Updating logging.

Author: jzonthemtn

CLAUDE.md

@@ -355,8 +355,11 @@ private JsonNode sendJson(final String url, final String body, final String auth
         final HttpResponse<String> resp = httpClient.send(reqBuilder.build(),
                 HttpResponse.BodyHandlers.ofString());
         if (resp.statusCode() / 100 != 2) {
+            // Do not include resp.body() — it carries partial search hits with raw
+            // originalText for the documents this job was about to ingest, and the
+            // exception bubbles up to a log site. Status + length is the safe surrogate.
             throw new IllegalStateException("Elasticsearch returned HTTP " + resp.statusCode()
-                    + (resp.body() == null || resp.body().isEmpty() ? "" : ": " + resp.body()));
+                    + " (body length " + (resp.body() == null ? 0 : resp.body().length()) + ")");
         }
         return objectMapper.readTree(resp.body());
     }

arbiter-platform/src/main/java/ai/philterd/arbiter/service/ElasticsearchIngestJobService.java

@@ -80,8 +80,13 @@ public void indexDocument(final Document document) {
             // (auth and configurable index name applied via applyAuth() and indexName())
             final HttpResponse<String> resp = httpClient.send(req, HttpResponse.BodyHandlers.ofString());
             if (resp.statusCode() / 100 != 2) {
-                log.warn("OpenSearch indexing returned HTTP {} for document {} ({}): {}",
-                        resp.statusCode(), document.getId(), url, truncate(resp.body()));
+                // Do not log resp.body() — a non-2xx index response from OpenSearch echoes
+                // parts of the request payload, which carries the document's PII-bearing
+                // originalText. Body length is enough for an operator to tell a parse error
+                // (a few bytes) from a quota / mapping error (a longer JSON envelope).
+                log.warn("OpenSearch indexing returned HTTP {} for document {} ({}); body length {}",
+                        resp.statusCode(), document.getId(), url,
+                        resp.body() == null ? 0 : resp.body().length());
             }
         } catch (Exception e) {
             log.warn("OpenSearch indexing failed for document {} at {}: {}",
@@ -184,8 +189,14 @@ public SearchResults search(final String query, final int from, final int size,
                 return new SearchResults(0, safeFrom, safeSize, List.of());
             }
             if (resp.statusCode() / 100 != 2) {
-                log.warn("OpenSearch search returned HTTP {} for query '{}': {}",
-                        resp.statusCode(), query, truncate(resp.body()));
+                // Never log the raw query — users routinely search for PII (an email
+                // address, a phone number, a partial name) and that string would land
+                // in the log file. Never log the response body either — it contains
+                // matched document originalText snippets. A length + status is enough
+                // for triage; the OpenSearch cluster's own logs carry the full payload.
+                log.warn("OpenSearch search returned HTTP {} (query length {}, response length {})",
+                        resp.statusCode(), query.length(),
+                        resp.body() == null ? 0 : resp.body().length());
                 return empty;
             }
             final JsonNode root = objectMapper.readTree(resp.body());
@@ -210,7 +221,9 @@ public SearchResults search(final String query, final int from, final int size,
             }
             return new SearchResults(total, safeFrom, safeSize, List.copyOf(hits));
         } catch (Exception e) {
-            log.warn("OpenSearch search failed for query '{}' at {}: {}", query, url, e.getMessage());
+            // Same reasoning as the non-2xx branch above — log only metadata.
+            log.warn("OpenSearch search failed at {} (query length {}): {}",
+                    url, query.length(), e.getMessage());
             return empty;
         }
     }
@@ -264,8 +277,11 @@ public SearchResults findSimilar(final String documentId, final String batchId,
             final HttpResponse<String> resp = httpClient.send(req, HttpResponse.BodyHandlers.ofString());
             if (resp.statusCode() == 404) return empty;
             if (resp.statusCode() / 100 != 2) {
-                log.warn("OpenSearch findSimilar returned HTTP {} for document {}: {}",
-                        resp.statusCode(), documentId, truncate(resp.body()));
+                // The findSimilar response body contains matched documents' originalText
+                // snippets — never log it. Length is enough for triage.
+                log.warn("OpenSearch findSimilar returned HTTP {} for document {}; body length {}",
+                        resp.statusCode(), documentId,
+                        resp.body() == null ? 0 : resp.body().length());
                 return empty;
             }
             final JsonNode root = objectMapper.readTree(resp.body());
@@ -354,11 +370,6 @@ private HttpRequest.Builder applyAuth(final HttpRequest.Builder b) {
         return b;
     }
 
-    private static String truncate(final String s) {
-        if (s == null) return "";
-        return s.length() <= 200 ? s : s.substring(0, 200) + "…";
-    }
-
     /**
      * Render a highlight snippet as safe HTML. The raw snippet contains the surrounding
      * document text (which may include user-typed {@code <script>} payloads) bracketed by

arbiter-platform/src/main/java/ai/philterd/arbiter/service/OpenSearchIndexService.java

@@ -389,8 +389,13 @@ private JsonNode sendJson(final String url, final String body, final String auth
         final HttpResponse<String> resp = httpClient.send(reqBuilder.build(),
                 HttpResponse.BodyHandlers.ofString());
         if (resp.statusCode() / 100 != 2) {
+            // Do not include resp.body() in the exception message: it can carry partial
+            // search hits (with raw originalText) for the documents this job was about
+            // to ingest, and the exception is then logged by the caller's failure path.
+            // Status code + body length is the safe surrogate; an operator who needs the
+            // full body can read it from the OpenSearch cluster's own logs.
             throw new IllegalStateException("OpenSearch returned HTTP " + resp.statusCode()
-                    + (resp.body() == null || resp.body().isEmpty() ? "" : ": " + resp.body()));
+                    + " (body length " + (resp.body() == null ? 0 : resp.body().length()) + ")");
         }
         return objectMapper.readTree(resp.body());
     }

arbiter-platform/src/main/java/ai/philterd/arbiter/service/OpenSearchIngestJobService.java

@@ -278,6 +278,36 @@ backups. Rotating the key requires re-encrypting every existing row; this is
 intentionally out-of-band today (no UI affordance) so that a sloppy rotation
 does not leave half the corpus unreadable.
 
+## PII never appears in application logs
+
+Arbiter's logging policy is that **document content is never written to a log
+file or to standard out**, regardless of log level. The fields covered are
+the same ones encrypted at rest in MongoDB:
+
+- Document `originalText` (the source text being redacted) and
+  `redactedText` (the rendered output).
+- Document `failureMessage` text.
+- Span `text` (the literal PII string detected).
+- Comment `text`.
+- User-supplied search queries (a reviewer searching for an email or phone
+  number must not pin that string in the log file).
+
+Network call sites that interact with stores carrying this content
+(OpenSearch indexing, OpenSearch search, OpenSearch `more_like_this`,
+OpenSearch and Elasticsearch ingest) deliberately log only metadata —
+status code, body length, document id, batch id, error class — when they
+fail. Response bodies and query strings are summarised by length, never
+echoed verbatim. Exceptions thrown from those layers carry the same
+metadata-only message so a downstream `log.warn(..., e.getMessage())` does
+not regress this contract.
+
+If a richer dump is needed for diagnosis, read the **OpenSearch /
+Elasticsearch cluster's own logs** rather than Arbiter's — those stores
+have their own access controls and are part of the same security boundary
+documented above. The bootstrap admin notice on first start is the only
+deliberate write to standard out, and it carries no document PII — just
+the configured admin email and a generated initial password.
+
 ## Document content integrity
 
 Every document Arbiter ingests — whether through the web upload form or