Follow the text beyond the query log
The July review found gaps in three different paths. AI Core accepted versioned requests when no token was configured, saved learner messages bypassed query-log redaction, and portable evaluation reports retained full responses or payloads.
Versioned service requests now fail when authentication isn't configured, and the default documentation routes are disabled. Saved conversations reuse the sensitive-text redaction rules but have a longer history allowance than query telemetry. A logging limit therefore doesn't cut conversational context down to the size of a diagnostic entry.
Evaluation exports keep selected status, scope, origin, citation counts, payload keys and presence flags instead of complete payloads or raw errors. This removes particular copies of learner and source text; it doesn't make every report field or provider trace anonymous.
Keep the test result at the scope it measured
Python tests cover health, versioned routes, authentication, disabled docs, validation, response shape, ranking, claim extraction and unsupported content. Laravel tests add the client and gateways, learner access, message redaction and report output.
The July 1 record reports 12 Python tests passing with one deprecation warning, plus 54 focused PHP tests and 360 assertions. It includes regressions that failed before the fixes. These are historical local results, not tests rerun for this account.
The evaluation harness uses provider fixtures to check targets, citations, source quality, refusals, access, injection-related cases and learner state. Its results apply to those supplied cases. They don't establish general accuracy, production load capacity or universal prompt-injection resistance.