Redact sensitive host artifact paths without changing source identity or policy scope

[pengfei-threemoonslab]

Found during the independent review of #589 (#547); deferred as requested rather than expanding the recovery change.

Problem

The host inventory sanitizes configuration values, but _artifact retains its raw source as artifacts[].path. A credential-like value embedded in a directory name can therefore enter an inventory artifact even when the corresponding failed-input diagnostic and boundary result redact it.

Reproduction

Create a temporary repository directory whose name is settings TOKEN=<synthetic GitHub-token-shaped sentinel> and place an invalid-UTF-8 .mcp.json inside it. Run build_host_boundary_snapshot or the repository host audit. The failed artifact path contains the sentinel. On #589, the new issues[].source/recovery text and check boundary output redact it and every permission remains denied. This is an output-privacy defect, not an observed authority bypass or disclosure of a real credential.

The independent reviewer compared _artifact on base 1d4c0f841b1d11f5f8e822d60263aa55cd77ded5 and head 5ed4b4452254102d2ddd7a8ee92a376781be6883: both publish path: source unchanged. The same function derives artifact_id from the unsanitized source. host_coverage[].sources_observed is projected from artifact paths, so that projection must be inventoried as part of a repair; replacing one presentation field alone may leave another raw copy.

Required follow-up

Trace path-bearing host inventory, grant, coverage and drift projections, then define consistent privacy and identity semantics for a redacted location. Preserve internal exact-path associations for source reads and policy classification. Do not truncate or redact paths before authority classification, silently merge different sources after redaction, or claim that a redacted path is an exact executable locator.

Acceptance

• Public audit JSON/human output, host coverage and drift contain no synthetic credential sentinel from the failed-input path; source contents remain absent.
• The same privacy policy covers successful and failed artifact paths without altering exact internal read or policy scope.
• Redaction collisions and long paths have explicit stable identity/locator behavior; one source cannot inherit another source's grants or recovery evidence.
• Existing incomplete-input denial and baseline/drift comparability rules remain unchanged, or any required format migration follows STABILITY.md.

Related: #547 confines the immediate failure-recovery extension; #586 concerns source-omission redaction accounting, not host artifact paths. This issue is separately deferred and does not establish a candidate release privacy result.