diff --git a/internal/config/expand.go b/internal/config/expand.go
index 3966d47f5..16a8f9d56 100644
--- a/internal/config/expand.go
+++ b/internal/config/expand.go
@@ -1,3 +1,16 @@
+// Package config — expand.go provides ${VAR_NAME} environment variable expansion
+// for configuration values loaded from JSON stdin and TOML files.
+//
+// Why this file does NOT reuse internal/envutil:
+//
+// internal/envutil is a generic, low-level toolkit (GetEnvString, GetEnvIntRaw, …)
+// that returns defaults or zero values when a variable is undefined.  Config
+// expansion has stricter semantics: an undefined variable referenced in a
+// configuration file is a hard error, not a silent fallback.  Implementing that
+// "fail-fast on undefined" contract directly here (via os.LookupEnv + error
+// accumulation) avoids coupling the expansion logic to envutil's optional-return
+// pattern and makes the fatal-undefined guarantee explicit and testable without
+// envutil dependency.
 package config
 
 import (
diff --git a/internal/config/config_env.go b/internal/config/gateway_env.go
similarity index 98%
rename from internal/config/config_env.go
rename to internal/config/gateway_env.go
index bafd13e98..ceec08ac2 100644
--- a/internal/config/config_env.go
+++ b/internal/config/gateway_env.go
@@ -1,6 +1,6 @@
 package config
 
-// config_env.go — gateway-specific environment variable helpers.
+// gateway_env.go — gateway-specific environment variable helpers.
 //
 // This file intentionally layers on top of internal/envutil rather than
 // calling os.Getenv directly. The layering is deliberate:
diff --git a/internal/logger/rpc_format.go b/internal/logger/rpc_format.go
index 46fc7256f..9150a8455 100644
--- a/internal/logger/rpc_format.go
+++ b/internal/logger/rpc_format.go
@@ -19,17 +19,8 @@ import (
 	"fmt"
 	"strconv"
 	"strings"
-
-	"github.com/github/gh-aw-mcpg/internal/sanitize"
-	"github.com/github/gh-aw-mcpg/internal/util"
 )
 
-// truncateAndSanitize truncates the payload to max length and sanitizes secrets.
-func truncateAndSanitize(payload string, maxLength int) string {
-	sanitized := sanitize.SanitizeString(payload)
-	return util.Truncate(sanitized, maxLength)
-}
-
 // LogMarshaledForDebug marshals value for debug logging and dispatches to the
 // provided callbacks for success or marshal failure paths.
 func LogMarshaledForDebug(value interface{}, onMarshalSuccess func(string), onMarshalFailure func(error)) {
diff --git a/internal/logger/rpc_helpers_test.go b/internal/logger/rpc_helpers_test.go
index 9169f84f6..e69fb968e 100644
--- a/internal/logger/rpc_helpers_test.go
+++ b/internal/logger/rpc_helpers_test.go
@@ -176,66 +176,6 @@ func BenchmarkExtractErrorMessageLong(b *testing.B) {
 	}
 }
 
-// TestTruncateAndSanitize tests the truncateAndSanitize function
-func TestTruncateAndSanitize(t *testing.T) {
-	tests := []struct {
-		name      string
-		payload   string
-		maxLength int
-		want      string
-	}{
-		{
-			name:      "short string no truncation",
-			payload:   "Hello, World!",
-			maxLength: 50,
-			want:      "Hello, World!",
-		},
-		{
-			name:      "exact max length",
-			payload:   "Hello",
-			maxLength: 5,
-			want:      "Hello",
-		},
-		{
-			name:      "truncation needed",
-			payload:   "This is a very long string that needs to be truncated",
-			maxLength: 20,
-			want:      "This is a very long ...",
-		},
-		{
-			name:      "empty string",
-			payload:   "",
-			maxLength: 10,
-			want:      "",
-		},
-		{
-			name:      "zero max length",
-			payload:   "test",
-			maxLength: 0,
-			want:      "...",
-		},
-		{
-			name:      "sanitize secrets - GitHub token",
-			payload:   "token: ghp_1234567890abcdefghijklmnopqrstuvwxyz",
-			maxLength: 100,
-			want:      "token=[REDACTED]",
-		},
-		{
-			name:      "sanitize and truncate",
-			payload:   "auth bearer ghp_1234567890abcdefghijklmnopqrstuvwxyz " + strings.Repeat("x", 100),
-			maxLength: 50,
-			want:      "auth bearer [REDACTED] " + strings.Repeat("x", 27) + "...",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := truncateAndSanitize(tt.payload, tt.maxLength)
-			assert.Equal(t, tt.want, result)
-		})
-	}
-}
-
 // TestIsEffectivelyEmpty tests the isEffectivelyEmpty function
 func TestIsEffectivelyEmpty(t *testing.T) {
 	tests := []struct {