fix(holoindex): redact timeout diagnostics

Author: Foundups Agent

ModLog.md

@@ -17,6 +17,8 @@
   closed before Holo-dependent worker execution.
 - Corrected incremental, malformed-registry, scoped/capped source, linked
   worktree, direct-adapter, and downstream freshness truth boundaries.
+- Replaced caller-controlled HoloIndex timeout/exception log text with stable
+  redacted codes after the PR CodeQL gate identified two high-severity flows.
 - Added the WSP_97 high-risk assumption audit, WSP_15 P0 record, module
   ROADMAP/TestModLogs, operator runbook, and machine contract.
 
@@ -31,8 +33,8 @@ build/repair recursion, not a claim of unrestricted production autonomy.
 **WSP Compliance**: Work was isolated from concurrent lanes in a dedicated Git
 worktree and focused branch; no framework WSP or knowledge mirror changed.
 MODULE_CONCATENATION_GATE.md remains correctly unmirrored because it is a
-non-protocol quick reference. The final HoloIndex matrix passed 345 tests, the
-final non-overlapping focused matrices passed 744 tests, the independent
+non-protocol quick reference. The final HoloIndex matrix passed 346 tests, the
+final non-overlapping focused matrices passed 745 tests, the independent
 boundary/security review passed 289 tests, all 81 changed or added Python files
 compiled, WSP_00 remained green, and the WSP_97 structural receipt validated.
 PR evidence and clean-main post-merge activation remain pending.

docs/audits/infrastructure/HOLOINDEX_REDDOG_WSP97_EXECUTION_RECEIPT_PHASE1.json

@@ -27,8 +27,8 @@
       "holo_index/tests/test_holoindex_embedding_space.py"
     ],
     "macro_pass": [
-      "Final no-overlap focused validation: 744 passed across HoloIndex, infrastructure owner, RedDog query/downstream, and idle-maintenance matrices.",
-      "Final HoloIndex validation: 345 passed across storage/source/CLI/embedding, freshness/maintenance, incremental/work-ledger, and machine-contract matrices.",
+      "Final no-overlap focused validation: 745 passed across HoloIndex, infrastructure owner, RedDog query/downstream, and idle-maintenance matrices.",
+      "Final HoloIndex validation: 346 passed across storage/source/CLI/embedding, freshness/maintenance, incremental/work-ledger, and machine-contract matrices.",
       "Independent owner/client/maintenance/security validation: 289 passed.",
       "All 81 changed or added Python files compiled without writing bytecode."
     ],

holo_index/ModLog.md

@@ -3,7 +3,7 @@
 ## [2026-07-18] HOLOINDEX_REDDOG_OPERATIONAL_TRUTH_BOUNDARY_POC_PHASE1
 
 **WSP Protocol**: WSP 00, 05, 06, 15, 22, 34, 50, 62, 64, 84, 87, 96, 97
-**Phase**: POC implementation; focused validation/PR evidence pending
+**Phase**: POC implementation complete; focused validation green; PR checks pending
 **Agent**: 0102 architect for 012 with delegated audit/test workers
 
 **Changes**:
@@ -28,6 +28,9 @@
 - FIX offline Hugging Face snapshot discovery (models--.../snapshots/<rev>)
   with refs/main selection and complete-artifact checks. Model/import timeout
   helpers now return promptly instead of waiting during executor shutdown.
+- REDACT timeout/dependency/failure diagnostics to stable codes and exception
+  class names; caller-controlled query, path, hint, and exception text is never
+  written to the timeout-wrapper log.
 - HARDEN the resident RedDog owner by forcing fp32 routing, disabling the
   generation-unbound SearchCache, comparing all seven live/reported
   collection_embedding_space_map values, and poisoning a backend that sees a
@@ -53,10 +56,10 @@ direct-store consumers remain outside that claim. Malformed, narrowed, capped,
 lexical, dirty, raced, and snapshot-only paths cannot claim operational
 freshness through the migrated boundary.
 
-**WSP Compliance**: Newly extracted helpers are kept focused where verified;
-focused WSP_62 results and any architect exemptions will be recorded after the
-gate runs. Historical monolith debt is recorded rather than hidden. The WSP_97
-assumption audit and WSP_15 P0 score are in the cross-module audit.
+**WSP Compliance**: New helpers meet focused WSP_62 thresholds; exact temporary
+exemptions and ROADMAP remediation cover inherited monolith debt. The final
+HoloIndex matrix passed 346 tests, changed Python compiled, and the WSP_97
+assumption audit and WSP_15 P0 score are recorded in the cross-module audit.
 
 ## [2026-07-16] HOLOINDEX_MEMEX_PER_TARGET_RETRIEVAL_VERDICT_PHASE1
 

holo_index/core/holo_index.py

@@ -106,10 +106,10 @@ def _run_with_timeout(func, timeout_sec: float, default=None, error_msg: str = "
     Execute a function with a hard timeout using ThreadPoolExecutor.
     Returns default value on timeout or exception instead of hanging.
 
-    Distinguishes between:
-    - Actual timeout (FuturesTimeoutError): Log as timeout with remediation hints
-    - Missing dependency (ImportError/ModuleNotFoundError): Log with install hint
-    - Other exceptions: Log with original error message
+    Distinguishes timeouts, missing dependencies, and other exceptions while
+    emitting stable diagnostics only. error_msg and missing_dep_hint remain
+    for call compatibility but are never logged because callers may derive
+    them from repository content, queries, paths, or secrets.
 
     WSP 97: Prevents indefinite hangs in HoloIndex operations.
     """
@@ -122,17 +122,20 @@ def _run_with_timeout(func, timeout_sec: float, default=None, error_msg: str = "
         return future.result(timeout=timeout_sec)
     except FuturesTimeoutError:
         logger.warning(
-            f"{error_msg} (>{timeout_sec}s). "
-            f"Semantic search will be unavailable. "
-            f"Raise HOLO_MODEL_IMPORT_TIMEOUT/HOLO_MODEL_LOAD_TIMEOUT or rerun after model warmup."
+            "HOLOINDEX_OPERATION_TIMEOUT (>%.3fs); semantic search unavailable. "
+            "Raise the bounded model timeout or rerun after model warmup.",
+            timeout_sec,
         )
         return default
     except (ImportError, ModuleNotFoundError) as e:
-        hint = missing_dep_hint or "pip install -r holo_index/requirements.txt"
-        logger.warning(f"Missing dependency: {e}. Fix: {hint}")
+        logger.warning(
+            "HOLOINDEX_DEPENDENCY_UNAVAILABLE (%s); install the declared "
+            "HoloIndex requirements or use explicit lexical diagnostics.",
+            type(e).__name__,
+        )
         return default
     except Exception as e:
-        logger.warning(f"{error_msg}: {e}")
+        logger.warning("HOLOINDEX_OPERATION_FAILED (%s)", type(e).__name__)
         return default
     finally:
         # A context manager waits for a running worker during __exit__, which

holo_index/core/search_engine.py

@@ -869,7 +869,7 @@ def _search_collection(
             lambda: model.encode(query, show_progress_bar=False).tolist(),
             timeout_sec=HOLO_ENCODE_TIMEOUT,
             default=None,
-            error_msg=f"model.encode() timed out for query '{query[:50]}'",
+            error_msg="model.encode() timed out",
         )
     if embedding is None:
         if _strict_semantic_owner(holo):

holo_index/tests/TESTModLog.md

@@ -25,9 +25,11 @@
   runtime map mismatch, cache-disable, and resident generation-pin regressions.
 - Added strict-owner collection-count and blocking-encode regressions proving
   swallowed errors or lexical fallback cannot produce CURRENT.
-- Final HoloIndex evidence: storage/source/CLI/embedding/backend 87 passed;
+- Added a CodeQL regression proving caller-controlled diagnostic and exception
+  text cannot leak through timeout-wrapper logs.
+- Final HoloIndex evidence: storage/source/CLI/embedding/backend 88 passed;
   freshness/maintenance 143 passed; incremental/work-ledger 109 passed; and
-  machine-contract validation 6 passed (345 total, no failures or skips).
+  machine-contract validation 6 passed (346 total, no failures or skips).
 - Independent owner/client/maintenance/security evidence: 289 passed. These are
   scoped matrices, not a whole-repository claim.
 

holo_index/tests/test_holoindex_embedding_space.py

@@ -114,6 +114,36 @@ def test_timeout_returns_without_waiting_for_running_worker() -> None:
     assert elapsed < 0.15
 
 
+def test_timeout_wrapper_never_logs_caller_or_exception_text(caplog) -> None:
+    secret = "sentinel-secret-query-material"
+
+    def fail_with_secret() -> None:
+        raise RuntimeError(secret)
+
+    caplog.set_level("WARNING")
+    result = _run_with_timeout(
+        fail_with_secret,
+        timeout_sec=0.1,
+        default="failed",
+        error_msg=secret,
+        missing_dep_hint=secret,
+    )
+    assert result == "failed"
+    assert secret not in caplog.text
+    assert "HOLOINDEX_OPERATION_FAILED (RuntimeError)" in caplog.text
+
+    caplog.clear()
+    result = _run_with_timeout(
+        lambda: time.sleep(0.1),
+        timeout_sec=0.01,
+        default="timed-out",
+        error_msg=secret,
+    )
+    assert result == "timed-out"
+    assert secret not in caplog.text
+    assert "HOLOINDEX_OPERATION_TIMEOUT" in caplog.text
+
+
 class _Collection:
     name = "navigation_code"