir: &Path, limit: usize) -> Vec<String> {
                 continue;
             }
             // Defense-in-depth: redact query strings before truncation. The
-            // FORWARD deny path in `proxy.rs` populates the OCSF `message`
-            // and URL with the raw request path including `?query=...`, which
-            // the shorthand layer then renders verbatim. Stripping queries
-            // here means the agent never sees the secret even if an upstream
-            // emit site forgets to redact (TODO: harden the emit sites in
-            // proxy.rs FORWARD path so the on-disk shorthand log itself is
-            // clean — tracked separately). Redact first so truncation cannot
+            // FORWARD path in `proxy.rs` redacts query strings at emit sites
+            // (`redact_path_for_logging` / `redact_uri_for_logging`), but this
+            // read path still strips queries so a forgotten emit site cannot
+            // surface secrets to the agent. Redact first so truncation cannot
             // slice mid-secret.
             let redacted = redact_query_strings(line);
             let surfaced = truncate_at_char_boundary(&redacted, MAX_DENIAL_LINE_BYTES);