Report documented operation, scope and exposure error codes, permitted exposure enums and proxy challenge indicators during deployment checks. Exclude arbitrary upstream messages and credential material while retaining failure on denied access.
Validation: source checks and 123 tests pass. Retried staging run 227194 still returns org_context_http_403; the new diagnostic requires the user-managed push before a further run.
Log the requested tenant, endpoint, operation and exposure for organization HTTP 401/403 responses. Keep credentials and upstream response bodies out of diagnostics and retain the deployment gate.
Validation: source checks and 118 tests pass, including forbidden-root identification and diagnostic privacy coverage.