agent foundation

lib/Service/Audit/SystemAuditRedactionService.php

@@ -9,6 +9,7 @@ class SystemAuditRedactionService
     private const MAX_STRING_LENGTH = 500;
     private const MAX_ARRAY_ITEMS = 50;
 
+    // email/to_email are PII, not credentials, but still redacted to avoid leaking addresses in audit logs.
     /** @var array<int, string> */
     private const SENSITIVE_KEYS = [
         'password',
@@ -27,6 +28,8 @@ class SystemAuditRedactionService
         'to_email',
     ];
 
+    // Only fields on this list show actual before/after values in change sets.
+    // Everything else is recorded as '[REDACTED]' — callers must explicitly opt in to expose change values.
     /** @var array<int, string> */
     private const CHANGE_VALUE_ALLOWLIST = [
         'active',
@@ -45,6 +48,9 @@ class SystemAuditRedactionService
         'user_inactivity_delete_days',
         'system_audit_enabled',
         'system_audit_retention_days',
+        'frontend_telemetry_enabled',
+        'frontend_telemetry_sample_rate',
+        'frontend_telemetry_allowed_events',
     ];
 
     public function redactMetadata(array $metadata): array
@@ -157,6 +163,7 @@ class SystemAuditRedactionService
         return $string;
     }
 
+    // Use json_encode for arrays to get consistent comparison regardless of type coercion.
     private function valuesEqual(mixed $left, mixed $right): bool
     {
         if (is_array($left) || is_array($right)) {
@@ -177,6 +184,7 @@ class SystemAuditRedactionService
             return true;
         }
 
+        // Heuristic fallback catches new sensitive keys that weren't explicitly listed.
         return str_contains($key, 'password')
             || str_contains($key, 'secret')
             || str_contains($key, 'token')