Function filter_response 

pub fn filter_response(
    acl: &Effective,
    user: &str,
    path: &str,
    body: &str,
) -> String

A read response narrowed to what user may see (D29 phase B).

/api/view and /api/reviews are the two endpoints that answer with other repositories’ contents, so they are the two this rewrites; every other path is already gated by api_denial and passes through. A body that is not the JSON object this expects is returned untouched rather than emptied, because a filter that silently blanks an unrecognized payload hides the mismatch instead of showing it.

log and build survive for every reader: they name the node, its log head and the binary serving them. A writer needs the head to bind a scoped submission, and neither says anything about a repository.