[margrop]

What changed

• add the dependency-free @margrop-labs/redaction TypeScript workspace
• redact IP addresses, domains, email addresses, Authorization, Token, Cookie, serial numbers, and WWNs
• allowlist structured fields before recursive sanitization, with type and size limits
• reject Secret kinds by default without echoing their values
• document URL, logging, Analytics, AI-request, and export boundaries
• mark P0-007 complete and recommend P1-004 next

Why

P1-004 must not send raw repository or form content to an AI provider. P0-007 establishes the deterministic privacy boundary required before that integration.

Validation

• ASTRO_TELEMETRY_DISABLED=1 npm run validate
• 7 test files and 75 tests passed
• Astro/TypeScript: 0 errors, warnings, or hints
• build and 20 static/mobile/accessibility checks passed

Privacy and cost impact

• no network, storage, logging, or runtime dependencies
• unknown fields are dropped before free-text redaction
• reports contain only sensitive kinds and counts
• no AI calls or Token cost introduced