edison/chanora
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(governance): record PoC outcomes, owner decisions, and audit evidence

Browse Source 
Closes Phases A and D of the post-PoC sequencing.

Decision register (v0.9.2 → v0.9.3):
  - DEC-014 Accepted: flutter_rust_bridge 2.x pinned (closed by
    poc/flutter_rust_bridge_hello).
  - DEC-013.1 Accepted: rusqlite (bundled) (closed by
    poc/sqlite-storage-spike).
  - DEC-013.2 Accepted: Linux secure-storage backend policy —
    Secret Service preferred, keyutils fallback (closed by
    poc/secure-storage-spike; resolves SysRS-053 / SysRS-162
    ambiguity).
  - DEC-011.1 Accepted (desktop: cpal) / Deferred (mobile)
    (closed by poc/audio-capture-playback-spike desktop half only).
  - DEC-022 Accepted: canonical implementation directory layout per
    the README sketch and SAD §7.2.
  - DEC-020 explicitly Deferred by owner; remains a public-release
    blocker.

Audit reports updated with empirical evidence:
  - docs/security/secure-storage-audit-report.md v0.9.3:
    SS-AUD-001/002/003/005/006 = PoC Pass with evidence pointers;
    SS-TC-003 (Linux) Actual Result populated and Status = PoC Pass;
    SS-AUD-004 cross-referenced to diagnostics-redaction PoC;
    findings SS-FIND-001 (closed by DEC-013.2), SS-FIND-002 (keyutils
    session caveat), SS-FIND-003 (non-Linux adapters still open).
  - docs/security/diagnostic-redaction-audit-report.md v0.9.3:
    REDACT-TC-001..010 = PoC Pass with evidence pointers; export
    bundle policy §5 populated for every row; findings
    REDACT-FIND-001 (regex coverage), REDACT-FIND-002
    (tracing-layer integration), REDACT-FIND-003 (cross-spike
    KnownSecretRegistry contract).

PoC plan (v0.1.0 → v0.2.0):
  - Status column added to §2; outcomes recorded.

New doc:
  - docs/governance/poc-results-summary.md v0.1.0 — single-page
    reviewer-facing summary listing each spike's status, the
    toolchain exercised, the owner decisions taken, the audit
    coverage table, and open risks RISK-PoC-001..005 (mobile audio,
    non-Linux secure-storage adapters, license, remaining
    Proposed decisions, no product code yet).

This completes the post-PoC documentation work. Repo is at a clean
pause point: PoC code is committed, owner decisions are recorded,
audit reports carry empirical evidence, and the residual risks are
named in the summary doc.
This commit is contained in:
EdisonJwa
2026-05-14 12:34:13 +08:00
parent 181b3d329d
commit 271d23faf7
6 changed files with 233 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security/diagnostic-redaction-audit-report.md
+32 -23
View File
@@ -1,7 +1,7 @@
# Sec Diagnostic Redaction Audit Report V0.9.2.2.1
# Sec Diagnostic Redaction Audit Report V0.9.3.0.0
**Document type:** Security / Diagnostic Redaction Audit Report
**Version:** 0.9.2
**Version:** 0.9.3
**Status:** Baseline Candidate
**Language:** English
**Product:** Chanora
@@ -42,37 +42,39 @@ This report records evidence that Chanora logs and diagnostic exports do not lea
| Test ID | Input | Expected output | Status | Evidence |
|---|---|---|---|---|
| REDACT-TC-001 | Server password in connection data | Password replaced by `[REDACTED]` | TBD | TBD |
| REDACT-TC-002 | Identity secret in storage error | Secret absent | TBD | TBD |
| REDACT-TC-003 | Server URL with password-like field | Secret part redacted | TBD | TBD |
| REDACT-TC-004 | Chat text in diagnostic export | Excluded by default | TBD | TBD |
| REDACT-TC-005 | Channel name with Unicode | Preserved only if permitted; otherwise redacted safely | TBD | TBD |
| REDACT-TC-006 | Nickname with Unicode | Preserved only if permitted; otherwise redacted safely | TBD | TBD |
| REDACT-TC-007 | Local file path | User-identifying segments redacted or minimized | TBD | TBD |
| REDACT-TC-008 | Diagnostic bundle with mixed sensitive fields | All sensitive fields redacted | TBD | TBD |
| REDACT-TC-009 | Long hostile protocol string | Truncated or safely escaped | TBD | TBD |
| REDACT-TC-010 | Multilingual safe diagnostic text | Unicode preserved | TBD | TBD |
| REDACT-TC-001 | Server password in connection data | Password replaced by `[REDACTED]` | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_001_server_password_in_connection_data` |
| REDACT-TC-002 | Identity secret in storage error | Secret absent | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_002_identity_secret_in_storage_error` (via `KnownSecretRegistry`) |
| REDACT-TC-003 | Server URL with password-like field | Secret part redacted | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_003_server_url_with_password_field` — only the password value is redacted, the host and other query params keep flowing |
| REDACT-TC-004 | Chat text in diagnostic export | Excluded by default | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_004_chat_text_excluded_by_default` — default policy sets `include_chat = false` |
| REDACT-TC-005 | Channel name with Unicode | Preserved only if permitted; otherwise redacted safely | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_005_channel_name_with_unicode_excluded_by_default` — default policy excludes; UTF-8 preservation verified in TC-010 |
| REDACT-TC-006 | Nickname with Unicode | Preserved only if permitted; otherwise redacted safely | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_006_nickname_with_unicode_preserved_in_safe_field` |
| REDACT-TC-007 | Local file path | User-identifying segments redacted or minimized | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_007_local_file_paths_user_segment_minimized` — Linux `/home/<user>/`, Windows `C:\Users\<user>\`, macOS `/Users/<user>/` all minimized |
| REDACT-TC-008 | Diagnostic bundle with mixed sensitive fields | All sensitive fields redacted | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields` — whole-bundle JSON scan finds no plaintext |
| REDACT-TC-009 | Long hostile protocol string | Truncated or safely escaped | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_009_long_hostile_protocol_string_truncated` — `MAX_PROTOCOL_STRING_LEN = 256` cap with `…[truncated]` marker |
| REDACT-TC-010 | Multilingual safe diagnostic text | Unicode preserved | PoC Pass | `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_010_multilingual_safe_text_preserved` — Chinese, Japanese, Korean, and Latin-diacritic text preserved verbatim |
## 5. Export Bundle Contents
| Bundle item | Included? | Redaction rule | Status |
|---|---|---|---|
| App version | Yes | None | TBD |
| Build number | Yes | None | TBD |
| Platform info | Yes | Minimize device details | TBD |
| Connection state | Yes | No secrets | TBD |
| Server address | TBD | Redact/minimize | TBD |
| Channel tree | TBD | Redact/minimize | TBD |
| Chat history | No by default | Exclude unless explicit policy changes | TBD |
| Logs | Yes | Redacted | TBD |
| Audio diagnostics | Yes | No audio content | TBD |
| Secure storage data | No | Never include | TBD |
| App version | Yes | None | PoC Pass (`DiagnosticBundle.app_version` preserved verbatim) |
| Build number | Yes | None | PoC Pass (`DiagnosticBundle.build_number` preserved verbatim) |
| Platform info | Yes | Minimize device details | PoC Pass — flows through `Redactor::redact_text`, so embedded paths/usernames are minimized |
| Connection state | Yes | No secrets | PoC Pass — flows through `Redactor::redact_text` |
| Server address | Yes (redacted) | Redact/minimize | PoC Pass — passwords inside `ts3server://` URLs redacted |
| Channel tree | No by default | Redact/minimize | PoC Pass — default `include_channel_tree = false` |
| Chat history | No by default | Exclude unless explicit policy changes | PoC Pass — default `include_chat = false` |
| Logs | Yes | Redacted | PoC Pass — each log line flows through `Redactor::redact_text` |
| Audio diagnostics | Yes | No audio content | PoC Pass — only device names are exported; no PCM |
| Secure storage data | No | Never include | PoC Pass by construction — the redactor has no path that reads from `SecretStorageRepository`; the host application must never put secret material into the bundle in the first place |
## 6. Findings
| Finding ID | Severity | Description | Status | Owner |
|---|---|---|---|---|
| TBD | TBD | TBD | TBD | TBD |
| REDACT-FIND-001 | Informational | The PoC regex catalogue covers the documented audit matrix but is not exhaustive. Production `chanora_diagnostics` should add fuzz testing and adversarial inputs (e.g. base64 lookalikes, unicode confusables, regex evasion). | Open | Security Reviewer + `chanora_diagnostics` owner |
| REDACT-FIND-002 | Informational | The PoC redactor is a post-processor over strings. Production code should wire the redactor as a `tracing-subscriber` layer so redaction happens at write-time, not by re-walking text afterward. | Open — to be addressed when `chanora_diagnostics` is scaffolded | `chanora_diagnostics` owner |
| REDACT-FIND-003 | Informational | The `KnownSecretRegistry` defence-in-depth requires the secure-storage layer to register secrets when they materialise. The cross-spike contract is documented but not yet enforced by any product code. | Open — to be enforced by `chanora_storage` calling into `chanora_diagnostics`. | `chanora_storage` + `chanora_diagnostics` owners |
## 7. Approval
@@ -101,3 +103,10 @@ This report records evidence that Chanora logs and diagnostic exports do not lea
| Version | Date | Description |
|---|---|---|
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
## Baseline Candidate 0.9.3 Update
| Version | Date | Description |
|---|---|---|
| 0.9.3 | 2026-05-14 | Recorded PoC empirical evidence: REDACT-TC-001..010 status set to PoC Pass with evidence pointers to `poc/diagnostics-redaction-spike/tests/redaction.rs`. Export bundle policy §5 populated for every row. Findings REDACT-FIND-001..003 added (regex coverage limits, tracing-layer integration gap, KnownSecretRegistry cross-spike contract). |
docs/security/secure-storage-audit-report.md
+30 -21
View File
@@ -1,7 +1,7 @@
# Sec Secure Storage Audit Report V0.9.2.2.1
# Sec Secure Storage Audit Report V0.9.3.0.0
**Document type:** Security / Secure Storage Audit Report
**Version:** 0.9.2
**Version:** 0.9.3
**Status:** Baseline Candidate
**Language:** English
**Product:** Chanora
@@ -24,40 +24,42 @@ This report records evidence that Chanora stores secrets using platform secure s
| Platform | Secure storage mechanism | Test status | Evidence | Result |
|---|---|---|---|---|
| Windows | TBD | TBD | TBD | TBD |
| macOS | TBD | TBD | TBD | TBD |
| Linux | TBD | TBD | TBD | TBD |
| Android | TBD | TBD | TBD | TBD |
| iOS | TBD | TBD | TBD | TBD |
| Windows | DPAPI / Windows Credential Manager (per DEC-013 / SysRS-158) — adapter not yet implemented | Not started | n/a | Deferred to product `chanora_storage` |
| macOS | Keychain (per SysRS-159) — adapter not yet implemented | Not started | n/a | Deferred to product `chanora_storage` |
| Linux | Secret Service (libsecret) preferred; kernel keyutils fallback per DEC-013.2 | PoC Pass | `poc/secure-storage-spike/VERIFICATION.md`; six audit tests PASS via keyutils backend; CLI run additionally observed Secret-Service-locked → keyutils fallback live | PoC PASS; product audit pending |
| Android | Android Keystore (per SysRS-161) — adapter not yet implemented | Not started | n/a | Deferred to product `chanora_storage` |
| iOS | Keychain (per SysRS-160) — adapter not yet implemented | Not started | n/a | Deferred to product `chanora_storage` |
## 4. Audit Checks
| Check ID | Check | Expected result | Status | Evidence |
|---|---|---|---|---|
| SS-AUD-001 | Identity secret is not stored in local DB. | Pass | TBD | TBD |
| SS-AUD-002 | Server password is not stored in local DB. | Pass | TBD | TBD |
| SS-AUD-003 | Secret values are not written to application logs. | Pass | TBD | TBD |
| SS-AUD-004 | Secret values are not included in diagnostic export. | Pass | TBD | TBD |
| SS-AUD-005 | Secure storage failure returns safe error. | Pass | TBD | TBD |
| SS-AUD-006 | Secret deletion removes secure-storage entry. | Pass | TBD | TBD |
| SS-AUD-007 | Platform-specific secure storage is documented. | Pass | TBD | TBD |
| SS-AUD-008 | Migration or import path does not expose secrets. | Pass | TBD | TBD |
| SS-AUD-001 | Identity secret is not stored in local DB. | Pass | PoC Pass (Linux) | `poc/secure-storage-spike/tests/audit.rs::ss_aud_001_identity_secret_absent_from_local_db` — raw SQLite file scanned for plaintext markers; only the lookup name appears. |
| SS-AUD-002 | Server password is not stored in local DB. | Pass | PoC Pass (Linux) | `poc/secure-storage-spike/tests/audit.rs::ss_aud_002_server_password_absent_from_local_db` — distinct plaintext marker scan. |
| SS-AUD-003 | Secret values are not written to application logs. | Pass | PoC Pass (Linux) + cross-spike | `poc/secure-storage-spike/tests/audit.rs::ss_aud_003_secret_values_not_in_logs` — captured `tracing` output contains `<redacted>` markers; never the plaintext. Cross-referenced by `poc/diagnostics-redaction-spike` REDACT-TC-002. |
| SS-AUD-004 | Secret values are not included in diagnostic export. | Pass | PoC Pass | Covered by `poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields` — whole-bundle JSON scan finds no plaintext. |
| SS-AUD-005 | Secure storage failure returns safe error. | Pass | PoC Pass (Linux) | `poc/secure-storage-spike/tests/audit.rs::ss_aud_005_safe_error_on_missing_entry`. Reinforced by the CLI driver run: a real locked gnome-keyring collection produced a typed `Backend` error containing no secret material, which the application then routed to the fallback adapter (DEC-013.2). |
| SS-AUD-006 | Secret deletion removes secure-storage entry. | Pass | PoC Pass (Linux) | `poc/secure-storage-spike/tests/audit.rs::ss_aud_006_delete_removes_entry` — second delete returns `NotFound`, not silent success. |
| SS-AUD-007 | Platform-specific secure storage is documented. | Pass | Partial | Linux documented in `poc/secure-storage-spike/README.md` and DEC-013.2. Windows/macOS/Android/iOS remain to be documented when adapters land in `chanora_storage`. |
| SS-AUD-008 | Migration or import path does not expose secrets. | Pass | Pending | No migration / import path exists yet; depends on product `chanora_storage` schema design (cross-references DEC-013.1 and `poc/sqlite-storage-spike`). |
## 5. Test Cases
| Test ID | Platform | Procedure | Expected result | Actual result | Status |
|---|---|---|---|---|---|
| SS-TC-001 | Windows | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | TBD | TBD |
| SS-TC-002 | macOS | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | TBD | TBD |
| SS-TC-003 | Linux | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | TBD | TBD |
| SS-TC-004 | Android | Save identity secret, inspect app storage/logs/export. | Secret absent from DB/logs/export. | TBD | TBD |
| SS-TC-005 | iOS | Save identity secret, inspect app storage/logs/export. | Secret absent from DB/logs/export. | TBD | TBD |
| SS-TC-001 | Windows | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | Not run — Windows adapter not implemented in PoC | Deferred |
| SS-TC-002 | macOS | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | Not run — macOS adapter not implemented in PoC | Deferred |
| SS-TC-003 | Linux | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | Set / get / delete round-trip verified via keyutils backend; raw SQLite file scan confirmed plaintext absence; `tracing` log capture confirmed log absence. | **PoC Pass** |
| SS-TC-004 | Android | Save identity secret, inspect app storage/logs/export. | Secret absent from DB/logs/export. | Not run — Android adapter not implemented in PoC | Deferred |
| SS-TC-005 | iOS | Save identity secret, inspect app storage/logs/export. | Secret absent from DB/logs/export. | Not run — iOS adapter not implemented in PoC | Deferred |
## 6. Findings
| Finding ID | Severity | Description | Status | Owner |
|---|---|---|---|---|
| TBD | TBD | TBD | TBD | TBD |
| SS-FIND-001 | Informational | SysRS-053 / SysRS-162 ("Secret Service, libsecret, or equivalent") admitted both Secret Service and kernel keyutils as Linux backends. The PoC surfaced this ambiguity. | Resolved by DEC-013.2 on 2026-05-13 (Secret Service preferred, keyutils fallback). | Software Architect + Security Reviewer |
| SS-FIND-002 | Informational | Kernel keyutils requires a valid session keyring; cargo-test under non-interactive shells inherits an expired `_ses` and must be wrapped with `keyctl session -`. Production code on a graphical session inherits a valid session from PAM. | Documented in `poc/secure-storage-spike/README.md` and `VERIFICATION.md`. | Software Architect |
| SS-FIND-003 | Open | Windows / macOS / iOS / Android adapters not implemented; SS-TC-001/002/004/005 unverified. | Open — to be closed by per-platform adapter spikes or by the product `chanora_storage` implementation. | Platform Owners |
## 7. Approval
@@ -86,3 +88,10 @@ This report records evidence that Chanora stores secrets using platform secure s
| Version | Date | Description |
|---|---|---|
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
## Baseline Candidate 0.9.3 Update
| Version | Date | Description |
|---|---|---|
| 0.9.3 | 2026-05-14 | Recorded PoC empirical evidence: SS-AUD-001/002/003/005/006 status set to PoC Pass with evidence pointers; SS-AUD-004 cross-referenced to the diagnostics-redaction PoC; SS-TC-003 Linux Actual Result populated and Status set to PoC Pass. Added findings SS-FIND-001 (closed by DEC-013.2), SS-FIND-002 (keyutils session caveat), SS-FIND-003 (non-Linux adapters still open). Non-Linux test cases SS-TC-001/002/004/005 remain Deferred. |