feat: harden shared platform contracts

tests/test_core_events.py

@@ -250,6 +250,38 @@ class CoreEventTests(unittest.TestCase):
         self.assertIn("frame-ancestors 'none'", response.headers["Content-Security-Policy"])
         self.assertEqual("max-age=86400", response.headers["Strict-Transport-Security"])
 
+    def test_slow_request_log_excludes_query_headers_and_cookies(self) -> None:
+        router = APIRouter()
+
+        @router.get("/slow")
+        def slow() -> dict[str, bool]:
+            return {"ok": True}
+
+        with patch("govoplan_core.server.fastapi._slow_request_threshold_ms", return_value=0.0001):
+            app = create_govoplan_app(
+                title="request log redaction test",
+                version="test",
+                registry=PlatformRegistry(),
+                api_router=router,
+            )
+
+        with self.assertLogs("govoplan.request", level="WARNING") as captured:
+            with TestClient(app) as client:
+                response = client.get(
+                    "/slow?token=query-secret",
+                    headers={
+                        "Authorization": "Bearer header-secret",
+                        "Cookie": "govoplan_session=cookie-secret",
+                    },
+                )
+
+        self.assertEqual(200, response.status_code, response.text)
+        rendered = "\n".join(captured.output)
+        self.assertIn("path=/slow", rendered)
+        self.assertNotIn("query-secret", rendered)
+        self.assertNotIn("header-secret", rendered)
+        self.assertNotIn("cookie-secret", rendered)
+
     def test_production_app_startup_rejects_an_unvalidated_environment(self) -> None:
         with patch.dict("os.environ", {"APP_ENV": "production"}, clear=True), self.assertRaisesRegex(
             RuntimeError,