Publish redacted ConfigKit effective configuration

internal/core/config/load.go

@@ -39,6 +39,7 @@ func documentDefinition(state *documentLoadState) configkit.Definition[Document]
 			Path:  configkit.Keys("version"),
 			Check: validateDocumentVersion,
 		},
+		Secret: sensitiveDocumentPath,
 	}
 }
 

internal/core/config/loaded_config_test.go

@@ -127,6 +127,52 @@ pipelines:
 	}
 }
 
+func TestLoadedConfigRedactsSensitiveNestedOptions(t *testing.T) {
+	t.Parallel()
+
+	loaded, err := loadConfigSource(configkit.Bytes("document.yml", []byte(`version: 5
+pipelines:
+  session:
+    input:
+      module: input
+      options:
+        nested:
+          api_key: input-secret
+    artifacts:
+      score:
+        extract:
+          module: extract
+          validators:
+            - module: configured-a
+              options:
+                credentials:
+                  token: validator-secret
+`)), LoadOptions{})
+	if err != nil {
+		t.Fatalf("loadConfigSource() error = %v", err)
+	}
+	var effective bytes.Buffer
+	if err := loaded.WriteEffective(&effective); err != nil {
+		t.Fatalf("WriteEffective() error = %v", err)
+	}
+	for _, secret := range []string{"input-secret", "validator-secret"} {
+		if strings.Contains(effective.String(), secret) {
+			t.Fatalf("effective configuration exposes %q: %q", secret, effective.String())
+		}
+	}
+	if !strings.Contains(effective.String(), "[REDACTED]") {
+		t.Fatalf("effective configuration did not mark sensitive values: %q", effective.String())
+	}
+
+	var explanation bytes.Buffer
+	if err := loaded.WriteExplanation(&explanation, "/pipelines/session/artifacts/score/extract/validators/0/options/credentials/token"); err != nil {
+		t.Fatalf("WriteExplanation() error = %v", err)
+	}
+	if strings.Contains(explanation.String(), "validator-secret") || !strings.Contains(explanation.String(), "[REDACTED]") {
+		t.Fatalf("explanation exposes sensitive value: %q", explanation.String())
+	}
+}
+
 func pipelineProfileWithChangedOption(profile pipeline.PipelineProfile) pipeline.PipelineProfile {
 	profile = clonePipelineProfile(profile)
 	nested := profile.Artifacts["score"].Extract.Options["nested"].(map[string]any)

internal/core/config/redaction.go

@@ -4,6 +4,7 @@ import (
 	"reflect"
 	"strings"
 
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 	"gitea.maximumdirect.net/eric/notarius/internal/framework/pipeline"
 )
 
@@ -188,3 +189,21 @@ func sensitiveConfigKey(key string) bool {
 	key = strings.ToLower(key)
 	return strings.Contains(key, "api_key") || strings.Contains(key, "apikey") || strings.Contains(key, "authorization") || strings.Contains(key, "bearer") || strings.Contains(key, "password") || strings.Contains(key, "secret") || strings.Contains(key, "token")
 }
+
+// sensitiveDocumentPath applies the existing option-key classification to the
+// fully typed ConfigKit document. Dynamic option maps can be nested below any
+// producer or validator, so every key after an options container participates.
+func sensitiveDocumentPath(path configkit.Path) bool {
+	segments := strings.Split(strings.TrimPrefix(path.String(), "/"), "/")
+	withinOptions := false
+	for _, segment := range segments {
+		segment = strings.ReplaceAll(strings.ReplaceAll(segment, "~1", "/"), "~0", "~")
+		if withinOptions && sensitiveConfigKey(segment) {
+			return true
+		}
+		if segment == "options" {
+			withinOptions = true
+		}
+	}
+	return false
+}