fix(server): keep connection tickets out of request traces - #27904

Eligibility
The change redacts connection credentials from logs and traces, but also enforces owner-only permissions on existing state directories during startup. Confirm that removing previously available group or other-user access is an intended compatibility change.

Additional Thinking

Your Custom Policy

The default criteria apply. The prohibition on automatically approving product-default changes applies because startup now enforces owner-only state-directory access instead of retaining existing or umask-derived permissions. No diagnostic-suppression directives appear in the assessed diff.

Code

Redacts wsTicket and dpop query credentials from serialized traces, span attributes/events/errors, and console/OTLP log causes. Server directory initialization also unconditionally changes the existing state directory to mode 0700, warning rather than failing if chmod fails. This reaches startup and existing persisted state; two ignored files were not reconstructed.

Review Context

Author maria-rcks has write access; no ownership requirements were supplied. The supplied thread check reports two resolved threads and no unresolved comments. No correctness findings, blocking-severity configuration, or CI results were supplied.

Verdict

The credential redaction limits sensitive diagnostic exposure, but unconditional chmod changes existing filesystem access expectations. Other users or service accounts that previously accessed the state directory could lose access. A human must confirm that enforcing owner-only access on existing installations is an intended, acceptable default change; the customer's default-change requirement independently requires human review.

Notes:
No code owners found in target merge base d2d1e4f

Agent Credits: 30 credits
Approvability runs at a flat rate of 30 credits whenever the agent is asked for a verdict.