fix: measure repository-wide risk coverage

tests/features/reference-feature/reference-runtime-composition.test.ts

@@ -138,4 +138,58 @@ describe("reference feature runtime composition", () => {
     );
     adapters.infrastructure.dispose();
   });
+
+  it("keeps private command intent identity out of URLs and diagnostics", async () => {
+    const requests: Array<Readonly<{ url: string; headers: Headers }>> = [];
+    const fetcher = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      requests.push({
+        url: String(input),
+        headers: new Headers(init?.headers),
+      });
+      return Response.json(
+        { id: "resource-1", name: "Created resource" },
+        { status: 201 },
+      );
+    });
+    const adapters = await createRuntimeAdapters({
+      runtime,
+      release,
+      host: {},
+      fetcher,
+    });
+    await adapters.outputPorts.session.beginSignIn();
+    await vi.waitFor(() =>
+      expect(adapters.infrastructure.serverStateScope.getPhase()).toBe("READY"),
+    );
+    const intent = Object.freeze({
+      intentId: "private-intent-id",
+      operationId: "CREATE_REFERENCE_RESOURCE",
+      canonicalInputIdentity: "private-canonical-input",
+      idempotencyKey: "private-idempotency-key",
+      createdAtMonotonicMs: 42,
+    });
+
+    await expect(
+      adapters.featureInputs[REFERENCE_FEATURE_ID].createResource(
+        { name: "Created resource" },
+        { intent },
+      ),
+    ).resolves.toMatchObject({ ok: true });
+
+    expect(requests).toHaveLength(1);
+    expect(requests[0]?.headers.get("Idempotency-Key")).toBe(
+      "private-idempotency-key",
+    );
+    expect(requests[0]?.url).toBe(
+      "http://localhost:8080/api/reference-resources",
+    );
+    const safeEvidence = JSON.stringify({
+      requests: requests.map((request) => request.url),
+      diagnostics: adapters.outputPorts.diagnostics.entries(),
+    });
+    expect(safeEvidence).not.toContain("private-intent-id");
+    expect(safeEvidence).not.toContain("private-canonical-input");
+    expect(safeEvidence).not.toContain("private-idempotency-key");
+    adapters.infrastructure.dispose();
+  });
 });