[Kohandezh]

Log-privacy follow-up to HOM-113, freeze scope, requested by the Integrator. Stacked on #43 (base backend/hom-113-observability, e0b577e); retarget to main after #43 merges. No migration, no compose change.

What it does

• uvicorn access log: AccessLogFilter (backend/observability/access_log.py) rewrites uvicorn's access record to show the matched route template instead of the raw path, and drops the query string. Paths matching no route show as unmatched. Share and invite tokens never reach the access log.
• Exception summaries are class-only: class name plus bounded fields only (driver SQLSTATE and constraint/table/column, code=, errno=, the class of an explicit raise … from cause). A scrubbed message is added only for SAFE_MESSAGE_TYPES (ProviderError, the RLS posture error). An exception passed as a %s argument, and Celery's %(exc)s, are replaced by the summary. This covers raw psycopg errors, validation errors and wrappers.
• Celery: a setup_logging receiver keeps our JSON handler in workers and beat. A failed task logs its summary and no traceback.
• Scrubber bound: a credential that starts in the last KiB before the 16000-character bound is dropped, so a quoted value split by the bound can't survive. The hostile-input tests now use the full bound.
• OTP_DELIVERY_FAILED logs the exception class, not its text.
• Docs (observability.md, ADR 0036 item 6): SIGBUS on a full metrics tmpfs, which WriteGuard can't catch. Dead workers' counter files are kept on purpose: mark_process_dead only removes live-gauge files, and deleting counter files would reset the summed counters.

Tests (local PostgreSQL 16 on 54334 + Redis), not CI-validated

• test_log_privacy.py (new, 29 tests):
  • a real uvicorn server with the access log on: requests carrying a token in the path, the query string, or an unmatched path; the captured uvicorn formatter output plus stdout and stderr contain no token;
  • a real Celery task run that raises an IntegrityError with an e-mail and a phone in its parameters and DETAIL: the logged line is the summary, with no SQL, DETAIL, PII or traceback;
  • ten exception-summary cases;
  • the quoted secret at the bound;
  • eight hostile inputs of 16000 characters or more, each scrubbed in under 1 s.
• Mutation checks: with the Celery receiver disconnected, both Celery tests fail; with the access filter disabled, the access-log test fails.
• Focused batch: every test file using caplog/capfd/capsys, plus auth, api, queue routing, observability and log privacy → 782 passed, 0 failed.
• ruff clean on the changed files; gitleaks clean.

Security notes

• Logs never carry exception text unless the type is allow-listed; raw paths and query strings never reach uvicorn's access log.
• Residual: the nginx proxy access log still prints raw paths (documented). services/tombstone_journal.py:221 logs str(JournalUnavailable); that file is Lane C's, so it has been routed to the Integrator.

[Kohandezh]

Integrator merge evidence (log privacy), head 1428702: reviews passed; CI hang root-caused (datetime.utcnow warning recursion in Celery workers) and fixed with guarded formatters; order-dependent access-log test root-caused (alembic.ini fileConfig raising root level) and fixed at the source with a regression test. Owner-approved otp_request re-baseline 2026-10-18. CI on 1428702 all green; owner guard re-run locally on main (after #55) + #66: fingerprint tests pass (only the host-load golden timing test failed). Merging.